New Spyware Platform Lets Buyers Rebrand and Resell Android Surveillance Malware

A newly discovered Android spyware package named KidsProtect is being openly sold and offered as a white-label product, enabling buyers to rebrand and resell it. The APK abuses Accessibility Service and multiple sensitive permissions (location, microphone, camera, SMS, call logs), registers as a Device Administrator for persistence, disguises itself with generic names (e.g., “WiFi Service”) and a placeholder package name (com.example.parentguard), and instructs users to disable Play Protect. Certo analysts obtained the APK, confirmed capabilities and persistence mechanisms, and published IoCs including the package name and multiple SHA-256 hashes; the reseller model raises the risk of rapid relaunches under new branding.