Even with one of the best MacBooks, you can never be too careful when downloading new apps. Case in point: a new malicious Mac app is posing as a legitimate Apple tool to steal passwords, keychain data and more from vulnerable systems.

As reported by BleepingComputer, the app in question serves as a means to infect vulnerable Apple computers with a new Mac info-stealer. While security researchers at Jamf first observed it back in May when it was still in development, this malware is now being actively used by cybercriminals in their attacks.

Dubbed CrashStealer, what makes this Mac malware strain so dangerous is the way in which it perfectly mimics Apple’s own macOS crash reports. Although something might seem off to more discerning users, others could easily fall for this attack given how much care and attention has gone into impersonating this legitimate tool.

Here’s everything you need to know about this new Mac malware and how you can keep your own MacBook and all the sensitive data it contains safe from hackers.

Impersonating a legitimate Apple utility

In their report, Jamf’s security researchers explain how the malware hides in plain sight by posing as a meeting platform called Werkbit. While they don’t go into details about the malware’s initial distribution method, a malicious app like this could be distributed via fake ads or on a developer-focused site like GitHub.

After downloading the app, it’s mounted on your desktop just like with any new software you download for your Mac. Surprisingly, though, the hackers behind this campaign are using a signed and Apple-notarized installer to distribute their fake app. Not only does this add a sense of legitimacy to the app but it also allows it to bypass Apple’s built-in Gatekeeper security feature without any warnings whatsoever.

When launched for the first time, the app displays a fake macOS password prompt that looks strikingly similar to what you’d see when downloading new software manually as opposed to through the Mac App Store. Once a victim puts in the password for their Mac, the hackers then have everything they need to unlock their Apple Keychain which acts as macOS’ encrypted password vault and contains all sorts of sensitive info like saved credentials in Safari, app passwords, Wi-Fi passwords and more.

The CrashStealer malware isn’t just limited to stealing from your Keychain though. It can also steal browser credentials and cookies from Chrome and other Chromium-based browsers as well as Firefox. Likewise, it can steal data from 80 different crypto wallet extensions and 14 of the best password managers including 1Password, LastPass, Dashlane and more.

To get all of this stolen data off your Mac, the malware encrypts it before packaging it into hidden ZIP archives and uploading it to a hacker-controlled C&C server.

By using a signed and notarized dropper and a re-signed payload, CrashStealer is a sophisticated Mac malware that’s especially good at avoiding detection.

How to stay safe from Mac malware

If you’re worried about CrashStealer and other Mac malware, the first thing you should do is to avoid sideloading apps, or in this case, installing new apps from anywhere besides the Mac App Store.

Just like on one of the best Android smartphones, when you download new apps from websites instead of an official app store, you’re putting your devices and the data they contain at risk. Apps submitted to the Mac App Store go through rigorous security checks while those you download from a random website don’t.

Normally when you download an unverified app from the web, macOS’s built-in Gatekeeper security feature will block it or warn you before you install it. In this case, though, that doesn’t happen since the installer used in this campaign is signed and appears to be legitimate. Well, at least in Gatekeeper’s eyes.

While Gatekeeper can keep you safe from most threats, there are ones like this that manage to bypass its defenses. For this reason, you might want to consider using one of the best Mac antivirus software solutions alongside Apple’s built-in ones. That way, if something slips past Apple, your third-party antivirus software will be able to stop the threat before it can do serious damage.

Since CrashStealer is still a relatively new Mac malware, this likely won’t be the last time we see it. This is why you always need to be extra careful when downloading and installing new software onto your Apple computer.

More from Tom’s Guide

• New PamStealer Mac malware poses as a clipboard manager to steal login info
• Apple’s ‘Hide My Email’ reportedly exposing real email addresses
• GTA 6 warning: Pre-order scams are stealing users' info and spreading malware

Security researchers who focus on Apple devices have discovered a new macOS malware that appears to be surprisingly clever while it harvests data and login credentials.

According to the IT firm Jamf (via ArsTechnica), the new malware, dubbed PamStealer, can get on your Mac in two stages. First, it disguises itself as Maccy, a clipboard manager.

Apparently, PamStealer is compiled as AppleScript written in Rust that uses the Pluggable Authentication Modules interface that is built into macOS to target the device's login password, which is then sent to an attacker-controlled server.

What makes PamStealer unique is that it combines AppleScript and disk images to stealthily enter your computer. When you click the AppleScript, it opens the macOS Script Editor where the malware is buried in the file.

"Rather than relying on shell commands such as curl or zsh, the AppleScript executes a self-contained JavaScript for Automation (JXA) downloader that retrieves and stages the payload using native Objective-C APIs," the Jamf team wrote. "Combined with a Rust-based second stage and a password capture workflow that validates credentials locally through PAM, the result is a quieter execution chain than we typically observe in commodity macOS stealers."

How PamStealer works

When someone installs the false Maccy and opens the disk image, they're prompted to enter Command-R immediately. Doing so executes the malicious code inside AppleScript. This allows it to bypass com.apple.quarantine, a normal macOS feature that offers warnings and restrictions when you're opening executable files from the internet.

The second stage is a Mach-O file specifically written for Macs running Apple M-series CPUs. Rust is apparently an uncommon code for macOS infostealers. This bundles SQLite and calls it read interface, meaning it opens and reads databases files directly.

PamStealer will pop up a native password prompt that is meant to resemble a system authorization request. It reads, "“Maccy wants to make changes. Enter your password to allow this.”

Once a password is entered, it's validated through the PAM API, meaning its harder for malware defenders to detect. Additionally, it can either give a malicious actor full disk access or inject code designed to access Ethereum accounts.

“Together, these behaviors illustrate how commodity macOS stealers continue to evolve, adopting quieter execution chains and native implementations that reduce traditional detection opportunities while remaining compatible with standard macOS features,” Jamf said.

How to stay safe from PamStealer

First and foremost, Maccy is a real, legitimate app that is quite popular. If you are interested in checking the app, the only real website is maccy.app.

Jamf found the fake Maccy was being hosted at maccyapp.com, a site you should not visit.

Secondly, it's a good reminder to double and triple-check website URLs. Specifically for macOS apps, you can also see if the app in question is available in the Apple App Store. Maccy, for instance, is in the App Store.

Apple is still a pretty closed garden so if you're looking for something and want to be sure it's real, I would recommend starting there before venturing into the hinterlands of the internet.

Beyond that, your Mac does come with built-in security software in the form of XProtect. But if you need some extra protection, it might be worth investing in one of the best Mac antivirus software solutions to run alongside it.

More from Tom's Guide

• Apple’s ‘Hide My Email’ reportedly exposing real email addresses
• What is Q-Day?
• 'Amazon put identity theft victims through a Kafkaesque ordeal': FTC issues $2.5 million fine over denying requests

Even though you should always download new apps from official sources like the Google Play Store, some Android users still end up getting tricked into downloading them from websites which can be extremely dangerous. Case in point, a new Android banking trojan is currently making the rounds online that’s distributed via fake apps from malicious websites.

As reported by BleepingComputer, once installed on vulnerable Android phones, the banking trojan in question is capable of targeting over 200 banking and financial apps to drain accounts and steal crypto. Unsurprisingly, it does so by impersonating Google Chrome and TikTok as both apps are extremely popular.

The trojan installs the new Rokarolla malware which also steals lock screen credentials, your contacts, SMS data and even uses keyloggers to record everything you type into your phone.

Here’s everything you need to know about this new Android banking trojan and how you can keep your bank account safe from the cybercriminals using it in their attacks.

Masquerading as Google Play Protect

Although you should never sideload Android apps unless you absolutely have to, many people still do despite the risk. The hackers behind this campaign use fake websites to trick unsuspecting users into installing Chrome or TikTok unofficially instead of downloading these apps directly from the Google Play Store like they should.

According to a new report from the cybersecurity firm Zimperium, after downloading either app though, the hackers use an interesting trick to give potential victims the illusion of safety. For those unfamiliar, Google’s built-in security app Google Play Protect checks any new software you download for viruses. However, in this case, a fake Play Protect pop-up appears before the Rockarolla malware is actually downloaded. Given the fact that the pop-up perfectly impersonates a Play Protect warning, most users wouldn’t think twice before proceeding with this secondary download.

At this point, the damage is done and the Rockarolla malware gets to work. In total, it’s able to spoof 217 different banking and financial apps to steal your credentials. It does so by using overlays that mimic each individual app. While to the end user it appears as if they’re just logging into their online bank account, they’re actually handing over their username and password to hackers.

Another interesting trick up Rockarolla’s sleeve is that it can steal SMS notifications from your online bank as well as intercept any calls trying to warn you that something is amiss. This way, you won’t get a fraud alert and the hackers can proceed to empty your accounts one by one.

While Google continues to improve Android’s security, if you don’t download apps the right way, you too could easily end up falling victim to this and other malware.

How to stay safe from Android banking trojans

I can’t stress this enough, unless you really know what you’re doing, you should avoid sideloading apps. Sure, malicious apps do manage to sneak past Google’s defenses from time to time but for the most part, if you download new apps from the Play Store, you should be safe. The same goes for other official Android app stores like the Samsung Galaxy Store too.

From there, you want to make sure that Google Play Protect is installed and enabled on your smartphone. It’s enabled by default on all of the best Android phones but it’s always a good idea to check to make sure. For extra protection though, you can also use one of the best Android antivirus apps alongside it. You have to pay for many of them but they typically add other useful features like a VPN or password manager to help keep you safe online.

Despite constant warnings, people keep installing apps from websites instead of official stores. As long as this keeps happening, hackers are going to use it to their advantage. However, if you install new apps the way you’re supposed to, you can avoid falling victim to Rockrolla and other banking trojans like it.

More from Tom's Guide

• Popular Steam wallpaper app hijacked to spread dangerous malware — how to stay safe
• Update your Nvidia GPU drivers now to protect your PC from 9 "high-severity" vulnerabilities — here's what's at risk
• I just got hit by the Ultrahuman data breach — here's what hackers stole from my account

If your Windows or Linux computer uses one of best graphics cards made by Nvidia, you're going to want to make sure you're using the latest drivers. This week, the company issued a security alert and driver updates to combat a variety of vulnerabilities.

The alert highlights 15 issues, nine of which Nvidia has marked as "high-vulnerability." The high-risk flaws run the gamut of what bad actors can do to your PC. That includes letting hackers get access to your PC kernel, inject malicious code, steal crucial data, or gain administrative access. All the stuff you don't want happening.

For both Windows and Linux, you can download the driver update directly from Nvidia. On Windows, you'll want to make sure you upgrade to driver version 569.49.

On Linux, you want to make sure you update to version 590.48.01. The new versions were released about a week ago, so most people who have automatic updates turned on should have the update. But check your driver version just in case.

According to the alert, all Nvidia drivers before version 596.36 — version 482.53 for GTX 10-series and below — are potentially at risk from these vulnerabilities.

Keep your PC safe from malware

This is a general reminder to ensure all your drivers are up to date. Most driver releases patch security flaws like the ones outlined by Nvidia.

To be fair, some driver updates can cause issues, but later this year, Microsoft will automatically roll back bad Windows drivers to the most recent stable version. Still, keeping your drivers up to date is good practice.

If you're on PC, Microsoft releases new security updates every second Tuesday of each month.

Additionally, you'll want to ensure that Windows Defender is enabled. It largely does a great job of catching threats before they do damage.

For extra protection, you should consider the best antivirus software. Paid antivirus solutions usually update regularly, plus you often get access to VPNs, a password manager and other security goodies.

New vulnerabilities crop up all the time, but if you practice good cyber hygiene you devices and data should stay safe.

More from Tom's Guide

• Nvidia is teaming up with Span to install mini AI data centers right on the side of your house, turning residential neighborhoods into a distributed supercomputing network that actually pays homeowners for their unused electricity
• I test gaming laptops all year — here are the only 8 I recommend in 2026
• Nvidia RTX 5070 laptop GPU gets 12GB VRAM — here’s why it's a game-changer

Mac users have felt safe behind Gatekeeper — the macOS digital security guard that only lets verified, trusted apps onto your machine. But now, that gate has just developed a massive crack, as hackers have found a way to get around it undetected.

On April 22, the research team at Mosyle Security discovered two forms of malware named “Phoenix Worm” and “ShadeStager.” With them, hackers are now successfully stealing developer keys, which act like a digital passport, and by hijacking them, cybercriminals can disguise malware as Apple-approved apps.

To your MacBook, these viruses don’t look like a threat; they look like trusted guests. And with over 100 million Mac users worldwide, this blind spot means that even the most cautious users could be downloading a disaster in disguise.

How it works

The attack doesn’t start with you, but with the people who make your favorite apps. Hackers target the developers with a tag-team effort between these two new threats. First, the Phoenix Worm is snuck onto a developers system through a range of social engineering attacks — think recruiters with fake job offers or urgent coding tasks from clients.

Once it's there, Phoenix Worm is the inside man, which gives your Mac a secret ID number, waits for instructions, and even keeps watch for security software to hide further away from it.

When the coast is clear, the Phoenix Worm calls in the heavy hitter: ShadeStager. This specialist comes in and takes over developer keys, cloud credentials and secret dev tools. And while this digital heist happens behind the scenes, the fallout lands squarely on your desktop.

With these master keys, hackers can forge Apple’s verified seal of approval on any malicious file they want. By compromising the tools used to build apps, hackers are essentially poisoning the well in the Mac’s walled garden — turning a trusted developer’s reputation into a backdoor onto your private machine.

How to avoid this attack

First off, given Apple’s real focus on security, I would not be surprised if a hotfix update is deployed in the next few days to strengthen its verification process. But ultimately, while these two exploits in tandem are sophisticated, they’re not magic — they still need people to let them in.

So from a developer perspective, it’s going to be all about being extra careful of the emails being received. In fact, Apple added a warning into macOS 26.4 when you’re about to paste potentially malicious code into the Terminal app. Stop immediately if you see it.

As for most of you reading this, if you’re downloading apps outside the Mac App store, it’s about exercising some extra caution and asking yourself a couple of questions:

• Do I really know this company?
• If it’s something I’ve never heard of before, is it worth the risk?

And of course, while the Terminal warning above is more to developers, it’s good general advice for you too. If ever you see a website asking you to open the Terminal at all, that’s an automatic “close tab” moment.

Like any computer, your Mac is only as safe as the things you allow it to do, and by staying vigilant and skeptical, you can keep yourself invisible to even the most sophisticated attacks like this one.

More from Tom's Guide

• Over 1 billion Windows users at risk after disgruntled security researcher leaks Defender zero-days
• Scammers are abusing Apple account change notifications in new phishing attack — how to stay safe
• 108 malicious Chrome extensions found stealing data and injecting ads into every page you visit — delete them right now

We’ve always been told that as long as we stick to the Google Play Store and avoid sideloading, our Android phones are safe. However, a sophisticated new malware campaign has just shattered that sense of security.

As reported by BleepingComputer, researchers at the cybersecurity firm McAfee have discovered 50 malicious apps that hid in plain sight on Google's official store, racking up 2.3 million downloads while quietly infecting devices with a dangerous new Android malware strain.

Just like in previous malware campaigns, these bad apps posed as system cleaners, mobile games and other utilities. When opened, the apps in question worked as intended and to avoid suspicion, they didn’t request access to unnecessary permissions which is typically a major red flag that an app is malicious.

Although Android users who installed and used these apps didn’t get the sense that anything was off, in the background, that couldn’t be further from the truth. You see, after contacting a hacker-controlled server, the apps profiled the devices they were installed on to look for exploitable weaknesses. If any are found, the new NoVoice Android malware then seizes complete and total control over an infected device, essentially turning it into a hacker’s plaything.

Here’s everything you need to know about this new malware and why it’s one of the most dangerous strains I’ve seen yet, along with some tips and tricks to help keep you and your Android smartphone safe from hackers.

A factory-reset proof infection

With most malware, performing a factory reset on one of the best Android phones should do the trick. However, with NoVoice, that won’t work because the malware burrows into the one area a system wipe can't touch.

To do so, NoVoice establishes root access by exploiting older vulnerabilities that have since been patched. Since many people don’t update their phones as often as they should — or own older devices that no longer receive security updates — the malware is able to use this to its advantage.

After being installed via one of those 50 malicious apps, the malware collects a wide variety of device information such as hardware details, the phone’s current Android version and patch level, a list of installed apps, and root status. With this info in hand, NoVoice then reaches out to a command and control (C2) server operated by the hackers. It does this every 60 seconds; in addition to sharing info on an infected device, the malware also downloads device-specific exploits used to seize root access.

According to a blog post from McAfee, its security researchers observed 22 different exploits being used by NoVoice. By exploiting known vulnerabilities, the malware is able to bypass Android’s built-in security protections and establish several layers of persistence. NoVoice even rewrites an infected device’s core system libraries to ensure that even if a victim performs a full wipe by factory resetting their phone, the malware remains installed.

NoVoice’s creators have gone to great lengths to maintain control over infected Android phones. For instance, a watchdog daemon checks the rootkit’s integrity every 60 seconds. If part of the malware has been removed, the missing components are automatically reinstalled. If the malware can't repair itself, it forces the infected device to reboot, which triggers a fresh infection from scratch.

So far, this new malware has primarily been used to target Android users in Africa, though it’s also been deployed against users in India, the U.S., and Europe. McAfee says a main reason for this is that budget devices running older versions of Android are more common in those regions. However, any Android user running an outdated security patch is squarely in its crosshairs.

The hackers behind NoVoice have primarily used the malware to target WhatsApp. When the messaging app is launched on an infected device, NoVoice extracts sensitive data to clone a victim’s WhatsApp session. This allows hackers to effectively hijack a victim’s digital identity and message their contacts in real-time.

Given the modular nature of NoVoice though, the malware could easily be reconfigured to target banking apps or any other app running on an infected device.

How to stay safe from the NoVoice malware

Fortunately, all 50 malicious apps used to spread NoVoice have been removed from the Google Play Store. However, if any of them are already on your phone, you will need to manually uninstall them. While that would normally be enough to keep you safe, the multiple levels of persistence used by this malware mean that simply deleting one of these bad apps isn't a guaranteed fix.

To see if your Android phone is at risk, you should immediately check your security patch level. This can be found by going to Settings > About Phone > Software Information. If your device’s security patch is dated before May 1, 2021, it is vulnerable to the exact exploits NoVoice uses to gain root access.

Since a standard factory reset won’t clear this infection, your only technical option is to "reflash" your phone with its official factory firmware. This process completely replaces the corrupted system files with a clean copy, but it also wipes all of your data and can be difficult for less experienced users. If your current phone is no longer receiving Android updates and security patches, the safest move is likely to start over with a brand-new Android device.

While the full list of all 50 malicious apps hasn't been released, you can still check your device for signs of infection. Open Google Play Protect which comes pre-installed on most Android phones and run a manual scan immediately.

In an email to Tom's Guide, a Google spokesperson provided further insight into how NoVoice really only affects older Android smartphones, saying:

"Android addressed the vulnerabilities this malware relies on in security updates years ago, so if your device has been updated since May 2021, it's been protected. As an added layer of defense, Google Play Protect automatically removes these apps and blocks new installs. Users should always install the latest security updates available for their device.”

Going forward, you need to be extremely selective about the apps you install. Stick to trusted developers, check ratings, and always read reviews before hitting download. In addition to keeping Google Play Protect enabled, you may also want to run one of the best Android antivirus apps alongside it for an extra layer of defense.

NoVoice marks a significant shift in the Android malware landscape, and we may see other attackers emulate its 'reset-proof' design in the future. Until then, the best defense is to keep your device updated — and if your phone is too old to receive critical security patches, it may finally be time for an upgrade

More from Tom's Guide

• More than 220 million iPhones under attack from new DarkSword exploit — how to stay safe
• Online age verification in the USA – a complete timeline
• Identity protection company Aura suffers massive 900,000 person data breach: customer information exposed

Last year, Google added new beta features to Google Drive, designed to detect ransomware and aid file restoration where needed. Today, Google announced that those same tools are rolling out to everyone, with upgraded AI detection that can recognize 14 times as many infections as before.

onsidering today is World Backup Day, it's pretty handy to get a bunch of tools designed to protect your backups from harm.

So how does this work, exactly? The tools are built into Google Drive for desktop, and should the app detect ransomware on a connected device, it will automatically pause all file syncing. This is to stop the ransomware from interfering with files stored in your Drive account and from spreading to other connected devices.

Google Drive will start by scanning your backups for potential ransomware, and if anything is detected, it will automatically pause syncing. This is to prevent you from spreading those files to your other devices and causing significantly more damage. The user is then notified about the file, and emails will be sent out to all connected users. It's not a subtle warning and includes a list of everything you need to do to solve the issue.

The first step is to disconnect your account from the Drive client, then use the Drive restoration tool to quickly and easily restore previous versions of your files. Google stores older versions for 25 days, giving you plenty of time to retrieve your data and undo any damage caused by the ransomware attack.

This isn't designed to be a replacement for antivirus or other defensive tools that would protect from ransomware. It's an additional layer of protection designed to help you catch the problem before the damage is irreversible — and ensure you can safely restore backed-up files later.

Google Drive's tools are free to use as well, which means regular users won't have to invest in expensive or business-focused software to better protect themselves against ransomware.

Google says that ransomware protection is now enabled by default and will be available in Google Drive version 114 and later. You can set the detection level in the settings or disable these protections altogether. Since Google has said it won't scan your files to train its AI without your express permission, we recommend that you only switch it off if you have better, more powerful ransomware protection tools at your disposal.

More from Tom's Guide

• I’ve been waiting a decade for AirDrop on Android — and it’s finally fixed my biggest frustration
• I put iPhone 17 Pro Max vs Samsung Galaxy S26 Ultra through a 7-round face-off — here's which is best for you
• iPhone Fold tipped to be most 'significant overhaul' in iPhone history — here's why I agree

In order to help iPhone users know when their device’s camera and microphone were currently in use, Apple added privacy indicators back in 2020 with the release of iOS 14. Now though, the creators of the notorious Predator spyware have figured out how to completely disable them to make spying on potential victims a whole lot easier.

As reported by BleepingComputer, the European-based surveillance company Intellexa has given its spyware a major update which allows it to hide the green and orange dots that let you know when your iPhone is recording video or audio. It’s worth noting that, instead of exploiting a vulnerability in Apple’s mobile operating system, the spyware uses previously obtained kernel-level access to pull this off.

Here’s everything you need to know about this latest development with the Predator spyware along with how to keep your iPhone safe from being spied on.

Intercepting recording indicators

In order to learn more about this new Predator capability, researchers at the mobile device management firm Jamf analyzed recent spyware samples to see how Intellexa managed to disable Apple’s privacy indicators.

According to a new report, the firm’s security researchers discovered that the spyware hides all recording indicators on iOS 14 and later versions of Apple’s mobile operating system by using a single hook function in the core system application SpringBoard. This method is used whenever an iPhone’s camera or microphone is opened and the device’s sensor activity changes.

By intercepting these changes quickly, Predator is able to prevent any sensor activity changes from showing up on iPhone’s UI which means the green and orange dots won’t appear. Interestingly, since the hook nullifies all sensor update activity, it can be used to disable a device’s camera and microphone indicator at the same time.

Fortunately as Jamf’s researchers explain, “the technique outlined in this analysis requires a device to first be fully compromised, including kernel-level access to install hooks and the ability to inject code into system processes,” which means that it only works on iPhones that have already been fully hacked.

How to stay safe from spyware on your iPhone

With one of the best iPhones, you don’t have to worry about malicious apps spreading malware like on Android. However, since Apple’s phones are so popular and known for being difficult to hack, there’s a very lucrative spyware market built around them.

The good news is that with spyware, cybercriminals and others who use it in their attacks typically tend to go after high-profile targets such as CEOs, celebrities, politicians and other government officials.

Still, in order to keep your iPhone safe from spyware, the first and most important thing you can do is to keep it updated and running the latest version of iOS. The reason why is that Predator and other spyware strains often rely on now patched vulnerabilities to gain a foothold on targeted devices. By keeping your iPhone updated and restarting it at least once a week, you’re making your phone a whole lot harder to hack.

If you want to find out if there is spyware installed on your iPhone, then you should check out iVerify’s $1 Basics app. Once installed, it scans your iPhone on a monthly basis to check for the infamous Pegasus spyware created by the NSO Group but it can find other spyware strains too.

Although there isn’t an iOS equivalent to the best Android antivirus apps, one of the best Mac antivirus software suites in particular can scan an iPhone or iPad for spyware and other types of malware. When connected to a Mac via a USB cable, Intego’s Mac antivirus can scan an iPhone for viruses just like it would with an Apple computer.

The Predator spyware might not be the biggest threat to ordinary people but if you open your camera app or Apple’s Voice Memos and suddenly don’t see a green or orange privacy indicator light, you’ll now know why.

More from Tom's Guide

• A new spyware called ZeroDayRat can take over your iPhone or Android via text
• 1 billion personal records exposed in massive new data leak — full names, addresses, phone numbers and more
• 300,000+ Chrome users installed these malicious extensions posing as AI assistants — delete them right now

Most Android malware is spread through dodgy apps and sideloaded programs, meaning that you can slightly control what gets on your device. However, researchers at Kaspersky have discovered a new Android backdoor, dubbed Keenadu, that is embedded in the firmware of tablets from several manufacturers.

The new report indicates that Keenadu can be distributed via compromised firmware images, other backdoors, embedded in system apps or modified from third-party sources or even the Google Play Store.

The firmware version is the most potent and has infected more than 13,000 devices mostly in Russia, Japan, Germany, Brazil and the Netherlands. Keenadu apparently does not activate if the language or time zone is associated with China, which indicates a potential clue as to its origin.

How it works

Kaspersky researchers noted that it's mostly being used for fraudulent ads, but that it's capabilities go far beyond that. It can inject itself into the Android "Zygote" process, a core system process that launches every app on your device.

This means it can give bad actors broad control and visibility over your system.

“Keenadu is a fully functional backdoor that provides the attackers with unlimited control over the victim’s device,” Kaspersky told BleepingComputer. "It can infect every app installed on the device, install any apps from APK files, and give them any available permissions.”

The researchers also found the malware in several apps that were available on the Google Play Store, including a smart home camera app that had over 300,000 downloads.

In a confirmed example, firmware images on the Alldocube iPlay 50 mini Pro tablet were compromised, including in tablets released after the vendor was informed of the malware. The firmware has valid signatures, meaning that it's a supply-chain issue where malicious code was injected during software development or even the manufacturing process.

Here's the silver lining: if you have one of the best tablets from a flagship brand like OnePlus or Samsung, you likely won't be affected by this malware. However, lesser-known Android manufacturers or knock-off ones seem to be more dangerous, and affected vendors haven't been totally named. This is quite similar to how malware was found on millions of budget Android TV boxes last year.

How to stay safe

If you have a budget Android tablet, especially from a smaller or knock-off brand, it's worth checking for software updates. You can also try installing fresh firmware from a reliable third-party. Kaspersky did say that vendors have been notified and hopefully are working on clean firmware updates.

Beyond that, it may be safer to invest in a tablet from a trusted manufacturer. We can help you with choices of the best tablets under $500 and the best Android tablets overall.

A Google spokesperson told Android Authority that "Android users are automatically protected from known versions of this malware by Google Play Protect." The spokesperson added that Play Protect will warn you and disable apps known to exhibit Keenadu behavior.

Google Play Protect is on by default, but if you want an extra layer of protection, you can run one of the best Android antivirus apps alongside it for scanning and defending your tablet or phone.

More from Tom's Guide

• 300,000+ Chrome users installed these malicious extensions posing as AI assistants — delete them right now
• How did the FBI get Nancy Guthrie's Google Nest camera footage if it was disabled — and what does it mean for your privacy?
• I visited a VPN data center – here's what I learned

Whether you use an iPhone or an Android phone, hackers have a brand new tool that’s capable of completely hijacking it to steal your data, track your location, log your keystrokes, intercept your 2FA codes and more. The worst part? The tool is sold on the dark web with full customer support in case they run into any problems.

As reported by BleepingComputer, the new ZeroDayRAT malware is a commercial mobile spyware platform that’s currently being advertised to cybercriminals on Telegram. Thanks to its very detailed dashboard, any hacker that deploys this malware in their attacks is easily able to manage infected devices while stealing all of their data and tracking them in real-time.

Here’s everything you need to know about this new mobile threat along with what it’s capable of, along with some tips on how to stay safe so you can recognize a potential infection before it takes over your phone.

Full access to your device, location and more

ZeroDayRAT acts like a one-stop shop for hackers when it comes to the sensitive data, login info and crypto stored on one of the best iPhones or best Android phones. And to make matters worse, it can allegedly infect devices running the latest software, whether that be iOS 26 or Android 16.

In a new report, researchers at iVerify explain that they first discovered ZeroDayRAT after seeing it openly sold on Telegram at the start of this month. In addition to customer support, the malware’s developer also provides regular updates so it will remain a viable tool in a hacker’s arsenal for even longer.

ZeroDayRAT is quite sophisticated on its own with the ability to glean all kinds of useful information from an infected device. Besides a phone’s make and model, operating system version, battery life, SIM details, country of origin and lock state, the malware can also log a victim’s app usage, their text messages, notifications and more. Likewise, a hacker can also use ZeroDayRAT to activate a phone’s front and rear cameras as well as its microphone to spy on victims in real-time.

From there, GPS access gives them the ability to track a victim’s location in real time and even see their current position on Google Maps. Then with SMS access, ZeroDayRAT can capture one-time passwords to bypass two-factor authentication (2FA) which lets an attacker take over a victim’s social media and banking accounts.

If that wasn’t enough, the malware even features a cryptocurrency stealer module that scans an infected device to look for wallet IDs and balances from Coinbase, Binance, MetaMask and Trust Wallet. As we’ve seen with other malware in the past, ZeroDayRAT also uses overlay attacks to steal online banking logins as well as credentials for Apple Pay, Google Pay and PayPal.

Perhaps the most surprising thing about ZeroDayRAT for me though is its online dashboard. Right from their browser, hackers have all the info they need from devices they’ve infected with the malware to launch additional attacks and keep tabs on any that are currently underway. It’s clear a lot of work went into creating this new spyware platform and depending on how much it costs, ZeroDayRAT could become a household name among cybercriminals.

How to stay safe from spyware

As iVerify points out in its report, a ZeroDayRAT infection begins by getting a malicious binary onto a targeted device: either as an APK for Android or a payload for iOS. While we don’t know exactly how cybercriminals are spreading this spyware yet, the firm’s security researchers believe that SMS phishing or smishing is likely the easiest infection method.

Whether you have an iPhone or an Android device, you want to be on the lookout for text messages from unknown senders containing a link that try to coerce you into downloading an app. They might use a sense of urgency or other common tactics to do so. While fake text messages are one probable delivery method, phishing emails, fake app stores and links on WhatsApp or Telegram are other ways the ZeroDayRAT spyware can be distributed too.

To stay safe from this new mobile threat, your best bet is to avoid clicking on any links sent to you via text messages, emails or through social media. It’s always best to avoid clicking on anything sent from an unknown sender but I’d also recommend being wary of links sent from friends or even acquaintances that you haven’t spoken with in a while. Once hackers take over one person’s accounts, they often use them in other attacks. A message from an old friend on social media about a new app that’s changed their life or made a common task a lot easier is the kind of lure that I could easily see unsuspecting users falling for.

In order to stay safe from the latest threats, you should be using the best antivirus software on your PC or the best Mac antivirus software on your Apple computer. On mobile, the best Android antivirus apps can keep your phone safe from malware but due to Apple’s own restrictions, there aren’t any antivirus apps for iPhone. However, many antivirus makers do offer protection for iOS through their main software suites. For instance, Intego’s Mac antivirus can scan an iPhone or iPad for malware but only when it’s connected to a Mac via a USB cable.

While we haven’t heard about any major attacks carried out using the ZeroDayRAT yet, chances are, we likely will soon. I’ll be keeping a close eye on this new mobile spyware platform just in case. In the meantime though, by practicing good cyber hygiene and being careful where you click or tap, you should be able to avoid falling victim to the ZeroDayRAT and other mobile malware.

More from Tom's Guide

• 149 million logins and passwords exposed for Gmail, Facebook, Instagram and more — everything you need to know
• Total phone hijack: New Hugging Face malware grants hackers full remote access
• Massive government tech data breach expands to more than 25 million more Americans a year after it was discovered

Update: Google spokesperson says malware not found in Google Play Store.

Hackers are reportedly using the popular Hugging Face AI platform to release Android malware that can take over your device. The malware is delivered via a fake app.

For the unfamiliar, Hugging Face is an open platform that hosts AI tools and machine learning bots. Users and creators can distribute and download AL, NLP and ML models. Unfortunately, sometimes it can be used to release bad models as well.

Researchers at the cybersecurity firm Bitdefender found that this new malware first appeared in an app called TrustBastion. Hugging Face "doesn’t seem to have meaningful filters that govern what people can upload," the researchers said.

Apparently, TrustBastion pretends to be an Android antivirus program by "offering" virus protection, phishing defense and malware blocking. In reality, this app is "scareware": once you install it, it claims your device is infected and demands an update. Once you update the app, it installs the malicious code.

What this malware does

Bitdefender says TrustBastion connects to a third-party server, which then redirects to a Hugging Face repository with 6,000 commits. Despite being reported, Bitdefender says a new repository almost immediately appeared with a new name and icons, but the same malicious code.

This Trojan malware is quite powerful. According to Bitdefender, it can take screenshots, display fake login interfaces for financial serives and capture your lock screen pin. That information is then sent to a third-party server.

Malware isn't in Google Play, says Google

A Google spokesperson told Tom's Guide that according to their systems this malware and apps containing it are not in the Google Play store.

"Based on our current detection, no apps containing this malware are found on Google Play," the spokesperson said.

They added that Android users are automatically protected against "known versions of this malware" by Google Play Protect, which scans apps for malicious behavior and can warn users or block apps.

How to stay safe

The simplest thing you can do is download Android apps only from reputable sources with some form of moderation and security filtering, such as the Google Play Store or the Samsung Galaxy Store. Even in those places, be sure to scour the reviews and note the overall downloads and rating.

Avoid sideloading APKs outside of the store. If you are triple-checking that the publisher and URL are correct before you download. Be wary of any apps that ask for accessibility permissions.

You should periodically scan your Android device with Play Protect and bolster your security with some of the best Android antivirus apps.

More from Tom's Guide

• Fake Chrome extension ‘breaks’ your computer before it hits you with malware — how to stay safe
• Malicious Zoom Stealer extensions can leak your private meeting details — how to stay safe
• New malware turns trusted banking apps into phone hijacking tools — how to stay safe

A new malicious browser extension has been discovered that along with two others, are designed to steal credentials, take over browsers and more. Discovered by security researchers at Koi Security, all three extensions are believed to be created by the same threat actor and put millions of Chrome, Edge and Firefox users at risk.

This most recent malware has been dubbed Zoom Stealer and its uses 18 different extensions to steal online meeting information like URLs, embedded passwords, meeting IDs, schedule times, registration status, topics and descriptions. These extensions affect up to 2.2 million Chrome, Firefox and Edge users and are specifically designed to imitate enterprise level tools for video conferencing apps like Google Meet and Zoom.

The extensions, which succeed specifically because they perform as advertised and have positive reviews, also silently run surveillance in the background to exfiltrate details of the meeting like links, participant lists and credentials using a WebSocket connection. If a users visits a webinar registration page with one of the malicious extensions installed in their browser, the threat actors can harvest all sorts of data including information about the speakers, the hosts and the session metadata.

The Zoom Stealer campaign is the third rolled out from the threat actor known as DarkSpectre. The first, known as ShadyPanda, was found by the same researchers last month and was used to commit fraud, hijack search queries and carry out data theft from more than five million users. The second campaign, known as GhostPoster, used hidden malicious JavaScript code inside logo files in order to gain full control over a browser.

How to stay safe from malicious browser extensions

As with any other malicious extension, if you've downloaded anything that you suspect isn't entirely legitimate, you should remove it immediately.

After removing a problematic extension, you should always reset your account passwords – often, the recommendation is for all your high profile accounts like your email, online banking and social media ones too. Since this could be a hassle, you should use one of the best password managers to make it easier since many can update compromised passwords for you. A password manager can also help keep your passwords organized, safe and can automatically generate strong and unique passwords for each of your online accounts.

I also always recommend using the best antivirus software as well. An antivirus program may not have caught these malicious extensions, but they can scan for malware, spyware and viruses to help you deal with the fallout from a campaign like this one. Antivirus programs also have browser extensions that can warn you when you try to visit suspicious websites, help protect your data with cloud backups and can provide you with a VPN and other extras to add an extra layer of security to protect you when you're online.

Given how effective malicious extensions like the ones described above have been in the past, I highly doubt cybercriminals are going to stop using them soon. Instead, it's up to you to remain vigilant when it comes to downloading and using new browser extensions. When in doubt though, consider whether or not you really need a particular extension before downloading and adding it to your browser.

More from Tom's Guide

• I write about hackers for a living but these are the 3 real-world threats that worry me most — and how to avoid them in 2026
• From misinformation to AI-powered cyberattacks – the top cybersecurity risks for 2026
• I’m a security editor and these are my 3 security New Years resolutions

A new malware has been identified by cybersecurity researchers, and it is capable of many information gathering techniques like screen capture, audio capture, remote shell (which permits the threat actor to launch further attacks), keylogging and file transfer and execution. It’s called PLAYFULGHOST and it’s known to be delivered via phishing or SEO poisoning techniques that then distribute trojanized VPN apps.

Capable of setting up persistence on the host in four different manners (run registry key, scheduled task, Windows Startup folder and Windows service), the feature set in the PLAYFULGHOST malware allows it to gather an extensive set of data. Including keystrokes and screenshots; it can also collect audio, QQ account information, installed security products, clipboard content and system metadata.

The malware is also capable of dropping more payloads, blocking mouse or keyboard input, clearing Windows event logs, wiping clipboard data, performing file operations, delete caches, deleting web browser profiles, and erasing profiles and storage for messaging apps.

Also, it can deploy Mimikatz, an open-source application that can extract passwords, a rootkit that is capable of hiding registry, files and processes specified by the threat actor and brings along with it an open-source utility called Terminator that can kill security processes using a BYOVD (Bring Your Own Vulnerable Driver) attack.

The way that PLAYFULGHOST gains access, or its initial pathway into your system, is usually a phishing email that has a lure mentioning a code of conduct violation, problem or issue; it is also known to use SEO poisoning techniques to send out a malicious version of a legitimate VPN app like LetsVPN.

One victim was tricked by opening a malicious RAR archive disguised as an image file by using a .jpg extension, which then dropped a malicious Windows executable. That in turn downloaded and executed PLAYFULGHOST from a remote server. Google’s Managed Defense team has said that the backdoor shares functionality with Gh0st RAT, which had source code publicly leaked in 2008.

The SEO poisoning attacks attempt to get victims to download malware laced with installers for LetsVPN which then drop an interim payload that will retrieve the backdoor components.

A PLAYFULGHOST infection leverages DLL search order hijacking and side loading to launch malicious DLL which is used to decrypt and load PLAYFULGHOST into memory. It’s also been observed using combined Windows shortcuts that leverage multiple files to construct rogue DLL to sideload it into a renamed version.

How to stay safe from PLAYFULGHOST

Because PLAYFULGHOST is using phishing as a technique, the best way to avoid it is to know common phishing techniques and make sure you can detect them. Only give away personal information to legitimate websites and companies. Never click on an unexpected link or attachment — if you know the sender, contact them directly to see what they sent and why before clicking through.

If you’re not expecting a code of conduct violation, don’t click on a link in an email. Contact the sender or your HR department to ask about the email first. Only download applications directly from a website you’ve gone to yourself, not from a link sent to you.

If your company contacts you about an urgent matter regarding your account, don’t click anything in an email, text or message. Instead go directly to their website in the browser’s address bar and type in their web address manually and enter in your log in details yourself. This way, you can make sure you’ve got the company name spelled correctly. (A common phishing technique is to misspell a company name with a “0” instead of an “o.”)

Maintain best practices with your online accounts: Never reuse passwords, remember you can always use a password manager to help keep your passwords secure. Use two-factor authentication when possible. Keep one of the best antivirus software programs current, updated and running on all your devices – both your PC and even your mobile device.

We have recommendations for the best Android antivirus apps if you don’t already have one installed. And for added protection make sure your antivirus program has a – real – VPN, or offers a hardened browser for an added layer of security.

More from Tom's Guide

• Hackers can steal your accounts, and all it takes is a double click – don't fall for this new form of clickjacking
• Millions of email users at risk – passwords could be exposed to hackers, experts warns
• These are the top cyber threats to watch out for in 2025

Even if you’re not sideloading apps, you still need to be careful when downloading new ones from official app stores as you might just end up with a malicious app that can infect even the best Android phones with dangerous malware.

Case in point, McAfee Labs researchers have discovered a bad app masquerading as a legitimate health app on the Amazon Appstore. While not nearly as popular as the Google Play Store, Amazon’s app store works on phones as well as the best Android tablets, though it comes pre-installed on the ecommerce giant’s own Fire tablets and Fire TV devices.

Now that Google has been working hard to lock down the Play Store, hackers have turned to third-party app stores as a means of distributing their malicious apps. I wouldn’t be surprised if they tried something similar on Samsung’s Galaxy Store going forward.

Here’s everything you need to know about this new malicious app along with what you should do next to remove it from your phone if you have it installed along with some tips and tricks to help you stay safe from Android malware.

Hiding in a health utility app

As reported by BleepingComputer, the app in question is called BMI CalculationsVsn and up until recently, was being promoted as a simple body mass index (BMI) calculator.

When opened, the app appears to be fairly simple with a single page where users can input their weight and height to calculate their BMI. However, while its user interface does look like a standard health app, it’s performing a range of malicious activities in the background.

In its report on the matter, McAfee’s researchers explain that the app starts recording a user’s screen whenever they click the “Calculate” button to find out their BMI. A pop-up request to grant the necessary permissions to screen record appears and if a user taps on “Start now” the malicious app begins recording.

McAfee believes this functionality is most likely used to capture gesture passwords or sensitive data from other apps. However, the firm’s researchers found that the app’s developer “PT Visionet Data Internasional” wasn’t quite ready to make use of this function since the app doesn’t upload the mp4 video files it captures to a command and control (C2) server.

At the same time though, this malicious app is also able to scan a victim’s device to retrieve a list of all of their other installed apps. This info could then be used to identify potential targets as well as to plan out more advanced attacks. Likewise, the BMI CalculationsVsn app also collects every text message received from an infected phone. This is likely done to capture one-time passwords (OTP), verification codes or other sensitive information sent via text.

The app itself was uploaded to the Amazon Appstore at the beginning of October of this year. While it started out as a screen recording app, its creators pivoted half way through its development cycle and changed it to a BMI calculator with its original screen recording capabilities still enabled. Its app icon was also changed to reflect this.

Fortunately, McAfee reached out to Amazon upon discovering this malicious app and it has since been delisted. If you happened to install it on your Android phone or tablet while it was still up though, you’re going to need to manually delete it from your device.

How to stay safe from Android malware

Since bad apps have a habit of ending up on official app stores like the Google Play Store and in this case, the Amazon Appstore, you need to be extremely careful when downloading any new app.

This means checking its ratings and reviews but since these can be faked, it’s always a good idea to look for external reviews or even a video review since they show you the app in question in action. You also want to look into an app’s developer to make sure they’re legit. A good way to get around installing a malicious app onto your Android devices is to stick with known, trusted apps that often show up on a respective app store’s top charts.

As for staying safe from Android malware, your first line of defense should be Google Play Protect as it comes pre-installed on most Android devices. This free security app scans all of your existing apps and any new ones you download for malware, even if you didn’t happen to download them from the Play Store. For extra protection though, I highly recommend using one of the best Android antivirus apps alongside Google Play Protect. They’re updated more frequently and often include other useful extras like a password manager or a VPN.

Hackers, scammers and other cybercriminals have been using malicious apps as a way to infect people with malware for years now and as such, I don’t think they’re going to stop doing so anytime soon. This is why it’s up to you to be security savvy and exercise caution when installing new apps on your Android smartphone or tablet.

More from Tom's Guide

• Hackers are sneaking malware on to the Google Play Store — how to stay safe
• 5 million Americans just had their credit card details leaked online
• Android phones under attack from malicious apps with over 8 million installs

A recent analysis of the 150 top Android apps by Norwegian cybersecurity firm Promon found that 144 of them could be successfully configured to operate within the controlled testing environment of the reverse engineering tool Frida. Only three of the apps tested actively detected Frida’s presence and shut down or limited functionality.

What does that mean? Well, it means that roughly 97% of the most popular Android apps are vulnerable to exploitation by threat actors and have a security gap that needs to be addressed.

As reported by Cybernews, Frida is a dynamic instrumentation toolkit that has grown in popularity among security researchers, reverse engineers and malware analysts. It can be used legitimately but has also become a primary tool used by malicious actors to attack apps. This tookit is considered an essential first step to reverse engineer any app.

A security researcher at Promon, Simon Lardinois, says that though not all apps are required to detect Frida, the fact that 97% do not “raises significant concerns as it becomes an open invitation for exploitation.” He adds that “For apps that process sensitive data or have sensitive features, this is certainly a wake up call to implement more robust detections for Frida.”

The cybersecurity experts involved were surprised to find that so few of the top apps tested were protected from common hooking framework, and the reports findings state that this “underscores the need for increased awareness and proactive security measures within the Android development community.”

Organizations that want to keep user data secure should seek to incorporate Frida detection techniques; these would range from identifying unique library names and memory strings commonly associated with Friday to examining names threads, enumerating exported functions and monitoring network resources.

Promon also points out that attackers are evolving in their evasion techniques, customizing Frida by stripping down its footprint to bypass these detection mechanisms.

Unfortunately, the apps tested were not named in the report, however they were the most popular apps based on monthly active users as of November 2024 – with more than 550 million users daily and 206 million monthly users on average.

How to stay safe

In order to stay safe from malicious apps and other mobile threats, you should always keep your phone up to date by installing the latest updates as soon as they become available. In addition to its operating system though, you also want periodically update all of your apps too.

For an added layer of protection, you want to make sure you've got one of the best Android antivirus apps installed on your phone as well. They can help remove malware, flag suspicious activity like fraud and phishing attempts and provide you with a secure VPN or even a password manager. If you're on a tight budget though, Google Play Protect can help keep your phone safe from bad apps and best of all, it comes pre-installed on all of the best Android phones.

Now that Promon has found that so many of the most popular apps can be used with Frida by attackers in addition to security researchers, expect the makers of this security tool to add additional safeguards to it soon.

More from Tom's Guide

• Fake video conferencing app is stealing passwords and spreading malware - how to stay safe
• FBI tells iPhone and Android users to stop texting each other amid major security breach
• Dangerous Pegasus spyware could be hiding on your iPhone — this $1 app can find it

Looking for a new job is already a difficult process on its own, but now hackers want to make things even harder for prospective job seekers by infecting their phones with a banking trojan designed to target any financial apps and services they have installed on their device.

As reported by The Hacker News, cybersecurity researchers have discovered a new mobile phishing campaign used to distribute an updated version of the Antidot banking trojan. Codenamed AppLite Banker by the mobile security company Zimperium who first spotted this new campaign, this malware can steal a victim’s PIN in order to remotely take over their smartphone.

AppLite Banker isn’t done there, though, as the banking trojan specifically targets 172 banking, finance and crypto apps and then uses overlay attacks to harvest a user’s credentials when they go to log into one of these apps.

Here’s everything you need to know about the AppLite Banker trojan along with some tips and tricks to help you stay safe from hackers during your next job search.

Impersonating recruiters and HR reps

In a new blog post, Zimperium’s zLabs team explains that the hackers behind this campaign pose as recruiters or HR representatives (like we saw with a similar Windows-based campaign this summer) to lure in potential victims with job offers. To make matters worse, they pretend to be from well-known organizations including Euskatel, Eminic, Distributel, and Oasis and use carefully crafted emails to avoid raising suspicion.

To get victims to respond to their offers, the hackers also promise them an hourly rate of $25. If a job seeker falls for this initial email, they are led to a malicious landing page where they can continue the application process or schedule an interview. Instead though, this page manipulates them into downloading a CRM or customer relationship management app for Android. While the app itself appears legitimate at first glance, it’s actually a malware dropper used to deploy the primary payload onto their device.

In order to bypass the best Android antivirus apps, this fake app uses a number of obfuscation techniques like manipulating ZIP file structures and Android Manifest files. These methods can often render antivirus apps and other anti-malware tools ineffective which allows the malware to take hold of a vulnerable Android phone.

When this malicious app is loaded for the first time, it shows an account creation page. After creating an account and logging in, users are then told they need to install an "update" for the app to function properly. However, as you might have guessed, this update is actually the AppLite banking trojan.

Clicking on the “Update” button within the app shows a fake Google Play Store icon to reassure users before the malware is installed on their phone. As with other Android malware strains, AppLite abuses Android’s Accessibility Services permissions to grant itself even more permissions but they are also used in the overlay attacks launched by the malware.

Once installed on one of the best Android phones, AppLite can be used by a hacker to launch all sorts of different commands including opening their keyboard, unlocking their device, downloading their text messages, uninstalling apps, sending push notifications and more.

How to stay safe from hackers during your next job search

Just like any other day on the internet, when you’re looking for your next job, you need to be extra careful when it comes to who and what you interact with online.

In this case, victims should have done their due diligence about the recruiter and why they contacted them out of the blue in the first place. Were they actively looking for a job? Had they submitted their resume on job sites? If not, an email with an offer like this one would definitely seem too good to be true. However, if their job hunt hadn’t gone as planned and they had been looking for a while, they might be more likely to let their guard down and head to the site included in the initial email.

Still though, if a job requires you to sideload an app in order to apply for a position, that should be a major red flag. A real business would direct you to their app on the Google Play Store or on the App Store; even then, when was the last time you had to download an app to just apply for a job? I could see if a company made you download Zoom or another popular workplace tool, but one of their own internal apps would be very unlikely.

When looking for a new job, you'll want to stick to trusted and well-known recruitment sites like Indeed, Monster, ZipRecruiter and others as well as LinkedIn. From there, be wary when you’re told to download files and especially apps. Most job applications and recruitment is done via web portals, so there’s nothing you would need to download in the first place.

It's worth noting that Google Play Protect does does protect against known versions of AppLite according to my contact at the search giant. Likewise, you should also consider using of one of the best identity theft protection services to recover any lost funds or even your identity after a run-in with a campaign like this one.

Hackers love to go after those who are vulnerable, and people actively looking for a new job after getting laid off or fired certainly fit the bill. This is why it’s up to you to practice good security habits and excellent cyber hygiene and who knows, your ability to spot a phishing email or a scam could give you a leg up over other potential candidates.

More from Tom's Guide

• Android phones under attack from malicious apps with over 8 million installs — delete these now
• Charging your iPhone? You might want to stay away from third-party USB-C cables
• Thousands of children exposed in major data breach — including names, addresses and social security numbers

The Pegasus spyware is a dangerous zero-day exploit that requires no action from users in order to compromise one of the best iPhones and expose your personal data. That means that simply receiving an infected iMessage is enough to compromise your device and allow the spyware to access almost all the data on your phone.

Fortunately though, there's now an easy way for you to tell if you’ve been targeted. For just $1, the iVerify Basics app lets you scan your iPhone on a monthly basis to check for the Pegasus spyware and analyze the results.

Since the app launched in May, iVerify has scanned roughly 2,500 devices and found seven infected ones. The company has also been surprised by who they’ve found carrying these compromised iPhones.

While the NSO Group, the company that purchases info on zero-day vulnerabilities from hackers to create its spyware, usually sells Pegasus to governments that target political opponents and journalists, the victims detected by iVerify were business leaders and people in government positions or commercial enterprises.

Although Apple does attempt to detect when iPhones have been compromised by Pegasus and alert owners about potential spyware infections, the iVerify Basics app provides smartphone owners a free version of their subscription service which they can run on their device once a month.

Meanwhile, business users are offered continuous scans of the “Mobile Threat Hunting” feature which uses iVerify’s signature-based malware detection, machine learning and heuristics to hunt down anomalies in mobile device operating systems that would indicate signs of spyware or malware infection.

Putting iVerify to the test

Using the iVerify Basics app is straightforward: the app downloads and then shows an introduction screen which explains that it will “provide insight backed by high-end security research along with the knowledge of the latest attacker techniques to help you stay secure.”

From there I tapped continue to be taken to a Ready to Scan: screen that offers options for Protection Measures or Threat Hunting: the Protection Measures option provides a scan for SMS phishing and continuous monitoring while the Threat Hunting is where the monthly scan for threats like Pegasus is contained. I ran the New Forensic Scan, which took about ten minutes. Thankfully, I didn’t have to leave the app open or the phone on while it ran.

When the scan was complete, it told me that my device was secure and that no threats had been detected. It gave me instructions on how to submit my scan results to iVerify for analysis and I provided my email address so I could be contacted if the company found anything suspicious or concerning in the results.

The entire process was easy to follow, quick and reassuring. It’s also nice that iVerify provides additional layers of security along the bottom of its app with buttons for guides (Protect Against Theft, Protect Wireless Data), Online (Use Security Software which details how to further protect your accounts by using a password manager or using two-step verification), and security news.

Due to Apple's own malware scanning restrictions, there's no iPhone equivalent for the best Android antivirus apps. However, some of the best Mac antivirus software from Intego does let you scan an iPhone or iPad for malware but the device needs to be connected to a Mac via USB. For just $1 though, the iVerify Basics app is an easy to use and much cheaper alternative.

Even if you're not a high-profile target, it could be worth downloading this app just for the peace of mind you get after a successful scan with no threats found.

More from Tom's Guide

• Dangerous LightSpy iPhone spyware can steal your files, location data and messages
• Hackers are now using corrupted files to bypass your antivirus software — how to stay safe
• Worried about spyware on your iPhone? iShutdown can reveal if you’ve been infected

Hackers have come up with a clever new way to deliver malware to your Windows PC that both you and even the best antivirus software might completely miss.

As reported by Cybernews and first discovered by the threat intelligence services firm ANY.RUN, hackers have started sending out phishing emails which contain broken or corrupt Microsoft Office or ZIP files.

Since these ‘broken’ or intentionally corrupted files cannot be properly read by antivirus software (and Outlook spam filters too), they bypass any security measures that are in place which results in these emails appearing in a victim’s inbox. Once a victim attempts to recover the corrupted files by executing the corresponding program in recovery mode, the malicious content they contain is able to infect their computer.

For example, a victim receives a broken .docx document that won’t open in Word, but a prompt appears that asks if they want to recover its contents. If the user presses yes, then Word will reconstruct and process the malicious file which then infects their system.

In a post on X, ANY.RUN explains that the threat actors are deliberately corrupting these file types to make it more difficult for security tools to detect the malicious content they contain. At the same time though, the apps used in these attacks were chosen specifically as they have built-in recovery mechanisms that the hackers behind this campaign can abuse in their attacks.

After being provided with the corrupted files, security solutions will assume they need to scan their contents but will fail to extract them. Since they don't find any files inside the archive and overlook the archive itself, the scanning process never really starts.

This basically means that the attackers are exploiting the recovery mechanisms of popular apps in a way that the corresponding programs, like Word or Outlook, inherently handle these types of files.

In a separate post on its site, ANY.RUN provides an example of one of the phishing emails used in this campaign which impersonates an HR department email hinting at a potential salary increase. However, it contains a malicious Word document with an additional malicious QR code to open a supposedly secure file which likely leads to a malicious domain. These phishing attacks are similar to those used by infostealers to steal login credentials, credit card details and other sensitive information.

How to stay safe from phishing attacks

It should go without saying but don’t click on any email or message from an unknown sender. When it comes to emails that are supposed to be internal or within your company, know the policies: Would your HR department send you a QR code normally? Check the sender’s email: Is this a regular, known source or person? Is the subject line suspicious, urgent or poorly spelled?

Also, if you don’t already have one of the best antivirus software solutions set up and running on your PC, then go ahead and get that handled immediately. Make sure all your devices are protected against malware and threats, even your mobile devices - we have recommendations for the best Android antivirus apps too but due to Apple's restrictions, there's no equivalent for the best iPhones.

Whenever you’re in doubt about an email, you can always contact the sender directly and even ask them to resend an attachment through a secure method or you can manually visit a link using a secure browser. When it comes to this kind of attack, you and your knowledge are the last line of defense.

Given that malicious attachments are one of the main ways that hackers distribute malware in the first place, don't expect this campaign to die off anytime soon. Instead, you just need to be extra careful when checking your inbox and under no circumstances should you download an attachment from an unknown sender or an email that doesn't pass the smell test.

Black Friday deals have turned into Cyber Monday deals and folks are snapping up everything from TVs to kitchen appliances, and while antivirus software might not be the first (or even the third) thing you think to buy today it absolutely should be.

Firstly, everyone needs to invest in some strong protection for all their home tech devices and antivirus software is a non-negotiable. You never, ever want to wait until it is too late to realize that you should have protected your home PC or Mac with strong antivirus software.

Secondly, there are some truly amazing sales going on right now for some of the best antivirus software solutions that we've tested and reviewed. The deals listed below are up to 85% off on some of our favorite antivirus security suites and will cover your laptops, desktops, tablets, smartphones and sometimes, all the devices for an entire household.

It is definitely worth adding antivirus deals to your Cyber Monday shopping list. While you're at it, keep your eyes open for all the other amazing Cyber Monday deals that are going strong from home security cameras and video doorbells to laptops and accessories.

Quick Links

• McAfee Total Protection: was $99 now $15 @ Amazon
• Norton 360 Deluxe: was $89 now $19 @ Amazon
• Malwarebytes Premium: was $40 now $20 @ Amazon
• ESET Home Security Essential: was $60 now $27 @ Amazon
• Webroot Internet Security Complete: was $99 now $20 @ Amazon
• Bitdefender Total Security: was $89 now $45 @ Amazon

Best Cyber Monday antivirus deals

Early versions of 7-Zip, a file compression program, are affected by a security flaw with a severity score of 7.8 out of 10.

Disclosed by Trend Micro’s Zero Day Initiative and first discovered by Trend Micro Security researcher Nicholas Zubrisky back in June of this year, the flaw affects all 7-Zip versions prior to 24.07 and allows attackers to execute code on a victim’s machine.

An easy exploit, the threat actors could use any of several attack vectors to exploit a specific flaw in the implementation of the program's Zstandard decompression. The ZDI advisory goes on to explain that the proper validation of user-supplied data can then be leveraged to execute code in the context of the current process.

Basically, this means that although it would likely require victim interaction such as opening a file, the archives could be used to install malware on your PC.

The current version of 7-Zip is 24.08, released on June 19, 2024. However, as the program doesn’t have automatic updates, the app itself and subsequent updates need to be manually installed to protect users.

How to stay safe

So, if you are running 7-Zip and especially a version earlier than 24.07, make sure to manually install the latest update immediately to avoid falling victim to any cyberattacks leveraging these flaws.

As always though, never open any files you didn't ask for, don’t open them when you don't recognize the sender and when you're not sure what they are. To protect yourself further, make sure you’re using the best antivirus software to keep your Windows PC safe from the latest threats.

More from Tom's Guide

• ExpressVPN steps up its game with new Credit Scanner tool
• Is VPN by Google coming to Pixel Tablet?
• Microsoft is changing the way admin privileges work in Windows - here's why

Three months after their launch back in September of this year, Apple has released a new iOS 18.1.1 and iPadOS 18.1.1 update that includes some minor changes as well as some important security fixes.

The two security fixes concern issues with JavaScriptCore (tracked as CVE-2024-44308) and WebKit (tracked as CVE-2024-44309). The JavaScriptCore threat involved processing maliciously crafted web content that could lead to arbitrary code execution and was mainly found on Intel-based Mac systems. It was solved by improved checks.

Similarly, the Webkit fix used maliciously crafted web content to carry out cross site scripting attacks and also exploited Intel-based Mac systems. The security fix on iOS 18.1.1 and iPadOS 18.1.1 solved this by fixing a cookie management issue with improved state management.

Recommended for everyone using one of the best iPhones, the fixes come three weeks after the launch of iOS 18.1 which mainly focused on Apple Intelligence features.

How to protect an iOS or iPadOS device

Though Apple's own rules prohibiting malware scanning apps mean there isn't an iOS or iPadOS equivalent of the best Android antivirus apps, it doesn't mean you're out of options entirely.

Either Intego Mac Internet Security X9 or Intego Mac Premium Bundle X9 can be used to scan your Apple devices for malware, and both are considered some of the best Mac antivirus software solutions you can get right now. They can scan an iPhone or an iPad for malware, but either device will have to be connected to a Mac via a USB cable.

If you want an extra layer of protection for your Apple devices and the sensitive data they contain, it's worth signing up for either product.

Regardless though, the most important thing you can do to keep your iPhone or iPad safe from hackers is to install the latest updates as soon as they become available. I know installing updates can be time consuming as well as slightly annoying but hackers love to prey on people running outdated software. By keeping your devices updated regularly, you will be much less likely to fall victim to one of their attacks.

More from Tom's Guide

• Microsoft is changing the way admin privileges work in Windows — here’s why
• 123456 is the world's most popular password – again
• This fake AI image generator is pushing info-stealing malware onto Macs and PCs

Threat actors have been using links to fake AI image and video generators to steal login credentials and browsing history from infected Windows PCs and Macs

As reported by BleepingComputer and first discovered by cybersecurity researcher gonjxa on X, these fake apps are being spread through both search results and ads on the social media platform showing political deepfakes. The malicious links they contain lead to very professional appearing websites purporting to be for the fake AI image and video editing software application EditProAi.

Though it feels legitimate and even looks so at first glance, the download link for this fake AI app actually contains malware, namely the Windows variant of Lumma Stealer on PC and the macOS version of AMOS on Apple computers.

The malware itself attacks Chromium-based browsers to steal credentials, passwords, credit cards, cookies and browsing history, as well as cryptocurrency. Google Chrome, Microsoft Edge, Mozilla Firefox, Opera and Samsung Internet are all among the affected browsers.

Data is then archived and sent back to the attackers where it can be sold on the dark web or used in further attacks. The PC malware used in this campaign leverages a stolen code signing certificate from the freeware utility developer Softwareok.com to help it bypass Microsoft's built-in defenses.

If you’ve downloaded and installed this program, all of your authentications, saved passwords and crypto wallets should be considered compromised. Every site you visited after installing it should have its password reset with a strong, unique password. Likewise, any online banking or email services you visited with it installed on your computer need to be secured by using 2FA or multi-factor authentication if you haven't done so already.

How to stay safe from malware

It’s been said before but it bears repeating: you can never be too safe online. Whether it’s a new game or an AI image generator, if something seems too good to be true, it almost certainly is. That’s why you want to stick with known sites, services and in this case, AI tools like the ones on our list of the best AI image generators.

You also obviously will want to have strong protection against viruses on your Mac or PC, so make sure you have the best antivirus software on your PC and the best Mac antivirus software on your Apple computer. This ensures that malware is detected and blocked from infecting your machine which prevents your sensitive personal and financial data from being stolen by hackers in the first place.

At the same time, you want to stick to known sites and services with a good reputation and background, when in doubt, use Google or another reputable search engine for background information and reviews. And for the love of Dolly Parton, don’t just click on any link from social media or share your personal info all over the internet. If you do, you're just asking for trouble and you could even end up becoming a victim of identity theft.

More from Tom's Guide

• 1.5 million Americans hit in massive debt relief service data breach — names, addresses, SSNs and more exposed
• US confirms Chinese hacker group Salt Typhoon behind several telecom breaches
• Temu exploded out of nowhere to become a mega online store — but should you trust it?

Imagine making a call to your bank after discovering fraudulent activity on one of your accounts, only for the person on the other end of the phone to be a hacker. Well, that is exactly what’s happening to victims of this updated Android banking trojan.

As reported by BleepingComputer, a new version of the FakeCall trojan is currently making the rounds online. First discovered by the cybersecurity firm Kaspersky back in 2022, this malware uses voice phishing (or vishing), overlay attacks and other tricks to convince victims they’re actually on a call with someone from their bank.

Late last year, CheckPoint released its own report warning that FakeCall had gained the ability to impersonate more than 20 different financial organizations. Since then though, its capabilities have grown even stronger and now, the malware is able to hijack both incoming and outgoing calls made from the best Android phones.

Here’s everything you need to know about this banking trojan, along with some tips and tricks to help you stay safe from hackers and the malware they use in their attacks.

Hijacking outgoing and incoming calls

Just like most other banking trojans, FakeCall is spread through malicious apps which are usually sideloaded onto a victim’s phone. Previous versions of the trojan had users call their bank from within one of these bad apps and from there, hackers impersonated a bank employee while a fake overlay displayed their bank’s number during the call to prevent them from catching on.

Now though, this new version of FakeCall analyzed by cybersecurity researchers at Zimperium uses a new trick to appear even more convincing. Instead of an overlay on top of a legitimate app, the malicious app used to spread this malware sets itself as a phone’s default call handler. This is done by abusing Android’s accessibility services and after installation, victims are prompted to approve this.

With full control of an Android phone’s call handler, the hackers behind this campaign are able to hijack both incoming and outgoing calls. To make this appear more legitimate, a fake call interface that copies the real Android dialer is used which displays the names and info of a victim’s most frequent contacts.

If a victim goes to call their bank or other financial institution, FakeCall hijacks their call and redirects it to a hacker-controlled phone number. While the victim believes they're speaking with a bank employee who may ask for some sensitive information over the phone, they’re actually speaking with a hacker who is recording everything they say to use in subsequent attacks or even to commit fraud.

In addition to this new feature, this latest version of FakeCall has some other upgrades as well. These include the ability to live stream what’s on their screen, taking screenshots on an infected device, unlocking a phone to temporarily turn off auto-lock and more. Since so many new features have been added to this malware, it’s clear that it is currently under active development and that its creators are making it more powerful with each subsequent release.

In its report, Zimperium provides more details on this banking trojan and explains that it identified 13 malicious apps used to spread FakeCall. However, instead of their names, the firm has only released indicators of compromise (IoC) on GitHub. I'll try to get the full list of app names and will update this piece if I do so.

How to stay safe from Android malware

Just like with a lot of other Android malware, the easiest way to avoid having your phone infected with the FakeCall banking trojan is to not sideload apps. While installing apps this way may be convenient, you’re putting yourself at additional risk since these apps don’t go through the same rigorous security checks that ones on official app stores like the Google Play Store, Samsung Galaxy Store and the Amazon App Store do.

When in doubt, don’t install any apps as APK files on your phone. Instead, go to an official app store and search for the app you want to use by name. Google and other search engines are often used by hackers to host malicious ads, so it’s always better to navigate directly to an app store and search for new apps yourself. Likewise, you also want to limit the number of apps on your phone as even good apps can go bad.

In order to stay protected from malware and other online threats, you want to ensure that Google Play Protect is enabled on your device. This built-in security app scans all of the new apps you download and the existing ones on your smartphone for malware. For additional protection though, you might also want to consider using one of the best Android antivirus apps alongside Google Play Protect.

As long as there are apps, hackers are going to find a way to abuse them in their attacks. However, if you avoid sideloading new apps and don’t give the apps you do install access to permissions they don’t need, you should be safe from hackers. At the same time, it’s always a good idea to periodically restart your device to prevent hackers from using zero-click exploits to infect your phone with malware.

Since FakeCall is currently in active development, this likely isn’t the last time that we’ll hear about this banking trojan being used in cyberattacks.

More from Tom's Guide

• That emergency phone call from a loved one could actually be scammers using AI
• These are the best antivirus software solutions for your PC
• 800,000 people just had their full names, SSNs and more exposed in massive data breach

Just like with apps you use on your phone, mobile malware is always improving. Case in point, forty new variants of the TrickMo banking trojan have been spotted in the wild and some can even steal the PIN or unlock pattern from your Android phone.

As reported by BleepingComputer, the cybersecurity firm Zimperium has identified dozens of new TrickMo variants that are linked to 16 malware droppers and use 22 different command and control (C&C) infrastructures to steal your data and your hard-earned cash.

First discovered by IBM’s X-Force cybersecurity division back in 2020 though it’s likely been used to target the best Android phones since 2019, TrickMo has now been upgraded with new capabilities that make it even more dangerous. These include one-time password (OTP) interception, screen recording, data exfiltration, automatic permission granting, the ability to launch overlay attacks and more.

What’s particularly concerning about these new TrickMo variants though is their ability to steal an Android phone’s PIN or unlock pattern. With this info in hand, hackers can wait until a device is idle — like when you’re sleeping — to perform on-device fraud.

Here’s everything you need to know about the TrickMo banking trojan along with some tips on how you can keep your Android phone and other devices safe from malware.

Harvesting PINs and unlock patterns

As TrickMo is a banking trojan after all, it uses fake login screens — like the ones used in overlay attacks — to harvest usernames and passwords from unsuspecting Android users. You might think you’re logging into a banking app when really, you’re giving your credentials to hackers.

One of the ways in which TrickMo accomplishes this is by abusing Android’s Accessibility services to grant itself access to additional permissions. However, it also has the ability to tap on prompts automatically when they pop up on your phone.

In its report on the matter, Zimperium explains that these upgraded versions of TrickMo can mimic the unlock prompts you see on your Android phone when you turn on its screen. These are actually HTML pages hosted on an external website which are displayed in full-screen mode on an infected device. This makes them look legitimate and as we haven’t seen this type of attack in the past, you could see how someone could easily fall for it.

Once a PIN or unlock pattern is harvested by the hackers using TrickMo in their attacks, this info along with a unique device identifier is written as a PHP script that gets sent back to them. From there, they can unlock your phone remotely whenever they want and perform additional attacks or on-device fraud.

As it stands now, Zimperium has identified TrickMo victims in Canada, the United Arab Emirates, Turkey and Germany. However, a sophisticated banking trojan like this could easily be reconfigured to target Android users in the U.S., the U.K. and in other countries around the world.

How to stay safe from Android malware

These new TrickMo variants are currently being spread through phishing attacks. As such, you want to be careful when checking your email, messages or downloading new apps from unofficial sources.

For instance, if you get an email from an unknown sender, you want to avoid clicking on any links or downloading any attachments it may contain. The same goes for text messages and messages on social media.

Fortunately, Google Play Protect — which comes pre-installed on most Android phones — is able to identify and block known variants of TrickMo. To stay safe, you want to make sure that this free security app is enabled and running on your Android phone. However, for additional protection, you may also want to consider running one of the best Android antivirus apps alongside it.

Hackers are constantly looking for unique and clever new ways to gain access to our smartphones given how much personal and financial information they contain. For this reason, you want to be extra careful online and use a discerning eye when checking your email, messages or downloading new apps.

More from Tom's Guide

• This nasty Android adware is making phones unusable
• 11 million Android users infected with dangerous Necro trojan
• 100 million Americans just had their background check data exposed

I often warn about the dangers posed by info-stealing malware and banking trojans but there’s another mobile threat you need to worry about: adware. In fact, an adware infection can render one of the best Android phones unusable with ads popping out of nowhere when you least expect it.

According to a new blog post from the cybersecurity firm Malwrebytes, the MobiDash adware has returned to wreak havoc on vulnerable Android phones. First discovered back in 2015, this adware has continued to spread in the time since through hundreds of different variants. 

At the same time though, it also comes as a pre-packaged set of tools that hackers and scammers can add to any Android Application Package or APK file which makes distributing  it even easier.

Here’s everything you need to know about the MobiDash adware along with some tips on how to stay safe from having your own Android phone infested with annoying ads.

Hiding in plain sight

One of the main things that helps MobiDash stand out from other types of adware is that it can easily be added to legitimate Android apps without changing how they work. 

For instance, let’s say you download and install a flashlight app (which I don’t recommend for obvious reasons). The app itself will still work as intended but hidden inside it, there will be adware waiting to fill your phone’s screen with unwanted ads.

To make matters worse, MobiDash often waits for several days before activating on an infected phone. This makes the annoying ads it serves up harder to detect, especially if you recently installed several new apps on your Android smartphone.

Malwarebytes’ ThreatDown cybersecurity platform recently uncovered a new MobiDash campaign that spread through phishing emails as well as in links on social media posts made by real people as well as bots. 

With these posts on Facebook, users who click on a link in a screenshot (something you should absolutely avoid) are then sent through a chain of redirects which ends in an APK file being automatically downloaded to their phone. Likewise, Malwarebytes’ researchers also found that MobiDash was being spread on adult sites in a similar way.

How to stay safe from adware

Staying safe from this particular campaign is quite easy and you can avoid falling victim to the MobiDash malware by not sideloading apps. While you shouldn’t sideload apps in the first place, you definitely should install any APK file that’s randomly downloaded onto your smartphone after clicking on a link in an email or social media post.

Besides adware, sideloading apps can leave you with a nasty malware infection and those who did fall for this latest MobiDash campaign got off lucky. Instead of sideloading, you should only download apps from the Google Play Store or from official third-party app stores like the Samsung Galaxy Store or the Amazon Appstore.

To keep your Android phone protected from adware, malware, spyware and other threats, you want to make sure that Google Play Protect is enabled. This pre-installed app scans any new apps you download as well as your existing ones to help keep you and your data safe. For extra protection though, you may also want to consider running one of the best Android antivirus apps alongside it on your phone.

Hackers and scammers are always coming up with clever new campaigns designed to steal your data and your hard-earned cash or in this case, to bombard your phones with ads in order to commit ad fraud. However, MobiDash could also serve up malicious ads which can infect your phone with malware. Either way, you want to be extra careful where you click and avoid installing apps from unknown sources.

This likely isn’t the last we’ve heard of MobiDash as this particular adware has been going strong for almost a decade.

More from Tom's Guide

• 11 million Android users infected with dangerous Necro trojan — how to stay safe
• 100 million Americans just had their background check data exposed
• 2.9 billion hit in one of the largest data breaches ever — full names, addresses and SSNs exposed

After a two-year hiatus, the Octo malware has returned with improved capabilities that make it easier for hackers to use it to completely take over the best Android phones.

As reported by The Hacker News, security researchers at ThreatFabric have discovered a new version of this Android banking trojan called Octo2. So far, it’s mainly been used in campaigns across Europe but this malware could easily be reconfigured to target Android users in the U.S., Canada and other countries around the world.

What makes Octo2 so dangerous is the fact that it’s currently being distributed in malicious versions of popular apps including Google Chrome and NordVPN. Once your phone is infected with this malware, not only can hackers completely take it over but they can also perform fraudulent transactions right from the device itself. This helps the hackers behind this campaign avoid being detected by banks and other financial institutions.

Here’s everything you need to know about this new version of Octo 2 including how it has managed to infiltrate legitimate apps along with some tips on how to stay safe from Android malware.

Hiding in legitimate apps

The original Octo malware was first discovered back in 2022. However, it’s actually based on the Exobot malware that was first detected in 2016 according to a blog post from ThreatFabric.

The reason we’re now seeing the emergence of Octo 2 is due to the fact that the source code for the original version leaked earlier this year. With Octo’s source code in hand, hackers have begun creating their own variations of this malware to use in their attacks.

At the same time, Octo has moved to a malware-as-a-service (MaaS) operating model in which other cybercriminals pay its developer a small fee to use the malware in their own attacks. Octo’s developer even promoted this new version by informing its clients that existing users would be able to get Octo2 for the same price with early access.

To make their attacks harder to detect, the hackers deploying Octo2 are using it alongside an APK binding service called Zombinder. This may sound a bit too technical but here’s the gist, Zombinder lets hackers take legitimate Android apps and add malware to them in such a way that to the end user, they appear nearly identical to the original app.

Octo2 is downloaded by these rogue Android apps by convincing users that they need to install a “necessary plugin”. If an unsuspecting user falls for this, hackers then have complete control over their phone remotely which enables them to carry out all manner of attacks.

How to stay safe from Android malware

When it comes to staying safe from Android malware, the first and most important thing is that you avoid installing apps from unknown sources. This means only installing apps from trusted app stores like the Google Play Store, Samsung Galaxy Store or the Amazon Appstore.

Sideloading apps may be convenient but by doing so, you put yourself at risk of installing a malicious app that can then infect your phone with malware. This is why you should avoid doing so unless, of course, you need to install an app for work that can’t be hosted on an official store. However, this is extremely rare and most employers would never ask you to do this.

From here, you want to ensure that Google Play Protect is enabled on your Android phone. This free app comes pre-installed on most Android devices and it can scan all of your existing apps and any new ones you install for malware. For extra protection though, you should also consider using one of the best Android antivirus apps alongside it.

Now that Octo’s source code is out in the open, it’s very likely we will see even more variations of the malware. However, if you’re careful online, avoid sideloading apps and keep your phone updated with Google Play Protect enabled, you should be fine.

More from Tom's Guide

• 11 million Android users infected with dangerous Necro trojan — how to stay safe
• This Android malware uses stolen NFC data to drain your accounts
• 1.7 million people hit in massive credit card data breach — what to do now

Android phones are once again under attack from a dangerous trojan which has resurfaced to infect at least 11 million devices.

According to a blog post from the cybersecurity firm Kaspersky, the Necro trojan, which its security researchers first discovered in 2019, has returned. The trojan is now being distributed via official apps on the Google Play Store, unofficial modded versions of popular apps and in Android game mods.

Once installed on one of the best Android phones, Necro then downloads additional payloads that are used to activate a number of malicious plugins. From adware to subscription fraud to using infected devices as proxies to send malicious traffic, this malware is extremely versatile as a result of these plugins.

Here’s everything you need to know about the Necro trojan and how it can infect your smartphone along with some tips on how to stay safe from Android malware.

Hiding in official and unofficial apps

Even if you download a legitimate app from the Play Store, there’s still a slight chance it could be malicious as good apps can go bad thanks to the work of hackers. That appears to be exactly what happened in this case, as BleepingComputer points out, that the Necro trojan was installed through malicious advertising software development kits (SDK).

The first and most downloaded app on the Play Store is Wuta Camera, which lets you take pictures, touch them up and add a number of effects. This app alone was downloaded 10 million times. Based on Kasperky’s data, the Necro trojan was added to version 6.3.2.148 of Wuta Camera. However, versions starting from  6.3.7.138 no longer contain the trojan. This means if you’re using an older version of this app, you need to update it immediately.

The next official app infected with the Necro trojan is a web browser called Max Browser with one million downloads. The trojan was added to its code in version 1.2.0 but the app was removed from the Play Store after Kaspersky informed Google that it had become malicious. However, it’s still available on third-party app stores, so it’s best to recommend downloading Max Browser for the time being.

Kaspersky also found the Necro trojan lurking in a modified version of the Spotify Plus app. Users were invited to download a new version of the app from an unofficial source. However, unlike with the official Spotify app, this version was free and came with an unlocked subscription. This should have been a red flag but some unsuspecting users decided to download and install it despite the risk which led to their phones being infected with the Necro trojan.

Finally, Kaspersky found the Necro trojan lurking in mods for WhatsApp, Minecraft and other popular games including Stumble Guys, Car Parking Multiplayer and Melon Sandbox. Hackers often use mods to popular games as a lure, so when in doubt, you should avoid modding mobile games altogether.

How to stay safe from Android malware

When it comes to malware-filled apps, the first and most important thing you can do is to avoid downloading apps from unofficial sources. Sideloading apps may be easy and convenient but doing so can also be extremely dangerous. This is why you should stick to official app stores like the Google Play Store, Samsung Galaxy Store and the Amazon Appstore.

From here, you want to ensure that Google Play Protect (which comes pre-installed) is enabled on your Android smartphone. This first-party app scans all of the new apps as well as your existing ones for malware and other threats. For even more protection though, you should consider using one of the best Android antivirus apps alongside it.

Even when you download apps from the Play Store or other official app stores, you want to check their ratings and reviews first. As these can be faked though, it’s always a good idea to look for a video review online, so that you can see the app in question in action before downloading it.

Recently, Google has made great strides at eliminating malicious apps from the Play Store but they still manage to slip through the cracks from time to time. This is why it’s a good idea to limit the number of apps on your phone overall.

More from Tom's Guide

• 1.7 million people hit in massive credit card data breach — what to do now
• This Android malware uses stolen NFC data to drain your accounts
• New macOS malware poses as legitimate apps to steal passwords and personal data

Switching from pin and chip cards to contactless ones seemed like the perfect way to stay safe from credit card skimmers. However, a new Android malware abuses the same technology used for tap and pay to steal payment data from unsuspecting victims.

As reported by The Hacker News, the malware in question has been dubbed NGate by security researchers at ESET, and it steals NFC data to clone contactless credit and debit cards on a hacker’s smartphone. With these cloned payment cards on their phone, they can drain a victim’s bank accounts by using them to withdraw funds at ATMs.

Here’s everything you need to know about this new Android malware strain and how to stay safe from hackers.

Impersonating banks to takeover phones

The NGate malware is based on a legitimate tool called NFCGate, originally created by students at TU Darmstadt’s Secure Mobile Networking Lab in 2015. In the years since, though, the technique used by this tool has been weaponized by hackers.

According to a new report from ESET, the attackers behind this recent NGate campaign use a combination of social engineering and SMS phishing to trick unsuspecting Android users into installing the malware directly. This is done through fake sites impersonating actual banks or their mobile apps on the Google Play Store.

Between November of last year and March of this year, as many as six different malicious apps spreading the NGate malware were identified. However, malicious activity slowed significantly after a 22-year-old was arrested by law enforcement in Czechia after they were found withdrawing funds using stolen cards at ATMs.

Once one of the malicious apps used to distribute the NGate malware is installed on a victim’s smartphone, it asks them to enter sensitive financial information, including their banking client ID, date of birth and the PIN code for their bank card via a phishing page presented with a WebView. However, they’re also asked to turn on NFC on their phone and instructed to place their debit or credit card up against it until the malicious app recognizes their card.

To make matters worse, victims also receive calls from their attacker, who pretends to be a bank employee that informs them their account has been compromised due to installing the malicious app in question. From there, victims are then asked to change their PIN and validate their card using another NGate app.

How to stay safe from advanced Android malware

At the moment, the NGate malware is only being used by hackers to target owners of the best Android phones in Czechia. However, like with other online threats, this one could easily spread to the U.S., the U.K., Canada, Australia and other countries around the world. For this reason, you need to be on the lookout for more complicated malware attacks like this one. 

To avoid getting infected with the NGate malware, ESET recommends that Android users only download apps from official app stores like the Google Play Store, Samsung Galaxy Store and the Amazon Appstore. You also want to carefully scrutinize the URLs of any websites you visit and avoid clicking on links in emails and messages from unknown senders.

As this attack abuses NFC to steal your bank and credit cards, you may want to consider turning this feature off when you’re not actively using it. It could also be worth investing in a phone case that blocks unwanted RFID scans, which can prevent hackers from using NFC to steal your payment cards. You may also want to consider using digital versions of your physical cards on your phone. These digital versions are stored securely on your device, and you can use biometrics like your fingerprint or a face scan to keep them even safer.

Since we are dealing with malware, you also want to ensure that Google Play Protect is enabled on your device, as it can scan all of your existing apps and any new ones you download for viruses. For additional protection, though, you should also consider using one of the best Android antivirus apps alongside it.

In an email to Tom's Guide, a Google spokesperson provided further insight on this new Android malware threat, saying:

"Based on our current detections, no apps containing this malware are found on Google Play. Android users are automatically protected against known versions of this malware by Google Play Protect, which is on by default on Android devices with Google Play Services. Google Play Protect can warn users or block apps known to exhibit malicious behavior, even when those apps come from sources outside of Play."

Hackers are always coming up with clever new ways to steal your hard-earned cash, and the NGate malware is the perfect example of this. However, if you take the necessary precautions and are careful online, you should have no problem at all avoiding falling victim to this new threat.

More from Tom's Guide

• FBI issues warning over scammers impersonating banks to steal your debit cards
• Google removes hidden Pixel app that could have left millions of phones vulnerable
• Hackers can exploit these new flaws in Microsoft's macOS apps to spy on your Mac

While Apple's Macs aren't targeted by hackers as much as Windows PCs, they aren't impenetrable. Security researchers recently uncovered malware dubbed "Cthulhu Stealer" that impersonates popular apps to harvest passwords and steal data from macOS users. 

As first reported by The Hacker News, Cado Security pushed out a public warning this week about Cthulhu Stealer, a malware-as-a-service targeting macOS users launched in late 2023 that sells for $500 a month. "The malware is written in Golang and disguises itself as legitimate software," said Cado Security researcher Tara Gould. 

To trick users into installing it, it's appeared as software programs like CleanMyMac, Grand Theft Auto IV, or Adobe GenP, an open-source tool some Adobe users employ to get around having a Creative Cloud subscription. The malware comes packaged as a disk image (DMG) file that contains a pair of binaries, which lets it attack both Intel and Apple Silicon Macs depending on which architecture it detects. 

When a user tries to open the fake app, macOS's built-in security feature, Gatekeeper, warns that the software is unsigned. If the user opts to bypass Gatekeeper protections and let it run anyway, they're given an otherwise legitimate-looking prompt to enter their system password, followed by a second prompt for the MetaMask cryptocurrency wallet. Once it has the necessary permissions, Cthulhu Stealer can siphon a wide range of sensitive data, including saved passwords from iCloud Keychain, web browser cookies and Telegram account information. 

"The main functionality of Cthulhu Stealer is to steal credentials and cryptocurrency wallets from various stores, including game accounts," Gould explained. 

It's an osascript-based technique that we've seen in infostealers and malware before like Atomic Stealer, Cuckoo, MacStealer, and Banshee Stealer. But even if Cthulhu Stealer isn't the most sophisticated malware out there, it still poses a serious threat to Mac users who could stumble into this trap. 

How to stay safe from Mac malware

So what can you do to keep the best Macs protected from malware like Cthulhu Stealer? First and foremost, be vigilant about the apps you download and do your due diligence to make sure whoever you're downloading it from is who they say they are. While your Mac comes with built-in antivirus software in the form of XProtect, consider using that in tandem with one of the best Mac antivirus software solutions. Paid antivirus software is updated more regularly and will often throw in a VPN or password manager to help you stay safe online.

Apple is also working on making it harder to bypass Gatekeeper protections with macOS Sequoia, which is expected to roll out in mid-September. Rather than being able to override Gatekeeper warnings by Control-clicking, users will instead have to go through System Settings to allow unsigned software to run. Hopefully, the annoyance of going through an extra step will be enough of a deterrent to make users think twice before running potentially dangerous apps.

More from Tom's Guide

• Macs under threat from info-stealing malware — don’t fall for this Microsoft Teams scam
• Apple issues urgent spyware warning for iPhone users in 98 countries
• The FBI now recommends using an ad blocker — here’s why

Hackers are using malicious browser extensions to infect both Google Chrome and Microsoft Edge with dangerous malware that can steal your personal data and leave your computer at risk of further attacks.

As reported by The Hacker News, this recently discovered malware campaign has been active since 2021 and so far, at least 300,000 Chrome and Edge users have fallen victim to it.

What makes this malware particularly dangerous is the fact that it can achieve persistence on infected PCs. This means that even if you delete the malicious extension, the malware will reactivate itself the next time you restart your computer.

Here’s everything you need to know about this malware campaign and how you can actually remove the malicious extension used in it once and for all.

Using malvertising to push fake sites

Like other malware campaigns, this one uses malvertising to trick unsuspecting users into downloading and installing risky software.

The hackers behind it have created lookalike sites that impersonate popular software and services like Roblox FPS Unlocker, YouTube, VLC media player, Steam or Keepass. While potential victims think they’re installing legitimate software or extensions, they’re actually downloading a trojan that installs the malicious extensions used by this malware.

The digitally signed malicious installers used in this campaign register a scheduled task on vulnerable PCs that then executes a PowerShell script which downloads and executes the next-stage payload from a hacker-controlled remote server.

As part of this next-stage payload, the malware modifies an infected PCs Windows Registry to force the installation of Chrome and Edge extensions which are used for ad fraud by hijacking web searches on Google and Bing and then redirecting them through the hackers’ servers. To make matters worse, newer versions of this malware can even prevent browser updates from being installed, putting victims at risk of other attacks.

Fortunately, there is a fix but it does take some technical know how.

How to remove this malware from your PC for good

In a blog post detailing the findings of its security researchers, ReasonLabs provides further insight on how to properly remove this malware and the malicious extensions used in this campaign from your PC.

First things first, you need to remove the scheduled task from your PC. This is done by clicking on the Start Menu or pressing the Windows key on your keyboard and then searching for Task Scheduler. 

Once Task Scheduler is opened, you need to click on the Task Scheduler Library to show all of the tasks on your PC. While the task name used by this malware varies, you can identify it by clicking on tasks, opening them and then clicking on Actions. In the table below Actions, you can look at their Details and here, you want to look for a path to “c:\windows\system32” and a PowerShell script or a file ending with “.ps1”. ReasonLabs notes that the task name will often be similar to the PowerShell script name.  Once you’ve found the malicious task, right click on its name and then click Delete.

After this, you then need to remove the registry keys that are forcing the malicious extensions in your browser. This is more difficult but you can open the Registry Editor the same way that you did with the Task Scheduler. Keep in mind though that you shouldn’t mess with your computer’s registry unless you absolutely know what you’re doing. When in doubt, ask a friend for help or take your PC to a professional.

With the Registry Editor opened, you need to go to “Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist”. In the right pane here, there will be a list of extensions with a numerical value as “Name” and Extension ID as “Data”. Then right click on the name and then click Delete. You also have to do this for this registry key as well: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Policies\Google\Chrome\ExtensionInstallForcelist.”

As this malware affects both Chrome and Edge, you will need to repeat the same process for the Edge extensions at this path: “Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist”.

While you could delete the malware files yourself, you’re much better off using one of the best antivirus software solutions to do it for you. If you do want to do so manually, you can find instructions at the end of ReasonLabs’ blog post linked above.

Going through the process of removing these malicious extensions and the malware they’ve dropped on your PC will likely be more than enough to ensure you think twice before downloading new software or browser extensions from untrustworthy sources. If you do want to download a new extension, do so from the Chrome Web Store or from the Microsoft Edge Add-on Store instead.

More from Tom's Guide

• Made by Google event live blog — Pixel 9, Pixel 9 Pro Fold and Pixel Watch 3 news
• 2.9 billion hit in one of the largest data breaches ever
• Google just fixed 46 security flaws, including an actively exploited zero-day

Having your bank accounts drained by hackers is bad enough but a new Android malware is taking things a step further by completely wiping your phone clean afterwards.

As reported by BleepingComputer, this new malware strain has been dubbed “BingoMod” by the security researchers at the online fraud management company Cleafy who first discovered it back in May of this year.

Like other dangerous malware, this one is designed to steal your hard-earned cash by accessing your financial accounts. However, BingoMod is capable of performing on-device fraud (ODF) which allows the hackers behind it to easily bypass anti-fraud systems.

If you have one of the best Android phones and don’t want to end up with an empty bank account and a completely wiped phone, here’s everything you need to know about this new malware strain and what to look out for to help you stay safe.

Committing on-device fraud

In their report on the matter, Cleafy’s researchers explain that the new BingoMod malware is currently being spread through phishing messages sent via text. 

In order to get potential victims to open and interact with them, these malicious messages use a variety of names which closely resemble actual Android security software. For example, some of these phishing texts use the icon for AVG AntiVirus Free which is available on the Google Play Store.

When a potential victim does try to install one of these malicious apps, BingoMod asks for permissions for Android’s Accessibility Service which is often abused by mobile malware strains to gain even greater control over an infected smartphone.

From here, BingoMod steals login credentials, takes screenshots and intercepts any text messages sent to the now compromised Android device. However, in order to perform on-device fraud, it also establishes a socket-based channel to receive commands along with an HTTP-based channel to send screenshots back to hackers behind this malware.

By obtaining real-time screen content from an infected device, it’s much easier for BingoMod to bypass anti-fraud systems that use identity verification and authentication since they are using a victim’s actual smartphone and not just their credentials. In fact, the malware actually gives cybercriminals a great deal of command over an infected Android phone; they can click on a particular area, write text anywhere they want and launch apps. 

At the same time, BingoMod also allows hackers to launch manual overlay attacks by using fake notifications. Finally, to make matters worse, a smartphone infected with BingoMod can use text messages to spread onto other vulnerable phones.

Bypassing antivirus apps and wiping phones clean

If all that wasn’t scary enough, BingoMod can also remove the best Android antivirus apps from an infected smartphone as well as block the activity of any apps the hackers behind this malware specify in a command.

To help it evade detection, BingoMod’s creators have added code-flattening and string obfuscation layers. Even the popular malware analyzation service VirusTotal couldn’t detect this new Android malware.

As for wiping an infected phone clean, if the malware is registered on the device as a device admin app, a hacker can send a remote command to wipe its system. However, Cleafy’s researchers point out in their report that this is only done after a successful transfer and only impacts a phone’s external storage. 

Still though, a complete wipe is possible if a hacker uses this ability to erase all of a device’s data and then resets the phone via system settings.

How to stay safe from Android malware

Even with all of these advanced capabilities, BingoMod actually still appears to be in an early development stage which means it could become even more dangerous later on. At the moment though, it is only being used to target Android phones owned by English, Romanian and Italian-speaking users.

Since BingoMod can bypass Android antivirus apps and evade detection, the only way to stay safe is by avoiding the malicious text messages used in this campaign altogether. If you do get an unsolicited message from someone you don’t know, you need to be very careful. Don’t click on any links it may contain and likewise, you shouldn’t respond to it either.

In a statement to Tom's Guide, a Google spokesperson explained that the search giant's built-in antivirus app Google Play Protect can help protect Android smartphones from this new malware threat, saying:

"Android users are automatically protected against known versions of this malware by Google Play Protect, which is on by default on Android devices with Google Play Services. Google Play Protect can warn users or block apps known to exhibit malicious behavior, even when those apps come from sources outside of Play."

As BingoMod is still in active development, this likely isn't the last we've heard of this new Android malware. However, if you're extra careful online and avoid interacting with text messages from unknown senders, you can avoid having your bank accounts drained and your smartphone wiped by hackers.

More from Tom's Guide

• Intel laying off 15,000 employees and slashing R&D in biggest cuts ever
• 4.3 million people hit in massive healthcare data breach 
• Chrome is getting a major upgrade to keep you safe from dangerous downloads

Cybersecurity researchers have discovered a new version of the Mandrake Android spyware hiding in apps on the Google Play Store.

As reported by BleepingComputer, Mandrake was first discovered by Bitdefender in 2020, but before then, it had been operating in the wild since at least 2016. Since then, Kaspersky has discovered a new variant of the Android spyware that’s better at remaining undetected.

In a new report, the cybersecurity firm’s researchers explain that this new version of Mandrake managed to sneak onto the Play Store in five apps submitted back in 2022. Surprisingly, most apps remained available for at least a year, while one held out for two years before it was eventually discovered.

If you own one of the best Android phones and are worried about this resurfaced threat, here’s everything you need to know about the Mandrake spyware and how to stay safe from malware.

Delete these apps right now

At the time of writing, all malicious apps found to contain this new version of the Mandrake spyware have been removed from the Google Play Store. However, if you have any of them installed on your smartphone or one of the best Android tablets, you must manually delete them. 

Here are the apps in question, along with how many times unsuspecting Android users have downloaded them:

• AirFS - 30,305 downloads
• Astro Explorer - 718 downloads
• Amber - 19 downloads
• CryptoPulsing - 790 downloads
• Brain Matrix - 259 downloads

Of these malicious apps, AirFS is the one that managed to evade detection the longest, and it was up on the Play Store for two years before eventually being taken down back in March of this year. According to Kaspersky, Android users mainly downloaded these apps in the U.K., Canada, Germany, Italy, Mexico, Spain and Peru.

Hiding in plain sight

The malicious apps spreading the Mandrake spyware do things a bit differently than your typical Android malware. Instead of putting malicious logic in an app’s DEX file, Mandrake hides its first stage in a native library called “libopencv_dnn.so” which is obfuscated using OOLVM.

Once installed on a potential victim’s Android phone, this library then exports functions that are used to decrypt the second-stage loader DEx from its assets folder and load it into memory. 

This second stage also requests to draw overlays often used in overlay attacks. However, it also loads a second native library (called “libopencv_java3.so”), which decrypts a certificate that is used for secure communications with a hacker-controlled command and control (C2) server.

Once the malicious app is connected to the hacker’s C2 server, it sends a device profile and receives its third stage, which is actually the Mandrake spyware. The spyware can perform a wide range of malicious actions such as collecting data, screen recording and monitoring, command execution, simulating swipes and taps, managing files, and even installing additional malicious apps.

The hackers behind this spyware have also devised a way to display notifications that impersonate real ones from the Play Store to trick users into side-loading additional malware through APK files. 

Just like with other dangerous Android malware strains, Mandrake abuses Android permissions to run in the background and to hide app icons so that it can sneakily operate in the background unnoticed.

How to stay safe from Android malware

While all five malicious apps in question have since been removed from the Play Store, cybercriminals could use new, harder-to-detect apps to continue spreading the spyware from Google’s official app store going forward.

For this reason, you always need to be careful when downloading and installing new apps on your Android devices. You want to look at reviews and ratings carefully before downloading anything. Still, as these can be faked, you should also look for external third-party reviews and video reviews that show a particular app in action before you download it.

At the same time, you also want to ensure that Google Play Protect is enabled on your smartphone or tablet since it can scan all your existing apps and any new ones you download for malware. For additional protection, though, you should also consider using one of the best Android antivirus apps alongside it.

Malicious apps have been very successful for hackers and other cybercriminals in the past, which is why this threat likely won’t be going away anytime soon despite Google’s best efforts to prevent them from ending up on the Play Store. This is why you need to be careful and do your research first before installing any new apps on your Android smartphone or tablet.

More from Tom's Guide

• Rite Aid hit in major data breach with 2.2 million customers affected
• Google is giving Chrome a major upgrade to keep you safe from dangerous downloads
• 4.3 million people hit in massive healthcare data breach with full names, addresses and SSNs exposed online

When looking for new software online, you never want to click on the first search result as you could be dealing with fake ads spreading dangerous malware.

As we saw with the Arc browser in a recent Poseidon campaign, hackers are once again using fake ads to direct unsuspecting Mac users to malicious sites hosting malware. This time though, they’re spreading the Atomic Stealer malware which can steal passwords from web browsers and even Apple Keychain as well as cryptocurrency through fake Microsoft Teams downloads.

Here’s everything you need to know about this new campaign along with some tips on how you can keep your Mac virus free.

Hiding in plain sight

While cybercriminals and other hackers have traditionally used communication tools like Zoom, Webex or Slack as a lure, this time around, they’re using Microsoft Teams as the software giant’s workplace chat app has become quite popular.

In a new report, security researchers at Malwarebytes explain how a search for “Microsoft Teams for Mac” led to a fake ad being displayed at the top of Google Search. They believe this ad was paid for by a compromised Google ad account.

Even though the ad itself shows microsoft[.]com as the URL at the top, clicking on it doesn’t take you to Microsoft’s official site. Instead, doing so takes you to a fake landing page with the URL teambusiness[.]org that impersonates the actual Microsoft Teams site.

This incredibly simple site has Apple’s logo at the top with a brief description of the app and what it does. Underneath is a “Download Teams” button that when clicked, downloads a malicious Mac app.

If you frequently use one of the best MacBooks, you might immediately be able to tell that something is off as the downloaded file (MicrosoftTeams_v.(xx).dmg) instructs potential victims to open it with a right click. This is a big red flag as any app that asks you to install it in this manner is actually trying to bypass Apple’s built-in protection mechanism for unsigned installers.

From here, the malicious app requests that the user enters their password and grants access to the file system. However, doing so allows the Atomic Stealer malware to grab Apple Keychain passwords and other important files on the now compromised Mac. If you let things get this far, the malware then proceeds to extract sensitive data from your Apple computer and then send it back to the hackers behind this campaign.

How to stay safe from Mac malware

As I mentioned before, the first and most important thing you can do to stay safe from fake ads spreading malware is actually to scroll further down the page when searching for new software online. Just like you or I, hackers too can easily buy ad space but for much more nefarious purposes.

Taking the extra second or so to scroll down to a company’s actual website could save you from falling victim to a nasty malware infection and perhaps even having your identity stolen by hackers.

Although your Mac does come with built-in antivirus software in the form of XProtect, you might also want to consider using one of the best Mac antivirus software solutions alongside it. Paid antivirus software is updated more regularly plus, you often get extras like a VPN or password manager to help you stay safe online.

Over the past few years, we’ve seen hackers routinely use fake ads in their malware campaigns due to how successful this tactic can be. Fortunately, if you scroll down past the ads, you can avoid falling victim to this and other similar campaigns designed to infect your Mac with password-stealing malware.

More from Tom's Guide

• Apple issues urgent spyware warning for iPhone users in 98 countries
• The FBI now recommends using an ad blocker — here’s why
• Hackers are using Facebook ads to infect Windows PCs with malware

You wouldn’t expect to run into password-stealing malware while browsing Facebook but hackers are now using fake ads to target vulnerable Windows PCs on the popular social network.

As reported by BleepingComputer, security researchers at Trustwave have discovered several new campaigns that use fake Windows themes along with fake downloads for pirated games and software as a lure to trick unsuspecting Facebook users into clicking on their malicious ads. This is done by either creating new Facebook business accounts or by hijacking existing ones.

Here’s everything you need to know about this new campaign and how you can keep your own Windows PC safe from malware.

Stealing passwords and Facebook account info

According to Trustwave’s report, the hackers behind this latest round of attacks have taken out thousands of ads for each individual campaign. For instance, the top campaign called “blue-softs” had 8,100 ads while “xtaskbar-themes” had 4,300 ads.

Clicking on one of these fake ads takes potential victims to malicious sites hosted on Google Sites or True Hosting which appear to be download pages for the themes or software advertised on Facebook. These sites have a download button that when clicked, downloads a ZIP file with a name that matches the product advertised online.

As you’d expect, these ZIP files actually contain the SYS01 info-stealing malware which was first discovered by the cybersecurity firm Morphisec back in 2022. The malware itself uses a collection of executables, dynamic-link library (DLL) files, PowerShell scripts and PHP scripts to install itself and steal data from a targeted Windows PC.

SYS01 can steal cookies from your browser along with any passwords stored there and a victim’s browsing history. However, it also includes a task that leverages Facebook cookies on an infected device to extract data from a victim’s profile including their name, email, birthday and more on the social network. 

Even if you’re not on Facebook, you still need to be careful as Trustwave has observed similar malvertising campaigns on both YouTube and LinkedIn.

How to stay safe from malware

To avoid falling victim to this campaign and others like it, the first and most important thing you can do is to avoid clicking on ads. 

Hackers can buy ad space just as easily as legitimate businesses, so to stay safe, you’re better off not clicking on ads at all. In fact, even the FBI recommends you now use an ad-blocker. 

If you do see an ad for something you like, though, you’re better off heading to a search engine or — better yet — to the company’s site directly and shopping for the item you may be interested in. When you do need to interact with an ad online, you’re going to want to make sure that you’re using the best antivirus software to protect yourself from any malware or other viruses that ad could be spreading.

We’ve now seen fake ads on both Google and Facebook, and both companies are trying to crack down on this practice. In the meantime, you just need to be careful where you click and avoid downloading anything from unknown sites and sources online.

More from Tom's Guide

• Apple issues urgent spyware warning for iPhone users in 98 countries
• Hackers using Google Ads to steal your info and drain your accounts 
• NSFW Facebook ads used to spread dangerous malware — don’t click on these

Although iPhones have a reputation for being more secure than their Android counterparts, the popularity of Apple’s smartphones makes them a bigger target for hackers, especially when it comes to more sophisticated spyware attacks.

Earlier this year, the iPhone maker sent out a spyware warning to its customers in 92 countries around the world. Now Apple is back with another similar warning but this time, it’s gone out to iPhone users in even more countries.

Here’s everything you need to know about this new spyware warning along with how you can keep your own iPhone safe from hackers. 

Same threat, new warning

As reported by TechCrunch, Apple has sent out a new warning about mercenary spyware to iPhone users in 98 countries. Indian users were among them as many of the country’s journalists have been targeted by the infamous NSO Group and its Pegasus spyware in the past.

The warning says that “Apple detected that you are being targeted by a mercenary spyware attack” which is designed to remotely compromise the iPhone associated with your Apple ID. It goes on to explain that the reason a particular user is being targeted is due to “who you are or what you do.”

Unlike with malware or phishing attacks, spyware is more expensive for hackers to deploy, which is why it’s normally reserved for high-value targets like journalists, politicians and activists.

It’s worth noting that in the past, Apple has referred to these incidents as “state-sponsored” attacks while this time, the company is calling them “mercenary spyware attacks.” While the language may have changed, the threat remains the same.

How to stay safe from spyware

When it comes to protecting the best iPhones from spyware, the first and most important thing you can do is to keep your smartphone updated and running the latest software. Apple often includes security patches in both major and minor iOS releases that can help keep you, your devices and the data stored on them safe.

If you are a high-value target or think that you could be, you should also consider enabling Apple’s Lockdown Mode on your iPhone. However, doing so does limit certain functions (like link previews in messages and just-in-time [JIT] JavaScript compilation in your browser) to minimize vulnerabilities which can be exploited by spyware. For those who are at serious risk though, this can be worth it as the alternative is much worse.

In addition to enabling Lockdown Mode, you should also consider signing up for Google’s Advanced Protection Program which is designed to help keep you safe from phishing attempts and harmful downloads. It also comes with some limitations and extra requirements that change how you use your Google account.

For most people though, a warning like this is more of a wake-up call than a serious threat. Just because iPhones are known for being very secure, it doesn’t mean that you should take unnecessary risks online. One other way that you can keep your iPhone and your Mac safe is by installing the best Mac antivirus software. While not every Mac antivirus can scan your iPhone for malware, Intego Mac Internet Security X9 and Intego Mac Premium Bundle X9 can.

Spyware is highly profitable and can extract all sorts of sensitive data from a targeted device, so don’t expect this threat to disappear anytime soon.

More from Tom's Guide

• Dangerous LightSpy iPhone spyware can steal your files, location data and messages
• Hackers have found a sneaky new way to spy on your iPhone — here’s how
• Worried about spyware on your iPhone? iShutdown can reveal if you’ve been infected

If you’re tired of Safari or Chrome and are thinking of switching browsers, you need to be extra careful as hackers are using fake ads to infect the best MacBooks with info-stealing malware.

As reported by Cybernews, a rebranded malvertising campaign dubbed “Poseidon” has been discovered online hiding in fake ads on Google Search. Apparently, this Mac infostealer was developed as an alternative to the popular Atomic Stealer used to target Windows PCs.

Here’s everything you need to know about this new malvertising campaign along with how to stay safe from malware when downloading new software for your Mac.

Hijacking search results with fake ads

In a new report, the antivirus firm Malwarebytes revealed that once again, hackers are using the popular new Arc browser as a lure in their attacks. 

If a Mac user searches for Arc online, they could be tricked into clicking on a fake ad  that leads to the site “arc-download[.]com" which isn't the browser's real address. Instead of the Arc browser, this site hosts a malicious DMG file that looks like a legitimate installer.

Seasoned Mac users will notice that something is amiss right away as this fake installer asks them to right-click on the DMG file to open it. Doing things this way allows the hackers to bypass macOS’ built-in security protections.

When installed on a vulnerable Mac, this fake version of the Arc browser can steal a victim’s files, passwords and browser data and even extract cryptocurrency from any crypto wallets found on their computer.

If you are looking for a change and want to try out Arc on your Mac, you can download it here at The Browser Company’s official website.

How to stay safe from Mac malware

Since this info-stealing malware is spread through fake ads after all, you may want to consider using an ad blocker on your Mac to avoid this and other similar threats online.

From there though, you should also be using the best Mac antivirus software to help detect and stop malware from infecting your computer. Apple does include its own built-in antivirus software with macOS but unlike with XProtect, you often get a number of extras like a VPN or password manager with paid antivirus software.

Even with an ad blocker installed though, you want to get in the habit of scrolling down to the actual search results when looking for new software online. Hackers often use fake ads to lead potential victims to malicious sites distributing malware in their attacks, so you want to avoid clicking on ads when possible. Instead, you’re much better off navigating to a site directly just to be safe.

Malvertising is quite effective and while Google is taking steps to crack down on the practice, hackers will likely continue to use this tactic in their attacks.

More from Tom's Guide

• Apple AirPods can be hacked to eavesdrop on your conversations
• Hackers are now using 'malware cluster bombs' in their attacks
• Medusa banking trojan returns to steal your passwords and cash

Having your computer infected with malware is bad enough but imagine if hackers were able to drop ten different malware strains onto your PC at the same time? Well, a new hacker group is now doing just that.

As reported by BleepingComputer, a threat actor known as Unfurling Hemlock has begun infecting vulnerable systems with what security researchers at KrakenLabs are calling “malware cluster bombs”. 

According to a new blog post, Unfurling Hemlock has already launched these so-called malware cluster bomb attacks in 10 countries around the world, though the majority of them appear to be aimed at targets in the U.S. The attacks themselves began back in February of last year and are easy to trace back to the hacker group due to their distinct distribution method.

Here’s everything you need to know about these malware cluster bomb attacks along with some steps you can take to avoid falling victim to one.

Dropping a malware bomb

The initial malware used in these attacks is distributed through malicious emails or malware loaders that Unfurling Hemlock paid other hackers to use. Either way, there’s a malicious executable named “WEXTRACT.EXE” that ends up on a potential victim’s computer.

This malicious executable serves as the malware cluster bomb since it contains nested compressed cabinet files with each level containing a different malware sample or another compressed file. Once unpacked on a victim’s computer, each one drops a different malware variant.

When the final stage in the attack is reached, all of these extracted files are then executed in reverse order with the most recently extracted malware hitting the targeted device first. According to KrakenLabs’ researchers, each of these malware cluster bombs has between four and seven stages, so the amount of malware contained within them varies.

In regard to the types of malware dropped on a computer in one of Unfurling Hemlock’s attacks, there could be info-stealers, botnets and backdoors. KrakenLabs has observed the Redline stealer and many other popular malware strains in these cluster bomb-style attacks.

While KrakenLabs didn’t cover how Unfurling Hemlock is making money from these attacks, BleepingComputer believes that the group could be harvesting sensitive data using info-stealing malware and then selling this information off to other hacker groups.

How to stay safe from malware

When it comes to staying safe from malware in general and with these cluster bomb-style attacks, the most important thing you can do is to be extra careful when downloading files online. Whether it's an attachment in a phishing email or an executable from a dodgy site, you shouldn’t be downloading or opening any file from a non-trusted source.

However, hackers use all kinds of different tactics from social engineering to creating a fake sense of urgency to get you to respond to their messages or to download and open suspicious files. This is where the best antivirus software can help. 

When you do download something suspicious, your antivirus will flag the file to warn you that it’s dangerous. Paid antivirus software often comes with useful extras like a VPN or a password manager but Microsoft’s built-in antivirus software should be able to stop most threats. You just need to make sure that Windows Defender is enabled on your PC which it should be as it’s turned on by default.

Hackers are always coming up with new attack methods and these malware cluster bombs are one of the most interesting ones I’ve seen in quite some time. However, if you’re careful online, avoid downloading files from unknown sources and keep your PC and the software on it up to date, you should be able to avoid ending up with a nasty malware infection.

More from Tom's Guide

• Dangerous Medusa banking trojan returns to steal your passwords and cash
• Apple AirPods can be hacked to eavesdrop on your conversations
• 280 million at risk from malware-filled Chrome extensions — how to stay safe

When a popular Android banking trojan goes dark, it’s usually good news—but not in this case. 

As reported by BleepingComputer, after almost a year of lying low, the Medusa banking trojan has returned in several campaigns targeting users of the best Android phones in the U.S., the U.K., Canada, France, Italy, Spain and Turkey.

While Medusa was already dangerous before, these new variants require fewer permissions and include new features that make it easier for the malware to commit fraud directly on a compromised smartphone.

Here’s everything you need to know about these new Medusa variants along with how you can keep yourself and your Android devices protected from banking trojans.

Using botnets to deliver malicious apps

According to a new report from the online fraud management firm Cleafy, these new Medusa variants were first spotted back in July of last year in several campaigns that used SMS phishing or smishing to side-load the malware with the help of dropper apps.

In total, the researchers have identified 24 separate campaigns with five of them attributed to botnets that were used to deliver malicious apps to unsuspecting users. Some of the dropper apps used in these campaigns include a fake Chrome browser, a 5G connectivity app and a fake streaming app called 4K Sports.

As Medusa is a malware-as-a-service offering where hackers pay a subscription fee to deploy the banking trojan, all of these campaigns and botnets are handled by its central infrastructure, which fetches links for its command and control (C2) server.

Smaller footprint but even more dangerous

To make it easier to install their banking trojan, Medusa’s creators have made it even smaller, and it now requests fewer permissions after installation. However, it still relies on Android’s Accessibility Services to function.

While 17 commands were removed from the previous version of this banking trojan, it retains its ability to access a victim’s contacts and send text messages to spread even further. There are some new commands, though, which give these Medusa variants the ability to uninstall apps, draw over apps, set a black screen overlay and take screenshots.

Of these, the screen overlay one is particularly dangerous since it can be used by a remote attacker to make an infected smartphone appear as if it has been turned off while malicious activities are performed in the background. Likewise, Medusa’s screenshot capability provides hackers with an easy way to steal sensitive information like passwords from an infected device.

We’ll be keeping a close eye on this improved banking trojan as its smaller size means that the hackers using it will be able to expand the scope of their attacks while targeting even more Android users.

How to stay safe from Android malware

As the Medusa banking trojan is often spread through dropper apps, you need to be extra careful when installing new apps on your smartphone. 

While sideloading apps may be convenient, it’s an easy way to come down with a nasty malware infection, especially if you’re downloading their APK files from less-than-trustworthy sources. For this reason, you should stick to official Android app stores like the Google Play Store, Amazon Appstore and the Samsung Galaxy Store.

At the same time, you also want to make sure that Google Play Protect is enabled on your Android phone as it scans all of your existing apps and any new ones you download for malware. For extra protection, you may also want to consider using one of the best Android antivirus apps alongside it.

Banking trojans can be quite lucrative for the hackers that use them in their attacks, so don’t expect this particular threat to disappear anytime soon.

More from Tom's Guide

• Urgent Windows security flaw lets hackers infect your PC over Wi-Fi
• Over 280 million at risk from malware-filled Chrome extensions 
• Chrome security alert — this error will open the malware floodgates on your PC

Notorious Russia-based ransomware gang Lockbit 3.0 have claimed responsibility for a cyber attack on the US Federal Reserve.

The attack, which was announced on June 23 via a post on a site associated with the ransomware gang, allegedly saw the gang infiltrate the systems of the US Federal Reserve and exfiltrate 33 TB of sensitive banking information.

In the post, which was entitled 'federalreserve.gov', the gang explained how the Federal Reserve is structured, and its role in distributing money across the 12 US banking districts. It also gave the Reserve a 48-hour deadline to fire their "clinical idiot" of a negotiator (Lockbit's words, not mine) who had apparently valued the worth of America's banking secrecy at $50,000. The gang demanded the Federal Reserve hire a new one.

Lockbit 3.0 is notorious for its aggressive negotiation tactics and its targeting of high-profile organizations. Other recent victims of the ransomware gang include Canadian pharmacy chain London Drugs, the City of Wichita and the Hôpital de Cannes - Simone Veil.

The attack on the Federal Reserve follows the unmasking by the US Justice System of Russian national Dmitry Khoroshev as the developer, creator and administrator of the ransomware gang.

In the same way that you need to be careful when installing new apps on your smartphone, you also have to be cautious when adding new extensions to your browser, especially with Google Chrome.

With a 65% market share worldwide according to Statcounter, Chrome is the most popular browser by far which makes it the perfect target for hackers and other cybercriminals. While cyberattacks often exploit zero-day flaws in Google’s browser, there’s an easier way to target Chrome users: malicious extensions.

Just like with malicious apps, these bad extensions can contain malware and other threats designed to steal your data as well as your cash. Of the 250,00 extensions on the Chrome Web Store, less than 1% were found to include malware according to a recent blog post from Google. However, a new research paper is claiming differently. 

Published by researchers from Stanford University and the CISPA Helmholtz Center for Information Security, the research paper (PDF) claims that 280 million people installed a malware-infected Chrome extension between July 2020 and February 2023.

Here’s everything you need to know about malicious Chrome extensions and how you can stay safe when adding new extensions to your browser.

Lasting threats

As reported by TechSpot, the researchers found that over a three year period, 346 million users installed Security-Noteworthy Extensions (SNE). While 63 million of these extensions were policy violations and 3 million were vulnerable, 280 million of these installs actually contained malware. 

Surprisingly, many of these malicious extensions were available to download on the Chrome Web Store for quite some time. The malware-filled ones remained on the store for 380 days on average while the ones with vulnerable code stayed up for 1,248 days on average.

Of these malicious extensions, one called TeleApp was available to download and install for 8.5 years. The extension itself was updated in 2013 before it was finally removed after it was found to contain malware in 2022.

Normally with apps on the Google Play Store, I recommend checking user ratings and reviews to see if they are malicious. However, the researchers found that this doesn’t help when it comes to bad extensions as many of them don’t have any reviews at all. This could indicate that their users don’t know they’re dangerous or that they just didn’t take the time to rate and review them.

How to stay safe from malicious extensions

Since checking ratings and reviews on the Chrome Web Store doesn’t seem to work in this case, you’re going to have to look for external reviews to help judge whether or not a browser extension is safe to install. However, as browser extensions rarely get full reviews, there are some other things to keep in mind to stay safe.

Just like with bad apps, the researchers found that malicious extensions often ask for more permissions than they should. If you go to install a new extension and it’s asking for quite a lot of permissions, this can be a major red flag and could be a good indication that it might be malicious.

Since many malicious extensions contain malware, you’re going to want to use the best antivirus software on your PC and one of the best Mac antivirus software solutions on your Apple computer. This way, if an extension does contain malware, your antivirus software will be able to catch it before any damage can be done.

Likewise, before you install any new software or browser extensions, you first need to ask yourself if you really need to. A lot of times, you’ll be able to accomplish the same thing using built-in software or your browser’s own capabilities. If you do need to install an extension for your browser, make sure that it’s from a trusted source or a well-known software provider.

Since Chrome is the biggest browser after all, hackers will likely keep trying to have their malicious extensions slip past Google’s defenses. The search giant does have a dedicated security team that reviews every Chrome extension to make sure it isn’t malicious though. However, if you want to be extra careful, the fewer browser extensions you have installed the better.

More from Tom's Guide

• Chrome security alert — this error will open the malware floodgates on your PC
• Hackers are now using emoji to speed up their cyberattacks
• Urgent Windows security flaw lets hackers infect your PC over Wi-Fi

Hackers love to trick their victims into doing things they wouldn’t do otherwise, and a new malware campaign currently making the rounds online is the perfect example of this.

As reported by BleepingComputer, hackers are using fake Google Chrome and Microsoft Word errors to trick potential victims into running malicious PowerShell “fixes” that actually install malware.

This particular campaign is so effective that multiple hacker groups (including the ones behind ClearFake, a new group called ClickFix and the group TA571) are using it in their attacks. 

Here’s everything you need to know about this new malware campaign, and how you can avoid falling victim to the social engineering it uses to get you to infect your own Windows PC with malware.

From fix to fail

Just like with previous ClearFake campaigns, this new one uses overlays to display fake Chrome and Word errors. Potential victims are then prompted to click a copy button which contains a "fix" for these fake errors. This copied code then needs to be pasted into either a Windows Run dialog or a Powershell prompt.

In a new report highlighting all of the different attack chains used in this campaign, Proofpoint explains that compromised websites which load a malicious script hosted on the blockchain using Binance’s Smart Chain contracts are also used to infect vulnerable Windows PCs with malware.

This script performs several checks before displaying a fake Google Chrome warning that says there’s a problem displaying the webpage in question. From here, a dialog prompts visitors to install a "root certificate" by copying a PowerShell script and then running it in a Windows PowerShell (Admin) console.

When executed, this PowerShell script performs more checks to make sure that the device in question is a valid target before it downloads additional payloads, including an info-stealing malware.

Finally, there’s also an email-based infection chain that uses HTML attachments which resemble Word documents. They prompt potential victims to install a “Word Online” extension to view a document but like the other attack chains used in this campaign, a “fix” involving a PowerShell command also has to be copied and then pasted into PowerShell.

In this attack chain, the PowerShell command downloads and executes either an MSI file or a VBS script which infects the target PC with either the Matanbuchus or DarkGate malware.

How to stay safe from Windows malware

All three of the different attack chains used in this campaign rely on the fact that most Windows users aren’t aware of the dangers associated with running unknown PowerShell commands on their PCs. This is why you should never copy and execute code unless you absolutely know what you’re doing.

Likewise, you also want to ensure that Windows Defender is enabled and running on your PC as it can catch the malware dropped by these malicious PowerShell scripts. If you want even more protection though, you should also consider using one of the best antivirus software suites alongside Microsoft’s built-in security tools, especially as they often come with extras like a VPN or password manager.

As for campaigns like this one that use overlays to trick potential victims, you want to stop and take a minute to think things over before doing anything online. Hackers often try to instill a sense of urgency in their attacks to get you to act without thinking. Instead, you should read over any messages carefully and try to look them up online to see whether or not they’re genuine. Even if you don’t find any info online, the best course of action is to do nothing in most cases.

Overlay attacks are very effective as they often appear as if they’re coming from the software you’re currently using. However, by learning how they work and knowing what to look out for, you can keep your devices and your data safe.

More from Tom's Guide

• Urgent Windows security flaw lets hackers infect your PC over Wi-Fi
• Hackers are now using emoji to speed up their cyberattacks
• Scammers are impersonating this government agency to steal your cash

Hackers often use malicious documents or pirated software as a means of getting their malware onto vulnerable devices, but a new Windows flaw could let them do so over Wi-Fi.

As reported by Forbes, this new Wi-Fi vulnerability (tracked as CVE-2024-30078) affects all versions of Windows, and if exploited, it can be used by an attacker to infect vulnerable PCs with malware.

The flaw itself has a CVSS score of 8.8 out of 10, and what makes it particularly dangerous is the fact that an attacker doesn’t need physical access to a target system. They do however have to be on the same Wi-Fi network to exploit it.

Here’s everything you need to know about this new critical flaw along with some tips on how to keep your own Windows PC or laptop safe from hackers.

Making public Wi-Fi an even greater threat

In an update guide on its site, Microsoft confirmed that no special obligations need to be met to exploit this flaw except for the hacker being close to a target and on the same Wi-Fi network. They also don’t have to be authenticated nor do they need access to any settings or files on a victim’s PC.

To make matters worse, an exploit for this new Wi-Fi flaw doesn’t require any interaction from a potential victim at all. This means that users don’t need to click on a link in a phishing email or to download a malicious attachment for this to work.

For those working from home or at the office, this type of vulnerability is far less concerning. However, if you often use one of the best Windows laptops out in public — say at a coffee shop or in the airport — then you’d be more likely to fall victim to an attack exploiting this flaw.

Though often free, public Wi-Fi presents its own dangers, even without a flaw like this potentially being used in cyberattacks. This is why I highly recommend using one of the best VPNs when connected to public Wi-Fi networks. If you haven’t signed up for one yet or didn’t download its client before your big trip, then you’re going to want to avoid logging into sensitive sites on your laptop like your online banking account when connected to public Wi-Fi. Instead, you should use your phone and your own mobile data plan.

The good news here is that exploitation of this vulnerability is considered “less likely” by Microsoft. However, now that news about this flaw is out in the open, enterprising hackers could try to develop an exploit for it. The second bit of good news is that Microsoft has already patched this flaw along with 48 other vulnerabilities as part of its June 2024 Patch Tuesday updates.

How to keep your Windows PC safe from malware

Just like with your smartphone, the easiest and simplest way to avoid falling victim to malware on your Windows PC is to keep your machine updated and running the latest software. Microsoft releases new security updates on the second Tuesday of every month and you can use this timeline for when to update your desktop or laptop.

From here, you should ensure that Windows Defender is enabled on your computer. This free antivirus software from Microsoft has really improved over the years and it now does a great job of catching the latest threats before they can do damage to your PC. For even more protection though, you should consider signing up for one of the best antivirus software solutions. Paid antivirus software is usually updated more regularly, plus you often get access to a VPN, password manager and other extras to help you stay safe online.

New vulnerabilities like the one described above crop up fairly often, but if you stay on top of things and update your PC regularly, your devices and your data should be safe from any attacks exploiting them.

More from Tom's Guide

• Hackers are now using emoji to speed up their cyberattacks
• How to use a VPN to stay safe on public Wi-Fi
• Scammers are impersonating this government agency to steal your cash

Looking for a new job is hard enough as it is but now hackers are using a phishing campaign to infect job seekers with a new Windows-based backdoor.

As reported by The Hacker News, the backdoor in question has been dubbed WARMCOOKIE by researchers at the cybersecurity firm Elastic Security Labs. According to a new report, it’s used to “scout out victim networks and deploy additional payloads.”

Once installed on a victim’s PC, the backdoor can fingerprint infected machines, capture screenshots and drop other Windows malware onto their system. 

Here’s everything you need to know about this new Windows backdoor and how you can stay safe when looking for a new job online.

WARMCOOKIE backdoor

This campaign began at the end of April and uses emails that claim to come from recruitment firms such as Hays, Michael Page and PageGroup in its attack chain. These emails try to entice recipients into clicking on an embedded link to view additional details about a job opportunity.

If a potential victim does click on the link contained in these emails, they are then told to download a document by solving a CAPTCHA challenge. Doing so drops a malicious JavaScript file on their PC. It’s worth noting that this campaign uses compromised websites to host its initial phishing URLs which are then used to redirect potential victims to malicious landing pages.

According to Elastic, this obfuscated script runs PowerShell and loads the WARMCOOKIE backdoor onto their PC. The backdoor follows a two-step process which allows for it to establish persistence on the now compromised PC but before doing so, it performs anti-analysis checks to avoid being detected.

Besides capturing information from the infected PC, WARMCOOKIE can also read and write to files, execute commands using cmd.exe, compile a list of installed applications and capture screenshots. 

This backdoor doesn’t use automation to install malware onto a Windows PC. Instead, it walks victims through a number of different prompts that hide the intentions of the hackers behind this campaign that ultimately results in their computer being compromised and infected with malware.

How to stay safe from Windows malware 

Windows malware comes in many different forms but fortunately, the steps you can take to keep you and your PC safe remain the same across different malware strains.

For starters, you want to ensure that Windows Defender is enabled and up to date. This free antivirus software comes pre-installed on all Windows 10 and Windows 11 PCs in the same way that Apple includes its own X-Protect antivirus software with macOS. For additional protection though and some useful extras like a VPN or password manager, you should also consider installing one of the best antivirus software suites to run alongside it.

From here, you want to be extra careful when checking your inbox. This involves carefully scrutinizing senders’ email addresses to make sure they are legitimate and avoiding downloading any attachments or clicking on links from unknown senders. Hackers use malicious documents and other bogus attachments as an entryway into your PC, so if you don’t know the sender, you should avoid downloading anything that’s sent to you.

As for staying safe during a job hunt, you want to stick to established and trusted sites and services like Indeed, LinkedIn, ZipRecruiter, Monster and GlassDoor. Likewise, if possible, you should try to use your existing connections to see if there are any new positions or opportunities available before heading to a job site to look for work.

WARMCOOKIE may be a newly discovered backdoor but it is quickly gaining popularity among hackers and other cybercriminals as it provides an easy way to infect vulnerable PCs with other types of malware. As such, this likely isn’t the last time that we’ll hear about this particular backdoor being used in cyberattacks.

More from Tom's Guide

• Frontier hack exposed personal info of 750,000 customers including SSNs
• LightSpy spyware can now snoop on your Mac and your iPhone
• Over 500 million hit in massive Ticketmaster data breach — what to do now

Bad apps can wreak havoc on the best Android phones, which is why you always need to be careful when installing new ones. However, even when you download new software via the Google Play Store there’s still a chance that you could end up with a malicious app on your phone.

As reported by BleepingComputer, the cybersecurity firm Zscaler has revealed that it has discovered more than 90 malicious apps on Google Play which were collectively installed 5.5 million times.

While the firm hasn’t provided the names of most of these malicious apps, we do know that many of them impersonated productivity, personalization and health & fitness apps along with other utilities.

Here’s everything you need to know about this latest batch of bad apps including the names of two of them that you need to remove immediately if they’re installed on your Android devices.

Delete these apps right now

As I mentioned before, Zscaler has yet to release the full list of the 90+ malicious apps it discovered over the past few months. However, it did provide info on two particularly dangerous apps in a new report that you should delete immediately if you have them installed:

• PDF Reader & File Manager by TSARKA Watchfaces
• QR Reader & File Manager by risovanul

Fortunately, both of these apps have been removed from the Google Play Store and are no longer available for download. However, if you have them installed on your Android phone or tablet, you’re going to need to manually uninstall them.

Dropper apps hiding in plain sight

As we’ve seen in the past, bad apps can slip through the cracks and end up on the Google Play Store. Both of the apps listed above are what’s known as malware droppers and according to Zscaler, together they’ve been installed 70,000 times combined.

These dropper apps are able to bypass Google’s rigorous security checks as they don’t contain malware when uploaded to the Play Store. Instead, the apps communicate with a hacker-controlled command and control (C&C) server after installation to download malware.

In this case, both of these utility apps are being used to infect vulnerable Android phones with the Anatsa banking trojan. This Android malware targets over 650 banking apps in the US, the UK, Europe and Asia in order to steal their financial credentials. In fact, during a malware campaign late last year, Anatsa was able to infect 150,000 Android phones through Google Play using bad apps.

Just like with other banking trojans, Anatsa uses overlay attacks to steal your banking credentials. These overlays are actually fake websites designed to mimic the look and feel of the login pages of popular banking apps. However, instead of logging into your account, you’re also giving hackers your username and password.

Anatsa can also commit on-device fraud by launching banking apps on its own and performing transactions on behalf of victims. Not only does this save the hackers time but it also improves their chances of success since someone logging into their account on their own device doesn’t raise nearly as much suspicion as it would on a different Android phone.

How to stay safe from malicious apps

In order to stay safe from this and other Android malware strains, you’re going to want to limit the number of apps on your phone. Even seemingly innocent apps can be used to drop malware onto your device which is why you really want to ask yourself whether or not you need a particular app before downloading and installing it.

For this reason, you want to stick to bigger, more widely known app developers that have a history of putting out good software. Likewise, you’re much less likely to come across malware when going with paid apps as opposed to free ones. Before installing any app, you also want to check its rating and reviews but as these can be faked, it’s a good idea to look for video reviews online so that you can see the app in question in action before you download it.

To protect yourself and your devices from malware, you want to make sure that Google Play Protect is enabled on your phone as it can scan all of your existing apps and any new ones you download for malware. For additional protection and some useful extras like a VPN or even a password manager, you might also want to look into running one of the best Android antivirus apps alongside it.

In an email to Tom's Guide, a Google spokesperson provided further insight on these malicious apps, saying:

“All of the identified malicious apps have been removed from Google Play. Google Play Protect also protects users by automatically removing or disabling apps known to contain this malware on Android devices with Google Play Services.”

Hopefully Zscaler releases the full list of the 90+ malicious apps it has discovered over the past few months. Even if it doesn’t though, this new Anatsa campaign serves as the perfect reminder that you always need to be careful when downloading and installing new software even when it’s from official app stores.

More from Tom's Guide

• Android banking trojan uses fake Google Play updates to take over your phone
• Massive Ticketmaster data breach reportedly hits over 500 million customers
• Hackers have leaked the criminal records of millions of Americans online

Keeping your mobile devices and their apps updated is one of the most important things you can do to stay safe from the latest cyber threats. However, as hackers are aware of this too, they often use fake updates as a means to infect your devices with malware, as is the case with a new Android banking trojan currently making the rounds online.

According to a blog post from the cybersecurity firm Cyble, its researchers have discovered a new Android banking Trojan called Antidot, not to be confused with the Brokewell malware the team discovered last month.

Once installed on one of the best Android phones, the Antidot malware can collect contacts and text messages, harvest credentials, lock and unlock the device, forward calls and more which is why this new banking trojan is so dangerous.

Here’s everything you need to know about the Antidot banking trojan along with some steps you can take to keep your own Android phone safe from this and other malware strains.

Impersonating Google Play

Google Play is one of the most important apps on your Android phone, as it’s where you download new apps from as well as updates for your existing apps. It’s the kind of app you definitely want to keep up to date, which is why the hackers behind this campaign have decided to impersonate it.

Like with other malware campaigns, this one uses phishing messages to trick users into installing it. Unsuspecting users may receive an email — or more likely a text message — that appears to come from Google telling them they need to update Google Play. The message also contains a malicious link that leads them to the malware itself which needs to be sideloaded as an APK file.

What’s particularly interesting about this campaign is that the fake Google Play update pages it uses have been crafted in several different languages including English, German, French, Spanish, Russian, Portuguese and Romanian. This lets the hackers behind the Antidot banking trojan target a wide range of Android users from multiple countries at the same time without having to tweak the campaign itself for each country.

Once installed, the malware displays another fake update page that’s used to trick victims into giving it access to Android’s Accessibility Settings. Getting access to these services is what allows Antidot to gain complete control over a vulnerable Android smartphone as they can be abused to see what’s on a victim’s screen as well as to interact with their apps and other data.

From overlay attacks to keylogging

The Antidot malware and other banking trojans make use of a hacker-controlled Command and Control (C&C) server to carry out their malicious actions. This server lets the hackers communicate directly with an infected device and tell the malware what to do.

From here, the Antidot malware has a total of 35 different commands it can perform from unlocking an infected device to making calls, collecting and sending text messages, sending out push notifications, locking the device and more. This banking trojan can also copy text from an infected phone’s clipboard.

In order to steal passwords and other credentials though, Antidot uses overlay attacks in a similar way to other popular banking trojans like Ermac, Chameleon and Brokewell. For those unfamiliar with overlay attacks, here’s how they work. When you open a banking app on your phone, the malware loads an HTML phishing page that’s designed to look just like that particular app and this page is overlaid on top. Then when you enter your credentials to log in, they are captured by hackers who can then drain your bank account, commit fraud or even steal your identity with enough info.

If there are banking or other financial apps that the malware doesn’t have an overlay ready for, keylogging is used to capture everything a victim types on an infected Android smartphone including their passwords.

How to stay safe from Android malware

Android malware like Antidot can be very dangerous since so much personal and financial information is now stored on our phones. However, by taking the right steps and implementing certain safeguards, you can avoid falling victim to it.

For starters, you only want to install new apps from the Google Play Store or other official app stores like the Amazon Appstore or the Samsung Galaxy Store. While convenient and fast, sideloading apps puts you and your devices at risk, so it’s best to avoid this altogether.

At the same time, you want to avoid clicking on any links in emails or text messages sent from unknown senders to your smartphone. Hackers will often send messages that try to instill a sense of urgency with a link for you to click at the bottom. If you read through the message and get worked up about what it says, like how you need to update Google Play immediately in this case, you’re more likely to click on the link and do exactly what the hackers want you to. Also keep in mind that hackers can pose as your friends and family to trick you as well, like we saw with the recent ‘Look who died’ scam on social media.

To stay safe from Android malware, you should make sure that Google Play Protect is enabled on your smartphone. This free antivirus app from Google scans all of your existing apps and any new ones you download for malware. However, for additional protection and access to some useful extras like a VPN or password manager, you should also consider downloading one of the best Android antivirus apps.

Due to how much data and money they can bring in for hackers, banking trojans aren’t going anywhere anytime soon. This is why it’s up to you to carefully examine the messages you receive and practice good cyber hygiene.

More from Tom's Guide

• Massive Ticketmaster data breach reportedly hits over 500 million customers — what to do now
• Update Chrome right now — four zero-day flaws have already been patched this month
• Scammers are tricking Android users into installing a fake antivirus app to drain their accounts

Hackers are now using a combination of malicious apps and brand impersonation to steal the passwords and other sensitive data of unsuspecting Android users.

As reported by The Hacker News, a new malware campaign has been spotted online in which malicious Android apps pose as Google, Instagram, Snapchat, WhatsApp, X and other popular online services in a bid to harvest contacts, text messages, call logs and of course, passwords from vulnerable Android phones.

Although security researchers at SonicWall’s Capture Labs team know quite a bit about this new campaign so far, they aren’t quite sure how the malicious apps used in it end up on the best Android phones. However, these fake apps could be spread on phishing sites, through emails or text messages or they may even come bundled with pirated software.

While we’ll likely learn more regarding the intricacies of this campaign and the hackers behind it once SonicWall does, in the meantime, here’s everything you need to know to avoid getting a nasty malware infection on your own Android phone as the result of a malicious app. 

From a fake app to fake login pages

According to a blog post from SonicWall, once the malicious app used to distribute this malware is installed on a victim’s phone, it then uses famous Android app icons from popular apps and online services to hide in plain sight.

When the malicious app is opened for the first time which could easily happen by mistake as it’s impersonating another app, it requests access to two permissions: Android Accessibility Service and Device Admin Permission. If a potential victim grants the app access to these sensitive permissions, it can then take control over their phone and steal sensitive data from it without their knowledge.

The malicious app in question then establishes a connection with a hacker-controlled command and control (C&C) server from which it receives additional instructions. For instance, the malicious app can be used to read messages, read call logs, access notification data, send messages and worst of all, open malicious websites in a victim’s browser for the purpose of phishing.

Essentially, the way in which this malicious app and the malware it contains harvest credentials from victims is by taking them to fake login pages for sites such as Instagram, PayPal, Netflix, Microsoft, WordPress, LinkedIn, ProtonMail, Yahoo and more. They are then prompted to enter their username and password which is stored and then relayed back to the hackers behind this campaign. 

From there, they can then take over their online accounts and commit fraud or possibly even identity theft if enough of their sensitive, personal information is contained in one of these services. For instance, if they got a victim’s Microsoft credentials and they use OneDrive to store copies of their driver’s license, passport or even their Social Security number (a terrible idea but some people still do), the hackers could cause some serious trouble.

How to stay safe from Android malware

Since we aren’t entirely sure how this particular malware-filled app is being spread, the best I can do is to give you some overall guidance when it comes to protecting yourself from Android malware.

Google has taken a lot of precautions over the years to significantly decrease the chances of malicious apps ending up on Play Store. However, you still need to be careful when downloading any new app onto your Android phone. You want to check an app’s ratings, reviews and if possible, look for a video review online so that you can see the app in question.

Normally with malicious apps though, they are often sideloaded onto a victim’s smartphone. Surprisingly, this is often done by the victim themselves after being coerced into doing so by a hacker, scammer or some other type of cybercriminal. This is why you need to be extremely wary when someone tells you to install an app in either a text message, email or on social media. If the app isn’t available on a first party app store and needs to be downloaded as an APK file and then installed manually, this is a big red flag and you should avoid it at all costs.

To prevent malicious apps from being installed on your Android phone in the first place, you want to make sure that Google Play Protect is enabled as this pre-installed security app scans all of your existing apps and any new ones you download for malware. If you want to be extra careful though, you should also consider running one of the best Android antivirus apps alongside it.

We may not learn more about this particular campaign but at least now, you know that malicious apps can change their icons to hide in plain sight. Sometimes they do this by pretending to be system apps like contacts or settings or in this case, by impersonating popular apps using their logos and names. Since campaigns like this one can be so effective though, we likely won’t see hackers drop this tactic from their arsenal anytime soon.

More from Tom's Guide

• Wpeeper Android malware adds a backdoor to your phone to steal your data
• Here’s another big reason to avoid pirating content and software online
• Scammers are tricking Android users with a fake antivirus app that can drain bank accounts

A new Android malware campaign is using social engineering and several other tricks to dupe unsuspecting users into installing malware capable of draining their bank accounts.

As reported by BleepingComputer, this particular campaign currently only affects users of the best Android phones in Finland. However, it’s still a great example of the types of tactics and means hackers use to trick people into installing malicious apps.

According to Finland’s Transport and Communications Agency (Traficom), this attack begins with a text message that instructs the recipient to call a phone number. When they do, they are then instructed by a scammer on the other end to install a McAfee app for protection.

While you should never install any app someone coerces you to over the phone, the initial text messages in this campaign appeared to come from either banks or payment service providers using spoofing technology to make this request appear more legitimate.

Here’s everything you need to know about this new malware campaign and how you can avoid falling victim to it and others like it.

Sideloading malware

Instead of coming from the Google Play Store or another official app store, this fake McAfee app arrives as an Android APK file which needs to be sideloaded onto a victim’s phone. This is a major red flag and a clear giveaway that this is a scam since no bank or financial service provider would ever ask its customers to sideload an app.

Still though, many Finish users have fallen to this scam with Traficom reporting that one victim lost over $100,000. In fact, this scam has gotten so bad that the financial service provider OP Financial Group published a separate alert on its website warning its customers about text messages impersonating banks or national authorities.

While the Finnish authorities didn’t name the malware strain being used in this campaign, BleepingComptuer noticed that it resembled a recent Vultur banking trojan campaign from earlier this year.

This new Vultur variant uses a combination of smishing (phishing over SMS) and phone call attacks to convince potential victims to download a fake McAFee Security app. Sound familiar? It should as this is almost the exact same attack scenario used in this new campaign.

For those who may have accidentally installed this malicious app posing as McAFee, you should call your bank immediately to enable protective measures and restore your compromised Android phone to its factory settings. You will lose all of your apps and other data but doing so will wipe the malware from your phone.

How to stay safe from Android malware

Android malware has the potential to completely upend your life if you’re not careful. This is why you want to be extremely cautious when installing any new app onto your smartphone.

Besides not sideloading apps, you also want to check the ratings and reviews of any app you download from the Google Play Store or other official Android app stores like the Samsung Galaxy Store or Amazon Appstore for that matter. Since reviews and ratings can be faked, I always recommend that you also look for video reviews so that you can see the app in question in action before installing it.

When you do install a new app, pay careful attention to the permissions it requests. Malicious apps spreading malware often request access to unnecessary permissions as a means to gain access over your phone. For instance, a simple utility app like a calculator doesn’t need access to your photos or the ability to see your contacts. As for which permissions are an immediate red flag, Accessibility Services is a permission that’s often abused by malicious apps as it gives the hackers behind them near total control of your phone.

As it comes pre-installed on most Android phones, you also want to make sure that Google Play Protect is enabled as it scans all of your existing apps and any new ones you download for malware. For extra protection though, you might also want to consider installing one of the best Android antivirus apps as they often come with additional security features like a VPN or password manager.

Scammers and hackers are going to keep coming up with clever new ways to infect users with malware as companies like Google and law enforcement agencies grow wise to their tricks. As such, it’s up to you to be careful online and not let your emotions get the best of you when dealing with text messages or other communications sent from unknown senders or even people posing as someone they’re not.

More from Tom's Guide

• Wpeeper Android malware adds a backdoor to your phone to steal your data
• Hackers are using fake apps to distribute this dangerous Mac malware
• Cuckoo macOS malware can take over all Macs and steals your passwords too

Hackers are using a new Mac malware to launch attacks against both newer Macs running Apple Silicon as well as older Intel-based Macs.

As reported by The Hacker News, the malware in question has been dubbed Cuckoo by security researchers at the device management company Kandji. Besides targeting both newer and older Macs, what sets Cuckoo apart is that it behaves like a cross between infostealer malware and spyware.

In a blog post, Kandji’s Adam Kohler and Christopher Lopez explain that they came across a previously undetected malicious Mach-O binary on the malware-tracking site VirusTotal with the name “DumpMedia Spotify Music Converter.” They then looked up the program’s name online and found that it was being distributed from a site called dumpmedia[.]com which offers multiple apps to help users pirate music from streaming services by converting them into MP3 files.

While the Cuckoo malware is currently being spread on music piracy sites, this campaign could easily be changed to distribute it through other fake apps. Here’s everything you need to know about this new Mac malware threat including some tips on how you can keep your own Mac virus free.

Establishing persistence and escalating privileges

After downloading the DumpMedia Spotify Music Converter app, the researchers discovered it contained an application bundle. This is interesting as normally, macOS apps just need to be dragged into the Applications folder — in contrast, this one encourages users to right click on it and then click open.

The app found in the bundle was signed without a developer ID which means that Apple’s Gatekeeper will try to stop it from running. However, if a user allows it to run on their computer manually, the malware will then run its course.

Just like the MacStealer malware, Cuckoo uses a script to display a fake password prompt to trick users into entering their system password. If the hackers behind this malware do get a victim’s system password, they can then escalate the malware’s privileges on the infected machine.

Cuckoo then takes note of the apps installed on the now compromised Mac, takes screenshots and harvests data from iCloud Keychain, Apple Notes, web browsers, crypto wallets and apps like Discord, FileZilla, Steam and Telegram.

It’s also worth noting that Cuckoo uses a technique called LaunchAgent to establish persistence on an infected Mac. This way, even if you reboot your computer, the malware will still run the next time you turn your Mac on. Likewise, the malware checks to make sure that the targeted Mac isn’t located in Armenia, Belarus, Kazakhstan, Russia or Ukraine before it begins stealing sensitive data.

How to stay safe from Mac malware

As is often the case with other malware strains, Cuckoo is currently being spread on piracy sites. Besides being illegal and harmful to creators, pirating content online is usually a surefire way to end up with a nasty malware infection.

While your Mac comes with built-in antivirus software in the form of Apple’s XProtect, you might also want to consider using one of the best Mac antivirus software solutions as well. These paid antivirus programs tend to receive updates more regularly, come with more features and often give you access to extras like a VPN or password manager.

We could see the hackers behind this campaign come up with another way to distribute the new Cuckoo malware like through phishing emails or malicious apps. For right now though, if you avoid sites that offer a way to download music from streaming services, you should be safe.

More from Tom's Guide

• Hackers are using fake apps to distribute this dangerous Mac malware 
• Unpatchable vulnerability discovered in Apple M1, M2 and M3 chips
• This macOS flaw lets hackers install 'undeletable' malware on your Mac

Editor’s Note: We have updated this article to highlight the fact that the vulnerable apps in question have since been patched by their respective developers. Also, we’ve changed the headline to address that the apps themselves are not malicious and don’t need to be deleted. We’ll update this story as we learn more.

Microsoft is sounding the alarm about a recently discovered critical security vulnerability on Android named "Dirty Stream" that can let malicious apps easily hijack legitimate apps. Worse still, this flaw impacts multiple apps with hundreds of millions of installs. If you have one of the best Android phones, here's what you need to know to protect your data. 

The vulnerability relates to the ContentProvider system prevalent across many popular Android apps, which manages access to structured data sets meant to be shared between different applications. It's basically what lets your Android apps talk to one another and share files. To protect users and ward off unauthorized access, the system includes safeguards such as strict isolation of data, unique permissions attached to specific URIs (Uniform Resource Identifiers), and path validation security. 

According to Microsoft's alert, two vulnerable apps that have since been patched  include Xiaomi Inc.’s File Manager (1B+ installs) and WPS Office (500M+ installs). 

What makes the Dirty Stream vulnerability so devious is how it manipulates this system. Microsoft has found that hackers can create "custom intents," messaging objects that facilitate communication between components across Android apps, to bypass these security measures. By exploiting this loophole, malicious apps can send a file with a manipulated filename or path to another app using a custom intent, sneaking in harmful code disguised as legitimate files. 

From there, a hacker could trick a vulnerable app into overwriting critical files within its private storage space — and the results can be devastating. As BleepingComputer put it, Dirty Stream essentially turns a common OS-level function into a weaponized tool to execute unauthorized code, steal data, and even hijack an app while the user is none the wiser. 

"Arbitrary code execution can provide a threat actor with full control over an application’s behavior," Microsoft said in a security bulletin this week. "Meanwhile, token theft can provide a threat actor with access to the user’s accounts and sensitive data."

How widespread is this threat?

Microsoft’s investigation found that this vulnerability is not an isolated issue. The company uncovered incorrect implementations of the content provider system across many popular Android apps. 

"We identified several vulnerable applications in the Google Play Store that represented over four billion installations," Microsoft explained. "We anticipate that the vulnerability pattern could be found in other applications."

Given the nature of how this vulnerability works, it's hard to know exactly how many other legitimate apps may have been impacted. But it's safe to assume this potential risk is on an industrial scale until all apps are patched. 

How to stay safe from Android malware

When it comes to staying safe from Android malware, one of the easiest and simplest things you can do is to limit the number of apps on your phone. I know this may sound silly but think of it this way, the fewer apps you have, the less likely that one of them may turn out to be malicious. Before installing any new app, first ask yourself whether or not you actually need it.

From here, you want to make sure that you’re installing new security updates and patches as soon as they become available. These often fix vulnerabilities and zero-day flaws which can be used to launch attacks by hackers. While you can use an old phone for longer than you’d expect, it’s worth upgrading to a new device once your current phone isn’t receiving security updates any more, especially if you want to be on the safe side.

You also want to make sure that Google Play Protect is enabled on your device. This pre-installed app scans both your existing apps and any new ones you download for malware. Likewise, if you want extra protection and potentially even some extra features like a VPN or password manager, you also want to check out the best Android antivirus apps.

As ‘Dirty Stream’ is a very serious flaw, it’s likely that Google is already working on a fix as Microsoft would have shared any of the info it uncovered with the search giant before publishing its alert.

More from Tom's Guide

• New Wpeeper Android malware adds a backdoor to your phone to steal your data
• Google blocked over 2 million dangerous Android apps from the Play Store last year
• FBI warns scammers are using ‘free’ verification services to dupe dating app users

If you thought the best MacBooks were safe from malware, think again, as hackers now have Apple’s computers fixed firmly in their sights.

While there are a number of different Mac malware strains, one in particular keeps reappearing. Atomic Stealer is an info-stealing malware which is often distributed through pirated apps. This time, however, this malware is impersonating popular apps in Google Ads to dupe unsuspecting users into infecting their Apple computers.

According to a blog post from Intego, the cybersecurity firm’s researchers have been tracking two new Atomic Stealer variants. What makes this malware particularly dangerous is that it’s designed to steal sensitive data including saved passwords, cookies, autofill text and even crypto from infected Macs.

Here’s everything you need to know about this new Atomic Stealer campaign along with some tips and tricks to help keep your Mac malware free.

Impersonating popular Mac apps

In the same way that businesses can buy ad space to have their products show up higher in search results, so too can hackers. They’ve been using this technique for the past year or so, which is why I highly recommend that you now scroll down past the ads and don’t just click on the first result in Google (or any other search engine for that matter).

In this particular campaign, the hackers behind it are impersonating a popular Mac utility, a personal finance app, a digital trading card game and a productivity app using this technique. 

With the utility File Juicer, which extracts embedded files from different types of documents, and the personal finance app Debit & Credit, the hackers behind this campaign are using a fake installer called “AppleApp.” When opened on a vulnerable Mac, instead of installing the actual programs, this installer infects the system with the Atomic Stealer malware.

As for the digital trading card game Parallel and the productivity software Notion, both fake apps have installers that impersonate their legitimate counterparts, complete with their names and logos. 

During its investigation into the matter, Intego also observed that many of these fake apps are actually malware droppers which are “designed to obtain and install additional malware.” These droppers try to hide in plain sight before connecting to a malicious website to download additional payloads onto an infected computer.

How to keep your Mac safe from malware

To avoid accidentally downloading fake apps spreading malware onto your Mac, there are a few steps you can take to stay safe.

For starters, it’s better to stick to official app stores like the Mac App Store when downloading new software. If you do need to look for a particular program on a search engine, you want to scroll down past any ads as they could be malicious and instead install the app or program directly from a company’s website. When you know a company’s web address, you’re better off just typing that out into your browser’s address bar, too.

Although your Mac comes with built-in malware protection in the form of XProtect, you might also want to consider investing in the best Mac antivirus software for your Apple computer. These paid antivirus programs have more features, and it’s worth noting that Intego’s Mac antivirus products also have a clever trick up their sleeves. Both Intego Mac Internet Security X9 and Intego Mac Premium Bundle X9 can scan the best iPhones and iPads for malware but only when they are connected to a Mac via a USB cable.

Since Mac users are such a profitable target for hackers, it’s highly likely that we will continue to see even more malware targeting Apple’s computers. This is why you need to be extra careful online and this is especially true when downloading new apps or software.

More from Tom's Guide

• FBI warns scammers are using ‘free’ verification services to dupe dating app users
• Unpatchable vulnerability discovered in Apple M1, M2 and M3 chips
• Dangerous LightSpy iPhone spyware can steal your files, location data and messages