Ensure Google Play Protect is enabled. It is designed to scan for known SpyNote signatures.

Here is how a real-world attack unfolds: