A sophisticated Android spyware campaign has been uncovered, disguising itself as the official application of the Chinese Prosecutor’s Office (检察院).

This advanced variant of the SpyMax/SpyNote family targets Chinese-speaking users across mainland China and Hong Kong, exploiting Android Accessibility Services through polished social engineering techniques and deceptive UI elements to gain near-total control of victims’ devices.

Once granted permissions, the malware gains an alarming level of access to personal data and device functions. It can access messages, calls, GPS location data, camera functions, and microphone recordings – even operating silently in the background when the device’s screen is off.

The modular design includes components for command execution, camera/mic control, and data exfiltration over encrypted HTTPS.

ThreatMon researchers identified this threat in early April 2025, noting its particularly sophisticated approach to social engineering.

The malware was detected on April 4, with distribution primarily occurring through third-party app stores where it masquerades as legitimate government software with the APK name “检察院”.

The impact of this campaign extends beyond simple data theft. Victims may experience unauthorized financial transactions, premium SMS fraud, and complete surveillance of their digital and physical activities.

Technical analysis reveals the malware stores stolen data in categorized files, encrypts them, and wipes traces after transmission to its command and control server at 165.154.110.64.

The sophisticated nature of this threat is evidenced by its ability to dynamically trigger behavior based on system states including screen activity, battery level, and network conditions – making it particularly difficult for average users to detect.

Infection Mechanism: Deceptive User Interface

The most insidious aspect of this malware lies in its infection mechanism. The attackers have designed a fully interactive HTML interface that precisely mimics Android’s accessibility settings page.

This fake interface includes animated buttons and official-looking layouts specifically crafted to convince users to grant critical permissions without raising suspicion.

The deceptive interface employs advanced web techniques to create a convincing replica of system settings screens. When users interact with these fake interfaces, the malware silently requests and activates dangerous permissions in the background while displaying seemingly legitimate confirmation messages to the user.

This creates a seamless illusion that everything is functioning normally while the malware establishes its foothold.

// Sample code demonstrating permission hijacking technique
document.getElementById('accessibility-toggle').addEventListener('click', function() {
  // Request critical permissions while appearing legitimate
  requestAccessibilityPermission();
  // Hide actual warning messages that might alert the user
  document.querySelector('.warning-message').style. Display = 'none';
  // Show fake confirmation instead
  document.querySelector('.fake-confirmation').style. Display = 'block';
});

This sophisticated approach allows SpyMax to bypass users’ natural suspicion when requesting sensitive permissions, significantly increasing infection rates.

Once accessibility services are enabled, the malware gains the ability to read screen content, interact with applications autonomously, and intercept user interactions – essentially giving attackers complete remote control of the compromised device.

Malware Trends Report Based on 15000 SOC Teams Incidents, Q1 2025 out!-> Get Your Free Copy

The post Beware! Android Spyware ‘SpyMax’ Gain Total Control of Your Android Phone appeared first on Cyber Security News.