Cerberus Stalkerware Hits Google Play, Abuses Accessibility and Firebase for Remote Control

The report reveals that Cerberus Anti‑theft and a companion app on Google Play function as full‑featured stalkerware: abusing Android accessibility APIs and Google Firebase for command-and-control to perform silent camera/audio capture, GPS streaming, SMS/call access, remote lock/wipe and persistent surveillance via numerous triggers. The apps use HiddenApiBypass to evade Play review, expose 44 remote commands over FCM, and remain live and monetized on Google platforms despite violating policies, posing significant privacy and safety risks to victims.