Talk about geriatric - This devious Android malware escapes detection by typing like an old person

• Herodotus malware mimics human typing to evade timing-based antivirus detection
• Spread via SMS phishing, it installs silently using fake screens and permission bypass
• Researchers urge Android users to use Play Protect and avoid non-official app sources

One of the ways mobile antivirus programs spot malicious activity is through so-called “timing-based” detections.

When malware seeks to grant itself different Android permissions, download apps, or do other activities (such as tapping, swiping, or scrolling), it does so in an automated, robotic way, unlike humans who would normally have uneven intervals and different pauses.

Antivirus programs can spot these unusual behavior patterns and through them identify potential malware. Not with Herodotus, though.