overlay Archives

AppWizard

September 19, 2026

New RatHat Android Malware Uses AI to Steal Banking Logins, PINs and OTP Codes

Security researchers have identified an Android banking Trojan named RatHat, which utilizes artificial intelligence, accessibility features, and Android Debug Bridge (ADB) to steal financial credentials, PINs, and one-time passcodes. Unlike traditional malware, RatHat employs a live AI assistant that interacts with the Android accessibility tree, allowing it to make real-time decisions based on the victim's screen content. The infection typically starts with social-engineering tactics, leading victims to counterfeit download pages where they are tricked into sideloading a malicious APK. Once installed, RatHat prompts users to enable Android Accessibility Service permissions, which it exploits to navigate Developer Options and enable Wireless Debugging. This grants it shell-level ADB access, allowing it to bypass application sandbox restrictions. RatHat deploys two native binaries for executing commands and maintaining a connection to the attacker's infrastructure. It targets banking applications through credential-stealing overlays and can intercept SMS messages for transaction verification codes. Additionally, it can record touch coordinates to reconstruct PINs and unlock patterns. RatHat includes persistence mechanisms to restore itself after removal, and users are advised to perform a factory reset if they suspect compromise. To reduce infection risk, users should avoid sideloading apps from unknown links, deny unnecessary Accessibility Service requests, and refrain from enabling Developer Options or Wireless Debugging for unfamiliar applications.

AppWizard

September 18, 2026

RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall

Cybersecurity experts have identified a new Android malware named RatHat, believed to be operated by Chinese threat actors. RatHat is distributed primarily through smishing and malvertising campaigns, leading users to deceptive download portals. It employs an automated multi-stage infection process and exploits Accessibility features along with a local ADB self-pairing mechanism to escape the Android application sandbox. The malware uses various anti-analysis techniques, including container tampering, manifest bombs, DEX bytecode poisoning, and dual string-encryption. RatHat's architecture consists of a malicious Android application, a Go agent, and an FRP reverse-proxy client, which together enable it to gain critical system permissions and perform various malicious activities such as credential capturing, screen recording, and SMS interception. Even if uninstalled, the malware retains shell access to the device, allowing attackers to reinstall it. RatHat can serialize the device's Accessibility tree to XML and communicate with a Generative AI assistant for tasks like screen coordinate determination and text extraction. The Go Agent, masquerading as a native library, exploits shell access to execute commands and establish a persistent connection to a command-and-control server via the FRP client. The C2 server can issue extensive commands to collect sensitive information, including SMS messages, credentials, files, and keystrokes, and RatHat also features a hardware-level keylogger.

AppWizard

September 15, 2026

Latest Pixel Feature Drop Expands Access to Scam-Text Detection

Google has released a feature update for Pixel phones that enhances existing functionalities and introduces new elements. The update expands scam-text detection capabilities to chat applications using Gboard, compatible with devices as old as the Pixel 6, and is available in multiple countries including the US, UK, Australia, Canada, France, Germany, India, Mexico, Japan, and Singapore. It also improves VIP notifications by allowing users to add home-screen widgets for designated contacts and includes a new navigation menu for easier contact switching, available for Pixel 6 and newer models. Additionally, a Harry Potter-themed pack with wallpapers, icons, and audio effects is offered, along with a two-month free subscription to Audible. For Pixel Watch users, the update introduces a one-handed pinch gesture for easier access to notifications and improved functionality for the raise-to-talk gesture on newer models.

AppWizard

September 15, 2026

Unofficial PC Version of Super Smash Bros. Melee Released

An unofficial PC port of the Nintendo GameCube game Super Smash Bros. Melee has been released. The game, originally launched in 2001, features a unique damage system, various attack types, and diverse stages. It includes several game modes such as Classic Mode, Adventure Mode, and Event Matches, with unlockable characters and content. The PC version supports keyboard and gamepad inputs, allows for resolution adjustments and visual customizations, but lacks online play and widescreen support. Users need to provide their own ROM to play. This release is part of a trend of unofficial PC ports of classic games, including titles like Super Mario 64 and The Legend of Zelda: Ocarina of Time.

AppWizard

September 14, 2026

Google rolls out Motion Assist bubbles to Pixel, Samsung

Google has introduced the Motion Assist feature for Pixel and Samsung devices running Android 17, designed to reduce motion sickness during travel. Users can activate it by searching for "motion assist" in the Settings app or through the Quick Settings editor on Pixel devices. The feature can automatically activate in moving vehicles, and users can add a Quick Settings Tile for manual control. Once enabled, it displays two columns of shapes on the screen. Customization options include color, shape, opacity, and randomization. Motion Assist is available on all Google Pixel and Samsung Galaxy (Fold 8 series) devices with Android 17, and users should restart their phones if the feature does not appear. The bubbles require version 26.33.32 of Google Play services.

AppWizard

September 14, 2026

How to recover the Google Maps speedometer on Android Auto: the ultimate trick

The Google Maps speedometer has disappeared for many Android Auto users due to a cache conflict, resulting in the speed overlay vanishing from screens. This issue is linked to internal desynchronization between the mobile app and the car's infotainment system, causing crashes for users. The problem is not due to changes on Google’s servers but rather the accumulation of temporary data that prevents crucial elements from loading correctly. Reports indicate that this issue affects users across various Android versions, including Android 14. A temporary solution involves performing a clean reset of the Google Maps and Android Auto apps by clearing their cache and data. If the problem persists, users may need to check for updates or wait for a fix from Google. Additionally, maintaining updated location permissions and the car’s system is recommended. Waze is suggested as an alternative for speed accuracy during this issue.

AppWizard

September 12, 2026

New Android Ransomware Records Screens, Steals OTPs and Secretly Takes Photos of Victims

A newly identified malware threat in the Android ecosystem, named Mantax Otax, combines ransomware with espionage capabilities. It targets users who install applications from untrustworthy sources, often through messaging apps or phishing attempts. The malware is linked to Indonesian cybercriminals and can steal sensitive information such as SMS one-time passwords, chat histories, and lock-screen PINs, facilitating account takeovers. Mantax Otax requests device-administrator rights and seeks access to SMS messages, contacts, and media files. It encrypts files on devices running Android 9 and earlier using AES encryption and demands a ransom for recovery. Although the impact is reduced on Android 10 and later due to Scoped Storage, the malware still poses significant surveillance risks. The malware collects extensive sensitive data, including contacts, call logs, and location data, and targets multi-factor authentication codes. It uses a deceptive system-lock overlay to capture PINs and has introduced features like WebSocket communications and disruptive pop-ups in its second iteration. Users are advised to be cautious when installing applications, avoid unsolicited APKs, and reject permissions that do not align with an app's purpose. In case of suspicious activity, users should disconnect from networks and seek help before entering sensitive information. Organizations should monitor for signs of this malware on managed devices.

AppWizard

September 12, 2026

Google Releases Android Auto 17.7 for All Users, Here’s How To Install It

Google has launched Android Auto version 17.7, available through the stable channel. Users can manually install the update by downloading the APK installer. The update includes a new green icon for Android Auto, particularly for Google Pixel 10 Pro XL users, but lacks significant front-facing changes. Previous features, such as a new weather experience with an animated raccoon character, are still in development and not included. A more substantial update is expected by the end of the year, introducing widgets and support for video applications. The complete build for the current update is Android Auto 17.7.6636.

AppWizard

September 10, 2026

Steam’s latest beta brings ‘Big Art’ to Big Picture Mode and Steam Deck, and customizable screensavers too

The latest beta release of the Steam client includes several enhancements, particularly the new "Big Art Mode," which changes the home screen to display large artwork from games against a simplified backdrop. This mode reduces the size of the carousel for recently played games, creating a more spacious layout. The update also introduces a screensaver feature with options for a game art slideshow or a retro bouncing logo, along with the ability to load custom screensavers. Additional improvements include enhanced startup performance, bug fixes, improved game recording stability, in-game overlay fixes, better Steam Input performance, Linux support enhancements, and adjustments to Remote Play, such as removing the PIN requirement for app downloads. Users can access the beta through the Steam settings menu.

AppWizard

September 10, 2026

Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks

The Gigabud banking trojan installs a secondary Android application called Vwork, which creates a work profile on compromised devices to evade detection from banking app security measures. This work profile separates its contents from the personal space of the device, allowing fraudulent transactions without triggering alerts. Group-IB confirmed this operational chain in Indonesia, where Gigabud has been active since 2022 and is linked to the GoldFactory group, which uses deceptive tactics to distribute the trojan. Vwork simplifies the creation of a work profile and communicates with an external server for authorization before cloning apps. The report indicates that Vwork has been detected in various countries, while approximately 1,469 devices and 1,281 logins were compromised in Indonesia, leading to estimated losses of around ,000,000. Users can check for a work profile in their phone's settings and are advised to download apps only from official stores and to deny unnecessary Accessibility access.