overlays Archives

AppWizard

October 16, 2026

6 wild ways to make Android widgets more useful

The Popup Widget allows users to access any widget at any time and summon two widgets simultaneously with a single tap. Edge Gestures provide quick access to favorite widgets with a swipe. Material Capsule features on-demand camera cutout widgets for dynamic customization. The volume key can trigger the appearance of a widget. Overlays offer a floating icon for ongoing access to essential tools. Smart Launcher introduces stacked widgets for efficient organization and space-saving design, with an easy setup interface for customization.

AppWizard

October 15, 2026

Experts warn cheap Android phones are shipping with malware

Cybersecurity experts from Bitdefender have found that budget Android smartphones, such as the Doogee S200 X, Doogee Fire 3 Max, and Cubot KINGKONG X, may come pre-loaded with malware embedded in their firmware, posing significant security risks. This malware is introduced during the manufacturing process, particularly affecting devices with MediaTek chipsets. Thousands of users in around 150 countries, including Mexico, France, Italy, the United States, Germany, Brazil, and Spain, have been impacted. Bitdefender identified a network of 32 malicious applications disguised as legitimate utilities that generate fraudulent ad impressions. Some infected phones can function as residential proxies for criminal activities, including spam campaigns and DDoS attacks. Uninstalling the malicious app may not eliminate the infection if it is integrated into the system software, potentially requiring firmware-level remediation. Buyers of budget phones should research manufacturers' supply chain control and commitment to security updates.

AppWizard

October 11, 2026

Android 18 UI Breakdown: Deep Material You Upgrades, Progressive Blurs, and Hardware Synergy

Google is teasing the return of the Android Dev Summit, focusing on Android 18 and its visual transformation. Key upgrades include: 1. Modern Graphics: Introduction of multi-point mesh gradients and real-time progressive blurs for enhanced visual fidelity. 2. Evolved Material You: Development of tactile glassmorphism and fluid component scaling for a three-dimensional user experience. 3. App Efficiency: Stricter performance benchmarks to minimize resource-heavy background processes and ensure smooth operation. 4. Hardware Synergy: Optimizations in Android 18 designed to complement next-generation displays, particularly for the upcoming Pixel 12.

AppWizard

September 23, 2026

RatHat Android Malware Uses AI to Target Banking Credentials in Real Time

A newly identified strain of Android malware, RatHat, utilizes generative AI to manipulate infected devices in real time. It is linked to threat actors believed to be operating out of China. RatHat serializes the device’s live Accessibility tree into XML format and communicates with a generative AI assistant to return screen coordinates, identify text, and issue navigation commands. The malware employs WebView-based HTML overlays to capture login credentials from banking and cryptocurrency applications and can infiltrate payment apps like WeChat and Alipay to extract PINs. It also features an SMS receiver and notification listener to intercept OTPs and 2FA codes. RatHat is disseminated through smishing, malvertising campaigns, and misleading third-party forums. It employs anti-analysis techniques such as container tampering, manifest bombing, DEX bytecode poisoning, string encryption, and anti-debugging. Once installed, it gains Accessibility access, activates Developer Options, and enables Wireless Debugging, allowing it to connect to the device's local ADB service and launch control agents with shell-level privileges. The malware captures raw touch coordinates to reconstruct PINs and unlock patterns, bypassing screenshot protections. It also includes persistence mechanisms that prevent uninstallation by presenting a fake Google Play failure overlay and automatically reinstalling itself if removed.

AppWizard

September 22, 2026

RatHat is a new Android malware that records your screen touches to steal passwords

Cybersecurity researchers at Zimperium have identified a new strain of malware called RatHat, targeting Android devices and linked to threat actors from China. RatHat uses generative AI to maintain persistence and control over infected devices. The malware is typically spread through social engineering, tricking users into downloading counterfeit applications that appear legitimate. Once installed, RatHat requests accessibility permissions, activates Wireless Debugging, and can capture text messages, create overlays, and steal passwords and multi-factor authentication codes. Its AI capabilities allow it to navigate the device interface in real-time, making detection by security software more difficult. To protect against RatHat, users should avoid downloading apps from untrustworthy sources, and removal requires a factory reset of the device.

AppWizard

September 19, 2026

New RatHat Android Malware Uses AI to Steal Banking Logins, PINs and OTP Codes

Security researchers have identified an Android banking Trojan named RatHat, which utilizes artificial intelligence, accessibility features, and Android Debug Bridge (ADB) to steal financial credentials, PINs, and one-time passcodes. Unlike traditional malware, RatHat employs a live AI assistant that interacts with the Android accessibility tree, allowing it to make real-time decisions based on the victim's screen content. The infection typically starts with social-engineering tactics, leading victims to counterfeit download pages where they are tricked into sideloading a malicious APK. Once installed, RatHat prompts users to enable Android Accessibility Service permissions, which it exploits to navigate Developer Options and enable Wireless Debugging. This grants it shell-level ADB access, allowing it to bypass application sandbox restrictions. RatHat deploys two native binaries for executing commands and maintaining a connection to the attacker's infrastructure. It targets banking applications through credential-stealing overlays and can intercept SMS messages for transaction verification codes. Additionally, it can record touch coordinates to reconstruct PINs and unlock patterns. RatHat includes persistence mechanisms to restore itself after removal, and users are advised to perform a factory reset if they suspect compromise. To reduce infection risk, users should avoid sideloading apps from unknown links, deny unnecessary Accessibility Service requests, and refrain from enabling Developer Options or Wireless Debugging for unfamiliar applications.

Winsage

September 17, 2026

Microsoft Azure CTO used AI to port 20-year-old Windows tool to macOS in two days: “I was flabbergasted”

Mark Russinovich, the Chief Technology Officer of Microsoft Azure, transitioned ZoomIt, a Windows tool for screen zooming, recording, and annotation, to macOS using artificial intelligence. Originally developed to aid in teaching Windows Internals, ZoomIt has been enhanced over the years with features like screen recording and webcam overlays. Despite initial reluctance due to time constraints, Russinovich utilized AI to create a functional macOS version in just two days, significantly faster than anticipated. The AI model leveraged the original Windows code, allowing for a high-fidelity clone of ZoomIt that includes essential features. ZoomIt for macOS is now available as a free and open-source tool, requiring macOS 14 Sonoma or newer, and can be installed via Homebrew or from Microsoft’s GitHub repository. Users can access its functionalities through keyboard shortcuts and a menu bar icon.

AppWizard

September 12, 2026

New Android Ransomware Records Screens, Steals OTPs and Secretly Takes Photos of Victims

A newly identified malware threat in the Android ecosystem, named Mantax Otax, combines ransomware with espionage capabilities. It targets users who install applications from untrustworthy sources, often through messaging apps or phishing attempts. The malware is linked to Indonesian cybercriminals and can steal sensitive information such as SMS one-time passwords, chat histories, and lock-screen PINs, facilitating account takeovers. Mantax Otax requests device-administrator rights and seeks access to SMS messages, contacts, and media files. It encrypts files on devices running Android 9 and earlier using AES encryption and demands a ransom for recovery. Although the impact is reduced on Android 10 and later due to Scoped Storage, the malware still poses significant surveillance risks. The malware collects extensive sensitive data, including contacts, call logs, and location data, and targets multi-factor authentication codes. It uses a deceptive system-lock overlay to capture PINs and has introduced features like WebSocket communications and disruptive pop-ups in its second iteration. Users are advised to be cautious when installing applications, avoid unsolicited APKs, and reject permissions that do not align with an app's purpose. In case of suspicious activity, users should disconnect from networks and seek help before entering sensitive information. Organizations should monitor for signs of this malware on managed devices.

AppWizard

September 10, 2026

Steam’s latest beta brings ‘Big Art’ to Big Picture Mode and Steam Deck, and customizable screensavers too

The latest beta release of the Steam client includes several enhancements, particularly the new "Big Art Mode," which changes the home screen to display large artwork from games against a simplified backdrop. This mode reduces the size of the carousel for recently played games, creating a more spacious layout. The update also introduces a screensaver feature with options for a game art slideshow or a retro bouncing logo, along with the ability to load custom screensavers. Additional improvements include enhanced startup performance, bug fixes, improved game recording stability, in-game overlay fixes, better Steam Input performance, Linux support enhancements, and adjustments to Remote Play, such as removing the PIN requirement for app downloads. Users can access the beta through the Steam settings menu.

AppWizard

September 10, 2026

Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks

The Gigabud banking trojan installs a secondary Android application called Vwork, which creates a work profile on compromised devices to evade detection from banking app security measures. This work profile separates its contents from the personal space of the device, allowing fraudulent transactions without triggering alerts. Group-IB confirmed this operational chain in Indonesia, where Gigabud has been active since 2022 and is linked to the GoldFactory group, which uses deceptive tactics to distribute the trojan. Vwork simplifies the creation of a work profile and communicates with an external server for authorization before cloning apps. The report indicates that Vwork has been detected in various countries, while approximately 1,469 devices and 1,281 logins were compromised in Indonesia, leading to estimated losses of around ,000,000. Users can check for a work profile in their phone's settings and are advised to download apps only from official stores and to deny unnecessary Accessibility access.