overlays Archives

AppWizard

August 23, 2026

Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices

A new Android malware threat, codenamed Manic, poses significant risks to Ukrainian banks, government services, and messaging applications, with a reach extending to Russian and European financial institutions, global fintech platforms, cryptocurrency services, and military communication channels. Manic combines Android banking malware and mobile spyware, targeting sensitive applications and enabling comprehensive device takeover. It features a novel Wi-Fi mesh technique for data relay through compromised devices and utilizes phishing sites and dropper apps. The malware originated in February 2026, with initial development leading to its first deployment by late May. It monitors 169 package IDs related to banks, payment services, and messaging applications, primarily affecting Ukrainian targets but also impacting applications in Russia and Europe. Manic can infiltrate commercial and military messaging apps, track locations, monitor notifications, and collect files. It exploits Android's accessibility services to capture sensitive data and employs a store-and-forward relay mechanism for data exfiltration through nearby compromised devices. Google has stated that no apps containing this malware are found on Google Play, and Android users are protected by Google Play Protect.

Winsage

August 10, 2026

Windows 11’s built-in weather app hogs more than 1.2 gigabytes of RAM just to tell the forecast — memory-sucking web wrapper filled with ads masquerades as an actual application

Microsoft is addressing issues related to user dissatisfaction with its Windows operating system, which has faced criticism for lack of optimization, excessive bloat, and intrusive advertisements. The built-in weather application, MSN Weather, exemplifies these problems, consuming up to 1.2GB of RAM while idling and displaying ads despite being part of a paid OS. In contrast, Apple's macOS weather app uses about 250MB of memory and operates ad-free. MSN Weather functions as a web wrapper, utilizing eight Chromium-based subprocesses, which raises concerns about its efficiency. Microsoft plans to update all native Windows applications to the Win32 standard for better optimization, but it is unclear if this will also apply to MSN-branded services like MSN Weather. Users have shown a preference for mobile devices over the weather widget introduced in Windows 11.

AppWizard

August 7, 2026

Marvel Tōkon Fighting Souls launches with PC performance issues and mixed Steam ratings

Players of Marvel: Tōkon Fighting Souls are experiencing performance issues on PC, leading to a Mixed rating on Steam with only 43% positive feedback. The game suffers from persistent micro-stutters during gameplay, launch failures, and significant challenges for Linux users, who are unable to access the game. A Reddit user highlighted that the game has regular micro-stutters regardless of hardware or settings, with frame-time graphs showing frequent spikes correlating to visible stutters. These issues disrupt online matches due to dropped frames. Even high-end hardware does not alleviate the stuttering, and external frame-rate limiters do not resolve the visible stutters. Steam reviews reflect concerns about performance, with some users reporting issues before launching the game. Linux users are particularly frustrated as the game blocks any attempts to launch on Linux systems, unlike another title from the same developer. The game is also not compatible with the Steam Deck due to similar Linux-related issues. Arc System Works has released a day-one patch aimed at improving performance, including reducing CPU load and addressing performance drops associated with overlays, but players are still awaiting feedback on its effectiveness.

AppWizard

July 26, 2026

These 11 paid Android apps are worth every penny I spent

Stellarium Plus is a digital sky guide that shows celestial object positions and offers guided Tours and a calendaring feature. Buzzkill is a notification manager that allows personalized rules for alerts. Key Launcher Pro replaces the default Pixel Launcher with rapid search capabilities and additional features like Super Shortcuts and Focus Mode. Octopi Launcher Pro allows custom layouts for foldable devices, enhancing user experience through regular updates. KWGT Pro is a widget creation tool that enables device personalization with additional features in the Pro version. Tropical Hurricane Tracker provides timely updates on tropical weather conditions from NOAA and NWS, with an ad-free option available. PeakFinder identifies nearby mountains using the phone's camera and location, providing names and elevations. Hermit Premium transforms web pages into standalone web apps, enhancing privacy with an editable ad blocker and multiple profiles. Moon+ Reader Pro offers extensive customization for reading, including PDF editing tools. SuperDisplay provides low-latency connections that mimic a dedicated monitor. Tasker is an automation tool that allows users to create complex automation recipes for enhanced productivity.

AppWizard

July 23, 2026

Active Exploitation Alert: Fake Bahrain Alert App Deploys Advanced Android Surveillance Malware Targeting Gulf Region Users

A cyber-espionage campaign has been identified involving a counterfeit Bahrain Alert Android application designed to surveil individuals in Bahrain and the Gulf region. The app masquerades as an official civil defense tool and employs social engineering tactics to compromise Android devices, extract sensitive data, and maintain remote access. It targets high-value individuals such as activists and journalists, particularly during civil unrest and missile alerts, leveraging trusted government branding to increase infection rates. The malware features a complex, multi-stage architecture with advanced evasion techniques and is distributed through phishing links and malicious websites. It initiates a four-stage infection process, ultimately installing a remote access trojan (RAT) that enables covert surveillance and encrypted communications. The malware can monitor device activity, capture credentials, and intercept communications, while also employing mechanisms to avoid detection and maintain persistence. The campaign primarily targets Bahraini citizens, exploiting fear during crises to encourage app installation. Although there are indications of Russian-speaking developers involved, there is no definitive attribution to a specific nation-state or APT group. Mitigation strategies include monitoring for suspicious app installations, user education on verifying app authenticity, and blocking known malicious domains.

Winsage

June 24, 2026

Here are 5 Windows 11 features coming in July. None of them require AI

Microsoft will release five new features for Windows 11 in July, with an optional preview available in June. Key features include the ability to pause updates for up to 35 days using a calendar view, the Point-in-Time Restore (PITR) feature that automatically generates restore points for the system, and the Screen Tint feature to reduce eye strain with customizable color overlays. Improvements in Bluetooth connectivity will enhance performance, especially for AirPods and Beats Studio Pro headphones. The taskbar widgets will change to reduce distractions by not expanding on cursor hover, and notification icons will be streamlined. These features will be available through an optional update at the end of June or a mandatory update in July.

AppWizard

June 19, 2026

Rokarolla trojan uses screen overlays to hijack Android financial apps

A new banking trojan for Android, named Rokarolla, targets 217 applications, including banking and cryptocurrency platforms, to steal credentials and sensitive financial data. It operates via a command and control (C2) server and bypasses the Google Play Store by using phishing websites that mimic legitimate download portals. Users are tricked into downloading a dropper that installs the malware, which disguises itself as the Google Play Protect security tool to gain access to Android Accessibility Services. Rokarolla employs dynamic screen overlays to capture user input in targeted financial applications and can also impersonate the device's lock screen. Additionally, it uses a pseudo-VNC system to intermittently capture screenshots for data extraction and can modify clipboard contents to manipulate cryptocurrency transactions by replacing copied addresses with those controlled by attackers.

AppWizard

June 17, 2026

New Rokarolla Android Trojan Targets 217 Banking and Crypto Apps

Zimperium’s zLabs researchers have analyzed a newly identified Android banking trojan named Rokarolla, which targets 217 distinct banking and cryptocurrency applications. It is distributed through malicious websites that impersonate popular platforms like TikTok and Google Chrome, with one identified distribution point being hxxps://infocontablidades[.]it[.]com/. The malware uses a dropper disguised as Google Play Protect to install a second-stage payload and gain Accessibility Services access, allowing it to simulate user interactions and manipulate on-screen elements. Rokarolla downloads counterfeit HTML login pages for targeted applications and overlays them to capture user credentials, including sensitive card information. It can also deploy a fraudulent PIN entry screen, read and send SMS messages, intercept one-time codes from banks, and block incoming calls. The malware rewrites the clipboard, operates a keylogger and screen content logger, and scrapes WhatsApp contact data. It captures screenshots without alerting users and has a resilient command-and-control infrastructure with multiple fallback domains. No product flaws are exploited, and defenses against it include installing apps only from Google Play and being cautious with Accessibility Services. Zimperium’s Mobile Threat Defense and zDefend products can detect Rokarolla, and a list of indicators of compromise is available on their GitHub repository.

AppWizard

June 16, 2026

New Rokarolla Android malware targets 217 banking, crypto apps

A new Android banking trojan named Rokarolla targets 217 banking and cryptocurrency applications and features 137 commands for malicious activities. It is distributed via deceptive websites posing as legitimate application sources and impersonates Google Play Protect to lure users into installing infected apps. Once installed, it seeks Accessibility service permissions and access to notifications, SMS, and calls. Rokarolla communicates with a command-and-control server, sending device profiles to generate unique identifiers for victims. Its primary goal is to steal financial information by using deceptive login overlays to capture sensitive data and maintain control over the device. The malware employs evasion tactics such as disabling Google Play Protect, hiding its icon, silencing notifications, and keeping the screen awake. It can steal SMS messages, extract contacts, capture keystrokes, record screen content, manipulate clipboard contents, block calls, and take screenshots. Zimperium confirms that Rokarolla is not found on Google Play, and users are advised to avoid downloading APK files from untrusted sources and to be cautious with Accessibility permissions.

AppWizard

June 16, 2026

New Rokarolla Android Malware Steals PINs, SMS Codes, and Crypto Wallet Funds

Security researchers at Zimperium's zLabs have identified a new Android banking trojan named Rokarolla, which can target 217 banking and cryptocurrency applications and execute 137 remote commands. The malware spreads through deceptive websites that impersonate popular apps, installing a dropper that mimics Google Play Protect to gain Accessibility access. It uses overlay techniques to capture sensitive information by displaying counterfeit login pages and can intercept SMS messages, including one-time codes from banks. Rokarolla also features a keylogger, screen logger, and can rewrite clipboard contents to divert cryptocurrency payments. It employs advanced methods for discreet data capture and has multiple fallback command-and-control domains, making it resilient against takedowns. There is no patch available for this malware, and users are advised to install apps only from Google Play and remain cautious of unexpected Accessibility requests. Zimperium's products can detect this malware, and indicators of compromise are available on their GitHub repository.