Covert Android app launch via contacts

On Android, an app can add its own contacts to the system-wide search. To do so, it declares a special ContentProvider marked as a ContactDirectory. The catch: to read those contacts, the system has to start the app itself and query its provider.

And that is exactly what it does right after installation: upon receiving the new-package notification, it detects the ContactDirectory marker and calls the provider—which launches the app's process and executes its code before the user has opened anything. This is how the MoqHao trojan launched itself immediately after installation.

The offensive angle: this can bypass security tools (MTD/EDR) that block untrusted apps from launching. The install notification (PACKAGE_ADDED) is delivered asynchronously, creating a small window between the app's code executing and the defense reacting.

Fixed in Android 14 (android-14.0.0_r29): if the app isn't running, the system no longer reads its metadata. This is formally not considered a security fix, so the technique still works on older versions.

Source: https://fi5t.xyz/posts/contactdirectory-abuse/