accessibility services Archives

BetaBeacon

September 3, 2026

Building Tetris on Android With One Prompt and No Laptop

An AI coding agent called Gotcha can generate games and tools on Android phones by writing real code and running a local server. It can create games like Tetris and a 3D Angry Birds clone with features such as touch controls, score displays, and sound effects. Gotcha can also fix bugs in the game logic based on vague feedback. The autonomy and local capabilities of Gotcha make it a unique tool for developers, allowing for quick iteration and precise bug reporting.

AppWizard

September 1, 2026

Fake Porn Apps Target Android Users Via Ads On Facebook, Instagram: How To Stay Safe

Cybercriminals are targeting Android users with deceptive advertisements for malicious applications disguised as pornographic content on platforms like Facebook and Instagram. The National Cybercrime Threat Analytics Unit (NCTAU) has reported that these ads lead users to phishing traps or malware downloads that can compromise banking credentials. Malicious applications linked to this threat include “Night Play,” “Reloop,” “Kyss,” “Vimo,” “Rivo,” “Nexo,” and “Vixa.” The scam involves promoting these apps through enticing ads, redirecting users to websites offering pornographic content, and prompting them to download APK files directly from these sites, often using “.live” domains. The initial app may request users to download a second package disguised as an update, which can exploit permissions granted to the first app. This malware can gain extensive control over the device, potentially installing a VPN that routes internet traffic through attackers' servers. To protect against this threat, users should download apps only from trusted sources, avoid installing APK files from ads or suspicious links, refrain from granting Accessibility access to unknown apps, regularly review installed apps, keep Google Play Protect enabled, and monitor bank accounts for unusual activity. If a suspicious app cannot be uninstalled, users can try Safe Mode, remove special permissions, or perform a factory reset as a last resort.

AppWizard

August 31, 2026

Fake dating apps are being used to target Android users: How the new cyber scam works

India's cybercrime authorities have warned about the misuse of dating and adult-themed advertisements on social media platforms like Instagram and Facebook, which are being exploited by criminals to distribute malicious Android applications. These ads redirect users to external websites where they are prompted to download APK files, bypassing security measures of trusted app stores. The Indian Cybercrime Coordination Centre (I4C) has identified several malicious applications, including Night Play, Reloop, Kyss, Vimo, Rivo, Nexo, and Vixa, and cautions against installing unfamiliar applications promoted through unsolicited ads. These apps may request sensitive permissions, such as access to SMS messages, contacts, photos, device storage, and Accessibility Services, which can allow fraudsters to access valuable information. Compromised devices can lead to financial fraud by intercepting OTPs and other verification details. The I4C recommends using trusted app stores, keeping Google Play Protect active, reviewing app permissions, and being cautious with social media ads. If a suspicious app is installed, users should restart their phone in Safe Mode to uninstall it, disable its permissions if necessary, and consider a factory reset if removal fails. Users who suspect fraud are encouraged to report incidents promptly.

AppWizard

August 26, 2026

Beware of fake Indeed interview apps used to install spyware

Scammers are exploiting the Indeed platform to target job seekers by using counterfeit Android "interview" applications. Users in the UK and Brazil reported being instructed by supposed employers to download fraudulent apps like MyInterview, which compromised their devices. These scammers post fake job listings and prompt applicants to install apps that mimic Indeed's login page and establish a VPN connection. The malicious apps, classified as Trojan.Droppers, can install additional untrusted software and gain control over devices, complicating uninstallation efforts. Indeed confirmed that their interview process does not require downloading any separate app and warned job seekers against such scams. Indicators of compromise include specific MD5 hashes and package names associated with the Trojan droppers and dropped malware payloads.

AppWizard

August 23, 2026

Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices

A new Android malware threat, codenamed Manic, poses significant risks to Ukrainian banks, government services, and messaging applications, with a reach extending to Russian and European financial institutions, global fintech platforms, cryptocurrency services, and military communication channels. Manic combines Android banking malware and mobile spyware, targeting sensitive applications and enabling comprehensive device takeover. It features a novel Wi-Fi mesh technique for data relay through compromised devices and utilizes phishing sites and dropper apps. The malware originated in February 2026, with initial development leading to its first deployment by late May. It monitors 169 package IDs related to banks, payment services, and messaging applications, primarily affecting Ukrainian targets but also impacting applications in Russia and Europe. Manic can infiltrate commercial and military messaging apps, track locations, monitor notifications, and collect files. It exploits Android's accessibility services to capture sensitive data and employs a store-and-forward relay mechanism for data exfiltration through nearby compromised devices. Google has stated that no apps containing this malware are found on Google Play, and Android users are protected by Google Play Protect.

Tech Optimizer

August 16, 2026

Best Android Antivirus Apps 2026: Tested and Ranked

Bitdefender Mobile Security is rated as the best antivirus app for Android in 2026, achieving a 100% detection rate, 0.5% battery drain, and unobtrusive operation. The evaluation compared five antivirus applications on a Galaxy S26 Ultra, assessing detection rates, battery drain, scan speed, and permissions. Other notable antivirus apps include Norton 360 for Mobile, which is recognized for its features; Avast Mobile Security, known for its free version; McAfee Mobile Security, which excels in scam call and text filtering; and NordVPN Threat Protection, praised for web and Wi-Fi security. Most users may not need an antivirus app due to built-in protections like Google Play Protect, which automatically scans apps. However, specific scenarios warrant the installation of an antivirus app, such as sideloading apps, receiving scam texts and calls, assisting relatives, conducting banking and shopping on mobile, and using public Wi-Fi. The top five antivirus apps tested are: 1. Bitdefender Mobile Security: 100% detection, 0.5% battery drain, 31-second scan time. 2. Norton 360 for Mobile: 99.9% detection, 0.9% battery drain, 24-second scan time. 3. Avast Mobile Security: 99.9% detection, 0.7% battery drain, 26-second scan time. 4. McAfee Mobile Security: 99.78% detection, 1.0% battery drain, 34-second scan time. 5. NordVPN Threat Protection: 95.60% detection of web threats, 0.2% battery drain. Battery consumption varied, with NordVPN being the lightest and McAfee the heaviest. Permissions requested by each app also varied significantly, with Bitdefender requiring the most extensive permissions. Users are advised to check for legitimate antivirus apps by verifying the developer, installation count, update history, lab participation, and permission requests. Free antivirus apps like Avast and AVG offer effective protection but may lack some features of paid versions. Users should be cautious of fake security apps that mimic legitimate ones. If malware is suspected, users can run scans with Google Play Protect or other anti-malware apps and follow specific steps to remove malware if detected.

AppWizard

July 23, 2026

Active Exploitation Alert: Fake Bahrain Alert App Deploys Advanced Android Surveillance Malware Targeting Gulf Region Users

A cyber-espionage campaign has been identified involving a counterfeit Bahrain Alert Android application designed to surveil individuals in Bahrain and the Gulf region. The app masquerades as an official civil defense tool and employs social engineering tactics to compromise Android devices, extract sensitive data, and maintain remote access. It targets high-value individuals such as activists and journalists, particularly during civil unrest and missile alerts, leveraging trusted government branding to increase infection rates. The malware features a complex, multi-stage architecture with advanced evasion techniques and is distributed through phishing links and malicious websites. It initiates a four-stage infection process, ultimately installing a remote access trojan (RAT) that enables covert surveillance and encrypted communications. The malware can monitor device activity, capture credentials, and intercept communications, while also employing mechanisms to avoid detection and maintain persistence. The campaign primarily targets Bahraini citizens, exploiting fear during crises to encourage app installation. Although there are indications of Russian-speaking developers involved, there is no definitive attribution to a specific nation-state or APT group. Mitigation strategies include monitoring for suspicious app installations, user education on verifying app authenticity, and blocking known malicious domains.

AppWizard

July 5, 2026

Android users warned about fake app stealing bank details

A malicious application posing as a document reader has been downloaded over 100,000 times and installs the Anatsa banking trojan on Android devices. This app has bypassed Google's security checks and remains available on the Play Store. The Anatsa Trojan is designed to steal sensitive financial information by monitoring users' banking apps and intercepting login processes through a fake overlay that mimics legitimate interfaces. It requests extensive permissions, allowing it to observe screens, capture keystrokes, and interact with the device. Users are advised to review installed applications and monitor bank statements for unauthorized activity.

AppWizard

June 19, 2026

Rokarolla trojan uses screen overlays to hijack Android financial apps

A new banking trojan for Android, named Rokarolla, targets 217 applications, including banking and cryptocurrency platforms, to steal credentials and sensitive financial data. It operates via a command and control (C2) server and bypasses the Google Play Store by using phishing websites that mimic legitimate download portals. Users are tricked into downloading a dropper that installs the malware, which disguises itself as the Google Play Protect security tool to gain access to Android Accessibility Services. Rokarolla employs dynamic screen overlays to capture user input in targeted financial applications and can also impersonate the device's lock screen. Additionally, it uses a pseudo-VNC system to intermittently capture screenshots for data extraction and can modify clipboard contents to manipulate cryptocurrency transactions by replacing copied addresses with those controlled by attackers.

AppWizard

June 17, 2026

Hundreds of Android banking and crypto apps hit by dangerous new Rokarolla malware

Security researchers at Zimperium have identified a new Android banking trojan named “Rokarolla,” which threatens users of over 200 banking and cryptocurrency applications. It is distributed through spoofed websites, third-party app stores, and social media, but has not been found on the Google Play Store or other official Android repositories. Rokarolla requests extensive permissions, particularly concerning Accessibility services, SMS, calls, and notifications. Its capabilities include accessing WhatsApp contacts, capturing keystrokes, recording the screen, blocking incoming calls, and sending screenshots. Zimperium has not specified which geographical areas may be most vulnerable or the estimated number of potential infections. Users are advised to download applications only from official repositories to reduce the risk of encountering this malware.