fraud Archives

Tech Optimizer

September 1, 2026

Fake Microsoft Security Scan Tells You to Remove Antivirus—Then Scammers Ask for Remote Access

A new web-based scam is using counterfeit Microsoft-branded security scans to deceive users into uninstalling their antivirus software. The scam websites conduct fake inspections, reporting false security failures and claiming third-party antivirus products are unsupported by Windows. They gather browser information to create customized-looking scan reports and aim to mislead victims into a fraudulent refund process. Investigators have identified 11 related scam sites under the name SysScan, which present themselves as legitimate Microsoft security checks. The scam does not involve file downloads but relies on convincing websites, fabricated security scores, and personal information forms. The scan results are hard-coded, and the security score is limited to a range between 13 and 30 out of 100. The scams instruct users to uninstall antivirus software, which is misleading since Windows does not cease support for third-party antivirus solutions. The scam sites request extensive personal information, including names, addresses, phone numbers, and banking details, and redirect victims to a page claiming a refund manager will call shortly. This process allows scammers to gain remote access to victims' computers. Indicators of compromise include specific IP addresses and domains associated with the scam.

AppWizard

August 31, 2026

Home Ministry alerts about rise in financial frauds through malicious Android apps

The Indian Cyber Crime Coordination Centre (I4C) has reported a rise in financial frauds associated with malicious Android applications disguised as pornography apps. These apps, including names like "Night Play," "Reloop," and "Kyss," are promoted through ads on Facebook and Instagram, leading users to phishing websites where they are encouraged to download APK files from unverified sources. The malicious apps exploit permissions granted by users to take control of devices, potentially facilitating unauthorized financial transactions. Recommendations for safety include only installing apps from reputable sources, avoiding suspicious downloads, and regularly monitoring financial transactions. Instructions for uninstalling these apps involve starting the phone in Safe Mode, uninstalling the suspicious app, and then restarting the device.

AppWizard

August 31, 2026

Fake dating apps are being used to target Android users: How the new cyber scam works

India's cybercrime authorities have warned about the misuse of dating and adult-themed advertisements on social media platforms like Instagram and Facebook, which are being exploited by criminals to distribute malicious Android applications. These ads redirect users to external websites where they are prompted to download APK files, bypassing security measures of trusted app stores. The Indian Cybercrime Coordination Centre (I4C) has identified several malicious applications, including Night Play, Reloop, Kyss, Vimo, Rivo, Nexo, and Vixa, and cautions against installing unfamiliar applications promoted through unsolicited ads. These apps may request sensitive permissions, such as access to SMS messages, contacts, photos, device storage, and Accessibility Services, which can allow fraudsters to access valuable information. Compromised devices can lead to financial fraud by intercepting OTPs and other verification details. The I4C recommends using trusted app stores, keeping Google Play Protect active, reviewing app permissions, and being cautious with social media ads. If a suspicious app is installed, users should restart their phone in Safe Mode to uninstall it, disable its permissions if necessary, and consider a factory reset if removal fails. Users who suspect fraud are encouraged to report incidents promptly.

Tech Optimizer

August 27, 2026

Scammers Impersonate Microsoft to Push Fake Security Scans and Refund Fraud

A network of fraudulent websites, branded as SysScan, has been discovered, which falsely claims to evaluate antivirus software effectiveness through deceptive security scans. These sites manipulate users into uninstalling legitimate antivirus products and disclosing sensitive personal and banking information. Eleven distinct domains associated with SysScan have been identified, all hosted on a single server. The fraudulent scans generate misleading results based on static findings rather than actual system assessments, and users are coerced into believing their computers are at risk. The scams misrepresent normal browser behaviors as security threats and instruct victims to uninstall their antivirus software, compromising their defenses. The operation targets both individual and business users, collecting extensive personal information and utilizing remote-access tools. The data submitted is sent to Telegram via its bot API. Users are advised to disconnect from the internet and secure their devices if they suspect they have been compromised. Indicators of compromise include specific IP addresses and domains associated with the scam.

AppWizard

August 23, 2026

Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices

A new Android malware threat, codenamed Manic, poses significant risks to Ukrainian banks, government services, and messaging applications, with a reach extending to Russian and European financial institutions, global fintech platforms, cryptocurrency services, and military communication channels. Manic combines Android banking malware and mobile spyware, targeting sensitive applications and enabling comprehensive device takeover. It features a novel Wi-Fi mesh technique for data relay through compromised devices and utilizes phishing sites and dropper apps. The malware originated in February 2026, with initial development leading to its first deployment by late May. It monitors 169 package IDs related to banks, payment services, and messaging applications, primarily affecting Ukrainian targets but also impacting applications in Russia and Europe. Manic can infiltrate commercial and military messaging apps, track locations, monitor notifications, and collect files. It exploits Android's accessibility services to capture sensitive data and employs a store-and-forward relay mechanism for data exfiltration through nearby compromised devices. Google has stated that no apps containing this malware are found on Google Play, and Android users are protected by Google Play Protect.

AppWizard

August 21, 2026

New Android Malware Spotted Infecting Cars Via Software Updates

A new strain of Android malware has emerged, targeting automotive head units responsible for infotainment, connectivity, and navigation in vehicles. Discovered by Kaspersky in June, this is the first documented instance of malware affecting car head units, specifically within the firmware updaters of Android-based software developed by DoFun, a Hong Kong company. The malware, disguised as an application called JarService, infiltrates devices without user awareness. It is delivered through a legitimate system application called TWCore, which collects analytics and updates software. The malware aims to convert the head unit into a botnet, equipped with commands to download and execute code and display advertisements, potentially for online ad fraud. Kaspersky notified DoFun, which addressed the vulnerabilities, and noted similarities between this malware and a previous threat called BadBox, which affected various Android devices.

Tech Optimizer

August 20, 2026

Hackers Are Using a Fake Roblox Cheat To Access Your Webcam and Steal Data

Roblox is facing privacy concerns due to spyware disguised as an "undetected" version of the Xeno Roblox cheat tool. This malware can access screens, record keystrokes, and activate webcams, allowing attackers to execute remote commands. The infection begins when users download a file resembling a legitimate Xeno installation, often shared on platforms like Discord. The malware, previously known as Powercat, has evolved and operates in three stages: 1. The user executes a file named Xeno.exe, which checks for Java and extracts it if necessary. 2. The malware runs a JAR file disguised as decompiler.exe, performing checks to avoid detection. 3. It masquerades as a legitimate Windows DLL file, logging activities and attempting to escalate privileges. If successful, the malware can control the victim's system, access webcams, log keystrokes, and steal sensitive information, including cryptocurrency wallet credentials. To protect against this spyware, users are advised to avoid unofficial cheats, use antivirus software, refrain from clicking unsolicited links, enable two-factor authentication, inspect User Account Control prompts, and consider identity theft protection services.

AppWizard

August 18, 2026

Android 17 QPR2 Beta 3: Google brings new customization options and security

Google has released the third beta of Android 17 QPR2, build number CP41.260731.005.A2, for testing on Pixel devices including the Pixel 6a, Pixel 7 series, Pixel Fold, and Pixel Tablet. Key features include enhanced theming options with an expanded color selection tool, an app lock feature accessible by long-pressing an app icon, and customization options for quick settings allowing users to rearrange elements. The lock screen has improved blur effects, and security enhancements include new restrictions on programmatic call forwarding and a confirmation dialog for manually entered codes. The beta also addresses several bugs, including display errors and device restarts. The update is available for Pixel 6 to Pixel 10 Pro XL models, and users can enroll in the Android Beta Program for installation. A subsequent update is expected in September.

AppWizard

August 17, 2026

Android 17 QPR2 Beta 3 is pretty neat, especially if you hate fraud and scams

Google has rolled out Android 17 QPR2 Beta 3 for enrolled Pixel testers, introducing significant security measures against call-forwarding fraud. The update is available for Pixel 6a, Pixel 7, 7 Pro, 7a, Pixel Fold, and Pixel Tablet users, who will receive version vCP41.260731.005.A2, while other users will be on version vCP41.260731.005.B1. The beta addresses bugs such as "visual corruption" and unexpected device restarts, and resolves misleading battery capacity warnings. New security restrictions include API restrictions and an OS-level confirmation dialog for call-forwarding commands. The Quick Settings layout has been revamped, allowing users to customize their arrangement of key buttons. The Pixel 6 and Pixel 6 Pro have been removed from the Android beta program, and the focus will now be on devices starting from the Pixel 6a. The Pixel 11 series has officially debuted with pre-order deals available.

Tech Optimizer

August 16, 2026

Best Android Antivirus Apps 2026: Tested and Ranked

Bitdefender Mobile Security is rated as the best antivirus app for Android in 2026, achieving a 100% detection rate, 0.5% battery drain, and unobtrusive operation. The evaluation compared five antivirus applications on a Galaxy S26 Ultra, assessing detection rates, battery drain, scan speed, and permissions. Other notable antivirus apps include Norton 360 for Mobile, which is recognized for its features; Avast Mobile Security, known for its free version; McAfee Mobile Security, which excels in scam call and text filtering; and NordVPN Threat Protection, praised for web and Wi-Fi security. Most users may not need an antivirus app due to built-in protections like Google Play Protect, which automatically scans apps. However, specific scenarios warrant the installation of an antivirus app, such as sideloading apps, receiving scam texts and calls, assisting relatives, conducting banking and shopping on mobile, and using public Wi-Fi. The top five antivirus apps tested are: 1. Bitdefender Mobile Security: 100% detection, 0.5% battery drain, 31-second scan time. 2. Norton 360 for Mobile: 99.9% detection, 0.9% battery drain, 24-second scan time. 3. Avast Mobile Security: 99.9% detection, 0.7% battery drain, 26-second scan time. 4. McAfee Mobile Security: 99.78% detection, 1.0% battery drain, 34-second scan time. 5. NordVPN Threat Protection: 95.60% detection of web threats, 0.2% battery drain. Battery consumption varied, with NordVPN being the lightest and McAfee the heaviest. Permissions requested by each app also varied significantly, with Bitdefender requiring the most extensive permissions. Users are advised to check for legitimate antivirus apps by verifying the developer, installation count, update history, lab participation, and permission requests. Free antivirus apps like Avast and AVG offer effective protection but may lack some features of paid versions. Users should be cautious of fake security apps that mimic legitimate ones. If malware is suspected, users can run scans with Google Play Protect or other anti-malware apps and follow specific steps to remove malware if detected.