harvesting Archives

AppWizard

July 29, 2025

How to build a workbench in Grounded 2

Players must analyze a grass plank at a resource analyzer to unlock the workbench in Grounded 2. The first resource analyzer can be found at the Ranger Outpost: Snackbar, which is surrounded by grass for harvesting. To analyze, players need to chop down a grass stalk to obtain grass planks and then interact with the analyzer to research the grass plank, unlocking the workbench schematic. The materials required to craft the workbench are three grass planks, four sprigs, and two sap. Sprigs are commonly found nearby, and sap can be identified by small brown orbs on wood and roots. Players must gather these materials and transport them to their building site to complete the workbench.

AppWizard

July 29, 2025

ANDROID MALWARE POSING AS INDIAN BANK APPS

The report discusses a sophisticated Android malware targeting users in India, which disguises itself as legitimate banking applications to steal credentials and conduct unauthorized financial activities. The malware employs advanced techniques such as silent installation, exploitation of Android permissions, and remote command execution to avoid detection. It utilizes Firebase for command-and-control operations and phishing pages that mimic real banking interfaces. The malware consists of a modular architecture with a dropper and a main payload. The dropper requests several Android permissions, including ACCESSNETWORKSTATE, REQUESTINSTALLPACKAGES, and QUERYALLPACKAGES, which facilitate reconnaissance and persistence. The dropper uses a silent installation mechanism to load additional payloads without user awareness. The main payload requests permissions that enable data theft and stealthy operation, such as READSMS, SENDSMS, and RECEIVEBOOTCOMPLETED. It hides itself from the user's app list and employs separate classes for specific malicious tasks, including harvesting user credentials and collecting debit card information. The phishing page mimics a legitimate banking app to capture user data effectively. The malware also monitors incoming SMS messages, extracts critical metadata, and can silently forward calls to an attacker-controlled number. A specific APK sample impersonating an Indian banking application was observed on April 3, 2025, highlighting ongoing trends in mobile-based credential theft and financial fraud. Recommendations include enforcing stricter mobile application security standards, launching public awareness campaigns, implementing threat intelligence-driven filtering, and deploying mobile endpoint detection solutions.

AppWizard

July 25, 2025

Fake Indian Banking Apps on Android Steal Login Credentials from Users

A recently discovered malicious Android application poses significant risks by masquerading as legitimate banking apps in India. It facilitates credential theft, conducts surveillance, and executes unauthorized financial transactions. The malware operates on a modular architecture with a dropper and primary payload, employing deceptive user interfaces and silent installation techniques to evade detection. The dropper requests extensive permissions, including ACCESSNETWORKSTATE, REQUESTINSTALLPACKAGES, and QUERYALLPACKAGES, to monitor connectivity, install secondary APKs without user awareness, and profile installed apps. It loads a hidden payload and initiates installation using an INSTALL_NOW flag, bypassing app store scrutiny. The main payload requests additional permissions such as READSMS, SENDSMS, and RECEIVESMS for intercepting one-time passwords (OTPs) and two-factor authentication (2FA) codes. It also requests REQUESTIGNOREBATTERYOPTIMIZATIONS, READPHONESTATE, and READPHONENUMBERS for uninterrupted execution, device fingerprinting, and potential call forwarding abuse. Data exfiltration occurs through Firebase Realtime Database, storing user IDs and intercepted SMS metadata. The malware uses Firebase for command-and-control operations and generates phishing pages resembling authentic banking interfaces. Delivery methods include smishing, email phishing, WhatsApp bots, vishing calls, SEO-poisoned websites, malvertising, Trojanized utilities, QR/NFC attacks, preloaded malware on counterfeit devices, and exploitation of accessibility service vulnerabilities. Indicators of compromise include specific SHA256 hashes for the base payload and main payload.

AppWizard

July 23, 2025

Threat Actors Blend Click Fraud Apps and Malware to Steal Android Credentials

Security researchers at Trustwave SpiderLabs have identified a complex cluster of Android malware that combines click fraud, credential theft, and brand impersonation. This malware exploits the Android Package Kit (APK) file format to distribute malicious applications, often through phishing messages or deceptive websites. Users are tricked into installing these APKs, which are disguised as reputable brands or promotional apps. Once installed, the malware takes advantage of Android's permission model to access sensitive resources, primarily for click fraud and traffic redirection to generate illicit revenue. Some variants engage in data collection and credential harvesting, employing advanced evasion tactics to avoid detection, such as using counterfeit Chrome applications and overlay screens. A notable variant includes a spoofed Facebook app that mimics the official interface and connects to a remote command-and-control server for instructions. The malware uses encryption and encoding to secure data exchanges and employs open-source tools to bypass Android's signature verification. Evidence suggests that the operators may be Chinese-speaking, as indicated by the use of Simplified Chinese in the code and the promotion of related APK campaigns on Chinese-speaking underground forums.

AppWizard

July 22, 2025

Threat Actors Combine Android Malware With Click Fraud Apps to Steal Login Credentials

A new wave of malicious Android Package Kit (APK) files is combining click-fraud advertising and credential theft, primarily affecting regions like Southeast Asia, Latin America, and parts of Europe. These APKs disguise themselves as casual games or clones of legitimate apps, enticing users to sideload them and bypass Google Play’s security measures. Once installed, they request excessive permissions and operate in the foreground to inflate ad impressions while capturing user credentials through convincing login forms. The malware uses a modular configuration system and communicates with an encrypted command-and-control backend. The installation process often begins with social media messages or QR codes leading to spoofed landing pages. The app can embed secondary payloads without invalidating its original signature and minimizes detection by sandboxes. By the time users notice unusual activity, the malware has already exfiltrated ad revenue and credentials.

Tech Optimizer

July 15, 2025

VPN vs Antivirus 2025: Which Protects Your Finances Better?

In 2025, finance professionals face significant cybersecurity challenges due to evolving cyber threats. A VPN (Virtual Private Network) secures internet connections and encrypts data, while antivirus software detects and neutralizes malware and phishing attempts. For optimal protection, it is recommended to use both tools. A VPN masks IP addresses, encrypts sensitive transactions, prevents data harvesting on public Wi-Fi, and shields browsing from tracking. Antivirus software detects malware, blocks phishing emails, prevents keyloggers, quarantines infected files, and offers real-time threat detection, but does not encrypt internet connections. The comparison shows that a VPN encrypts internet traffic and hides IP addresses, while antivirus software prevents phishing and malware, detects keyloggers, and provides real-time threat monitoring. For financial safety, using both a VPN and antivirus is crucial, especially when accessing sensitive data on public networks or dealing with potentially harmful downloads. Common scenarios include using a VPN for banking on hotel Wi-Fi, requiring antivirus for suspicious downloads, and needing both tools for trading crypto on public Wi-Fi. Relying on one tool alone is insufficient, as a VPN does not protect against malware, and antivirus does not secure internet traffic.

AppWizard

July 15, 2025

How does your phone know so many private details? How thousands of apps are exploiting mysterious indoor location tracking

In 2023, a family at an amusement park experienced technology's impact on privacy when the park's app used geolocation to notify a waiting parent about fast-track entry. Spanish researchers investigated how apps exploit Bluetooth and Wi-Fi permissions to track users indoors, even without GPS. Their findings, to be presented at the Pets privacy conference, reveal that 86% of 9,976 analyzed Android apps collect sensitive data, including location coordinates. The study highlights ethical concerns regarding data sharing and potential misuse, as information can track individuals' movements and identify sensitive activities. Many apps use software development kits (SDKs) that include hidden location tracking features, with 52 SDKs identified in nearly 10,000 apps installed on around 55 billion devices. The Android Advertising ID allows companies to track users and create detailed profiles based on location data, raising ethical dilemmas about privacy and the commodification of personal information.

AppWizard

July 4, 2025

4 idle games I play while working on my PC

Idle games are designed for those working from home, allowing for minimal interaction and automated progress. They provide engaging yet low-maintenance entertainment, often developed by indie creators. Examples include: - Rusty's Retirement: A farm simulation where players set up their farm while automated assistants manage daily tasks. - Cauldron: An idle game featuring turn-based battles and resource gathering from five mini-games for upgrades. - Cast n Chill: A fishing game that allows players to actively fish or switch to an idle mode for automated fishing. - Bao Bao's Cozy Laundromat: Players manage a laundromat for pandas, with a focus timer to maintain productivity while engaging in gameplay. These games offer non-intrusive experiences, allowing players to check in at their convenience without the pressure of failure.

AppWizard

July 3, 2025

Qwizzserial Android Malware as Legitimate Apps Steals Banking Data & Intercepts 2FA SMS

A sophisticated Android malware campaign named Qwizzserial has emerged as a significant threat to banking security in Central Asia, particularly affecting users in Uzbekistan. Initially identified in mid-2024, it disguises itself as legitimate applications to deceive users into installation. Analysts from Group-IB uncovered it, noting its distribution network resembles the Classiscam fraud infrastructure. The campaign has reportedly infected around 100,000 users, resulting in financial losses exceeding ,000 within three months. The primary distribution channel is Telegram, where cybercriminals pose as government entities. Qwizzserial requests critical permissions upon installation and collects personal and financial information, systematically harvesting existing SMS messages. Recent iterations have incorporated obfuscation techniques and enhanced persistence mechanisms.

AppWizard

June 21, 2025

Tempest Rising’s first major update targets the Command and Conquer successor’s multiplayer, adding 6 maps, a 2v2 ranked mode, and an extensive balance overhaul

Tempest Rising has released its first major update, the "Rally and Recon" update, which enhances the multiplayer experience. Key features include a ranked mode for 2v2 matches with leaderboards and the ability to adjust the population cap for multiplayer matches from 100 to 500 units. The update also includes a comprehensive rebalance of existing units, affecting factions differently; for example, the GFD faction's spy drones are less effective, while its hunter tank is improved, and the Tempest Dynasty experiences slower resource harvesting but gains stronger second-tier units. Players are also anticipating the introduction of a third playable faction, which has only been available as an adversary in campaign mode.