Spyware packages for mobile phones have existed for a while, but the malware type is changing how it spreads.

Skycure Research Labs found one nasty piece of spyware known as Exaspy that works on Android phones and is rather complete in how it sucks up data. Most worryingly, it is available as a commodity service online — spyware-as-a-service, so to speak.

A Sophisticated Snooper

According to Threatpost, Exaspy spyware can intercept messages from all manner of communications, including SMS, MMS, Facebook Messenger, Google Hangouts, Skype, Gmail, native email, Viber, WhatsApp and more. It can also record background audio and telephone calls.

Additionally, the malware has the ability to access the device’s picture library and take secret screenshots on infected devices. This is a sophisticated snooper, for sure.

Physical Access Required

“Interestingly, this malware actually requires an end user to perform the initial installation steps, meaning physical access to the device is required at installation time,” security researcher Elisha Eshed wrote on the Skycure Research Labs blog.

It is possible that Exaspy requests access to device admin rights upon booting. Granting that kind of request likely requires a click action. The malware also installs itself as a system package to prevent the user from removing it, among other tricks to promote its effectiveness.

In any case, Skycure found this malware on an Android 6.0.1 device. It showed up as a fake app called Google Services running with full administrative rights. According to the researchers, the phone belonged to the vice president of a global technology company.

Classic antivirus detection software usually misses this kind of spyware. It doesn’t seem to contain a static signature that can be used for detection. This may be because the malware changes as its command-and-control (C&C) server issues different instructions for different kinds of information it seeks to steal.

Stopping Exaspy Spyware

Skycure advised users to set up PIN codes and fingerprint authentication on their phones. Users should also disable USB debugging and original equipment manufacturer (OEM) unlocking to protect their mobile devices from unwanted apps.

In short, phones need to be hardened to resist this kind of spyware.