NewApp Digest
search bot

fraud

Google eases Android app sideloading rules after
AppWizard
March 20, 2026

Google eases Android app sideloading rules after

Google is implementing a policy change to allow easier installation of Android applications from sources outside its Play Store, following an antitrust settlement. This includes an "advanced flow" option that lets users bypass mandatory app verification safeguards through a structured process. The changes aim to balance user choice with protections against scams and malware risks. Previously, Google required all Android applications to be registered by verified developers to mitigate risks like malware and fraud. The new process requires users to enable developer mode, restart their devices, and undergo a waiting period of up to 24 hours before verifying their identity with biometrics or a PIN to install apps from unverified developers. Users can install these apps temporarily for up to seven days or indefinitely, with ongoing warning prompts. Additionally, Google is offering free, limited app distribution accounts for students and hobbyists to share apps without full developer verification.
Google introduces a new way for users to sideload Android apps that still protects against scams
AppWizard
March 20, 2026

Google introduces a new way for users to sideload Android apps that still protects against scams

Google has announced a new "advanced flow" setting that simplifies the process for Android users to install applications from sources outside the Play Store by allowing them to disable a verification requirement. This change responds to user demand for more flexibility in app installation, despite the associated risks of unverified applications. Previously, Google required all Android apps to be registered by verified developers to prevent malware and fraud. The new setting involves enabling developer mode, followed by a verification check to ensure users are not being scammed, a phone restart, and a protective waiting period of one day before confirming the change. Users can choose to enable the option to install apps from unverified developers for seven days or indefinitely, with a warning provided for unverified apps. Additionally, Google is offering free distribution accounts for students and hobbyists to share apps with a small group without ID verification. These changes follow a legal settlement with Epic Games, resulting in reduced Play Store commissions to 20% on in-app purchases.
RUSSIA Mammut virus hits Russia’s patriotic messaging app
AppWizard
March 19, 2026

RUSSIA Mammut virus hits Russia’s patriotic messaging app

A virus known as Mamont is targeting users of the messaging platform Max, which has 100 million registered profiles. Mamont infiltrates online banking applications and spreads primarily through family and parental chat groups, allowing cybercriminals to steal payment information. The virus often begins with a deceptive message prompting users to click, leading to the silent download of a Trojan that siphons off data. Despite claims from the Max press service that the virus's spread is exaggerated, concerns remain about the security of user data, particularly given that all communications on Max are monitored by the state. Many users resort to using a second device, referred to as Maxofon, to comply with the platform's requirements while keeping their primary device for other applications.
New Perseus Android Banking Malware Monitors Notes Apps to Extract Sensitive Data
AppWizard
March 19, 2026

New Perseus Android Banking Malware Monitors Notes Apps to Extract Sensitive Data

Cybersecurity researchers have identified a new family of Android malware called Perseus, designed for device takeovers and financial fraud. It utilizes Accessibility-based remote sessions for real-time monitoring and interaction with infected devices, particularly targeting Turkey and Italy. Perseus monitors user notes to extract personal or financial information and is distributed through dropper applications via phishing websites. It expands on the codebase of previous malware like Phoenix and employs disguises as IPTV services to reduce user suspicion. Once operational, it performs overlay attacks and captures keystrokes to steal credentials from financial applications. The malware allows operators to issue commands through a command-and-control panel, enabling various malicious actions, including capturing note content and initiating remote visual streams. Perseus also conducts environment checks to evade detection and ensure it operates on legitimate devices.
Six Android Malware Families Target Pix Payments, Banking Apps, and Crypto Wallets
AppWizard
March 12, 2026

Six Android Malware Families Target Pix Payments, Banking Apps, and Crypto Wallets

Cybersecurity researchers have identified six new families of Android malware designed to extract sensitive data and facilitate financial fraud. Notable threats include: - PixRevolution: Targets Brazil's Pix payment platform, activates during Pix transfers, and uses real-time monitoring to intervene in transactions. Victims are tricked into installing malicious apps from counterfeit Google Play Store listings, which enable accessibility services for the malware to capture screens and overlay fake interfaces to reroute funds. - BeatBanker: Spreads through phishing attacks disguised as legitimate Google Play Store pages. It uses an inaudible audio loop for persistence, functions as a banking trojan, and includes a cryptocurrency miner. It creates deceptive overlays for platforms like Binance and Trust Wallet to divert funds and can monitor web browsers and execute remote commands. - TaxiSpy RAT: Exploits accessibility services to gather sensitive information such as SMS messages and call logs, targeting banking and cryptocurrency applications with overlays for credential theft. It employs advanced evasion techniques like native library encryption and real-time remote control. - Mirax: A private malware-as-a-service (MaaS) offering with a subscription model that provides tools for banking overlays and information gathering, including keystrokes and SMS. - Oblivion: Another Android RAT available at a competitive price, featuring capabilities to bypass security measures on various devices. - SURXRAT: Distributed through a Telegram-based MaaS ecosystem, it uses accessibility permissions for persistent control and communicates with a Firebase-based command-and-control infrastructure. Some samples incorporate a large language model component, indicating experimentation with AI by threat actors.
Search