The security firm notes that upon installation (from a third party store), the malware communicates with the operator’s Firebase server – used to control the smartphone remotely. The collected data is then organised into several folders inside the spyware’s private storage.
Android Phone Users, Beware of ‘System Update’ Malware That Can Steal Your Photos and Messages
