New Delhi, Aug. 13 -- An antivirus app is supposed to keep digital predators away, but this Android app turned out to be the predator itself. Security researchers have flagged a new Android spyware strain called LunaSpy that dresses up as an antivirus or "banking protection" tool and spreads through messaging apps like Telegram. The ruse is simple and effective. It launches a convincing scan, throws up scary "threats found" warnings, and then asks for broad permissions under the pretext of fixing problems. Once those permissions are granted, the app pivots to surveillance, not security.

LunaSpy's fake scan is a permission trap. With accessibility access, notification access, and other high‑risk privileges in hand, the app can read ...