Ensure Google Play Protect is enabled. It is designed to scan for known SpyNote signatures.
Here is how a real-world attack unfolds: