FireScam infostealer poses as Telegram Premium app to surveil Android devices
ID: be10f93a-f1d7-5936-8bc2-ce2fc38183f4
STIX ID: report--be10f93a-f1d7-5936-8bc2-ce2fc38183f4
Feed Name: The Register (Security)
Threat Score
FireScam is an Android infostealer/spyware distributed via a GitHub.io phishing site impersonating RuStore that installs as GetAppsRu.apk, requests extensive permissions (including an 'update owner' role to maintain persistence), harvests notifications, SMS, clipboard, app data and USSD responses, and exfiltrates data to Firebase while using Firebase Cloud Messaging for command-and-control and silent remote payload delivery.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.