malicious apps Archives

Tech Optimizer

April 19, 2026

Avast Antivirus: Between Free Tier Strength and Privacy Risks, Things Are Getting Interesting

Avast Antivirus offers free protection against malware, phishing, and unsafe websites, featuring real-time scanning, ransomware protection, and a behavior-based detection system. The free edition includes protective shields for files, emails, and web browsing, while Avast Premium Security provides advanced ransomware defense and a secure browser. Avast One bundles additional features like a VPN and parental controls. Gen Digital acquired Avast in 2022, positioning it as a key part of its consumer cybersecurity strategy, with a freemium model that attracts users and encourages upgrades to premium plans. Avast has a user base of 435 million, with millions transitioning to paid subscriptions annually. The global antivirus market is experiencing double-digit growth, driven by increasing cyber threats. Avast competes with major players like Norton, Bitdefender, and Kaspersky, while facing challenges from free alternatives like Windows Defender. The company previously faced privacy issues related to the sale of anonymized browsing data but has since implemented transparency measures and compliance with EU regulations. Avast is exploring AI-driven detection methods and post-quantum defenses to enhance its offerings.

AppWizard

April 17, 2026

This Android Setting Makes It Easy to Manage All Your App Permissions

In Android devices, users can manage app permissions through a privacy dashboard located in Settings > Security & Privacy > Privacy > Permission manager. This includes permissions for the camera, microphone, location, and more. Users can specify access levels for these features, including allowing access all the time, only while using the app, or not at all. Special permissions, which allow apps to modify system settings or access sensitive data, require particular attention and can be reviewed in Settings > Apps > Special app access. Caution is advised for apps from outside the Google Play Store, as they may pose greater risks. Regular audits of app permissions are recommended to ensure that apps do not have more access than necessary.

AppWizard

April 6, 2026

Dangerous “NoVoice” malware found in over 50 Play Store apps that were installed 2.3 million times

A new malware threat called "NoVoice" has been found in over 50 applications on the Google Play Store, with 2.3 million installations on Android devices. Discovered by McAfee, this malware is hidden in seemingly harmless apps like system cleaners, games, and image galleries. It exploits Android vulnerabilities to gain root access, potentially allowing attackers to steal sensitive information and manipulate applications without user consent. In some cases, it may persist even after a factory reset. Google has stated that Android devices updated since May 2021 are protected against this threat and that Google Play Protect actively removes malicious apps and blocks new installations. The malware was not able to infect devices in Beijing and Shenzhen, suggesting the attackers may be avoiding local law enforcement. One identified app carrying the NoVoice payload is SwiftClean, developed by Biodun Popoola. The malware operates using a silent audio file, executing its code without user detection. Users are advised to download apps only from the Google Play Store and keep their devices updated.

AppWizard

April 1, 2026

‘NoVoice’ Android malware on Google Play infected 2.3 million devices

A new Android malware called NoVoice has been found in over 50 applications on Google Play, with more than 2.3 million downloads. The malware targets older Android versions, specifically those patched between 2016 and 2021, and attempts to gain root access by exploiting vulnerabilities. It conceals malicious components within the com.facebook.utils package and uses steganography to hide an encrypted payload within a PNG image file. NoVoice avoids infecting devices in certain regions and has checks to detect emulators and VPNs. Once activated, the malware contacts its command-and-control server to gather device information and polls it every 60 seconds for tailored exploits aimed at rooting the device. It can exploit 22 vulnerabilities, including kernel bugs, and establishes persistence by replacing key system libraries and installing recovery scripts. The malware injects code into applications, particularly targeting WhatsApp to extract sensitive data for session replication, which is then exfiltrated to the C2 server. The malicious apps containing NoVoice have been removed from Google Play, but users who installed them should consider their devices compromised. Upgrading to devices with later security patches is recommended to mitigate the threat.

AppWizard

March 21, 2026

I don’t recognize the Android I fell in love with anymore

In 2010, the author purchased a Samsung Galaxy 5, which introduced them to the Android ecosystem characterized by freedom, openness, and choice. By 2026, the Android platform had evolved significantly, with restrictions on sideloading impacting the author's nostalgic view of the system. The early 2010s were marked by diverse hardware innovations, such as microSD expansion and customizable features, alongside software freedom that allowed for extensive customization and app installations. Over time, Android transitioned to a more structured ecosystem focused on user safety, reflecting the need to protect personal information. The author acknowledges the trade-off between openness and security, recognizing the importance of safeguarding users, even if it means accepting a more restrictive environment.

AppWizard

March 20, 2026

Google adds 24-hour Android sideloading for unverified apps

Google is revising its approach to Android sideloading by allowing users to install applications from unverified developers while implementing a new 24-hour process to enhance security. Users must activate developer mode, confirm their decision, restart their devices, and re-authenticate before installation. A one-time 24-hour waiting period is also introduced to prevent scams. This change addresses concerns from developers and advocacy groups about the impact of stringent verification policies on smaller developers. Google is also offering limited-distribution accounts for students and hobbyists to share apps without full verification. The updated process includes additional security measures to disrupt scams, while users are encouraged to use dedicated security solutions for better protection against mobile threats.

AppWizard

March 13, 2026

Google’s Android boss talks Android 17, sideloading drama, and why he hates phone cases

MWC (Mobile World Congress) in Barcelona is a significant event for the tech industry, where companies unveil new hardware and showcase emerging ideas. At MWC 2026, Sameer Samat, President of the Android Ecosystem, discussed the evolution of Android, particularly focusing on Android 17, which aims to transition from an operating system to an intelligent system. This version will integrate AI capabilities through Gemini, allowing for more intuitive task management. Android 17 will introduce early agentic capabilities, initially available in a beta feature for select devices, enabling users to automate multi-step tasks. Samat confirmed that Google has no plans to remove sideloading, despite concerns about app security. Upcoming changes to sideloading will focus on verifying app identities to protect users from malicious apps while still allowing power users to install unverified software. He emphasized the importance of balancing openness and safety in the Android platform. Samat expressed excitement about current Android phones, highlighting trends in foldable devices and praising models from brands like Motorola and Nothing for their appeal to younger consumers. He mentioned using a Galaxy Z Fold 7 for work and a Pixel 10 Pro for personal use, noting the beauty of the devices and his preference not to use cases.

AppWizard

March 12, 2026

Six Android Malware Families Target Pix Payments, Banking Apps, and Crypto Wallets

Cybersecurity researchers have identified six new families of Android malware designed to extract sensitive data and facilitate financial fraud. Notable threats include: - PixRevolution: Targets Brazil's Pix payment platform, activates during Pix transfers, and uses real-time monitoring to intervene in transactions. Victims are tricked into installing malicious apps from counterfeit Google Play Store listings, which enable accessibility services for the malware to capture screens and overlay fake interfaces to reroute funds. - BeatBanker: Spreads through phishing attacks disguised as legitimate Google Play Store pages. It uses an inaudible audio loop for persistence, functions as a banking trojan, and includes a cryptocurrency miner. It creates deceptive overlays for platforms like Binance and Trust Wallet to divert funds and can monitor web browsers and execute remote commands. - TaxiSpy RAT: Exploits accessibility services to gather sensitive information such as SMS messages and call logs, targeting banking and cryptocurrency applications with overlays for credential theft. It employs advanced evasion techniques like native library encryption and real-time remote control. - Mirax: A private malware-as-a-service (MaaS) offering with a subscription model that provides tools for banking overlays and information gathering, including keystrokes and SMS. - Oblivion: Another Android RAT available at a competitive price, featuring capabilities to bypass security measures on various devices. - SURXRAT: Distributed through a Telegram-based MaaS ecosystem, it uses accessibility permissions for persistent control and communicates with a Firebase-based command-and-control infrastructure. Some samples incorporate a large language model component, indicating experimentation with AI by threat actors.

Winsage

February 27, 2026

De-Enshittify Windows 11: Make Windows 11 More Secure ⭐

Windows 11 offers a mix of security and privacy features, with a recommendation for users to opt for a Copilot+ PC with a Qualcomm Snapdragon X-series processor for enhanced security. Most users log in with a Microsoft account, which provides benefits such as two-factor authentication, device-bound passkeys, account recovery options, and automatic disk encryption. However, using a local account poses security risks, including limited recovery options and lack of support for key security features. To secure Windows 11, users should take several steps during initial setup or later, including enabling Windows Security features, verifying device encryption, and enhancing sign-in security through Windows Hello options like facial and fingerprint recognition. Additional security features such as Controlled Folder Access and Smart App Control can be configured for better protection. Users are advised to remove unnecessary third-party security apps and keep Windows 11 and installed applications up-to-date to maintain security. Regular updates and proper configuration of Windows Update settings are also essential for preventing disruptions and ensuring data safety.

AppWizard

February 21, 2026

Android users put on high alert: Malware hides in TV streaming apps

A new strain of malware called Massiv has been identified by the fraud detection firm ThreatFabric. This malware disguises itself as legitimate IPTV applications to steal financial information and identities. IPTV refers to Internet Protocol Television, often associated with unauthorized content streaming. Many of these malicious apps are not found on reputable platforms, leading users to unofficial sources where malware can be embedded. The malware can monitor screens in real-time and extract data from the phone's Accessibility Service, allowing attackers to interact with devices without users' knowledge. Cybercriminals can then open bank accounts in victims' names, leading to debts with banks the victims have never interacted with. ThreatFabric has noted an increase in fake IPTV applications used for malware delivery, particularly in Portugal, Spain, France, and Turkey. Many of these apps do not provide free content but instead deliver malware. Users are advised to avoid sideloading applications from untrusted sources.