The hardest part of Android surveillance isn't capturing data — it's staying hidden. Here's how XeraX avoids detection from multiple angles simultaneously.
No Launcher Icon
XeraX runs as a background Termux process, not as an installed APK with a launcher entry. There is no icon in the app drawer, no entry in Settings → Apps under a suspicious name. To a casual user inspecting their phone, there is nothing to see.
No Persistent Notification (With Root)
Android 8+ normally requires background services to show a persistent notification. With root, XeraX uses appops to suppress this notification silently. Without root, Termux's own notification is shown but appears as a normal Termux process.
Camera and Mic Indicator Suppression (Root)
Android 12+ shows green dots when camera or mic is in use. With root, XeraX uses settings put global camera_mic_icons_enabled 0 to disable these indicators system-wide, so silent captures leave no visual trace.
OOM Protection
XeraX sets oom_score_adj to -1000 on all daemon processes. Android's Out-of-Memory killer will skip these processes even under severe memory pressure, treating them as untouchable system processes.
Doze and Battery Optimization Exemption
XeraX exempts itself from Doze mode using Android's power management API, ensuring heartbeats and command polling continue even when the screen is off and the device is stationary.
Anti-Detect Script (Root)
XeraX includes an anti-detect module that monitors for known spy-detector apps, ADB connections, and settings-inspection activity. If detected, it can pause operations or trigger a cleanup sequence.
Decoy Process Name
With root, XeraX disguises its process name in ps output to resemble a common system component, making casual inspection of running processes inconclusive.
Transparency Note
A forensic inspection of running processes by someone who knows what to look for can still find XeraX. No software is truly undetectable under a full forensic audit. XeraX is designed for everyday invisibility, not forensic-level concealment.