LunaSpy: New Android Spyware Poses as Antivirus in Messaging Apps

A new Android spyware campaign dubbed LunaSpy is targeting users through messaging platforms by disguising itself as legitimate antivirus software. The malware, which exhibits advanced stealth capabilities, represents a significant evolution in mobile threat vectors.

Infection Methodology
LunaSpy primarily spreads through Telegram channels and private messages, where attackers distribute it as a 'necessary security update' or 'antivirus scanner.' The APK file uses social engineering tactics, often claiming to protect against banking trojans or other prevalent threats.

Technical Capabilities
Once installed, LunaSpy performs several malicious actions:

• Displays realistic but fake antivirus scanning animations
• Requests and abuses Accessibility Services permissions
• Hides its icon from the app drawer after installation
• Monitors and exfiltrates:

* SMS messages and call logs
* Keystrokes (including banking credentials)
* Screen content
* GPS location data

Banking App Targeting
The malware specifically looks for financial applications, using overlay attacks to capture login credentials. Researchers observed it targeting major banking apps in North America, Europe, and Latin America.

Detection Challenges
LunaSpy employs multiple evasion techniques:

• Delayed payload activation (24-48 hours post-installation)
• Encrypted C2 communications
• Dynamic domain generation
• Periodic process termination to avoid battery drain suspicions

Protection Recommendations

1. Enterprise security teams should:

• Block sideloaded APKs through MDM policies
• Monitor for unusual Accessibility Service usage
• Implement network filtering for suspicious C2 domains

1. Individual users should:

• Only install apps from Google Play Store
• Verify app permissions (especially Accessibility Services)
• Install reputable mobile security solutions

This campaign highlights the growing sophistication of mobile spyware and the need for layered defense strategies in both enterprise and personal device usage.