Android Malware Is Still Spying On You Even When Your Mobile Is Off

MALWARE WORKS AFTER SWITCHING OFF MOBILES

When users presses the power button on their device, a fake dialog box is shown. The malware mimics the shutdown animation and the device appears to be off, but actually remains on, giving the malicious program freedom to move around on the device and steal data.

"After pressing the power button, you will see the real shutdown animation, and the phone appears off. Although the screen is black, it is still on," "While the phone is in this state, the malware can make outgoing calls, take pictures and perform many other tasks without notifying the user." says Manan Shah, CEO Avalance an online cyber security company

HOW DOES MALWARE WORKS ?

• Once installed, the malware asks for root-level permissions and tampers with the 'system_server' file of the operating system to affect the shutdown process. The malware particularly hijacks them
  ​ ​
  WindowManager
  ​ ​
  Funcs interface, so that it can display a fake shutdown dialog box and animation every time the victim presses the power button.
• The nasty malware is apparently being propagated via third-party online app stores, but the researchers haven't mentioned the names of the the innocent-looking apps, also they haven’t explained how the malware gains the root access of the device.  

USERS AND ANDROID VERSIONS INFECTED

• According to the company, PowerOffHijack malware infects devices running Android versions below 5.0 (Lollipop) and requires root access to perform the tasks.
• So far, PowerOffHijack malware has already infected more than 10,000 devices, mostly in China where the malware was first introduced and offered through the local, official app stores.
• PowerOffHijack malware has ability to silently send lots of premium-rate text messages, make calls to expensive overseas numbers, take photos and perform many other tasks even if the phone is supposedly switched off. 

EASY STEPS TO GET RID OF POWEROFFHIJACK

• In order to get rid of PowerOffHijack malware, users are advised to take some simple steps:
• To restart infected device manually just take out the battery.
• Remove malicious, untrusted and useless apps from your Android device.
• Do not install apps from 3rd Party app stores.
• Make sure you have a good anti-virus installed and updated on your mobile devices. 
• ​Avalance Super7
   product can detect PowerOffHijack malware.
  ​ (Zeroday and Ransomware)​