sideloading Archives

Tech Optimizer

July 10, 2026

Hackers Use Fake VLC Executable and Malicious libvlc.dll to Deploy ValleyRAT

Cybercriminals are exploiting the VLC media player to install ValleyRAT, a remote access trojan, by embedding malware in a seemingly harmless file linked in phishing emails. The attack starts with an email that prompts the victim to download a ZIP archive containing a fake VLC executable and a malicious DLL named libvlc.dll. This method uses DLL sideloading to execute the malware under the guise of a legitimate application. Once executed, the malware establishes persistence by creating a registry entry and connects to a remote server to retrieve the final payload. ValleyRAT employs evasion tactics to avoid detection, including assessing system characteristics before executing harmful actions and using a fileless approach to deliver the payload directly into memory. Researchers have identified indicators of compromise, including specific SHA1 hashes and URLs associated with the malicious campaign.

AppWizard

July 9, 2026

Play Store Catalog Interoperability Goes Live July 22: Android Developers Must Decide

On July 22, 2026, Google Play will launch its Play Catalog Access program, allowing third-party Android stores in the U.S. to access app listings from the Google Play Store, including names, icons, descriptions, screenshots, and metadata. Developers will be automatically enrolled unless they opt out by the deadline. The program enables these stores to showcase app listings while downloads will still occur through Google Play Console, ensuring Google’s service fee applies. All downloaded apps will undergo Play Protect scanning, and enrolled stores must prevent malware distribution, maintaining a malware installation-attempt rate below one percent. A December 2023 jury verdict found that Google violated federal and California antitrust laws, leading to a Ninth Circuit decision that requires Google to grant third-party app stores access to its catalog, dismantling barriers to competition. The legal battle began in August 2020 when Epic Games sought changes to counter Google's monopolistic practices. A March 2026 settlement introduced a tiered service fee structure, reducing costs for developers from a flat 30 percent commission to 20 percent for new installs and 10 percent for subscriptions. Developers can choose to publish all listings to all enrolled stores, manage stores individually, or opt out entirely. If no action is taken before July 22, Google will automatically share the app's listing with all enrolled third-party stores. The Play Catalog Access program aims to address the cold-start problem faced by alternative stores but does not guarantee a competitive ecosystem, as third-party stores must still create compelling user experiences to attract customers.

Tech Optimizer

July 7, 2026

7 Habits That Are More Important Than Using Antivirus on Your Phone

Antivirus software was once standard on personal computers, but modern smartphones have evolved with enhanced security measures from Apple and Google, making them less vulnerable to traditional malware. Smartphones isolate applications, allowing them only to access user-permitted information, and if a malicious app infiltrates, it faces significant challenges due to built-in defenses. Apple requires thorough vetting of apps through the App Store, which enhances security but limits antivirus capabilities. Android allows sideloading apps from outside the Google Play Store, which introduces risks but also includes built-in security features like Google Play Protect and regular updates. Despite these advancements, smartphones can still be compromised, and cybercriminals increasingly target user accounts through phishing tactics rather than malware. Security experts recommend focusing on phishing awareness, strong passwords, and two-factor authentication. For enhanced security, users should keep devices updated, download apps from official sources, review app permissions, use strong passwords, utilize a password manager, enable two-factor authentication, and be cautious with unexpected communications. While most users may not need antivirus apps, those who frequently sideload or download from unfamiliar sites may benefit from additional security tools.

AppWizard

July 6, 2026

Latest Android Auto updates are crashing for some users

Users of Android Auto are experiencing significant crashing issues, particularly after the release of version 17.2, with some instability also noted in version 17.1. The application crashes shortly after launch, often when users navigate the map or select media, causing the vehicle's display to revert to the native infotainment system. Most affected users are part of the Android Auto beta program, while those on the stable track using version 17.0 have not reported similar problems. Users can revert to a more stable version by exiting the Play Store beta program, uninstalling updates, or sideloading an APK of a previous version.

AppWizard

July 6, 2026

There’s one group of Android users Google’s new sideloading rules won’t affect

LineageOS will not be affected by Google's upcoming developer verification system, which applies only to certified Android devices that come with Google Mobile Services (GMS). LineageOS operates independently of GMS and does not go through Google's certification process, making it exempt from the new requirements. Starting September 30, 2026, Android devices in Brazil, Indonesia, Singapore, and Thailand will require all apps to be registered to a verified developer, with a global rollout in 2027. LineageOS has stated that it does not include the verification feature in its ROM and is unaware of any GApps package that would enable it. The project may disable the verification feature if integrated into Play Services in the future. LineageOS acknowledges concerns from organizations like F-Droid and the EFF regarding the potential for increased control over app distribution by Google.

AppWizard

July 5, 2026

I tried a hidden Android Auto feature Google doesn’t want you to know about

Android Auto can be expanded through the installation of third-party applications, allowing users to go beyond its default navigation and media functionalities. To sideload apps, users must enable Developer Mode on their Android device and for Android Auto, then install the Android Auto Apps Downloader (AAAD) from a GitHub page. Notable third-party apps include CarStream, which allows YouTube streaming while driving, AAMirror for screen mirroring, and Fermata Auto, which supports various multimedia functions. However, sideloading raises safety concerns and may lead to issues with app functionality due to updates from Google.

Tech Optimizer

July 3, 2026

Hackers Use Fake VLC Executable and Malicious libvlc.dll to Deploy ValleyRAT

Cybercriminals are using a sophisticated method to bypass security measures by embedding malware within the VLC media player. This campaign exploits VLC to install ValleyRAT, a remote access trojan, through phishing emails that contain links to download a seemingly harmless file. Once the file is opened, it activates a hidden backdoor that evades detection by antivirus solutions. The malware has been active since 2023, with a significant increase in activity noted through 2025 and into 2026, particularly targeting Chinese and Japanese-speaking users. The infection process begins when a victim clicks a link in a phishing email, leading to a ZIP archive containing a disguised executable and a malicious DLL (libvlc.dll). The executable mimics a legitimate VLC file, and when executed, it loads the DLL, allowing the malware to run under the guise of VLC. The malware establishes persistence by creating a registry entry and connects to a remote server to retrieve the final payload. ValleyRAT employs evasion tactics to avoid detection, such as performing checks on system behavior and using a fileless approach to inject its payload directly into memory, avoiding storage on disk. Researchers recommend training employees to recognize suspicious filenames and deploying endpoint detection tools to identify DLL sideloading behavior. For organizations affected by this campaign, isolating compromised systems and reviewing security logs are critical initial steps. Indicators of compromise include a malicious email domain, a ZIP archive containing a fake VLC executable, and a download URL for ValleyRAT.

AppWizard

June 28, 2026

The Steam client was hurting PC gaming on Android — Valve’s VR headset accidentally solved it

Playing Windows games on Android has become feasible due to Winlator and open-source technologies like Wine, Box64, and DXVK. User-friendly applications such as GameHub and GameNative have emerged, enhancing mobile gaming experiences to rival dedicated handheld consoles. A major challenge was the reliance on the x86 Windows Steam client, which was resource-intensive on mobile devices. GameNative 1.0 introduced an experimental feature that eliminates the need for the desktop Steam client by using Valve's native Android libraries, improving the gaming experience significantly. Valve released Steamworks SDK version 1.63 in November 2025, which included native ARM64 libraries for Android, allowing for essential Steam functionalities without a translation layer. GameNative integrated these libraries, replacing the desktop client with a more efficient "bionic" Steam client that operates without a user interface, streamlining DRM and matchmaking processes. GameNative now supports Steam Guard TOTP sign-in, enabling smooth authentication and access to the user's Steam library. It downloads games natively, supports cloud saves, and is compatible with most single-player games with Steam DRM. The application boasts a high compatibility rate, with 221 out of 241 games in one user's library showing as compatible. GameNative 1.0 has improved performance with a Vulkan renderer and reworked controller stack. Despite its success, GameNative is not yet available on the Play Store, with nearly a million users sideloading the application. Developers aim to create a Play Store version that complies with Google's policies for easier installation.

AppWizard

June 22, 2026

Google reveals new timeline for Android’s app sideloading changes

Google is rolling out a new system service for Android devices to enhance app sideloading safety, starting this month. In July, the Android Developer ID Status API and early access to the Android Developer Console API will be introduced globally, along with limited distribution accounts for students and hobbyists. By August, these accounts and the new API will be fully launched. The developer verification protections will take effect by September 30 in Brazil, Indonesia, Singapore, and Thailand, requiring app registration for participating app stores. Options for sideloading unregistered apps will still be available through Android Debug Bridge (ADB). By 2027, Google plans to expand the developer verification requirement globally. Developers in the initial countries must complete the verification process by September.

AppWizard

June 22, 2026

Google Sets Sept. 30 Deadline for Android Developer Verification in Four Countries

Google will implement Android developer verification on September 30, 2026, in Brazil, Indonesia, Singapore, and Thailand. Certified Android devices will block installations of apps from unverified developers, affecting both Google Play and major device-maker app stores. Starting June 2026, the Android Developer Verifier will ensure apps are associated with verified developers before installation. Unregistered apps will not install via standard methods post-September 30 but can be sideloaded through a complex process. Developer registration began in March, requiring legal identification and app ownership verification. Google aims to combat malware with this initiative, which has faced backlash from open-source advocates like F-Droid and the Keep Android Open campaign. The global rollout is set for 2027, with ongoing concerns about appeals processes and the impact on pseudonymous developers.