The Architecture of Surveillance: How Cerberus Weaponizes Google Infrastructure as Stalkerware

While marketed as a legitimate security suite, Cerberus Anti-theft has evolved into a sophisticated piece of stalkerware operating directly within the Google Play ecosystem. By abusing Android’s Accessibility Services and leveraging Google’s own Firebase cloud infrastructure, the application provides abusers with a high-fidelity, remote command-and-control (C2) pipeline to monitor victims with near-total autonomy.

The user experience for an abuser is deceptively simple: via a web dashboard at cerberusapp.com or a synced smartwatch, an operator can push custom notifications to the victim’s lock screen. This acts as a social engineering lure; when a victim interacts with the message, the app executes a preconfigured, silent payload—typically activating the front-facing camera and logging precise geolocation data.

However, the true danger lies in the app’s persistence and trigger logic. Cerberus does not require active manual input to function; it is designed to self-activate based on environmental and device-state changes, such as power cycles, network handovers, geofence breaches, or even simple motion detection. This ensures a continuous stream of telemetry even during periods of operator inactivity.

Granular Control via Firebase Cloud Messaging

Technical analysis reveals that Cerberus exposes 44 distinct remote commands through Firebase Cloud Messaging (FCM). This gives the operator a granular toolkit for digital surveillance, including:

• Multimedia Capture: Silent activation of front and rear cameras, as well as continuous audio and video recording.
• Data Exfiltration: Real-time GPS streaming, screen recording, and full access to SMS and call logs.
• Device Manipulation: The ability to initiate outgoing calls/SMS, remotely lock or wipe the device, and launch arbitrary applications.
• The “Fake Shutdown”: A sophisticated deceptive tactic that mimics the Android power-off UI, tricking the victim into thinking the device is off while the underlying processes remain fully active and connected.

Permission Obfuscation and the Accessibility Loophole

To maintain a lower “permission footprint” on the Google Play Store, the developer, LSDroid SRL, employs a multi-app strategy. Cerberus is paired with a companion app, Lock Screen Protector (com.lsdroid.lsp), which serves as the primary vehicle for high-risk permission requests.

By requesting Android Accessibility Services, the companion app gains the ability to scrape on-screen content, perform automated gestures, and capture screenshots. Crucially, it can intercept the system power menu; if a victim attempts to shut down the phone to stop the spying, the app dismisses the menu and broadcasts a screenshot of the lock screen back to the operator, effectively stripping the user of their ability to regain control of the hardware.

Infrastructure as a Service: The Firebase Backbone

Cerberus’s reliability is a direct result of its reliance on Google’s cloud backbone. The app utilizes multiple Firebase projects to host FCM topics for command delivery and Realtime Database instances to synchronize operator dashboards with the “fleet” of compromised devices. This ensures that commands—whether “take photo” or “wipe device”—are delivered with low latency, regardless of whether the device is on mobile data or transitioning between Wi-Fi networks.

Furthermore, the app features a specialized Wi-Fi “radar.” This allows for indoor tracking in environments where GPS signals are attenuated, such as hospitals or domestic violence shelters, by monitoring for specific Wi-Fi SSIDs. When combined with geofencing, this creates a high-resolution map of a victim’s routine.

Bypassing Review: The HiddenApiBypass Strategy

Perhaps most concerning is the technical method used to evade Google’s automated security scans. LSDroid ships several apps in the Cerberus family with the HiddenApiBypass library. This open-source component is specifically engineered to circumvent Android’s restrictions on non-SDK interfaces and, more importantly, to hide dependencies from the Play Store’s review process by disabling dependency reporting in the build configuration.

This architecture creates a profound regulatory and ethical paradox: while Cerberus violates Google’s Malicious Behavior and Stalkerware Policies, the platform simultaneously monetizes the app through AdMob and provides the very C2 infrastructure (Firebase) required for the surveillance to function.

As academic researchers and industry leaders like F-Secure continue to flag these tools, the legal landscape is shifting. With the EU Digital Services Act classifying major app stores as Very Large Online Platforms (VLOPs), the continued hosting of Cerberus places significant regulatory pressure on both the developer and the platform providers to address these systemic security failures.