APK files Archives

AppWizard

April 21, 2026

NGate NFC malware targets Android users through trojanized payment app

NFC-based payment fraud targeting Android users in Brazil has been linked to a campaign using a trojanized version of the HandyPay app, part of the NGate malware family, since November 2025. The malware is distributed through a counterfeit website mimicking a lottery and a fraudulent Google Play page. The operators chose HandyPay for its low cost and minimal permissions required. The malware requests users to set it as the default NFC payment app, allowing it to capture payment card PINs and relay NFC card data to attackers. ESET Research identified this campaign and discovered logs from compromised devices containing sensitive information. The trojanized app has never been on the official Google Play store, and ESET has notified Google and the HandyPay developer about the issue.

Tech Optimizer

April 16, 2026

MiningDropper Android Malware Exploits Lumolight App

Researchers at Cyble Research and Intelligence Labs (CRIL) have discovered an Android malware framework called MiningDropper, which is being used in various campaigns to distribute malicious payloads such as cryptocurrency miners, infostealers, Remote Access Trojans (RATs), and banking malware. Over 1,500 MiningDropper samples were detected in one month, with many showing minimal antivirus detection. MiningDropper operates as a multi-stage delivery framework that employs techniques like XOR-based obfuscation and AES encryption to evade detection. A recent variant uses a trojanized version of the Lumolight application as the initial infection vector, often spread through phishing links and fraudulent websites. The malware executes a series of stages, starting with decrypting an embedded asset and loading additional payloads, including a counterfeit Google Play update interface to deceive users. Two main campaign clusters have been identified: an infostealer campaign targeting Indian users by impersonating trusted entities, and a global campaign distributing the BTMOB RAT, which enables credential theft and device takeover. The final payload capabilities include extracting sensitive data, enabling full device compromise, facilitating financial fraud, and unauthorized cryptocurrency mining. MiningDropper's modularity allows it to adapt and scale across various campaigns while maintaining low detection rates.

AppWizard

April 15, 2026

Top Android Apps You Won’t Find On Google Play Store

The Google Play Store does not include every app desired by users due to strict privacy, security, and content moderation policies, leading to the growth of third-party platforms and APK-based tools. Notable apps outside the Play Store include: - BombitUp: A prank app that allows users to send multiple SMS messages, popular among younger users, but excluded from the Play Store due to potential misuse. - 9Apps: An alternative app store developed by Alibaba Group, offering a variety of apps, games, and older versions of applications, particularly popular in regions lacking Play Store access. - Snaptube: A video downloader for platforms like YouTube and Facebook, absent from the Play Store due to policy violations but sought after for offline video access. - VidMate: A comprehensive video downloading app that also provides access to live TV, movies, and music, maintaining popularity despite not being available in official app stores. - Honista: A modified version of Instagram that enhances privacy and customization options, appealing to users wanting more control over their social media experience. - Lucky Patcher: A tool for advanced users that allows modifications to app permissions and ad removal, requiring technical knowledge and sometimes root access, leading to its exclusion from the Play Store. - APKPure: An alternative app store that focuses on providing safe and verified APK files, emphasizing security and access to region-locked apps or older versions. These applications cater to specific user needs that are often overlooked by mainstream platforms.

AppWizard

April 14, 2026

Mirax RAT Targets Android Devices Through Meta Apps

Mirax is a remote access Trojan (RAT) targeting Android devices in Spanish-speaking countries, identified by Outpost24's KrakenLabs in early March. It propagates fraudulent advertisements on Meta-owned applications, allowing cybercriminals to gain initial access. Mirax can interact with compromised devices in real time, converting them into residential proxy nodes through ads on platforms like Facebook and Instagram. It uses SOCKS5 protocol and Yamux multiplexing to establish proxy channels and uncover victims' IP addresses. The malware captures keystrokes, steals sensitive data, executes commands, and monitors user activity. It employs overlay pages to steal credentials and orchestrates distribution through Meta ads and GitHub for malicious APK files. Users are tricked into enabling installations from "unknown sources," and the malware disguises itself behind video playback features. Additionally, a threat actor has been offering Mirax as a malware-as-a-service (MaaS) on illicit forums, with subscription prices starting at ,500 for three months. This service is described as highly controlled and exclusive, primarily targeting Russian-speaking actors in underground communities.

AppWizard

March 25, 2026

Android app sideloading is about to get more complicated – Here’s what you’ll do

Google has updated the method for side-loading apps on Android devices to enhance user safety. Users must first enable Developer Mode in their settings. After this, they will be prompted to confirm if they are being guided through the process. There will be a delay before side-loading can begin, requiring a device reboot and a one-day waiting period to prevent scams. Users must then verify their identity using biometrics or a PIN. Finally, they can choose to enable side-loading for one week or permanently, with the latter option exempting them from future reauthorization.

AppWizard

March 20, 2026

Certified Android devices won’t let user sideload APK app files anymore, or at least it won’t be straightforward

Starting September 2026, Google will regulate the sideloading of apps through APK files on certified Android devices. Users will need to pay a fee, agree to terms and conditions, provide government identification, upload evidence of the developer's private signing key, and list all application identifiers. There are three methods for sideloading: 1. Sideloading from verified developers, requiring a verification process. 2. Sideloading from developers with limited distribution accounts, allowing sharing with up to 20 devices without ID or fees. 3. Sideloading from unverified developers, which involves enabling developer mode, confirming the user is not being scammed, restarting the phone, waiting 24 hours, and confirming identity through biometric authentication or device PIN. These changes aim to enhance security and reduce scams while still allowing some flexibility for developers.

AppWizard

February 24, 2026

Android mental health apps with 14.7M installs filled with security flaws

Recent analysis by Oversecured identified 1,575 security vulnerabilities across ten mental health mobile applications, which include 54 high-severity, 538 medium-severity, and 983 low-severity issues. These apps, with over 14.7 million downloads, assist users with conditions like clinical depression and anxiety. Vulnerabilities include improper handling of user-supplied URIs, weak local data storage practices, and cryptographically weak session token generation. Six of the ten apps had no high-severity vulnerabilities, but medium-severity issues still pose risks to user privacy. The scans were conducted between January 22 and 23, 2026, and only four apps had received recent updates.

AppWizard

February 19, 2026

Fake IPTV Apps Spread Massiv Android Malware Targeting Mobile Banking Users

Cybersecurity researchers have identified a new Android trojan named Massiv, designed for device takeover attacks targeting financial theft. It disguises itself as IPTV applications and poses risks to mobile banking users by allowing operators to remotely control infected devices for fraudulent transactions. The malware was first detected in campaigns targeting users in Portugal and Greece, with features including screen streaming, keylogging, SMS interception, and fake overlays for credential theft. One campaign specifically targeted the gov.pt application to deceive users into providing sensitive information. Massiv can execute various malicious actions, such as altering device settings, sending device information, and downloading malicious files. It is distributed through dropper applications that mimic IPTV services, often via SMS phishing. The malware operates in the background while the dropper appears as a legitimate app. Recent campaigns have focused on regions like Spain, Portugal, France, and Turkey, indicating a growing threat landscape. The operators of Massiv are developing it further, suggesting intentions to offer it as a Malware-as-a-Service.

Tech Optimizer

February 18, 2026

Fake Antivirus Program Threatens Android Phones and Steals Data – Jordan News | Latest News from Jordan, MENA

Cybersecurity experts have identified a malicious campaign targeting Android users through a counterfeit antivirus application called TrustBastion. This app serves as a vehicle for distributing malware that steals personal and banking information and provides attackers with remote access to infected devices. TrustBastion has been found on Hugging Face, complicating detection for users. The app masquerades as a legitimate security tool, prompting users to install a “necessary update” that contains malicious code. Once activated, the malware captures screenshots, displays fake login pages for financial services, and records sensitive information, which is sent to the hackers' servers. Attackers frequently re-upload modified versions of the app, maintaining its harmful functionality. Users are advised to download apps only from official stores, review ratings, and avoid untrusted APK files. Installing reputable antivirus solutions and activating Google Play Protect is recommended for enhanced security.

AppWizard

February 17, 2026

New Keenadu backdoor found in Android firmware, Google Play apps

A sophisticated Android malware named Keenadu has been discovered embedded in the firmware of various device brands, compromising all installed applications and granting unrestricted control over infected devices. It employs multiple distribution methods, including compromised firmware images delivered over-the-air, access via backdoors, embedding in system applications, modified applications from unofficial channels, and infiltration through apps on Google Play. As of February 2026, Keenadu has been confirmed on approximately 13,000 devices, primarily in Russia, Japan, Germany, Brazil, and the Netherlands. The firmware-integrated variant remains dormant if the device's language or timezone is associated with China and ceases to function without the Google Play Store and Play Services. While currently focused on ad fraud, Keenadu has extensive capabilities for data theft and risky actions on compromised devices. A variant embedded in system applications has limited functionality but elevated privileges to install apps without user notification. The malware has been detected in the firmware of Android tablets from various manufacturers, including the Alldocube iPlay 50 mini Pro. Kaspersky has detailed how Keenadu compromises the libandroid_runtime.so component, making it difficult to remove with standard Android OS tools. Users are advised to seek clean firmware versions or consider replacing compromised devices with products from trusted vendors.