Was there any known malware running on Android (let's say since Nougat) which can compromise non-rooted Android device in a way that the malware is active also in the safe mode?

So when booting non-rooted into the safe mode, the malware is still running. Was there such a malware in the wild?


Look no further than the one-click root apps as an example. They exploit a vulnerability (usually on phones no longer updated or supported by their vendors) in the Android to gain elevated privilege to install a persistent piece of software, which usually is a system app in the form of a root access manager, but can also add daemons and other files wherever they deem fit.

When the device boots into safe mode only the system apps are available for the user to use, which also includes that superuser manager app in the aforesaid example. If an app installed a system app malware, then it would be booted even in safe mode.

Do note that it is not necessary that an app explicitly exploits a vulnerability to install a malware. Some vendors exploits their users' trust by turning factory shipped system level app into a malware, usually done by shipping a security or Android update to the devices. Some vendors even ship such hidden malwares from the very beginning. This is usually observed in low-end devices, but not limited to them.

We have many questions covering a number of Android versions and devices. Just search for the terms such as "malware", "system", "persistent", "factory reset" individually or in combination. Some examples of system level malware:

  • Thanks for all the information. Please what apps are one-click root apps from your first sentence? And how can I recognize superuser manager apps in non-rooted phone? (In this case, it is Note8.) – miroxlav Jan 27 at 19:15
  • Here you can find some examples of the one-click root apps. Please note that I used one-click root app as an example only because they are popular apps which deliberately employ exploit to gain root access. Furthermore, I mentioned superuser manager apps in context of one-click root app only. An actual malware would definitely avoid installing such a manager which can work against itself – Firelord Jan 27 at 19:21
  • Oh. (I am new to Android.) So can theoretically any PlayStore app be able to exploit a vulnerability and install a malware? Is the anti-virus software guarding installations the best achievable software preventive protection? Is an anti-virus also able to scan system space, typically invisible in non-rooted phone? – miroxlav Jan 27 at 19:41
  • An antivirus app, unless being a device administrator or a system app, wouldn't have any greater access than any non-system app has, such as WhatsApp. If a non-root app can read system partition, than so can your antivirus. Otherwise, both would fail. Furthermore, they rely on proven heuristics and databases, and given the limited access they have in the system they can't really protect the system to the level they can in Windows. – Firelord Jan 27 at 20:02
  • Theoretically yes, any app can exploit, but I would be far-fetching this too much. Android employs various safeguards to prevent privilege escalations. Bypassing them is incredibly tough nowadays, though not impossible. You would have better luck in this area if you look for vulnerabilities yourself to gain understanding and confidence in my words. Try this: cve.mitre.org/cgi-bin/cvekey.cgi?keyword=android – Firelord Jan 27 at 20:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.