Cerberus Stalkerware Hits Google Play, Abuses Accessibility and Firebase for Remote Control

Gbhackers •Mayura Kathir • May 5, 2026

Cerberus Anti-theft, a long-running Android “security” app, is operating as full-featured stalkerware on Google Play, abusing accessibility services and Google Firebase to give abusers near-total remote control over victims’ phones. Once installed, Cerberus lets an abuser push a custom lock‑screen notification to the victim’s device from a web dashboard at cerberusapp.com or a paired smartwatch. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cerberus Stalkerware Exploits Google Play for Remote Control of Victims' Devices Cerberus Anti-theft, a stalkerware application, has been available on Google Play since October 4, 2023, masquerading as a legitimate anti-theft tool. The app utilizes accessibility services and Google Firebase to enable abusers to gain extensive remote control over victims' Android devices. Once installed, it can silently capture photos, track locations, record audio, and even wipe devices without the victims' consent. Victims are primarily Android users who unknowingly install the app, believing it to be a security tool. The app's presence on Google Play raises significant concerns about the platform's security vetting processes. As of now, the app remains available, posing a continuous threat to users. The situation highlights the need for improved scrutiny of apps that request extensive permissions. Users are advised to be cautious of apps that require accessibility services for non-essential functions. 2 sources 66

Extracted Entities

Cerberus Stalkerware Hits Google Play, Abuses Accessibility and Firebase for Remote Control

The full story

Extracted Entities

Attack Types (1)

Domains (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (3)