SMS Archives

AppWizard

January 15, 2026

Chinese app “Sileme” not available for download on Apple, Android app stores

The app "Sileme," which translates to "are you dead," has been removed from both Apple and Android app stores, confirmed by a search conducted by the Global Times. Following its delisting, similar apps have emerged, such as "Alive Yet? - Dead Yet? SMS Version" and "Dead Yet? Drift Version." One of Sileme's founders, surnamed Guo, confirmed its removal. Sileme's official Weibo account announced a daily check-in feature and invited the public to suggest a new Chinese name, while also revealing plans to adopt the global brand name "Demumu" in the next version. The app is designed as a safety tool for individuals living alone, allowing users to check in daily, with alerts sent to emergency contacts if they fail to do so within a set timeframe.

AppWizard

December 25, 2025

Android Malware Operations Merge Droppers, SMS Theft, and RAT Capabilities at Scale

Threat actors in Uzbekistan are increasingly using sophisticated tactics to target mobile users, specifically through malicious dropper applications that appear as legitimate software. A recent analysis by Group-IB identified an Android SMS stealer called Wonderland, which was previously known as WretchedCat. Unlike traditional Trojan APKs that activate malware immediately upon installation, Wonderland utilizes droppers that activate malicious payloads locally after installation, even without an internet connection. Wonderland enables bidirectional command-and-control communication, allowing real-time execution of commands, including SMS theft and USSD requests. It disguises itself as Google Play or various file formats to evade detection. The financially motivated group behind this malware, TrickyWonders, uses Telegram for coordination and was first detected in November 2023. Wonderland is associated with two dropper families: MidnightDat and RoundRift. Propagation methods for Wonderland include counterfeit Google Play Store pages, Facebook ads, and fake accounts on dating apps. Attackers exploit stolen Telegram sessions from Uzbek users to distribute APK files. Once installed, Wonderland can access SMS messages, intercept one-time passwords, and siphon funds from victims' bank accounts. It can also retrieve phone numbers, exfiltrate contact lists, suppress security alerts, and send SMS messages from compromised devices. Users must enable installations from unknown sources to sideload the app, often misled by a fake update screen. If granted permissions, attackers can hijack the phone number and log into the associated Telegram account, perpetuating the malware's spread. Wonderland represents a significant evolution in mobile malware in Uzbekistan, moving from basic malware like Ajina.Banker to more sophisticated variants like Qwizzserial. The use of dropper applications enhances its deceptive nature, allowing it to evade security checks. Both the dropper and SMS stealer components are heavily obfuscated, complicating reverse engineering. The supporting infrastructure for Wonderland is dynamic, with rapidly changing domains complicating monitoring efforts. Malicious APKs are generated through a Telegram bot and distributed by a network of threat actors. New strains of malware, such as Cellik, Frogblight, and NexusRoute, have also emerged, each capable of harvesting sensitive information from compromised devices.

Tech Optimizer

December 25, 2025

New malware can read your chats and steal your money

The Android banking trojan Sturnus has emerged as a significant cybersecurity threat, capable of taking control of a device's screen, stealing banking credentials, and accessing encrypted communications from trusted applications. It operates stealthily, capturing decrypted messages without breaking encryption. To protect against Sturnus, users should employ robust antivirus software, be vigilant with app prompts, and exercise caution with links and attachments, as malware is often spread through these channels. Attackers can remotely control devices to execute financial transactions without user knowledge.

AppWizard

December 22, 2025

Frogblight Malware Targets Android Users With Fake Court and Aid Apps

A new Android-based Trojan named Frogblight is targeting mobile users in Turkiye to steal funds from bank accounts. Identified by Kaspersky's Securelist in August 2025, it spreads through smishing, where scammers send deceptive SMS messages about legal court cases or financial aid. These messages often include links to download malicious applications disguised as legitimate support tools. The malware, which can conceal itself and deactivate on simulated devices or within the U.S., requests extensive permissions to access SMS messages and device storage. Once installed, it opens a legitimate government website to appear credible and injects JavaScript to record keystrokes during banking logins. Recent versions have added keylogging, contact list theft, and private call log collection. The malware has evolved to disguise itself as the Google Chrome browser and other tools, and its source code is available on GitHub, indicating it may be marketed as malware-as-a-service. Kaspersky advises users to avoid downloading APK files from untrusted sources and to scrutinize app permission requests.

AppWizard

December 18, 2025

Kimsuky Spreads DocSwap Android Malware via QR Phishing Posing as Delivery App

A new Android malware campaign has been launched by the North Korean threat actor Kimsuky, introducing a variant called DocSwap. This malware is distributed via QR codes on phishing websites that impersonate CJ Logistics. Attackers use QR codes and notification pop-ups to lure victims into downloading the malware, which decrypts an embedded APK and activates Remote Access Trojan (RAT) capabilities. The malicious app is disguised as a legitimate application to bypass Android's security measures. Victims are tricked into installing the app through smishing texts or phishing emails that mimic delivery companies. The app downloads an APK named "SecDelivery.apk," which then loads the malware. It requests permissions to access various device functions and registers a service that simulates an OTP authentication screen. The app connects to an attacker-controlled server, allowing execution of commands such as logging keystrokes, capturing audio, and gathering sensitive information. Additionally, two other malicious samples have been identified, disguised as a P2B Airdrop app and a trojanized version of the BYCOM VPN app. The campaign also includes phishing sites mimicking popular South Korean platforms to capture user credentials.

BetaBeacon

December 17, 2025

Is Minecraft APK Safe?

- APK stands for Android Package Kit and is used to install apps on Android devices. - Installing an APK manually outside of Google Play Store's protections can eliminate a layer of security. - APK files can hide malware, spyware, and other dangerous software. - Fake sites and phishing dangers are common when downloading APKs from unofficial sources. - Unusual permissions and hidden data access can be a risk when installing APKs. - APKs from unofficial sources may not receive automatic updates or security patches. - Research studies show that cracked apps are more likely to be flagged as malicious. - Legal and ethical considerations should be taken into account when downloading APKs. - It is recommended to prefer official sources, scan with a mobile antivirus, check permissions, and avoid piracy to stay safe when downloading APKs.

AppWizard

December 12, 2025

Before You Download a Minecraft APK, Read This

Minecraft is one of the most downloaded games in history, leading to a high demand for free or modded APK versions, particularly among Android users. Downloading unofficial Minecraft APKs is generally unsafe due to several risks: 1. High malware infection rates: Gaming APKs are significant conduits for Android malware, with Minecraft APKs frequently flagged. Reports indicate that game-related APK downloads account for 19% to 28% of Android trojan distribution cases. 2. Fake Minecraft APK sites often engage in phishing: Over 50% of such sites feature intrusive ads or misleading download buttons, and nearly 30% redirect users to phishing landing pages. 3. Modified APKs may request dangerous permissions: Many modified APKs ask for permissions that exceed basic functionality, such as access to SMS, device admin privileges, and the microphone and camera. 4. Lack of automatic updates creates long-term security vulnerabilities: APKs from external sites do not receive automatic updates, may contain known vulnerabilities, and can be replaced by more harmful versions. An example is given of a user named John, who downloaded a seemingly harmless APK that contained hidden spyware, leading to issues with his device and privacy. Many users download Minecraft APKs to avoid purchase costs, but the risks to their devices and data are significant.

AppWizard

December 8, 2025

Android Malware FvncBot, SeedSnatcher, and ClayRat Gain Stronger Data Theft Features

Cybersecurity researchers have identified two new families of Android malware, FvncBot and SeedSnatcher, as well as an upgraded version of ClayRat. FvncBot is designed to target mobile banking users in Poland, masquerading as a security application from mBank. It is built from scratch and includes features such as keylogging, web-inject attacks, screen streaming, and hidden virtual network computing (HVNC). It uses a crypting service called apk0day and communicates with a remote server at naleymilva.it.com. FvncBot requests accessibility permissions to operate with elevated privileges and can perform various malicious activities, including exfiltrating data and delivering overlays on targeted applications. SeedSnatcher is disguised as a cryptocurrency wallet app called Coin and is distributed via Telegram. It focuses on stealing cryptocurrency wallet seed phrases and can intercept SMS messages to capture two-factor authentication codes. It employs techniques like dynamic class loading and WebView content injection to evade detection and initially requests minimal permissions before escalating its access. The upgraded ClayRat malware now exploits accessibility services and default SMS permissions, allowing it to record keystrokes, capture screen content, and present deceptive overlays. It has been distributed through fraudulent phishing domains and dropper apps that impersonate legitimate services. The enhanced capabilities of ClayRat enable complete device takeovers and persistent overlays, making it a more significant threat than its previous version.

AppWizard

December 3, 2025

TREK: T.I. SMS For Android

The TREK: T.I. SMS application is an SMS/MMS messaging app with a rating of 4.3 stars from over 5,000 user reviews. It features customizable options, including security and privacy management, data controls, dual SIM support, group messaging, customizable notifications, delayed messaging, message filters, themes, widgets, and popup replies. The app's interface is inspired by retro sci-fi designs and uses public domain graphics to avoid copyright issues. It is available for USD 3.49 and is compatible with various Android devices, rated for all ages. Users can follow the developer, NSTEnterprises, on Facebook for updates.

AppWizard

December 2, 2025

All phones sold in India will be pre-installed with a state-owned ‘security’ app that needs access to all phone permissions — and you can’t delete or uninstall it

The Indian government's Department of Telecommunications has mandated that all phone manufacturers pre-install the Sanchar Saathi app on their devices to enhance connectivity and security. Android manufacturers must comply with this directive for future models, and an OTA update will be provided for existing devices. Apple is also required to include the app on iPhones. The Sanchar Saathi app has over 10 million downloads and requires extensive permissions, including access to phone state, SMS, camera, call logs, and device storage. Manufacturers such as Vivo, Xiaomi, and OnePlus have not yet commented on the directive, while OPPO is assessing the situation and Samsung has not responded to inquiries.