Researchers have published a new report detailing “SecuriDropper”, a Dropper-as-a-Service (DaaS) operation that has been observed bypassing the “Restricted Settings” security measure introduced in Android 13 by Google. The “Restricted Settings” measure was created to restrict privileges that allow the sideloading of applications (typically from sources other than the legitimate Google Play Store). Researchers detailed that the “Restricted Settings” feature prevents sideloaded applications from requesting Notification Listener access as well as accessibility settings, which are commonly sought out and abused by malware. Droppers are primarily used for installing a payload on a compromised device and are notorious for allowing threat actors the ability to “separate the development and execution of an attack from the installation of malware.” DaaS operations offer a two (2) stage process that increases the difficulty of detection. The first stage of this process involves the distribution of a malicious application that appears legitimate, which installs the secondary payload onto the device. SecuriDropper utilizes a different Android API than its predecessors to install its payload, which is noted as “mimicking the process used by marketplaces to install new applications.” Researchers explained that, with this specific API, the compromised device’s Operating System cannot differentiate between the fraudulent application and a legitimate marketplace, which allows the malicious application to bypass “Restricted Settings”. Technical details of the SecuriDropper DaaS operation as well as indicators of compromise (IOCs) can be viewed in the report linked below.