malicious applications Archives

AppWizard

May 27, 2026

Google could soon flag the dead Android apps hiding on your phone

Google is developing a new notification system for the Play Store that will inform users when an installed app has been removed, providing tailored messages based on the number of affected apps. Currently, Google Play Protect only alerts users about harmful apps but does not notify them about apps that are voluntarily removed or delisted for policy violations. The new system aims to address this gap by notifying users that apps will no longer receive updates, which is a concern for security and functionality. There is no specific timeline for the release of this feature, and the findings are based on code snippets that may not all make it to the final version.

AppWizard

May 26, 2026

Is your phone bill higher? 200+ Android apps might secretly be stealing money from you

A new type of malware has emerged that targets smartphone users by inflating phone bills through unauthorized carrier subscriptions. Discovered by cybersecurity firm Zimperium, this operation involves nearly 250 counterfeit Android applications that impersonate popular apps like TikTok and Instagram. Once downloaded, the malware uses advanced techniques such as JavaScript injection and SIM card access to enroll users in fictitious premium services without their knowledge. The scam has primarily affected users in Malaysia, Romania, Thailand, and Croatia, with Malaysia accounting for 85% of the victims. Google has confirmed that these malicious apps are not available on the Play Store and that users are protected by Google Play Protect. Despite a peak in activity in September 2025, parts of the scam's infrastructure remain operational, with the last recorded activity in January 2026. Users are advised to practice online security measures to protect their personal data.

AppWizard

May 20, 2026

Trapdoor Android Ad Fraud Scheme Hit 659 Million Daily Bid Requests Using 455 Apps

Cybersecurity researchers have identified an ad fraud and malvertising operation called Trapdoor, targeting Android users with 455 malicious applications and 183 command-and-control domains. Users often download these disguised apps, which initiate malvertising campaigns and lead to further downloads of malicious applications. At its peak, Trapdoor generated 659 million bid requests daily, with over 24 million downloads of the associated apps, primarily from the United States. The operation exploits install attribution tools to activate malicious activities only for users acquired through fraudulent ad campaigns, while suppressing such behavior for organic downloads. Trapdoor employs advanced evasion techniques, including obfuscation and impersonation of legitimate software, to avoid detection. Google has removed the identified malicious apps from the Play Store in response to the threat.

AppWizard

May 18, 2026

Beware of Activating Them: 5 Android App Permissions That Pose a Threat to Your Data

Android applications often request various permissions upon installation, including access to the camera, microphone, contacts, messages, and accessibility features. Users frequently accept these requests without hesitation, which can compromise their device's privacy and security. Certain permissions, if granted to malicious apps, can enable monitoring of user activity, audio recording, location tracking, or unauthorized app installations. Five Android app permissions that require careful consideration before granting include: 1. Accessibility Services: Can allow untrusted apps to monitor screen content, read messages, track keystrokes, and perform actions on behalf of the user. 2. Display Over Other Apps: Allows apps to overlay content on other apps, which can be exploited by malicious apps to create deceptive interfaces. 3. Install Unknown Apps: Permits apps to install software from outside the Google Play Store, increasing the risk of malware. 4. Usage Data Access: Enables apps to monitor usage patterns, which can be used for targeted advertising or sold to data brokers. 5. Access to Contacts and Messages (SMS): Sensitive information can be intercepted by malicious apps, posing risks to account security. It is crucial to grant permissions that align with an app's intended function and to be cautious of unnecessary access.

AppWizard

May 15, 2026

Android 16 VPN Bypass Lets Apps Reveal Users’ Real IP Address

A security vulnerability in Android 16 allows malicious applications to expose a user's real IP address, even with "Always-On VPN" and "Block connections without VPN" features activated. Discovered by security researcher 0x33c0unt and disclosed on April 30, 2026, the flaw exploits the registerQuicConnectionClosePayload feature, which lacks permission checks. This vulnerability has been verified on a Pixel 8 with Proton VPN active. Google has not released a patch, but users can disable the feature via ADB commands.

AppWizard

May 14, 2026

5 Android App Permissions You Should Never Allow

Users should be cautious when granting permissions to applications on Android devices, as extensive access can lead to security vulnerabilities. Apps with accessibility permissions can perform actions like hacking passwords and altering device settings without user consent. Overlay permissions allow apps to display content over others, which can be exploited by malicious apps to trick users into providing sensitive information. Installing apps from unknown sources poses risks to device security and privacy. Usage data access enables apps to monitor user activity, which can be sold to advertisers. Granting access to contacts and SMS can lead to privacy concerns, as this information can be exploited by malicious entities. Users are advised to regularly review and manage app permissions to mitigate potential threats.

AppWizard

May 8, 2026

Android alert: 7 million users downloaded ‘stalking’ apps that were actually scams

Security researchers at ESET uncovered a scam involving 28 applications named "CallPhantom," which collectively amassed over 7.3 million downloads on the Google Play Store. These apps promised access to call histories, SMS records, and WhatsApp call logs for any phone number, raising privacy concerns. They requested intrusive permissions from users' devices, leading to potential privacy violations. Payment structures varied, with some using Google Play's billing system and others circumventing it through third-party methods. ESET reported the apps to Google in December 2025, resulting in their removal from the Play Store. A recent search confirmed that these apps are no longer available.

AppWizard

May 8, 2026

Scam Android apps on Google Play got millions of downloads from a creepy pitch

Researchers uncovered a scam involving 28 fraudulent applications on the Google Play Store, collectively called "CallPhantom," which garnered over 7.3 million downloads. These apps promised access to call logs, SMS records, and WhatsApp history for any phone number, but users received fabricated data after paying a fee. The apps varied in appearance but shared a common strategy of generating random phone numbers and pairing them with pre-existing names and call details. Some requested email addresses to send the 'retrieved' history, but none had the necessary permissions to access the claimed data. Payment methods included Google Play’s official billing system and third-party platforms, with some apps misleading users into staying on subscription screens. ESET reported these apps to Google on December 16, leading to their removal from the Play Store.

AppWizard

April 25, 2026

Android Hackers Target 800 Banking, Crypto and Social Media Apps With ‘Near-Zero Detection Rates’: Zimperium

Android hackers are targeting over 800 applications in banking, cryptocurrency, and social media sectors, utilizing four active malware families: RecruitRat, SaferRat, Astrinox, and Massiv. These malware employ advanced techniques to evade detection and execute credential theft, unauthorized financial transactions, and data exfiltration. Attackers lure victims through phishing websites, fraudulent job offers, fake software updates, text-message scams, and promotional lures. Once installed, the malware can request Accessibility permissions, obscure app icons, obstruct uninstallation, and steal sensitive information through counterfeit lock screens. They can also capture one-time passcodes, stream device screens, and overlay fake login pages on legitimate applications. The malware uses HTTPS and WebSocket communications to blend malicious traffic with normal activity and may incorporate encryption layers to avoid detection.

Tech Optimizer

April 24, 2026

Microsoft Says You Don’t Need A Third-Party Antivirus App Anymore

Microsoft Defender Antivirus effectively addresses everyday security risks for many Windows 11 users without the need for additional software. It is active by default, integrated into the OS, and continuously updated. Windows 11 includes various security features, such as Microsoft Defender SmartScreen, Smart App Control, and Controlled Folder Access, which protect against unsafe links, untrusted applications, and unauthorized data modifications. Microsoft Defender scans files upon access and monitors system processes for threats, utilizing cloud capabilities to address emerging risks. While many users find Microsoft Defender adequate, experts note it may not meet everyone's needs, particularly in enterprise environments. Reviews have pointed out shortcomings, such as low phishing detection and inadequate ransomware protection, with a protection accuracy rating of 93 percent compared to some paid alternatives that achieved 100 percent.