Stiller on Android: technical details, legal risks and safe alternatives

The term "stiller" (from English stealer — “thief”) in the context of Android refers to malware designed to steal data: passwords, cookies, bank details, message history and other confidential information. Such apps are often disguised as legitimate utilities, from memory optimizers to game cheats. However, their creation, distribution or even testing on your own device may entail criminal liability in most countries, including Russia (Articles 272–274 of the Criminal Code of the Russian Federation).

This article does not contain instructions for developing malware. Instead, we will look at:

- How stealers work on a technical level (to understand threats).

- Why their use is dangerous - both for victims and for creators.

- Legal methods Android application security testing, if you are interested in cybersecurity as a profession.

⚠️ Warning: The material is for informational purposes only. Any actions related to the creation or distribution of malware are prosecuted by law. The author and the resource are not responsible for the unlawful use of information.

1. How does a stealer for Android work: technical principles

Stillers exploit vulnerabilities in Android permissions, data storage mechanisms and user habits. Typical algorithm of operation:

1. Infiltration —infiltration of the device under the guise of a harmless APK (for example, through third-party stores or phishing links).
2. Privilege escalation —requesting permissions to access SMS, contacts, files or use AccessibilityService to intercept input.
3. Data collection - copying application databases (for example /data/data/com.whatsapp/databases/msgstore.db for WhatsApp), screenshots or keylogging.
4. Ekfiltration — sending stolen data to a remote server (often through encrypted channels or legitimate cloud services like Firebase).

The danger of modern stealers is their modularity: they can download additional payloads after installation, bypassing antiviruses. For example, the malware Cerberus (2019–2021) used Android Debug Bridge (ADB) to remotely control the device, and Anubis encrypted traffic via Tor.

⚠️ Attention: Even “educational” projects open source stealers on GitHub (for example AhMyth or L3mon) may contain backdoors. Downloading them and running them on a real device is tantamount to infection.

2. Legal consequences: what the law says

In Russia, the creation and distribution of stealers is qualified under several articles of the Criminal Code:

Article of the Criminal Code of the Russian Federation	Crime element	Maximum punishment
272	Illegal access to computer information	Up to 7 years of imprisonment (if major damage is caused)
273	Creation, use or distribution of malicious apps	Up to 5 years of imprisonment + fine of up to 500 thousand rubles.
159.6	Fraud in the field of computer information	Up to 10 years (if the damage exceeds 1 million rubles)

Important: Even testing the stealer on your device can be regarded as preparation for a crime (Article 30 of the Criminal Code of the Russian Federation) if intent is proven. In 2023, more than 1,200 cases were initiated in Russia under Art. 272–274, of which 15% are related to mobile platforms.

The penalties are even stricter abroad. In the USA, similar actions are prosecuted with fines of up to $250 thousand and a prison term of up to 10 years. The EU has a directive Computer Fraud and Abuse Act (CFAA) with fines up to $250 thousand and a prison term of up to 10 years. There is a directive in the EU NIS2tightening liability for cyber attacks.

3. Why stealers are dangerous for victims: real cases

The consequences of stealer infection go beyond the theft of passwords. Here are specific examples from practice:

• 💳 Financial losses: In 2022, a stealer Flubot stole bank card data from 60 thousand users in Europe, causing damage of €50 million. Victims lost funds from their accounts within hours.
• 🔑 Account theft: Malware BlackRock (2020) steals cookies and authorization tokens, allowing attackers to gain access to the victim's accounts without entering a password (for example, on Google, Facebook or crypto exchanges).
• 📱 Blackmail: Some stealers (for example, Xenomorph) take screenshots of the screen while entering data, and then blackmail victims with the threat of publishing personal information.
• 🛡️ Reputational damage: If stealer is used to spread spam or attack the victim’s contacts; their accounts can be blocked (for example, in WhatsApp or Telegram).

Stillers often go unnoticed for months, because they disguise themselves as system processes (for example, com.android.system) and do not consume many resources. Antiviruses detect them only after updating the databases - and by this time the data has already been stolen.

How to check a device for the presence of a stealer?

1. Install Malwarebytes or Kaspersky Mobile and run a deep scan.

2. Check the list of application permissions in Settings → Applications → Special access (especially Accessibility and Manage other applications).

3. Monitor network traffic via NetGuard or PCAPdroid —stealers often contact suspicious IPs (for example, in China, Russia or Bulgaria).

4. Check for unknown APKs in /data/app/ via Root Explorer (required root access).

4. Legal alternatives: how to study cybersecurity without violations

If you are interested in ethical hacking or penetration testing, there are legal ways to develop in this area:

4.1. Laboratories and test sites

• 🔬 Hack The Box (HTB): Platform with virtual machines for legal testing of vulnerabilities. There are mobile tasks (for example, Android applications with vulnerabilities).
• 🛡️ TryHackMe: Courses on reverse engineering of Android applications (for example, path Mobile Hacking Pre-Path).
• 🤖 Android Tamer: Linux distribution with tools for APK analysis (includes MobSF, JADX, Frida).

4.2. Certifications and training

For official employment in the field of cybersecurity, the following will be useful:

• 📜 OSCP (Offensive Security Certified Professional): Practical exam on hacking systems (includes mobile goals).
• 📱 CMSP (Certified Mobile Security Professional): Specialization in Android/iOS security.
• 🎓 Courses from SANS Institute: For example, SEC575: Mobile Device Security and Ethical Hacking.

⚠️ Attention: Even for educational purposes prohibited test vulnerabilities on other people's devices or applications without written permission of the owner (this is called unauthorized penetration testing and is punishable by law).

Learn the basics of networks (TCP/IP, DNS, HTTP)|Learn to work with Wireshark and Burp Suite|Try APK reverse engineering through JADX|Get a certificate eJPT or CEH|Participate in bug-bounty apps (for example, HackerOne)

-->

5. How to protect your device from stealers

Prevention of infection by stealers includes both technical and behavioral measures:

5.1. Android settings

• 🔒 Disable installation from unknown sources: Settings → Security → Unknown sources (or Installation of unknown applications in new versions Android).
• 🛡️ Limit AccessibilityService: Check the list of applications with access to Settings → Accessibility → Accessibility Services. Remove suspicious ones.
• 📱 Update the system: Vulnerabilities in older versions of Android (for example, CVE-2021-0918 Android 10) are actively exploited stillers.

5.2. Applications for protection

Type of protection	Recommended software	Features
Antivirus	Bitdefender Mobile, Kaspersky Internet Security	Detection of stealers by behavioral analysis (for example, attempts to access SMS or encryption keys).
Permission manager	Bouncer, AppOps	Block app access to contacts, location or camera on demand.
Sandbox	Shelter, Island	Isolate suspicious apps in a separate user profile (requires root or Android for Work).

⚠️ Attention: Some stealers (for example, TeaBot) bypass two-factor authentication (2FA) by intercepting SMS or notifications. Use hardware keys (for example, YubiKey) or token applications (Google Authenticator, Aegis).

6. Myths about stealers: what they really are

There are many myths around stealers that can be misleading. Let's look at the most common ones:

• 🤖 "Stealers only work on rooted devices"} — Incorrect. data-i="187">) exploit vulnerabilities in Android without root access, using BRATA) exploit vulnerabilities in Android without root access, using AccessibilityService or Overlay Attack (overlaying fake windows on top of legitimate applications).
• 🔍 "Antivirus will protect. from all stealers" — Not quite. Many stealers (for example, Alien) use polymorphic code that mutates every time it is launched, bypassing signature analysis. You need behavioral monitoring (for example, in Bitdefender).
• 💰 "Stillers bring easy money" — Dangerous misconception. Most of the "customers" of such apps are scammers who do not pay the performers. In addition, you can track the creator of the stealer through metadata APK or transactions cryptocurrencies.
• 📱 "I". I test the stiller only on my phone - it’s safe." — No. Even local testing can lead to data leakage (for example, if the stealer sends information to a hard-coded IP). In addition, this can be qualified as preparing for a crime.

Another common myth is that stillers are written only on Java/Kotlin. In fact, they are often combine:

• Native code (C/C++) to bypass analysis.
• Flutter/React Native to disguise as legitimate applications.
• AutoIt or Python (via Termux) to automate attacks.

7. Career in cybersecurity: how to legally monetize skills

If you are attracted to the idea of “making money by hacking,” there are legal and well-paid ways:

7.1. data-i="217">Companies pay for discovering vulnerabilities in their products. Average payments:

Companies pay to find vulnerabilities in their products. Average payouts:

• 💻 Google Vulnerability Reward app: From $100 to $150 thousand for critical vulnerabilities in Android.
• 📱 Samsung Mobile Security Reward: Up to $200 thousand for exploits in Knox.
• 🌍 HackerOne: Search platform bug-bounty apps (for example, Twitter pays up to $15 thousand for RCE).

7.2. Freelancing and remote work

Security specialists are in demand on exchanges:

• 💼 Upwork/Toptal: Orders for testing mobile applications (rates from $30/hour).
• 🛡️ Freelancer.com: Projects on APK reverse engineering or malware analysis.
• 🎓 Mentoring: Teaching on platforms like Udemy or Cybrary (a course on Android security can bring $500–$2000/month).

⚠️ Attention: When working with foreign customers, make sure that the project does not violate local laws. For example, testing applications from sanction lists (for example, some Russian banks) can lead to account blocking on the freelance platform.

FAQ: Frequently asked questions about stealers and Android security

❓ Is it possible to write a stealer “for yourself” without distributing it?

No. Even the creation of malware without distribution can be qualified as preparation for a crime (Art. 30 of the Criminal Code of the Russian Federation), if intent is proven. In addition, the stealer can accidentally leak (for example, through GitHub) or infect your device.

❓ How do I know that my phone is infected with a stealer?

Signs infections:

• Unexplained increase in traffic (check in Settings → Mobile network → Traffic usage).
• The appearance of unfamiliar applications in Settings → Applications.
• The battery drains quickly (stillers often work in the background).
• SMS or notifications arrive with a delay (possibly they are intercepted by malware).

To check, use Malwarebytes or Kaspersky Mobile in deep mode scanning.

❓ Are there legal tools for testing Android security?

Yes, here are some of them:

• MobSF (Mobile Security Framework) — automatic analysis of APK vulnerabilities.
• Frida —a tool for dynamic analysis of applications (for example, intercepting API calls).
• Burp Suite —a proxy for analyzing Android application traffic.
• Genymotion —an Android emulator for testing in an isolated environment.

All of them are legal when used on your own devices or in agreed test environments.

❓ Is it possible to remove the styler without resetting settings?

In most cases - yes, but it depends on the type of malware:

• If the stealer does not have rights Device Adminit can be removed through Settings → Applications.
• If the malware uses AccessibilityService, first disable it in the accessibility settings.
• For persistent stillers (for example, xHelper) you may need factory reset settings or flashing.

After deletion, be sure to change all passwords and revoke sessions in your accounts (for example, in Google, VKontakte, banking applications).

❓ What is the penalty for distributing the stealer?

In Russia:

• According to Art. 273 of the Criminal Code of the Russian Federation - up to 5 years in prison + a fine of up to 500 thousand rubles.
• If the damage exceeded 1 million rubles, it can be applied Art. 159.6 of the Criminal Code of the Russian Federation (fraud) with a penalty of up to 10 years.
• Additionally, compensation may be recovered civil claim from victims for damages.

In judicial practice, there are cases when the creators of stealers received real sentences even without evidence of direct damage (for example, the case of the Moscow City Court under Article 272 of the Criminal Code of the Russian Federation in 2021).