fake update Archives

AppWizard

September 1, 2026

Fake Porn Apps Target Android Users Via Ads On Facebook, Instagram: How To Stay Safe

Cybercriminals are targeting Android users with deceptive advertisements for malicious applications disguised as pornographic content on platforms like Facebook and Instagram. The National Cybercrime Threat Analytics Unit (NCTAU) has reported that these ads lead users to phishing traps or malware downloads that can compromise banking credentials. Malicious applications linked to this threat include “Night Play,” “Reloop,” “Kyss,” “Vimo,” “Rivo,” “Nexo,” and “Vixa.” The scam involves promoting these apps through enticing ads, redirecting users to websites offering pornographic content, and prompting them to download APK files directly from these sites, often using “.live” domains. The initial app may request users to download a second package disguised as an update, which can exploit permissions granted to the first app. This malware can gain extensive control over the device, potentially installing a VPN that routes internet traffic through attackers' servers. To protect against this threat, users should download apps only from trusted sources, avoid installing APK files from ads or suspicious links, refrain from granting Accessibility access to unknown apps, regularly review installed apps, keep Google Play Protect enabled, and monitor bank accounts for unusual activity. If a suspicious app cannot be uninstalled, users can try Safe Mode, remove special permissions, or perform a factory reset as a last resort.

Tech Optimizer

August 31, 2026

Fake Chrome update scam could infect your computer

A fake Chrome update scam has emerged, linked to a Chrome extension called Enable Right Click & Copy - Smart Unlock + OCR, which was initially legitimate but later compromised. The extension had around 70,000 users before being removed from the Chrome Web Store on August 14 due to its malicious nature. Users may encounter deceptive warnings while browsing benign sites, urging them to download files instead of using Chrome's built-in update mechanism. Google advises against engaging with suspicious pop-ups requesting software installations. The scam highlights that trusted extensions can become threats without warning, and users should regularly review their installed extensions and check for updates directly within Chrome. Similar fake update alerts have also been reported in other Chromium-based browsers. Users are encouraged to adopt safety measures, such as using strong antivirus software, reviewing browser extensions, and being cautious with downloaded files. If a suspicious file has been executed, users should treat their computer as potentially compromised and take appropriate security actions.

Tech Optimizer

August 13, 2026

PSA: Don’t trust that Chrome update popup

Users of Chromium-based browsers, including Google Chrome, Brave, and Opera, are experiencing deceptive pop-ups that falsely claim a "Critical Update Required" or "Update available." These notifications are part of a scam designed to trick users into downloading malware disguised as software updates. Clicking on these prompts can lead to the download of harmful scripts, such as .vbs or .exe files, which traditional antivirus software often fails to detect. The issue is linked to compromised browser extensions that fetch malicious scripts from external servers. A specific extension, QuickLens – Search Screen with Google Lens, has been identified as a source of these pop-ups and has been removed from the Web Store. Other extensions, like “Enable Right Click & Copy Smart Unlock + OCR,” have also been implicated despite their popularity. Users are advised not to click on any links or run downloaded files and to check their browser settings for legitimate updates, as well as to audit and disable suspicious extensions.

Tech Optimizer

August 8, 2026

Hackers use fake Adobe and Zoom updates to load malware onto victim devices — here’s what to look out for

Securonix Threat Research has identified a cyber campaign called SMOKE#SCREEN that uses deceptive tactics to trick users into installing weaponized versions of ScreenConnect, a legitimate remote monitoring software. The attackers disguise their malicious intent with fake update notifications for applications like Zoom and Adobe, as well as counterfeit business documents. This campaign allows attackers to gain persistent remote access to victims' systems, disable security protections, and exploit trusted services like Dropbox and Cloudflare for delivering malicious payloads. Victims have been reported on both Windows and macOS platforms. Businesses are advised to verify updates through official channels and train staff on the risks of unexpected software installations.

BetaBeacon

August 8, 2026

Mastering Sideloading: Safe APK Installation on Android

People reach outside the Play Store to download APKs for emulators, early builds of apps, region-locked releases, modded versions of apps, and apps like betting and casino apps that are restricted by Google's store policies. Google has found that there is over 50 times more malware coming from internet-sideloaded sources than from apps on Google Play. Starting in September 2026, Google will require every developer to verify their identity for apps installed on certified Android devices, including sideloaded apps. To sideload without getting burned, users should pull APKs from reputable sources, match permissions to the job, keep Play Protect switched on, and revoke the "install unknown apps" permission after installation.

AppWizard

April 29, 2026

New Android spyware Morpheus linked to Italian surveillance firm

Morpheus is a new spyware identified by the nonprofit organization Osservatorio Nessuno, which spreads through counterfeit Android applications that appear as legitimate updates. Attackers use SMS messages to direct victims to a fraudulent website mimicking an Internet Service Provider (ISP). The spyware installs a dropper app that deploys a concealed payload, which disguises itself as legitimate system components and manipulates users into granting dangerous permissions, including Accessibility access. Once granted, Morpheus initiates a Permission Workflow that creates a fake update overlay, disabling the touchscreen to prevent user interaction. It ensures persistence by restarting after device reboots and can request device administrator privileges. The spyware exploits overlay windows and Accessibility features to gain control of the device and bypass security measures, including disabling antivirus solutions without requiring root access. Analysis suggests Morpheus has Italian origins, with connections to an Italian firm, IPS Intelligence, known for lawful interception technologies. The spyware is capable of invasive actions such as recording audio and video, linking to WhatsApp, and compromising device security. The report highlights a network of dubious companies and shared contacts linked to the spyware's distribution.

AppWizard

April 24, 2026

Another spyware maker caught distributing fake Android snooping apps

The Italian digital rights organization Osservatorio Nessuno has revealed a new malware called Morpheus, used by government agencies for surveillance. Morpheus is disguised as a phone updating application and can extract various data from targets' devices. The spyware is linked to IPS, an Italian firm specializing in lawful interception technologies, which claims to operate in over 20 countries. Morpheus is categorized as "low cost" due to its straightforward infection method, which involves tricking targets into installing the software. Authorities collaborated with the target's mobile service provider to obstruct data and send an SMS prompting the installation of the malware. Once installed, Morpheus exploits Android's accessibility features to access extensive information and masquerades as the WhatsApp application to solicit biometric data. The spyware's code contains Italian phrases and references to "Gomorra," indicating its connection to the Italian spyware industry. The attack is likely linked to political activism in Italy. IPS is among several Italian spyware manufacturers that have emerged following the decline of Hacking Team.

Winsage

April 7, 2026

“This was not opportunistic. It was precision.” — How North Korean hackers used Microsoft Teams and Slack to compromise Windows PCs with an elaborate ploy

On March 30, 2026, axios, a JavaScript HTTP client library, was temporarily compromised by suspected North Korean hackers who hijacked maintainer Jason Saayman's account. This allowed them to publish two malicious versions of axios on npm. The malicious versions were identified and removed within three hours by StepSecurity. A post-mortem blog on GitHub provided security measures for users of Windows, macOS, and Linux, highlighting risks from a Remote Access Trojan (RAT) introduced during the breach. The attack was attributed to a group known as UNC1069, which has been active since at least 2018. Two weeks prior to the breach, Saayman was targeted in a social engineering campaign where attackers posed as a legitimate company founder, leading him to install the RAT via a fake update during a Microsoft Teams meeting. Microsoft Teams was not compromised; it was used as a delivery method for the Trojan. Saayman noted the operation's sophistication.

AppWizard

March 11, 2026

New BeatBanker Android malware poses as Starlink app to hijack devices

A newly identified Android malware called BeatBanker disguises itself as a Starlink application on fake Google Play Store websites. It functions as a banking trojan and includes Monero mining capabilities, allowing it to steal credentials and manipulate cryptocurrency transactions. Researchers at Kaspersky traced BeatBanker to campaigns targeting users in Brazil. The latest version uses the BTMOB RAT for remote access, enabling keylogging, screen recording, camera access, GPS tracking, and credential capture. BeatBanker is distributed as an APK file that decrypts and loads hidden code into memory, conducting environment checks before activation. It presents a fake Play Store update screen to trick users into granting permissions for additional payloads. To avoid detection, it delays malicious operations and plays a nearly inaudible MP3 file to maintain persistent activity. The malware uses a modified version of the XMRig miner to mine Monero on Android devices, connecting to mining pools through encrypted TLS connections. It can start or stop mining based on device conditions and uses Firebase Cloud Messaging to relay device information to its command-and-control server. Currently, BeatBanker infections have only been observed in Brazil, but there are concerns about its potential spread. Users are advised to avoid side-loading APKs from untrusted sources and to review app permissions regularly.

AppWizard

December 25, 2025

Android Malware Operations Merge Droppers, SMS Theft, and RAT Capabilities at Scale

Threat actors in Uzbekistan are increasingly using sophisticated tactics to target mobile users, specifically through malicious dropper applications that appear as legitimate software. A recent analysis by Group-IB identified an Android SMS stealer called Wonderland, which was previously known as WretchedCat. Unlike traditional Trojan APKs that activate malware immediately upon installation, Wonderland utilizes droppers that activate malicious payloads locally after installation, even without an internet connection. Wonderland enables bidirectional command-and-control communication, allowing real-time execution of commands, including SMS theft and USSD requests. It disguises itself as Google Play or various file formats to evade detection. The financially motivated group behind this malware, TrickyWonders, uses Telegram for coordination and was first detected in November 2023. Wonderland is associated with two dropper families: MidnightDat and RoundRift. Propagation methods for Wonderland include counterfeit Google Play Store pages, Facebook ads, and fake accounts on dating apps. Attackers exploit stolen Telegram sessions from Uzbek users to distribute APK files. Once installed, Wonderland can access SMS messages, intercept one-time passwords, and siphon funds from victims' bank accounts. It can also retrieve phone numbers, exfiltrate contact lists, suppress security alerts, and send SMS messages from compromised devices. Users must enable installations from unknown sources to sideload the app, often misled by a fake update screen. If granted permissions, attackers can hijack the phone number and log into the associated Telegram account, perpetuating the malware's spread. Wonderland represents a significant evolution in mobile malware in Uzbekistan, moving from basic malware like Ajina.Banker to more sophisticated variants like Qwizzserial. The use of dropper applications enhances its deceptive nature, allowing it to evade security checks. Both the dropper and SMS stealer components are heavily obfuscated, complicating reverse engineering. The supporting infrastructure for Wonderland is dynamic, with rapidly changing domains complicating monitoring efforts. Malicious APKs are generated through a Telegram bot and distributed by a network of threat actors. New strains of malware, such as Cellik, Frogblight, and NexusRoute, have also emerged, each capable of harvesting sensitive information from compromised devices.