FireScam Android Spyware Campaign Poses 'Significant Threat Worldwide'

FireScam is a recently observed Android spyware/infostealer campaign that lures victims via a phishing site impersonating an app store to install a fake Telegram Premium app; once installed it steals notifications, messages and other sensitive data, uses Firebase Realtime Database for exfiltration and C2, and maintains persistence to deliver additional malware. Researchers highlight that the campaign abuses legitimate services and common apps to evade detection and recommend real-time mobile app scanning, API protections, and reliance on platform defenses like Google Play Protect.