If you still have iRecorder installed, you should delete it from your devices right away. Of all their apps, only iRecorder had malicious features. Whatever the case, Google removed the malware app and all the apps that developer Coffeeholic Dev uploaded to the Play Store. But an app has to have been inactive for months for the protections to kick in. App hibernation places dormant apps into a hibernation state, resetting permissions and preventing malicious apps from working.

Image source: ESETĮSET points out a protective feature in Android 11, and later that might have prevented the app from spying on you. The malicious commands included in iRecorder – Screen Recorder malware app. It’s unclear who its target, or targets, might have been. IRecorder only got 50,000 downloads from the Play Store. But the researchers observed that other malicious features were not enabled. Like extracting audio recordings and other files. The August update only implemented a set of potential spying features.

“However, we were not able to attribute the app to any particular malicious group.” Also, the ESET team says it hasn’t detected AhRat anywhere else. “The app’s specific malicious behavior – exfiltrating microphone recordings and stealing files with specific extensions – tends to suggest that it is part of an espionage campaign,” the researchers said.

The list includes saved web pages, images, audio, video, and documents. The app also looked for various types of files, which it would then upload to the server. But it also got the ability to record surrounding audio from the microphone and send the files to the command and control server. Image source: ESETĪfter the update, iRecorder maintained its original features. IRecorder – Screen Recorder Google Play store listing.

Macbook screen record audio