Sturnus

The malware relies on two tightly integrated mechanisms—HTML overlays and accessibility-based keylogging—to capture and exfiltrate user credentials and other sensitive data.

allowing attackers to map the entire screen, understand its layout, and issue precise actions such as clicks, text input, scrolling, app launches, or permission confirmations.

"New Sturnus Android Malware Reads WhatsApp, Telegram, Signal Chats via Accessibility Abuse" / "bypasses end-to-end encryption"

Twelve internal broadcast receivers and a dedicated security-checking thread continuously track system activity, connectivity changes, power and battery states, SIM transitions, app installation events, USB behavior

"New Sturnus Android Malware Reads WhatsApp, Telegram, Signal Chats via Accessibility Abuse" / "bypasses end-to-end encryption"

Twelve internal broadcast receivers and a dedicated security-checking thread continuously track system activity, connectivity changes, power and battery states, SIM transitions, app installation events, USB behavior

Sturnus reinforces its persistence by securing Android Device Administrator privileges and actively defending them.

The malware then generates a 256-bit AES key locally, encrypts it using RSA/ECB/OAEPWithSHA-1AndMGF1Padding, and sends the encrypted key back... all further communication is protected with AES encryption

DELETE_ALL_SMS Deletes all SMS messages on the device. DELETE_SMS Deletes a specific SMS message. DELETE_ALL_CALLS Deletes the entire call log. DELETE_CALL Deletes a specific call entry.

the malware builds a detailed device profile that helps attackers assess risk, adapt their tactics, and detect analysis environments or emulators.

The system also supports a full-screen “block overlay”, that allows attackers to hide their malicious activities from victims by displaying a full screen black overlay that blocks all visual feedback while the malware operates in the background.

By capturing content directly from the device screen after decryption, Sturnus can monitor communications via WhatsApp, Telegram, and Signal.

Alongside overlays, the malware implements a comprehensive keylogging pipeline through the Android Accessibility Service.

“It can also inject text, observe user activity…”

It also monitors security-relevant settings such as developer mode, ADB debugging, SELinux state, and the device’s patch level, reporting any change immediately to the operators.

the malware builds a detailed device profile that helps attackers assess risk, adapt their tactics, and detect analysis environments or emulators.

By collecting sensor information, network conditions, hardware data, and installed-app inventories, the malware builds a detailed device profile

This enables attackers to reconstruct full user activity even when screen capture is blocked by FLAG_SECURE or when network conditions prevent live video transmission.

By capturing content directly from the device screen after decryption, Sturnus can monitor communications via WhatsApp, Telegram, and Signal.

Alongside overlays, the malware implements a comprehensive keylogging pipeline through the Android Accessibility Service.

“It can also inject text, observe user activity…”

Its primary method relies on the system’s display-capture framework to mirror the device screen in real time, while a fallback mechanism uses Accessibility-based screenshots when standard capture is blocked.

the malware communicates with its command-and-control server through both WebSocket (WSS) and HTTP channels

Then, the management of the session is handed to a native library, which implements the VNC RFB protocol, encoding frames for transmission to connected clients.