Cerberus Stalkerware on Google Play Leverages Accessibility Abuse and Firebase for Remote Control

A persistent Android stalkerware named Cerberus Anti-theft (package com.ssurebrec) has been available on Google Play since Oct 2023, operated by LSDroid SRL and marketed as an anti-theft app; it stealthily captures front-camera photos, logs location, records audio, and can wipe devices. Researchers (April 2026) found it supports 44 remote commands via Firebase Cloud Messaging, uses a companion app (com.lsdroid.lsp) with Android accessibility abuse and HiddenApiBypass to intercept shutdowns and persist, and has historically been a dominant stalkerware family—posing a high personal-safety and privacy risk while evading store controls.