# Android Malware Records Your Screen While You Read "Encrypted" Chats

**URL:** <https://onehack.st/t/android-malware-records-your-screen-while-you-read-encrypted-chats/313902>\
**Category:** News & Articles\
**Tags:** hacking, privacy\
**Created:** [November 21, 2025, 2:59pm UTC](https://onehack.st/t/android-malware-records-your-screen-while-you-read-encrypted-chats/313902 "2025-11-21T14:59:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ze380y](https://onehack.st/user_avatar/onehack.st/ze380y/32/48760_2.png) [@Ze380y](https://onehack.st/u/Ze380y)\
**Post date:** [November 21, 2025, 2:59pm UTC](https://onehack.st/t/android-malware-records-your-screen-while-you-read-encrypted-chats/313902/1 "2025-11-21T14:59:35Z")

</div>

☣ Sturnus: The Android Trojan That Doesn’t Hack Your Chats…  
It Just Watches You Read Them 😭

> **🗺 One-Line Flow:**  
> A banking trojan with god-mode accessibility powers is screen-watching your “encrypted” chats, stealing your logins, faking system updates, and using dual command-servers like it’s running a startup.

![](https://onehack.st/uploads/default/original/3X/2/c/2cc47ae38f84a23767e8f229edcf618592f8cfba.gif)

* * *

## 🧨 Dumb Mode Dictionary

**Trojan:** Friendly icon, evil soul.  
**Accessibility Abuse:** Malware becomes your “assistant” and then assists itself to your data.  
**Overlay:** Fake screen slapped over real screen to steal passwords.  
**C2 Server:** Hackers’ office. Two of them = remote teamwork.

* * *

## 😑 For 🫏 1Hackers — What’s Really Happening

Sturnus isn’t your regular dumb malware.  
It uses **dual encrypted channels** , **real-time screen mirroring** , **fake overlays** , **fake updates** , and **device admin rights** to fully puppeteer your phone.  
Once you decrypt a message, it reads it faster than you do.

Full story: [https://thehackernews.com/2025/11/new-sturnus-android-trojan-quietly.html](https://thehackernews.com/2025/11/new-sturnus-android-trojan-quietly.html)

* * *

# 📉 What’s Changing

- Malware isn’t sniffing your traffic… it’s **reconstructing your UI** in real-time.
- Encryption is useless if the attacker sees the decrypted text on your screen.
- Banking trojans now also steal your chats because why not.

* * *

# ⚡ Highlights (But 10x Scarier Now)

### **Dual C2 Architecture**

- AES-encrypted **WebSocket** for live VNC-style control
- HTTPS for exfiltration
- Two channels = smoother remote robbery.

### **Accessibility Service Exploitation**

- Logs: on-screen text, keystrokes, UI structure, app launches
- Bypasses encryption because it reads what _you_ see.

### **Smart Fake Overlays**

- Places perfect banking login screens
- Steals data
- **Automatically disables itself** after success to stay invisible.

### **Full UI Reconstruction**

- Attackers can tap, scroll, type, approve permissions, open apps
- Basically remote desktop… on _your_ phone.

### **Continuous Device Profiling**

- Sensors, network, hardware, app list
- Used to tailor attacks so you never notice.

* * *

# 🎯 Who They’re Targeting (You Wish It Was Random)

- **European financial institutions** — laser-focused, not mass spam.
- Currently in **evaluation stage** — meaning you’d be a **beta tester**. Congrats?

* * *

# 🤡 Disguise Packages Used

- `com.klivkfbky.izaybebnx` (fake Google Chrome)
- `com.uvxuthoq.noscjahae` (fake Preemix Box)

If you installed these… condolences.

* * *

# 🧬 What Sturnus Really Is

A **banking trojan** , not generic spyware.  
Money theft is the goal.  
Chat interception is just the bonus round.

* * *

# 📚 Sources That Actually Matter

Research by **ThreatFabric** (Netherlands).  
Extra juicy coverage:  
[https://www.bleepingcomputer.com/news/security/multi-threat-android-malware-sturnus-steals-signal-whatsapp-messages/](https://www.bleepingcomputer.com/news/security/multi-threat-android-malware-sturnus-steals-signal-whatsapp-messages/)  
[https://therecord.media/new-android-malware-captures-private-messages](https://therecord.media/new-android-malware-captures-private-messages)

* * *

# 🔥 Hidden Mechanics You Definitely Missed

### **Black Screen Takeover**

Fake “Android update” while it steals everything behind a blackout curtain.

### **Admin Privilege Escalation**

It grants itself device admin — good luck removing it manually.

### **Native Display-Capture Abuse**

Not a screen recorder.  
It uses Android’s internal display framework to mirror your real-time screen.

### **Post-Decryption Sniping**

Doesn’t crack encryption.  
Just waits microseconds after you open the message.

* * *

# 🕰 Obscure History Lesson (Useful, Shockingly)

AhRat (2023) pulled a similar stunt — downloaded clean, updated dirty.  
50k installs before Google noticed.

Accessibility abuse is now the **#1 malware vector** on Android.  
Google _can’t_ fully lock it without breaking real accessibility tools.

* * *

# 🧠 The “How Did You Find This?” Trivia

**Why the name “Sturnus”?**  
It’s the genus of starlings — birds famous for synchronized swarming.  
Yes, the malware also “swarms” multiple attack vectors in sync.  
Hackers are either nerds or dramatic.

ThreatFabric says this is **pre-production malware**.  
Meaning: early victims = guinea pigs.

* * *

## ☠ Why It Matters

Encryption is useless if the attacker has front-row seats to your screen.  
Your secure apps mean nothing when your OS itself is compromised.

* * *

## 😒 Cool. They Built a Super Trojan…

### Now What the Hell Do We Do?

[https://media0.giphy.com/media/v1.Y2lkPTc5MGI3NjExczgxdjcwc3JxYzdkZ3JoZHI1aG1kc3dmMHZ3OXhycHM1dHM0czlyNCZlcD12MV9pbnRlcm5hbF9naWZfYnlfaWQmY3Q9Zw/Zx9RYmKNxD9uGsDkM1/giphy.gif](https://media0.giphy.com/media/v1.Y2lkPTc5MGI3NjExczgxdjcwc3JxYzdkZ3JoZHI1aG1kc3dmMHZ3OXhycHM1dHM0czlyNCZlcD12MV9pbnRlcm5hbF9naWZfYnlfaWQmY3Q9Zw/Zx9RYmKNxD9uGsDkM1/giphy.gif)

1. 🪤 Affiliate “Safer Phone Checklist”

Make a simple checklist PDF.  
Inside: links to

- antivirus
- Secure browser
- VPN
- Cloud backup
- People always click when fear is fresh.

* * *

1. 📦 Build a “Clean Phone Starter Pack”

Single-page site:

- Recommended apps
- Setting tweaks
- Security tools  
All with affiliate links.  
You basically monetize common sense packaged well.

* * *

## ✔ In Short

This headline = fear → fear = attention → attention = **money**.  
Cybersecurity is the only niche where being the “smart friend” can literally make you a side-income…  
…even if all you do is say,  
**“Bro don’t install random APKs.”**

* * *

on safer note…

- Stop installing sketchy APKs (yes, even that “premium mod”).
- Use Play Protect or proper scanners.
- If your phone acts haunted → **factory reset.**
- Update your device (the _real_ updates).
- Don’t grant Accessibility permission to apps that look like they were named by a cat walking on a keyboard.

* * *

## 🎯 Sigh part!

“Encrypted chats” aren’t the weak point.  
**Your OS is.**  
If malware owns the screen, it owns _you_.

* * *

## ✔ In Short

Device hacked = Encryption meaningless.  
Stay clean, or stay watched.

---

<div class="post-metadata">

**Author:** ![aleks\_uskov](https://onehack.st/user_avatar/onehack.st/aleks_uskov/32/112138_2.png) [@aleks\_uskov](https://onehack.st/u/aleks_uskov)\
**Post date:** [November 21, 2025, 3:06pm UTC](https://onehack.st/t/android-malware-records-your-screen-while-you-read-encrypted-chats/313902/2 "2025-11-21T15:06:01Z")

</div>

**Sturnus is not your average Android trojan.** It abuses Accessibility Services to gain full device control, intercepts decrypted messages directly from the screen, and deploys fake banking overlays to steal credentials. With dual C2 architecture, AES-encrypted channels, and HTTPS exfiltration, it’s highly sophisticated. End-to-end encryption means nothing if your OS is compromised. Tip: avoid shady APKs, review permissions, and use antivirus plus Play Protect.