Firebase Cloud Messaging

Reported Context (2)

infrastructure for command-and-control communication and payment URL delivery (‘CallPhantom uses Firebase Cloud Messaging for C&C communication’ and URLs were ‘fetched dynamically from a Firebase realtime database’). ESET Uncovers 28 CallPhantom Android Apps That Faked Call Logs to Charge Users
Firebase Cloud Messaging is used as a remote command channel (AgentService â ProcessCommand) enabling SMS forwarding, inbox exfiltration, remote SMS sending, call initiation, and USSD execution. KYCShadow Android Malware Uses Fake KYC Workflows to Steal Credentials and OTPs

Malware (1)

MITRE ATT&CK (14)

Vendors (1)

Products (4)

Industries (1)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.