MalwarePublished 21 Nov 2025

New Sturnus Android Malware Reads WhatsApp, Telegram, Signal Chats via Accessibility Abuse

Source Reddit InfoSec News

Description

The Sturnus Android malware abuses accessibility features to read chats from popular messaging apps including WhatsApp, Telegram, and Signal. It leverages accessibility permissions to bypass normal app sandboxing and extract sensitive message content without user consent. While no known exploits in the wild have been reported yet, this malware poses a significant privacy risk by targeting encrypted messaging platforms. The malware's medium severity reflects its potential to compromise confidentiality but requires accessibility permission, which may limit widespread exploitation. European organizations using Android devices with these messaging apps are at risk, especially those with employees who may unknowingly grant accessibility access. Mitigation involves restricting accessibility permissions, monitoring app permissions closely, and educating users about granting such privileges. Countries with high Android adoption and significant use of encrypted messaging apps, such as Germany, France, and the UK, are most likely to be affected. Given the malware’s ability to access sensitive communications and the ease of exploitation once permissions are granted, the suggested severity is high. Defenders should prioritize detection of suspicious accessibility service usage and enforce strict mobile device management policies.

Impact

For European organizations, the Sturnus malware could lead to severe breaches of confidentiality by exposing sensitive communications conducted over WhatsApp, Telegram, and Signal. These apps are commonly used for both personal and professional messaging, including sharing of intellectual property, strategic discussions, and personal data protected under GDPR. The malware’s ability to read encrypted chats undermines the security assurances these platforms provide, potentially leading to data leaks, reputational damage, and regulatory penalties. The impact is particularly critical for sectors relying heavily on secure messaging, such as finance, legal, and government agencies. Additionally, the malware could facilitate espionage or insider threat activities by covertly monitoring employee communications. The requirement for accessibility permission reduces the likelihood of mass exploitation but does not eliminate targeted attacks or social engineering campaigns aimed at tricking users into granting access. The stealthy nature of the malware complicates detection and incident response, increasing the risk of prolonged exposure. Overall, the threat could disrupt trust in secure communication tools and necessitate enhanced mobile security controls within European enterprises.

Defensive guidance

To mitigate the risk posed by Sturnus malware, European organizations should implement the following specific measures: 1) Enforce strict mobile device management (MDM) policies that restrict or monitor accessibility service permissions on corporate Android devices. 2) Educate employees about the risks of granting accessibility permissions to untrusted apps and provide clear guidelines on app installation and permission granting. 3) Deploy endpoint detection and response (EDR) solutions capable of monitoring unusual accessibility service usage or behaviors indicative of screen scraping. 4) Regularly audit installed applications and their permissions to identify and remove suspicious or unauthorized apps. 5) Encourage the use of official app stores and avoid sideloading apps from unverified sources to reduce infection vectors. 6) Implement network-level monitoring to detect anomalous data exfiltration patterns from mobile devices. 7) Promote the use of device encryption and strong authentication to limit unauthorized access. 8) Coordinate with security vendors to stay updated on emerging detection signatures and threat intelligence related to accessibility abuse malware. These targeted actions go beyond generic advice by focusing on the unique attack vector of accessibility abuse and the operational context of Android devices in European organizations.

Summary

Sturnus is a newly identified Android malware strain that targets encrypted messaging applications—specifically WhatsApp, Telegram, and Signal—by abusing Android's accessibility services. Accessibility services are designed to assist users with disabilities by allowing apps to read screen content and interact with other apps. Malicious actors exploit this feature to bypass Android's app sandboxing and extract sensitive information displayed on the screen, including chat messages. Once the malware gains accessibility permissions, it can monitor and capture conversations in real time without requiring root access or exploiting system vulnerabilities. This method is stealthy and difficult to detect because accessibility permissions are legitimate and often granted by users for benign reasons. The malware does not require user interaction beyond the initial permission grant, which is the main vector for infection. Although no active exploitation campaigns have been confirmed, the presence of such malware represents a significant threat to user privacy and organizational confidentiality. The malware’s medium severity rating reflects the balance between the high impact of data compromise and the prerequisite of user permission granting. The lack of patches or CVEs indicates this is a novel abuse technique rather than a traditional software vulnerability. Organizations should be aware of this evolving threat vector as it targets widely used communication platforms critical for secure business communications.

References

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 21 Nov 2025, 16:58 UTC

Technical details

References

Community reviews

Related threats