In a statement, the researchers also note, “As part of the installation, the malware will ask for administrator privileges that allow it to terminate antivirus applications running in the background.”

It threatens the user that his/her device is compromised by a virus that it can only be free from infection by updating the system. When a user visits an infected website, an alert pops up and warns the user to install an update-a common scare tactic used to elicit a sense of urgency. Such domains are short-lived, and are regularly updated and replaced by new ones to avoid any form of URL-based filtering. The malware squats on different URLs that resemble actual, existing Google updates. The malware in question is capable of mining user data from call logs, SMS exchanges, browser history, and even banking and credit card credentials before sending them to a remote server. Researchers at Zscaler reportedly spotted an Android infostealer that spreads by hiding under the guise of a Google Chrome update.

Update chrome android