PromptSpy Silent Second-Stage APK Install via PackageInstaller createSession

Subhankar H@Andrewsec57

•updated Jul 8, 2026•0•0•0

Detects the initialization of an Android package installation session using the 'PackageInstaller.createSession' API in conjunction with 'PackageInstaller$SessionParams'. This behavior is indicative of potential silent second-stage APK installation, a technique used by malicious applications to bypass standard installation prompts or deploy additional malicious components.