yashsingh1/xdaforums huggingface dataset:
[General Questions and Answers] Sentimental Sugarcube:
I have the same malware on my device! It's a spyware-type malware, and I'm not sure how my device contracted it, to be honest. I'll type my software information below so that others can find this post, too, and not feel left out.

Model:

Samsung S9+

Model number:

SM-G956U

One UI version:

2.5

Android version:

10

Baseband version:

G965USQU9FVB2

Kernel version:

4.9.186-22990479

#1 Thu Feb 24 18:22:06 KST 2022

Build number:

QP1A.190711.020.G965USQU9FVB2

SE for Android status:

Enforcing

SEPF_SM-G965U_10_0030

Thu Feb 24 18:33:14 2022

Knox version:

Knox 3.4.1

Knox API level 30

TIMA 4.0.0

Service provider SW ver.:

SAOMC_SM-G965U_OYN_TMB_QQ_0026

32564c5336363098

TMB/XAA/VZW

Carrier configuration version:

2.450001

[Update]

(P.S. After factory resetting my device, it changed to "0.0.0")

Security software version:

MDF v3.1 Release 5

WLAN v1.0 Release 2

VPN PP-MOD v2.1 Release 3.0.1

ASKS v3.1 Release 20200806

ADP v3.0 Release 20191001

FIPS BoringSSL v1.4

FIPS SKC v1.9

FIPS SCrypto v2.2

SMR Mar-2022 Release 1

Android security patch level:

March 1, 2022

When I tried to mess around with my Developer's options, it showed that I am not the administrator. It doesn't allow me to turn on "Restrict my SMS and call log access" under Apps, and a bug report I opened and had looked at gave me these additional specifications I had never seen before:

Build fingerprint:

'samsung/star2qltesq...'

Bootloader:

G965USQU9FVB2

Radio:

G965USQU9FVB2

Network:

(unknown)

Module Metadata version:

330477090

Kernel:

Linux version 4.9.186-22990479...

Besides this, all of my applications have been compromised; they all have odd versions, permissions I cannot control (such the system app, Tips, being able download files without notifying me), can change system settings, install unknown apps, have "Open source licenses," and so on. Some of the capabilities that my app, Messages, has is the ability to modify my call logs, send out messages without my knowledge (then delete them), use my microphone to record at any given time, and connect or disconnect from Wi-Fi. It's quite difficult for me to find authentic information online, because my Google Chrome app constantly gives me false redirections to fake/modified links that appear legitimate.

Everything on my phone will tell me that the apps, the websites, and the operating system are safe and authentic, but they're all infected. I have been under the false impression that nothing was wrong with my device for months now, because judging from my Wi-Fi usage history, it had spiked up between June-July.

I'll also go ahead and attach a sh*tload of screenshots on what the malicious, system applications look like.
[General Questions and Answers] tutibreaker:
to fix this you need to reinstall te full firmare in odin, and format the sd card o the device ( a back up is not recommended due the malware can be copy too
[General Questions and Answers] Sentimental Sugarcube:
Thank you, I was planning on doing so, anyway. I'm just learning as much as I can before I reinstall the stock firmware, such as if there's a method I could use that wouldn't trip Knox because I like using some of the Samsung applications.

I have 2 other phones that have been compromised, as well, and the hacker knows, essentially, all my passwords now to all of my accounts, and has access to my SIM card/number. It's frustrating that when an application requests a verification code, I get messages like these:

And it also gets onto my WhatsApp account. I really have to flash my mobile devices, I'm just afraid I'll f*ck up really badly.
[General Questions and Answers] tutibreaker:
usind odin wont trip knox
[General Questions and Answers] Sentimental Sugarcube:
That's relieving to know, thank you!
[General Questions and Answers] Glow1717:
I have the same issue now going on for 2 years.

I have changed everything from emails devices wifi and cel companies. I've been super careful to not access any infected data from previous devices. On my new note 20 5g ultra out of box disabled blue tooth and dis not connect to any wifi so far. I di not transfer data from any device..

I've lost so much time and money trying to get rid of this. I've lost all 99 of all my Pic videos for over the past decade emails and social media accounts.

Knox has been activated I tried to access the account but I've been unsuccessful.

Has flashing it work for anyone else. I have on previous devices galaxy 8plus just to reverse back to the compromised state.
[General Questions and Answers] JesseJamez55:
To be honest, I eventually gave up on it because whoever it is that wants access to my devices clearly has the resources to do so.

On top of that, no one would believe me when I tried to explain to them how serious it is and all the information I've gathered to prove my point.

Unfortunately, I'm not fluent enough in coding or low level system management to professionally explain my concern for anyone to listen to.

I came to the realization that in the bigger picture, I'm a nobody in the cybersecurity field and what that means is no one will take me, and most likely you, seriously nor do others want to spend their time assisting us for anything short of a fortune.

If you are experiencing something similar to what I've posted here then chances are high you are being targeted specifically and without the relevant cybersecurity knowledge to protect yourself, you will never get away from it.

Hate to be negative here but I can assure you that I spent countless days, weeks, months trying to figure it out by researching, contacting cybersecurity specialists, forums etc. all to no avail.

I genuinely wish you luck and if you happen to find some information you could share with me, I'd appreciate it.

Outside spending a small fortune to hire an expert to come to my house and dig deep into my network, I don't see a way to resolve it, personally.

Good luck

I'm glad that at least someone believes me.

My God, seriously.

I really hope you were able to get this fixed. I haven't been able to since my entire network has been infected. It's a really long story but the bottom line is that I've never seen malware with these capabilities. They are incredible and not one you would ever want to be infected with.
[General Questions and Answers] Sentimental Sugarcube:
I'm very sorry to hear that, I can't imagine what it's like to have to deal with this for such a long time. I slowly started losing my sanity when my devices were infected, especially my primary device (the Samsung Galaxy S9+), and had started becoming irrational at times due to the paranoia and lack of understanding about what had been going on the entire time.

I have yet to flash any of my devices, so I don't know just how well it'll work out doing so. What Android version is your Samsung Galaxy S8+, though? Because devices running on Android 9 (Pie) and up are pretty unique in the sense that the security rids the device of malware & spyware once a factory reset takes place, so if you have a newer operating system like you do on your Samsung Galaxy Note 20 Ultra 5G, then you may be able to fix that issue. Although, it would only clear up issues you have on your firmware/software & not be able to help issues you'd occur with a compromised hardware & network connection.

When I factory reset my Samsung Galaxy S9+ (which runs on Android 10), the oddity disappeared! I wish I had done it sooner or routinely, at least, because it would've saved me from so much stress & anxiety.

Although, as @JesseJamez55 mentioned, you may be directly targeted, and that makes a huge difference in the matter. I, for one, am not specifically in the center of attention — my best friend is, and I suppose I somehow got involved in this awfulness just for knowing about so many of the concerning experiences he's had in the last several years.

I was planning on doing the same thing when I had gotten tired of it; I was just going to accept that my life will always be this way and there's nothing I can do to try to stop it from happening because I wasn't educated enough about the problems I was facing, and couldn't find any real information due to the DSN spoofing.

It's best to not share this with too many people — we'll end up looking like nutjobs, which we probably are a little of, due to apophenia & the heightened stress/anxiety (causing paranoia), haha. But in all seriousness, the people of people won't understand or believe is — especially when we're more suspectable to being discredited.

I think that's what the hackers/stalkers do — pick out & mess with those that have disadvantages (such as if one uses illegal substances known to distort our thinking or if one is diagnosed with a serious mental illness) because we're easily discredited.

How long has this been happening to you, if you don't mind me asking?

I was extremely relieved when I found out there are others that believed me too & who were suffering from the same issues & malware.

I was able to get it fixed, thankfully, but I've also changed my way of thinking about this whole thing. I've started taking my medications, too (or I'm starting to again). And I agree, it's definitely a considerably severe form of electronic harassment. But I suppose it's inevitable, and there's no point in stressing out so much over it anymore — for me, at least.
[General Questions and Answers] JesseJamez55:
My situation isn't on Android only, it's my entire network which includes the following;​

PC's

Android Phones

Android Tablets (No longer own)

Macbook Pro (No longer own)

MacBook Air (No longer own)

Chromebook (After allowing Linux via Developer Settings)

Router

Samsung Smart TV (No longer own)

Sony AV Receiver

My CCTV DVR System (No longer own)

Any

other device that either connects to my network or can be accessed via the Nearby Devices

pervasive

permission within Android (This is my best guess for how devices are being infected when I haven't in any way accessed my network)

After all my research and some helpful clues/texts/emails sent to me, i found out that I am being specifically targeted by my upstairs neighbor that strongly dislikes me and finds me extremely amusing.​

I won't go into further details but this is why I gave up. They are exponentially more fluent in cybersecurity than I could ever hope to be and since they have local access to my devices, I could never hope to win. I need to move which I will be doing very soon.​

This is why I say if you are going through anything close to what I am then it's almost certainly a targeted attack. I'm sure there are other possibilities but this is what my experience is.​

Do you ever use the Tor network? Depending on where you decided to browse or what you may have downloaded, you can get some especially nasty malware from there, too. Even just browsing some sites can deliver drive-by malware or not having your browser/firewall set up correctly is enough to lose your anonymity. Something to think about since it could be a government agency keeping tabs on you for a reason only you would know. Just a thought.​

​

I'll leave you with one final thought; would you honestly consider yourself a very interesting person? Do you have hobbies others would be interested in learning more about it they had the relevant skills to do so?​

​

After thinking about it, I do. I have my hobbies that I would find different or weird if I were someone else. So that mixed with some neighbors that have networking skills, are always home and way to damn nosy is how I got where I'm at.​

​

That's my real situation so just something to consider.​
[General Questions and Answers] what_the_nacho_wifi?:
I am so glad I came across this thread. Honestly. Had the exact same issue Dec last year. Although I suspect they were in the network for a couple of years before I realised. Tried to solve it for 6 weeks. Gave up, threw all network devices out and started over. All good. For three months. Even with the most strictest routines in watching what I was clicking online, not downloading anything, updates ran regularly, new vpn and more costly antivirus and equipment. It returned.

I honestly don't think its a personal attack, but it's insane how it spreads. I've worked constantly on it since June. Contacted so many people. I can't afford to throw this new stuff out, don't have money to replace it all again. My doc sent me to see a psychiatrist. Said I'm delusional. I told them I was feeling stressed and exhausted just trying to boot whoever this was out of my network and life. Psychiatrist says I'm sane, just needing to relax and have someone actually listen to me.

I have 2 pcs, laptop, 3 mobile phones, xboxes and TV being controlled by whatever this is. Root trust certs are all wrong. Traffic being directed to http although looks legit as if its https. All have been flashed with wrong ota updates. I am considering flashing my phone but don't think it will help as will be doing it with infected pc... seems pointless.

I am starting to realise I have to live with it and just get on with stuff. I've been seriously slacking in work and been so focused on this malware/spyware/rootkit whatever it is.

Honestly it's a massive relief to know I am not alone.
[General Questions and Answers] sudo_null:
I am having the same issue. What I have learned so far:

> The malware is a RAT

> It can infect and embed itself in most IoT capable devices and most anything that has RF capability, including BT, NFC, Zigbee, etc.

>It enumerates all devices in your local network. After this step it appears to inject malicious code into device drivers, specifically network interfaces. It then creates virtual network interfaces, swaps and/or spoofs MAC addresses on the devices in your network. For example, what appears to be your router on first glance, is actually your xbox or laptop which is now hosting all your devices while your router is throwing out hidden wifi networks that connect other devices.

>It creates virtual BT interfaces and is capable of discreetly connecting with other BT capable devices in the background.

>It appears to be sending a continous video/audio stream to servers located in New York and Ashburn, VA.

>It changes VPN settings for your carrier.

>It routes browser traffic to a CDN server so you get preloaded versions of certain webpages and apps.

>Some of the code I discovered in app manifests include instructions for the phone to access a created hidden camera interface called "hiddencamera0", while specifying that the led indicator for the camera remains turned off.

>It prevents me from doing a hard reset and won't allow usb or wireless debugging, making it impossible (for me at least) to flash a new OS to my device.

>When I removed certain DNS entries from the registry or updated my AD on any of my 4 Windows based computers, the OS was wiped. When it was reinstalled, the same activity resumed.

>Using simple network command prompts, I discovered early on that my computers had established connections with various servers, even with all of the network capable devices turned off. I was able to stop these by disabling each device.

>Each time the device is restarted, the malware seems to gain more control over the system.

>Antivirus software does not detect it and the only way I was able to see what was going on was to uninstall my antivirus and go into Windows Defender Firewall as an admin. There I was able to see over a hundred rules enabling communication between my device and the remote server. I immediately deleted the inbound and outbound rules, but they repopulated until I manually disabled each interface. The first time I did this on my laptop, my phone and my son's phone actually switched back to the appropiate mobile network for about 15 minutes. Then my computer reset itself and it went back to it's malware version of operation.

I will attach screenshots a bit later.

Oh y

One more thing that is particularly disturbing: It appears to be connected to my vehicle BT and Uconnect interface. There is more, but I will inckude that later as well.
[General Questions and Answers] iammakiaveli:
This is exactly what I am facing.

It seems like it has been a couple of years.

Yes the LED of the camera is off too.

Did you manage to solve it ?

Anyone with a solution?
[General Questions and Answers] rainyskye:
This seems a bit over-exaggerated, the "dangerous" processes you're talking about actually look like normal services on a samsung device lol, it's not uncommon for some frameworks and stuff to have a lot of privileges, the message you're saying you see on boot could maybe be the:

The phone is not running Samsung's official software. You may have problems with features or security. and you won't be able to install software updates.

This is typical for a bootloader unlocked/modified device, feel free to send photos of the messages you're describing, and it can help point into the correct direction.

The "traced" app you're using seems very misinforming though. The Call app having permissions to call and read storage/contacts is normal.

If you're really that paranoid about random services (which look fairly normal) - feel free to format everything, debloat down to the core OS, wrap your walls in tin-foil, throw out your phone and hide under your bed lol (sarcasm)
[General Questions and Answers] pmnlla:
And remember kids, if someone tells you "the government wouldn't do that!", Oh yes they would.
[General Questions and Answers] fillwithjoy1:
I love how we are calling them schizophrenias, when they clearly need help with cleaning a serious infection on their devices
[General Questions and Answers] pmnlla:
could that infection be called "blink" by any chance? it's a serious piece of software that makes its way onto every windows and android device without user discretion. that sounds a lot like what's happening, and blink has the ability to utilize any active internet connections when activated.
[General Questions and Answers] pmnlla:
I'm aware of a piece of software called blink that comes pre-installed on most Windows and Android devices, the only devices invulnerable to it are iPhones. It sounds similar to what OP is describing
[General Questions and Answers] rainyskye:
Depends, if it's Blink182 or the SCP999 Variant, iirc both of them got leaked at some point but are both pretty unknown.
[General Questions and Answers] pmnlla:
IIRC the 182 variant is the only one that can traverse platforms, 999 wasn't made with libwget
[General Questions and Answers] Reiscakes:
Glad to know that I'm not alone. Ive also been dealing with this for years. At what point do we start to fight back?
[General Questions and Answers] what_the_nacho_wifi?:
How do we fight back, where do we start? If we can't find the root of the issue or how to begin solving it, I don't really know how we can fight back. I still haven't replaced everything. It will have been a year on June 7th that the second infection started. I am beginning to believe many people have the same issue but just don't know it. It's an absolute nightmare.

I think the first infection I had started around 2018 but I didn't realise until 2021. Very stealthy.
[General Questions and Answers] Carolus Damnatus:
I tried multi quote more than Two Of You just to thank you so much for your information and experiences.

I am partly An Addict and has such experienced real psychosis and there for no one in my real life believe me about anything anymore regarding the people stalking me.

I have even heard the Noise you hear when the telephone get an alert or whatever it is called in English from my clothes! (!!!)

I has a happened two times close to episode of psychosis but Once I had been Clean and Sober Wither medication for weeks and I still heard it very clear When my phone was in my room and no one Was around me and I was of course disappointed again a realized It must have been Real the time before that has well.

Sorry but my knowledge about computers is too Low to help anyone here.

I changing phones and computers and it still Continue thank continues even thou I use completely new email s and so fort.

I I have even manage to capture their found when they have been in my room at the same time as but problem is they edit the films afterward and no one believe me about this but

.... I have at least a short clip from a video of something Moving in my room and it's not a part of my body but neither Is it a human being but an Object of some kind.

[This can all be you to my psychosis] can all be due to my psychosis)

I have also believed because of my not very Close association with criminals that there goal is to kidnap and torture me but that i real life is not very believable at all or realistic even that they should play me with me for so long time without taking me.

[/only psychosis]

I have more than Once been subjected to compulsory psychiatric treatment and locked up solely Because I told the doctors my phone was hacked. One time they even admitted that I had no other Signs of psychosis But that I needed to remain until the doctors of another facility had decided otherwise....

sorry for my bad English but I write so slowly that I use Googles Voice thingy for this.

the bottomline I think we all agree on is we can do nothing to stop them really. And who ever had the capabilities to stop them and find out what they are doing And Who they are and so on, would not believe us in the first Place and spend no energy on us.

I live in Sweden by the way But I am so glad I Found this Thread and unfortunately a part of me believes that the people stalking me have created this Thread just to play with their victim.

sorry for wasting in your time but if anyone believed Us I think even the media will be happy to write about this
[General Questions and Answers] fillwithjoy1:
please fix your english, i'm confused what you are talking about and I'm pretty sure this thread is basically dead now
[General Questions and Answers] rainyskye:
Don't worry, we see you :3
[General Questions and Answers] dotain11:
Hi there,

Just to make a note that i've been enforced to contract with certain online 3rd Party organizations, applications and so on ... Ill give you a shot of my point of view.

1.

One of them proccesses which iss SIM ROAMING works at all times for some reason ... We can get a wierd conclusion out of this ...

2.

I was just about to upload a screenshot which shows a proof of that the time zone of my device it's mixed somehow across the couple of devices which i've changed got different time zones each and a different A different android build as well, as at times am being redirected from one version of Google Play Store to another one.

About the e-mail which i've sent was showing -8 hours time difference between UK and the "X" other location

3.

I lost control over my UBER-Driver application, multiple times been supposed to unblock my everything almost at all times like sims, apps, bank accounts even didn't work properly ...

Still strugging to update my details as basicly am still captivated by this THING blink or however you call it...

Another wierd thing is that strangers in real life are approaching you with a certain intention on their mind...

...And the thing is that somebody out there told them about you and your current location.

Like even in my case obviosly someone out there was trying and it does yet bother me via different ways, mostly with taking control of my applications.

Been enforced to take a lot more than this actually for the last couple of months.

I've lost so much already...

For me this is not really a hack...

I don't have a clue about coding...

What i know so far isss like this eventually is just a mixture of being subscribed with loads of loads of bad cyber spots of which we need to unsubscribe before flashing devices or doing anything else as the whole malware broadcast proccess of my device would comeback over and over again.

Am sending you couple of screenshots...

Would love to know if somebody left this application this, to share his expierience over, would appreciate it!