The Trojan that’s nearly impossible to remove

1 April 2020 Cyber Security

Last year, a particularly indelible malware was discovered attacking Android-based devices: the now infamous xHelper Trojan, which is nearly impossible to remove from a device. As of March 2020, the xHelper has infected over 55 000 phones around the world, and the attacks continue.

After xHelper is installed, it runs a series of downloads of other malicious files, including one known as Triada, which provides root access on the device. This is what makes xHelper particularly difficult to remove; the malware module installed in the system folder simply reinstalls the deleted applications. In addition, all the files copied to the phone’s folders by the malware are designated ‘immutable’, meaning not even super-users can delete them.

“xHelper is particularly dangerous because it creates a backdoor that the attackers can use to execute commands as if they’re a super-user, as well as gain access to all app data. A similar backdoor can then be used by other malware, like CookieThief, to attack the same device. Since xHelper is nearly impossible to remove, it’s important that Android users stay vigilant about what they’re downloading on their phone and always use strong mobile security software. The good news: if you are downloading apps from official stores, chances of encountering this malware are very low,” says Igor Golovin, malware analyst at Kaspersky.

Kaspersky solutions successfully block the threat.

To protect yourself from xHelper and other Android malware, Kaspersky experts recommend:

• Only download applications from trusted sources, like official marketplaces.

• Install an antivirus solution on your phone, like Kaspersky Antivirus & Security for Android.

For more information contact Kaspersky Lab, +27 11 783 2424,,


Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Work from home securely
Issue 5 2020 , Cyber Security
First Consulting provides enterprise-level IT security to working-from-home employees at more than 40 South African organisations.

Agility, meticulous alignment and testing
Issue 5 2020 , Cyber Security
Data loss can put the nails in the coffin for unprepared businesses. Investing in cyber resilience is key to succeed in the age of digital transformation.

An out-of-the-box tutor
Issue 5 2020, Kaspersky , Training & Education
Kaspersky’s new security awareness training provides every employee with an individual learning path.

Cybersecurity comment: Cyber threats remain relentless
Issue 5 2020, CA Southern Africa , Cyber Security
Over 80% of email-based threats in Q1 2020 leverage COVID-19 in some form to feign legitimacy to the end user.

11 essential steps to reinforce cybersecurity
Issue 5 2020 , Cyber Security
Wayne Olsen has compiled a guideline to ensure that businesses and their employees are protected while working remotely.

Cybersecurity comment: Securing the real endpoint
Issue 5 2020 , Cyber Security
The corporate perimeter is fast becoming irrelevant, as the so-called security boundary extends to wherever an Internet connection exists.

Don’t squeeze your cyber assets
Issue 5 2020 , Cyber Security
Inadequate investment in cybersecurity is directly related to the spate of cyberattacks we’re seeing in South Africa now.

Cybersecurity comment: Create layers of security
Issue 5 2020 , Cyber Security
Any organisation, whether large or small, public or private, should follow an established framework in order to protect itself against cyber threats.

Next-generation security operations centre
Issue 4 2020, AVeS Cyber Security , Cyber Security
Pay-as-you-use cybersecurity from AveS allows all businesses access to world-class expertise.

Strengthen your passwords for world password day
Issue 4 2020 , Cyber Security
May 7 is World Password Day and KnowBe4 is providing tip sheets, videos and tools to help people strengthen their passwords.