Cerberus Anti-theft, a long-running Android “security” app, is operating as full-featured stalkerware on Google Play, abusing accessibility services and Google Firebase to give abusers near-total remote control over victims’ phones.
Once installed, Cerberus lets an abuser push a custom lock‑screen notification to the victim’s device from a web dashboard at cerberusapp.com or a paired smartwatch.
When the victim taps the message, Cerberus silently triggers a preconfigured sequence: it activates the front camera and logs the location.
The lock‑screen lure is only one of many triggers; the app schedules itself to run whenever the phone powers on or off, is unlocked, joins new networks, moves across geofences, or detects motion, ensuring continuous surveillance even when the operator has been inactive for weeks.
Cerberus exposes 44 distinct remote commands over Firebase Cloud Messaging (FCM), giving the operator granular control over a victim’s device.
These include silent front‑ and rear‑camera photos, video and audio recording, continuous GPS streaming, screen recording, SMS and call log access, outgoing SMS and call initiation, device lock and wipe, alarm activation, arbitrary app launch, Tasker automation triggers, and a “fake shutdown” that mimics Android’s power‑off screen while keeping the device fully active for spying.
Cerberus on Google Play is paired with a companion app, Lock Screen Protector (com.lsdroid.lsp), from the same developer account, LSDroid SRL of Milan, Italy.
Lock Screen Protector requests Android’s accessibility‑service permission, the most sensitive capability on the platform, allowing it to read all on‑screen content, perform gestures, and capture screenshots once granted.
It intercepts the power menu when a user attempts to turn the phone off, dismisses it, and broadcasts a screenshot of the lock screen back to Cerberus, effectively blocking safe shutdown and feeding more data into the surveillance pipeline.
By delegating accessibility to this separate app, Cerberus keeps its overt permission footprint smaller while still gaining the practical ability to observe every interaction, including SMS notifications and permission changes.
Both Cerberus Anti‑theft and Lock Screen Protector remain live listings on Google Play, marketed as anti‑theft and lock‑screen security tools on a €5/month subscription model.
Behind the scenes, Cerberus relies on Google’s Firebase platform as its command‑and‑control (C2) backbone.
Multiple Firebase projects under the same developer account host FCM topics for remote commands such as “take photo”, “wipe device”, or “fake shutdown”, as well as Realtime Database instances that synchronize operator dashboards with the fleet of compromised devices.
This design lets an operator issue commands from a browser or smartwatch and have them reliably delivered over Google infrastructure, even when the phone is on mobile data or moving between Wi‑Fi networks.
Cerberus also integrates a Wi‑Fi “radar” feature that alerts the operator when the victim’s phone comes within range of specific network names, enabling indoor tracking in locations like shelters, hospitals, and police stations where GPS is unreliable but Wi‑Fi SSIDs are stable.
Combined with motion and geofence triggers, this allows fine‑grained monitoring of a victim’s movements and routine.
To stay on Google Play, LSDroid ships several Cerberus‑family apps with the HiddenApiBypass library, an open‑source component explicitly designed to bypass Android’s hidden‑API restrictions and to be concealed from Play Store review by disabling dependency reporting in the app’s build configuration.
This setup directly conflicts with Google’s Malicious Behavior Policy and Stalkerware Policy, which ban covert tracking, hidden launchers, and misuse of sensitive APIs for surveillance.
Nonetheless, five Cerberus apps remain live on Google Play, three of them carrying HiddenApiBypass, while Google simultaneously monetizes Cerberus via AdMob and hosts its C2 infrastructure on Firebase.
Cerberus has been repeatedly named in academic work and industry reporting as stalkerware, including a 2018 IEEE S&P paper on intimate‑partner‑violence spyware, F‑Secure’s global telemetry.
With prior FTC actions already on record against other stalkerware vendors and Google Play classified as a Very Large Online Platform under the EU Digital Services Act, Cerberus’s continued presence on official distribution, monetization, and hosting channels exposes both its developer and platform operators to growing regulatory scrutiny.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…