Android

AppWizard
May 6, 2026
Google is rolling out the May 2026 software update for all supported Pixel devices running Android 16, which includes the Pixel 7a, Pixel 8 series, Pixel 8a, Pixel 9 series, Pixel 9a, Pixel 10 series, Pixel Tablet, and Pixel Fold, under the build number CP1A.260505.005. The update addresses known issues and brings enhancements to the devices listed. However, for Pixel 10, 10 Pro, 10 Pro XL, and 10 Pro Fold users, the update includes a bootloader change that prevents rolling back to previous versions of the bootloader after installation.
AppWizard
May 5, 2026
The Google Home app will receive a significant update in Spring 2026, focusing on enhanced performance and a more intuitive interface. The update will improve smart camera functionality, allowing cameras to work together for a clearer understanding of home events, and will feature a revamped event details page for easier navigation of recorded footage. Google Home Premium users will receive Gemini-generated event descriptions for older Nest cameras, and the camera settings menu will be simplified. The voice assistant will be upgraded to Gemini 3.1, improving reasoning capabilities for complex commands. Additionally, a new "Ask Home on Web" feature will enable users to manage devices and automations from their desktops. Privacy considerations regarding AI-generated summaries of home footage will also be a factor for users.
AppWizard
May 5, 2026
A newly leaked build of Samsung's One UI 9 reveals an app called Driving Insights, which uses artificial intelligence to provide personalized feedback on driving habits. The app analyzes driving behaviors through location tracking and AI algorithms, generating weekly summaries for users. It assesses aspects such as speed and braking intensity, and activates when a phone connects to a vehicle's Bluetooth. Users can filter reports by time and distance, receiving feedback ranging from commendations to constructive advice. The app will also monitor rapid acceleration and sharp turns. Driving Insights aims to enhance driving practices, but raises concerns about the reliability of AI-generated advice in promoting safe driving.
AppWizard
May 5, 2026
Google is introducing a feature called Low Light Boost for its messaging platform's in-app camera preview, aimed at improving visibility in dim lighting. This feature brightens the viewfinder in real-time, allowing users to frame their shots better before taking a photo. Low Light Boost adjusts brightness based on surrounding light conditions and operates instantly, unlike traditional Night Mode. There are two methods for implementing Low Light Boost: 1. Low-Light Boost AE Mode, a hardware-level auto-exposure mode available on devices running Android 15 or later, specifically on Pixel 10 devices. 2. Google Low Light Boost, a software-based solution (HDRNet) for devices that do not support AE mode, enhancing brightness through post-processing techniques. The latest beta version of Google Messages, v20260501, includes code hints for the integration of Low Light Boost, although it is not yet fully operational. The feature enhances the viewfinder experience but does not affect the quality of the final image, which requires a separate Night Mode.
BetaBeacon
May 5, 2026
ScarCruft compromised a video game platform in a supply chain attack, trojanizing its components with a backdoor called BirdCall to target ethnic Koreans residing in China. The attack enabled the threat actors to target both Windows and Android devices, turning it into a multi-platform threat. The campaign targeted sqgame[.]net, a gaming platform used by ethnic Koreans in China, known as a transit point for North Korean defectors. BirdCall has features like screenshot capture, keystroke logging, and data gathering, and relies on legitimate cloud services for command-and-control. The Android variant collects various data and has seen active development.
AppWizard
May 5, 2026
A fraud network called FEMITBOT has emerged, using Telegram's Mini App feature to conduct investment scams and distribute malware. Identified by the research firm CTM360, the network operates through API responses and presents itself as organized. The scams involve Telegram Mini Apps that display phishing pages, fake dashboards showing fictitious earnings, and urgency tactics to pressure users into making quick decisions. FEMITBOT mimics well-known brands like Apple and Coca-Cola to enhance credibility and disseminates Android malware disguised as legitimate applications. The operation is highly organized, utilizing marketing tools to optimize their scams. Users are warned to be cautious of bots requesting deposits before granting access to funds.
BetaBeacon
May 5, 2026
APT37, also known as ScarCruft and Ricochet Chollima, has developed an Android version of the backdoor BirdCall, which serves as spyware in addition to a backdoor. The malware was delivered through a Chinese website that hosts games for Android, iOS, and Windows, targeting only Android and Windows systems. The Android variant of BirdCall has capabilities such as extracting IP geolocation information, collecting contact lists, call logs, SMS data, device information, taking screenshots, recording audio, and exfiltrating files. Users are advised to download software only from official marketplaces and trusted publisher sites to protect against malware infections.
AppWizard
May 5, 2026
A North Korean hacking group has targeted a digital gaming platform popular among the Korean ethnic enclave in China, using a sophisticated strategy to infiltrate Android applications. Researchers from Eset discovered that an app on the platform contained a backdoor known as BirdCall, linked to North Korea. The official website for the gaming platform hosted the same suspicious APK file. A second Android file associated with another game on the same site was also found to contain the BirdCall backdoor. This supply-chain attack was attributed to the threat actor ScarCruft (APT37), active in Asia and extending into Europe and the Middle East since late 2024. The hackers likely compromised the web server to recompile original APKs with the backdoor, which can collect sensitive information such as contacts, SMS messages, call logs, documents, media files, and private keys, and can take screenshots and record audio. The malware disguises its command and control traffic among regular internet traffic, primarily using Zoho WorkDrive for operations.
Search