PowerOffHijack spies on Android, even when devices are off

The malicious app makes it appear as if your device is turned off, when it's actually active

Newly discovered Android malware has surfaced that could spy on users' actions even when their device appears to be switched off.

PowerOffHijack was discovered by AVG, and is thought to have spread through Chinese app stores onto 10,000 devices.

The malicious software will only work on rooted devices running Android KitKat or below and takes effect when a user activates the hardware power switch to turn off their device.

Advertisement - Article continues below

The company explained the malware attacks a device when you request it to shut down: "First, it applies for the root permission. Second, after root permission is acquired, the malware will inject the system_server process and hook themWindowManagerFuncs object.

"Third, after the hook, when you press the power button, a fake dialog will pop up. And if you select power off option, it will display a fake shut down animation, leaving the power on but the screen off. Last, in order to make your mobile look like [it's] really off, some system broadcast services also need to be hooked."

Although the device appears to be switched off, it can operate independently, making calls, taking photos and sending data, often accessing the user's personal data too.

AVG said Android users should remove their batteries to switch off their devices, if they're concerned it may be infected, or install AVG's mobile antivirus product that can detect if malware is running.

Advertisement
Advertisement - Article continues below

Last year the Selfmite worm was uncovered that, like PowerOffHijack, could control devices without the user knowing, sending out SMS messages and - in some cases - extracted money from Android users.

Featured Resources

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Remote working 2020: Advantages and challenges

Discover how to overcome remote working challenges

Download now

Keep your data available with snapshot technology

Synology’s solution to your data protection problem

Download now

After the lockdown - reinventing the way your business works

Your guide to ensuring business continuity, no matter the crisis

Download now
Advertisement

Recommended

Andrew Daniels joins Druva as CIO and CISO
Cloud

Andrew Daniels joins Druva as CIO and CISO

22 Jul 2020
Over two dozen Android apps found stealing user data
Google Android

Over two dozen Android apps found stealing user data

7 Jul 2020
University of California gets fleeced by hackers for $1.14 million
ransomware

University of California gets fleeced by hackers for $1.14 million

30 Jun 2020
Australia announces $1.35 billion investment in cyber security
cyber security

Australia announces $1.35 billion investment in cyber security

30 Jun 2020

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

3 Aug 2020
Labour Party donors caught up in Blackbaud data breach
data breaches

Labour Party donors caught up in Blackbaud data breach

31 Jul 2020
How do you build a great customer experience?
Sponsored

How do you build a great customer experience?

20 Jul 2020