Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It only takes a minute to sign up.
Sign up to join this community
Was there any known malware running on Android (let's say since Nougat) which can compromise non-rooted Android device in a way that the malware is active also in the safe mode?
So when booting non-rooted into the safe mode, the malware is still running. Was there such a malware in the wild?
Look no further than the one-click root apps as an example. They exploit a vulnerability (usually on phones no longer updated or supported by their vendors) in the Android to gain elevated privilege to install a persistent piece of software, which usually is a system app in the form of a root access manager, but can also add daemons and other files wherever they deem fit.
When the device boots into safe mode only the system apps are available for the user to use, which also includes that superuser manager app in the aforesaid example. If an app installed a system app malware, then it would be booted even in safe mode.
Do note that it is not necessary that an app explicitly exploits a vulnerability to install a malware. Some vendors exploits their users' trust by turning factory shipped system level app into a malware, usually done by shipping a security or Android update to the devices. Some vendors even ship such hidden malwares from the very beginning. This is usually observed in low-end devices, but not limited to them.
We have many questions covering a number of Android versions and devices. Just search for the terms such as "malware", "system", "persistent", "factory reset" individually or in combination. Some examples of system level malware:
