For this, Google provides ContactsContract class, which is the contract between the Contacts Provider and applications.

In ContactsContract, there is a class called Directory.

A Directory represents a contacts corpus and is implemented as a Content Provider with its unique authority.

android malware

So, developers can use it if they want to implement a custom directory.

The important thing is the Contact Provider automatically interrogates newly installed or replaced packages.

Thus, installing a package containing special metadata will always call the Contact Provider automatically.

Malicious service process

Next, they change their icons and names using the tag to hide.

According to McAfee, users have already installed these apps from 100K to 1M+.

spot_img

source: www.techworm.net