banking apps Archives

AppWizard

May 30, 2026

Concerned about privacy on your Android? Here’s why Bitdefender is your all-in-one solution

Privacy on Android can be compromised through routine activities like checking bank accounts, shopping online, or using public Wi-Fi. Bitdefender Antivirus Plus offers comprehensive security features, including phishing protection, scam detection, VPN capabilities, and app security. Its VPN encrypts internet connections and routes traffic through secure servers to minimize tracking and protect data from third-party access. Bitdefender also monitors applications for suspicious behavior and blocks threats, ensuring security across the Android ecosystem. The software operates autonomously in the background, scanning for threats and applying protective measures without requiring constant user intervention.

AppWizard

May 20, 2026

Nationwide banking app update ahead of Fairer Share £100 decision

Beginning Thursday, Nationwide customers can conceal payment references on incoming bank transfers within the app. This feature aims to help prevent abusers from using banking systems to maintain unwanted contact and control over survivors. Domestic abuse charities have raised concerns about payment references being used for harassment, with some abusers sending messages or threats through these references. Nationwide's initiative empowers customers to control what is visible in their accounts. Approximately 4.2 million women in the UK have experienced economic abuse, which can include controlling bank accounts and monitoring financial activity. Nationwide's vulnerability support team assisted 312 customers facing abuse in 2025, an increase from 213 the previous year. The organization has also established “safe spaces” in hundreds of branches for domestic abuse support. Campaigners urge other banks to assess how banking features might be exploited by abusers, and Nationwide is considering extending similar functionalities to Virgin Money customers in the future.

AppWizard

May 12, 2026

TrickMo Android Malware Targets Banking, Wallet, and Authenticator Apps

TrickMo, an Android banking malware, has re-emerged with enhanced stealth and operational capabilities, targeting banking, fintech, wallet, and authenticator apps. It retains its core device takeover abilities while improving stealth, persistence, and flexibility. The malware persuades users to grant accessibility permissions, allowing full remote control, including real-time screen viewing. A significant advancement is its shift to The Open Network (TON) for command-and-control communication, complicating takedown efforts. TrickMo has been actively deployed in France, Italy, and Austria since early 2026, using fake login overlays to capture credentials while recording user activity. It communicates through .adnl endpoints within the TON network and employs DNS-over-HTTPS for encrypted DNS queries. The malware's modular design includes a primary application as a loader and a dynamically loaded APK module called “dex.module” for malicious capabilities. It features network reconnaissance and tunneling capabilities, allowing commands like HTTP probing and establishing SSH tunnels, which can bypass fraud detection systems. Dormant features suggest potential for future capabilities without altering the core application. Indicators of compromise include specific SHA-256 hashes and package names associated with TrickMo's various components.

AppWizard

May 11, 2026

New TrickMo Variant: Device Take Over malware targeting Banking, Fintech, Wallet & Auth apps

Modern Android banking malware is evolving with architectural enhancements for increased stealth, resilience, and operational flexibility. In early 2026, a new variant of the TrickMo Android banking trojan was identified, actively targeting banking and wallet users in France, Italy, and Austria. This variant has replaced its predecessor in ongoing campaigns and has transitioned its command-and-control traffic to The Open Network (TON). Key features of the new TrickMo variant include: - The primary command-and-control channel now operates over TON, utilizing .adnl endpoints through an embedded local TON proxy. - It employs a runtime-loaded APK (dex.module) with enhanced functionalities, including reconnaissance, SSH tunneling, and SOCKS5 proxying, allowing infected devices to act as network pivots. - TrickMo is classified as Device Take Over (DTO) malware, targeting banking, fintech, wallet, and authenticator applications on Android devices. - Operators gain control over infected devices through accessibility-service permissions, enabling capabilities such as credential phishing, keylogging, screen recording, remote control, and SMS interception. The new variant features a modular architecture with a host APK functioning as a launcher and persistence layer, while offensive capabilities are delivered through the dynamically loaded dex.module. Significant enhancements include network reconnaissance commands (curl, dnslookup, ping, telnet, traceroute) and socket-level tunneling via an embedded SSH client. Indicators of compromise include specific SHA-256 hashes and package names associated with TrickMo dropper applications and host applications. The malware retains unused permissions for NFC capabilities, suggesting a strategic approach to device filtering.

AppWizard

April 28, 2026

10,000 Users Exposed As Fake Document Reader App Delivers Anatsa Banking Trojan

Security researchers from ThreatLabz discovered a malicious document reader app on the Google Play Store that delivered the Anatsa Android banking trojan. The app, which had over 10,000 downloads before its removal, disguised itself as a legitimate file management tool using the package name com.groundstation.informationcontrol.filestationbrowsefilesreaddocs. It employed a "dropper" technique to hide its malicious code, connecting to an external server to retrieve the malware payload after installation. Anatsa is designed to steal financial information by overlaying a fake login screen over legitimate banking apps, capturing user credentials and enabling unauthorized transactions. Users are advised to delete the app and monitor their financial accounts. Technical indicators for identifying infections include the Anatsa Installer SHA256 (5c9b09819b196970a867b1d459f9053da38a6a2721f21264324e0a8ffef01e20), Payload URL (http://23.251.108[.]10:8080/privacy.txt), Payload SHA256 Hash (88fd72ac0cdab37c74ce14901c5daf214bd54f64e0e68093526a0076df4e042f), and Command and Control servers (http://172.86.91[.]94/api/ and http://193.24.123[.]18:85/api/).

AppWizard

April 16, 2026

Your Android phone could soon get a better way to sniff out spoofed calls

Google is enhancing the security of incoming calls on Android devices by integrating a "Verified Caller" feature into Google Play Services. This feature aims to combat scam calls that use Do-Not-Originate (DNO) numbers by cross-referencing incoming calls against a database of DNO numbers to flag potential scams. The system will work with existing applications, such as banking apps, to monitor specific DNO numbers. The feature is still in development and its effectiveness will depend on business participation and strict verification processes by Google.

AppWizard

April 10, 2026

22 of Russia’s 30 most popular Android apps monitor whether users have VPN enabled, study finds

Recent research by RKS Global found that 22 out of the top 30 Android apps in Russia monitor users' VPN status. Banking apps like T-Bank, Sberbank, VTB, and Alfa-Bank are leading this trend, along with Yandex and VK applications such as Yandex Browser and VKontakte. Online marketplaces including Wildberries, Ozon, MegaMarket, and Samokat also track VPN usage. In total, 18 of the 30 apps transmit VPN status data to their servers, while 24 send lists of installed applications. Yandex Browser uniquely searches for the Tor browser, and Samokat and MegaMarket retrieve lists of installed VPN apps. The Russian Digital Development Ministry has mandated that major internet platforms restrict access for users with VPNs by April 15.

AppWizard

April 10, 2026

Android 16 April 2026 Update Tackles Pixel UI Fixes and App Crashes

Google has released the April 2026 Android 16 update, which includes security patches and improvements for Pixel devices. The update, launched on April 10, 2026, addresses issues such as app crashes, missing user interface elements, and game performance. It is compatible with devices from the Pixel 6 to the Pixel 10 series and features region-specific variations to meet local regulations. Key fixes include resolving crashes in banking apps, restoring the Backup menu and Quick Share functionalities, and enhancing the home screen search bar.

AppWizard

April 9, 2026

The latest Pixel update tackles Android 16’s early stability woes

Google has released its April 2026 security patch for Pixel phones, addressing issues such as app crashes in banking and third-party applications. The update improves app performance across the Pixel lineup, from Pixel 6 to Pixel 10a, and includes a fix for gaming performance on Pixel 10, Pro, and Pro XL models. It also resolves the disappearing Quick Search Bar issue and reinstates the Backup menu for older devices like the Pixel Fold and Pixel 8. The rollout includes essential security updates and is occurring in phases, with users advised to connect to a stable Wi-Fi network to check for updates in Settings.

AppWizard

March 31, 2026

Free Antivirus for Android: Best Apps to Protect Your Smartphone

Smartphones are integral to daily life, storing emails, banking apps, and social media. The Android operating system is vulnerable to threats like viruses and ransomware. Free Android antivirus tools offer basic protection but have limitations compared to paid versions. Free antivirus solutions focus on malware scanning and threat detection. Bitdefender Mobile Security (Free Version) provides lightweight background operation, real-time scanning, and web protection but lacks anti-theft and VPN features. Norton Mobile Security (Free Tier) offers essential malware scanning, with advanced features available in premium subscriptions. Avast Mobile Security (Free) includes virus scanning, malware protection, and anti-theft tools, allowing users to lock apps and protect against malicious websites. AVG AntiVirus (Free) offers virus, malware, and spyware scanning, real-time updates, and a "Photo Vault" for securing images. Kaspersky Mobile Security (Free) provides basic virus protection and ranks high in malware detection, with additional features available in paid plans. Free antivirus tools detect malware and monitor real-time system activity, alerting users to phishing sites. They may scan files transferred via USB or Bluetooth and offer limited VPN services. Limitations of free antivirus include the absence of advanced features like unlimited VPN, application locking, and anti-theft capabilities. Many rely on ads for revenue, which can disrupt user experience. Choosing the right antivirus depends on usage habits and security concerns. Running multiple antivirus apps can cause conflicts and hinder performance. Upgrading to premium versions may be necessary for comprehensive protection, especially for sensitive tasks. User behavior is crucial for security; regularly updating the OS and applications, using strong passwords, and considering two-factor authentication can enhance protection. Free antivirus apps offer core threat protection but lack advanced features. Most are lightweight, with minimal impact on performance. Regular scans are recommended, and reputable sources should be used for downloads. Free antivirus apps can warn about phishing attempts but cannot eliminate the risk entirely. A built-in VPN is not essential for basic protection but is advisable for public Wi-Fi use.