developer options Archives

AppWizard

September 23, 2026

RatHat Android Malware Uses AI to Target Banking Credentials in Real Time

A newly identified strain of Android malware, RatHat, utilizes generative AI to manipulate infected devices in real time. It is linked to threat actors believed to be operating out of China. RatHat serializes the device’s live Accessibility tree into XML format and communicates with a generative AI assistant to return screen coordinates, identify text, and issue navigation commands. The malware employs WebView-based HTML overlays to capture login credentials from banking and cryptocurrency applications and can infiltrate payment apps like WeChat and Alipay to extract PINs. It also features an SMS receiver and notification listener to intercept OTPs and 2FA codes. RatHat is disseminated through smishing, malvertising campaigns, and misleading third-party forums. It employs anti-analysis techniques such as container tampering, manifest bombing, DEX bytecode poisoning, string encryption, and anti-debugging. Once installed, it gains Accessibility access, activates Developer Options, and enables Wireless Debugging, allowing it to connect to the device's local ADB service and launch control agents with shell-level privileges. The malware captures raw touch coordinates to reconstruct PINs and unlock patterns, bypassing screenshot protections. It also includes persistence mechanisms that prevent uninstallation by presenting a fake Google Play failure overlay and automatically reinstalling itself if removed.

AppWizard

September 22, 2026

RatHat is a new Android malware that records your screen touches to steal passwords

Cybersecurity researchers at Zimperium have identified a new strain of malware called RatHat, targeting Android devices and linked to threat actors from China. RatHat uses generative AI to maintain persistence and control over infected devices. The malware is typically spread through social engineering, tricking users into downloading counterfeit applications that appear legitimate. Once installed, RatHat requests accessibility permissions, activates Wireless Debugging, and can capture text messages, create overlays, and steal passwords and multi-factor authentication codes. Its AI capabilities allow it to navigate the device interface in real-time, making detection by security software more difficult. To protect against RatHat, users should avoid downloading apps from untrustworthy sources, and removal requires a factory reset of the device.

BetaBeacon

September 21, 2026

Gaming on the Pixel 11 is a mess, and I traced it to one hidden setting

ANGLE is a compatibility layer that implements OpenGL ES on top of Vulkan, allowing OpenGL ES games to make OpenGL calls while ANGLE translates them into Vulkan commands for the GPU driver. The Pixel 11 has transitioned to an OpenGL ES-on-Vulkan architecture as part of a broader Android graphics strategy, but this change may not be completely transparent across all workloads, leading to microstuttering or jank in some games. Users can change ANGLE preferences on a per-app basis to try the native OpenGL option and potentially reduce frame-time spikes.

AppWizard

September 19, 2026

New Android malware uses AI to take over your phone

A new Android malware called RatHat has emerged, analyzed by researchers from Zimperium's zLabs. It spreads through deceptive smishing texts and malicious ads that lead users to counterfeit download pages for popular apps. Once installed, it manipulates Android's Accessibility Service to gain elevated access by enabling Wireless Debugging and retrieving authentication codes without user intervention. RatHat targets finance and banking apps to steal user IDs, passwords, and MFA codes, using techniques to obtain touch coordinates for PIN recovery. It can intercept SMS messages, gain limited control of the device, and reinstall itself. Users are advised against sideloading apps and granting unnecessary accessibility permissions. Google's Advanced Protection Mode and Malwarebytes for Android can help mitigate risks associated with RatHat.

AppWizard

September 19, 2026

New RatHat Android Malware Uses AI to Steal Banking Logins, PINs and OTP Codes

Security researchers have identified an Android banking Trojan named RatHat, which utilizes artificial intelligence, accessibility features, and Android Debug Bridge (ADB) to steal financial credentials, PINs, and one-time passcodes. Unlike traditional malware, RatHat employs a live AI assistant that interacts with the Android accessibility tree, allowing it to make real-time decisions based on the victim's screen content. The infection typically starts with social-engineering tactics, leading victims to counterfeit download pages where they are tricked into sideloading a malicious APK. Once installed, RatHat prompts users to enable Android Accessibility Service permissions, which it exploits to navigate Developer Options and enable Wireless Debugging. This grants it shell-level ADB access, allowing it to bypass application sandbox restrictions. RatHat deploys two native binaries for executing commands and maintaining a connection to the attacker's infrastructure. It targets banking applications through credential-stealing overlays and can intercept SMS messages for transaction verification codes. Additionally, it can record touch coordinates to reconstruct PINs and unlock patterns. RatHat includes persistence mechanisms to restore itself after removal, and users are advised to perform a factory reset if they suspect compromise. To reduce infection risk, users should avoid sideloading apps from unknown links, deny unnecessary Accessibility Service requests, and refrain from enabling Developer Options or Wireless Debugging for unfamiliar applications.

AppWizard

September 18, 2026

RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall

Cybersecurity experts have identified a new Android malware named RatHat, believed to be operated by Chinese threat actors. RatHat is distributed primarily through smishing and malvertising campaigns, leading users to deceptive download portals. It employs an automated multi-stage infection process and exploits Accessibility features along with a local ADB self-pairing mechanism to escape the Android application sandbox. The malware uses various anti-analysis techniques, including container tampering, manifest bombs, DEX bytecode poisoning, and dual string-encryption. RatHat's architecture consists of a malicious Android application, a Go agent, and an FRP reverse-proxy client, which together enable it to gain critical system permissions and perform various malicious activities such as credential capturing, screen recording, and SMS interception. Even if uninstalled, the malware retains shell access to the device, allowing attackers to reinstall it. RatHat can serialize the device's Accessibility tree to XML and communicate with a Generative AI assistant for tasks like screen coordinate determination and text extraction. The Go Agent, masquerading as a native library, exploits shell access to execute commands and establish a persistent connection to a command-and-control server via the FRP client. The C2 server can issue extensive commands to collect sensitive information, including SMS messages, credentials, files, and keystrokes, and RatHat also features a hardware-level keylogger.

AppWizard

September 14, 2026

3 Sideloaded Apps Worth Installing On Android Auto

Android Auto allows users to enhance their driving experience with applications from the Google Play Store and through sideloading. To enable sideloading, users must access developer settings in Android Auto by navigating to the Apps section, tapping on version and permission info multiple times, and activating the Unknown sources toggle. Users can then install the Android Auto Apps Downloader (AAAD) from its GitHub repository, which helps discover and install third-party applications. Notable applications include CarStream, which allows access to YouTube content while parked, although it is not compatible with Android 15 or later. Screen2Auto enables users to mirror their entire Android phone screen onto the infotainment display, allowing access to any application, including YouTube. AABrowser provides a full web browsing experience on Android Auto, supporting touchscreen controls and a keyboard for input, but should only be used when safely parked.

AppWizard

August 31, 2026

Improve your Android Auto experience by doing these simple things

Android Auto is used in over 250 million vehicles worldwide and offers extensive customization options to enhance usability, safety, and personalization. Key features include the ability to clean up the home screen by selecting relevant apps, accessing hidden developer settings for wireless connectivity and video resolution adjustments, manually setting a consistent theme, enabling automatic launch when entering the vehicle, controlling automatic media playback, and utilizing Google's Gemini AI assistant for personalized commands and shortcuts. These adjustments can improve the overall driving experience without requiring advanced technical skills.

AppWizard

August 30, 2026

How to improve your audio quality on Android Auto

To enhance audio experience with Android Auto, consider the following factors: 1. Upgrading to a 5Gbps cable may not improve audio quality if the current cable is functioning well; a reliable cable is recommended for troubleshooting. 2. Check the music app before blaming Android Auto for audio issues, as streaming services like Spotify adjust audio quality based on network conditions. 3. Pre-download playlists to avoid subpar streaming quality in areas with weak signals. 4. Adjust download-quality settings, as Android does not have a universal output rate for Android Auto. 5. Focus on equalizer (EQ) and normalization settings, as an EQ profile for earbuds may not suit car audio systems. 6. Test both wired and wireless connections to troubleshoot audio issues; wired connections can help isolate problems. 7. If wired playback fails, examine the cable used, ensuring it is high-quality and avoiding hubs or extensions. 8. Investigate the vehicle's audio settings, disabling features like bass boost or surround mode for clearer audio quality. 9. Check for firmware updates for aftermarket receivers if issues persist. 10. Wireless Android Auto requires a compatible phone with 5GHz Wi-Fi support.

AppWizard

August 26, 2026

How to sideload Android apps on your phone in 2026 – and what’s behind the changes

Google has revamped the sideloading process on Android devices with a new protocol called "Advanced Flow" to enhance user security while allowing the installation of applications from downloaded APK files. Users must enable sideloading, authenticate their identity, and confirm they are not being pressured into installation, followed by a device restart and a 24-hour waiting period. Users can choose to allow installations for seven days or indefinitely. To sideload apps, users need to download an APK file, disable Advanced Protection temporarily, install the app, and then re-enable Advanced Protection. Caution is advised when downloading APK files from unknown sources, with recommendations for trusted sites like APKMirror, F-Droid, and Uptodown.