The Android threat landscape continues to evolve rapidly, with spyware developers increasingly relying on social engineering and system abuse rather than expensive zero-day exploits. One of the latest discoveries in this domain is a previously undocumented Android spyware strain named Morpheus, version 2025.3.0. This malware represents a concerning shift toward highly invasive yet cost-effective surveillance tools that exploit legitimate system features to gain complete control over targeted devices.

Morpheus appears to have been developed with strong ties to Italy, based on linguistic artifacts and infrastructure analysis. Despite its relatively low-cost infection strategy, its capabilities rival those of more advanced surveillance frameworks. It leverages accessibility services, Android Debug Bridge (ADB) manipulation, overlay attacks, and device administration privileges to establish deep persistence and extract sensitive user data.

Infection Strategy and Initial Compromise

The infection vector follows a familiar pattern seen in many low-cost spyware campaigns. Instead of exploiting system vulnerabilities, attackers rely on deception. Victims are typically tricked into installing a malicious application after being denied access to a service, such as mobile connectivity.

In this case, targets received SMS messages containing a link to a phishing domain impersonating a legitimate ISP service. The malicious application masqueraded as a Fastweb-related tool, convincing users it was necessary to restore connectivity or fix network issues. Once installed, the first-stage payload—known as the dropper—initiates the second phase of the infection. The dropper uses the package name com.android.cored and embeds the actual spyware payload within its assets. It is based on a modified version of an open-source installer, adapted to silently deploy the second-stage application without raising suspicion.

Multi-Stage Architecture and Deployment

Morpheus operates through a two-stage architecture. The dropper serves as a delivery mechanism, while the second-stage agent (com.android.core) performs the actual surveillance activities. The agent application is designed to appear legitimate, presenting itself as system utilities such as “Mobile Config,” “Play Protect,” or “microG Settings.” These disguises are carefully chosen to blend into the Android ecosystem and avoid user suspicion. Upon launch, the spyware displays a fake diagnostic interface that claims to scan for SIM or network issues. This interface is not functional but serves as a psychological trigger to guide users toward granting permissions.

Abuse of Accessibility Services

A central component of Morpheus is its abuse of Android Accessibility Services. These services are intended to assist users with disabilities but provide powerful capabilities such as reading screen content, interacting with UI elements, and performing automated actions. The spyware declares itself as an accessibility tool to gain full access. It bypasses Android’s restrictions on sideloaded apps by using the dropper installation method, effectively circumventing protections introduced in newer Android versions.

Once granted accessibility permissions, Morpheus executes predefined workflows that automate complex interactions with the system. These workflows allow the malware to enable developer options, activate wireless debugging, and grant itself extensive permissions—all without meaningful user awareness.

Overlay Attacks and Biometric Bypass

Morpheus uses overlay techniques enabled by the SYSTEM_ALERT_WINDOW permission to manipulate user interactions. It can display fake interfaces on top of legitimate applications, including system dialogs.

One of the most alarming capabilities is its ability to bypass biometric authentication. The spyware overlays a fake fingerprint prompt while triggering real authentication requests in the background. When the user interacts with the fake interface, they unknowingly authorize malicious actions. This technique is used to compromise messaging platforms such as WhatsApp. The spyware silently links a new device to the victim’s account, granting attackers full access to conversations and communications.

Privilege Escalation via ADB

A standout feature of Morpheus is its use of Android Debug Bridge (ADB) for privilege escalation. By enabling wireless debugging and pairing with the local ADB daemon, the spyware gains shell-level access to the device.

It executes a series of scripted commands that grant itself dangerous permissions without user prompts. These include access to secure settings, notification data, and device identifiers. The malware also disables system protections such as Play Protect verification and camera/microphone usage indicators. This level of control allows Morpheus to operate with near-complete autonomy, bypassing many of Android’s built-in security mechanisms.

Anti-Detection and Persistence Mechanisms

To ensure long-term persistence, Morpheus registers itself as a device administrator and configures the system to prevent removal. It disables battery optimization restrictions and ensures continuous background execution. The spyware also targets and disables popular antivirus applications, including Bitdefender, Avast, Sophos, and Malwarebytes. This is achieved without requiring root access, highlighting a significant weakness in Android’s application-level security model. Additionally, the malware includes device-specific optimizations for various Android distributions such as MIUI, OneUI, and ColorOS. These adaptations allow it to bypass manufacturer-specific restrictions and maintain persistence across a wide range of devices.

Data Collection and Surveillance Capabilities

Morpheus is highly invasive and capable of collecting a wide range of sensitive data. Its features include recording audio and video, capturing screenshots, monitoring notifications, and accessing messaging platforms. It also weakens system security by modifying core settings and disabling privacy indicators. This ensures that its surveillance activities remain undetected by the user. Furthermore, the spyware integrates with Firebase services, potentially exposing correlations between infected devices and user identities.

Infrastructure and Attribution

Analysis of the malware’s command-and-control infrastructure reveals connections to Italian networks and entities. The spyware communicates with servers hosted on domains associated with Dyn DNS services and Italian ISPs. Evidence suggests links to organizations such as IPS Intelligence, along with related entities like Rever Servicenet and Iris Telecomunicazioni. These connections are based on shared infrastructure, WHOIS records, and overlapping business affiliations. The use of generic naming conventions, free email accounts, and minimal corporate transparency aligns with patterns commonly observed in surveillance technology providers.

Indicators of Compromise and Detection

IPs:

• 109.239.245.172
• 195.120.31.91
• 212.210.1.211

Domains:

• assistenza-sim.it and subdomains
• gamehosts-621ba.appspot.com

Android package names:

---

Our Opinion on the Morpheus Spyware Case

The emergence of Morpheus highlights a critical shift in the spyware ecosystem. Instead of relying on expensive exploits, developers are increasingly exploiting human behavior and legitimate system features. This approach makes such threats more scalable, accessible, and difficult to regulate. What makes Morpheus particularly concerning is not just its technical sophistication, but its operational model. It demonstrates how surveillance capabilities once limited to state actors are now becoming available through smaller, less transparent organizations. The apparent connections between infrastructure providers and loosely defined companies raise serious questions about accountability and oversight.

From a security perspective, this case underscores the limitations of current mobile defenses. Android’s reliance on user consent for permissions becomes a vulnerability when users are manipulated through convincing social engineering. Even advanced protections like biometric authentication can be bypassed when combined with overlay attacks. In our view, combating threats like Morpheus will require a multi-layered approach. This includes stronger platform-level restrictions, improved detection of abnormal accessibility usage, and greater awareness among users. Additionally, there must be increased scrutiny of companies operating in the surveillance technology space. Ultimately, Morpheus is a reminder that the weakest link in cybersecurity is often not the system, but the human interacting with it.