Whether you missclicked or downloaded the wrong file, malware can infect your Android device or iPhone and you might not have even noticed. There are some signs that are completely obvious, but others are a little more discreet and take some snooping around to suss out.

Here are some warning signs that you might have an unwanted guest on your smartphone.

Pop-up ads

Advertisements spamming your phone, especially outside of an app, is a dead giveaway. Don’t ignore the problem, even if you’re a fan of Neon Genesis Evangelion who really appreciates seeing “CONGRATULATIONS” spread across their screen.

New apps

If your phone is packing a ridiculous number of applications like mine, then you might not notice when a new app creeps into your system. For both the sake of spotting malware and cleaning up your library of unused apps, it's worth taking the time to audit your current apps.

Shorter battery life

Malware does a lot in the background to wreak havoc on your device, and that takes power. So one of the telltale signs of malware infecting your device is if you experience shorter battery life. Battery life can vary, especially as a phone ages, so I recommend looking up the average battery life for your device to see if there's an obvious discrepancy.

Performance issues

Got a brand new phone and all of a sudden everything slows down to a crawl? Are apps randomly crashing on you? This is another sign that malware may have crept onto your device. This may be more difficult to spot on phones already experiencing slower performance, so keep an eye out for other signs if that’s the case.

Overheating

Unless you still have a Samsung Galaxy Note 7 hanging around, which you shouldn't, your device should not be scorching your hand. If your smartphone is spamming you with overheating warnings or is straight up crashing, especially in temperate environments, there might be a virus giving your phone a fever (my dad joke for the day).

Abnormal data usage

Unless you have a limited data plan and are remaining vigilant about your usage, it’s unlikely you’ll notice malware taking up all your data. Unlimited data users who have never checked their data metrics need to be more alert. It doesn’t hurt to check your data usage every once in a while, if not to see what apps you’re maybe spending a little too much time on.

Your contacts get spam

The most embarrassing and frustrating sign of malware is all your friends and family getting hit with spam messages that can potentially affect their devices. You’ll likely hear about this sooner than later, but as someone who doesn’t actually use SMS to contact people, it doesn’t hurt to check your default messaging app. Hopefully your contacts know what you sound like versus a spam bot imitating you, but the sooner you alert people the better.

What you can do

If you’re still not 100% certain whether or not your device is carrying around malware, there’s a few things you can do.

For iPhone users, navigate to Settings > General > VPN & Device Management to check if any unknown profiles are installed. If you don’t find anything here, go to Settings > Privacy & Security and check on your app permissions. This might be a bit tedious, but you should do a step by step inventory of app permissions and revoke access to apps that you aren't using, and delete ones that you don’t recognize.

For Android users, go to Google Play > tap your profile picture > Play Protect. This will scan your device for any harmful apps. It typically runs automatically, but it doesn’t hurt to do a manual check.

If you don’t find anything going down these routes, Android users can download one of the best Android antivirus software solutions, which can not only help locate malware but also delete it. Unfortunately, iPhone users don’t have access to traditional antivirus software because of how Apple sandboxes each app, but you can download security apps that can detect data breaches.

If you can’t manage to track down the issue, then resetting your device to factory settings may be the next step. In this case, you should set up your smartphone as a new device, as any backups can bring with it the malware that infected the system to begin with. Then reintroduce apps and services one by one to see if the issue continues, and if it happens again, you’ll know where the call inside the house is coming from and you can get rid of it — it could be something as simple as a browser extension.

I highly recommend changing passwords on critical services, like banking apps, using a different device. Monitor your smartphone for a while to see if the issue has been addressed before relogging into any sensitive apps.

More from Tom's Guide

• 5 fast steps to take immediately after a company leaks your personal data
• 3 hidden macOS security features you need to turn on right now
• Does antivirus software still slow down your PC in 2026? We tested the top security software to find out

Massive Microsoft Patch Tuesday updates have become the norm and October may actually have broken records, fixing over 1,400 vulnerabilities in Windows. This comes just a month after the company released patches for more than 1,000 flaws, and then had to send out an emergency patch to fix what those updates broke.

This week, Microsoft shipped patches that covered a mind-boggling 1,413 flaws, including one that the company said was actively being exploited by hackers in the wild before the patch.

Those patches cover 1,102 flaws in Windows, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server and 22 in SQL Server. 670 of the patches are related to privilege escalation vulnerabilities. And 70 are rated as "Critical" in severity.

Microsoft's update guide specifically highlighted three notable flaws:

• CVE-2026-96951: - Windows Shell had a command injection vulnerability that would allow a bad actor to bypass security over a network. This one was apparently actively exploited.
• CVE-2026-108398:- An untrusted search path in .NET Framework would allow an attacker to bypass a "security feature" locally. This one is listed as publicly disclosed but not exploited.
• CVE-2026-21413: This one apparently wasn't found by Microsoft but would allow a buffer overflow of Windows Raw Image Extension to allow attacks to execute code over a network.

Microsoft credited Riku Bamba and Yuya Chudo of Fujitsu Limited and Benoit Sevens, who used Anthropic's Claude, with discovering the 96951 flaw which was exploited in the wild.

"In an email or instant message attack scenario, the attacker could send the targeted user a specially crafted file that is designed to exploit the vulnerability," the company explained. "In any case an attacker would have no way to force a user to view attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could entice a user to either click a link that directs the user to the attacker's site or send a malicious attachment."

It's not clear how this flaw is being exploited or by whom in the real world.

What's with these massive patches?

When Microsoft patched over 1,000 flaws in September, it set a record that the October patch just smashed. This might be the new normal for Patch Tuesdays moving forward.

Microsoft has said that AI has been behind the uptick in discovered vulnerabilities. The company uses its own internal "multi-model agentic scanning harness", dubbed MDASH, that identifies Windows flaws, reduces false positives, and then sends the results to Microsoft engineers faster than previous processes.

"Submits code repositories to a multi-model agentic pipeline that identifies vulnerabilities with greater depth than traditional, pattern-matching static analysis," the company explains in a post.

What that means in practice is that more flaws are being actively discovered than ever before and also being patched quicker.

Some extra fixes

The latest massive patch doesn't just fix over 1,400 vulnerabilities. It also fixes some glitches in File Explorer. You should be able to more easily preview downloaded files in the Preview window.

Additionally, Bluetooth connections got improved accuracy and stability.

Finally, the update adds a new setting that lets you remap the Copilot Key to whatever you want like making it a right Ctrl button again.

What you need to do

If you're on Windows 11, you'll want to update your system especially to get block the known exploited flaw.

You can go to Settings and select Windows Update. The patch may be installed already and waiting for your to reboot your computer.

This patch does end support for Windows 11 version 24H2, so you'll want to make sure you're on version 26H2 now. Microsoft ends support for each version after 24 months.

Windows 11 23H2 Enterprise and Education editions are also losing support starting November 10. You'll want to encourage your organization to update to the latest version before then.

More from Tom's Guide

• 'They are new to the laptop market': AMD issues a reality check to Nvidia’s RTX Spark and fires a warning shot at Arm
• Microsoft Surface Laptop Ultra vs. MacBook Pro M5 Pro: The biggest differences explained
• Forget RTX Spark: The Surface Laptop Ultra’s magnetic USB-C charger is a game-changer that makes Apple’s MagSafe look obsolete

Update: Google responds to inquiries about this attack.

Sponsored Google ads for fake ChatGPT are leading Windows users to download malware in "ClickFix" traps, according to security researchers from the AI company Island.

The sponsored Google ads lead to Custom GPT sites that are built to look like normal ChatGPT websites. These ads pop up when people type terms like "chatgpt" into Google Search.

Unfortunately, for trapped users, the ads do go to legitimate chatgpt.com sites. However, in these instances, entering a prompt makes the fake service direct people to a "backup domain" due to "high traffic."

Clicking on that link then redirects unsuspecting users to another fake instance of ChatGPT with a fake Cloudflare verification page that contains ClickFix instructions. Island found nearly identical responses across two separate Custom GPTs over a 3-day period in August.

According to the researchers, the malware advertising campaign appeared to involve around 850 paid ads, 26 fake ChatGPT links, and 71 Google Ads campaign IDs over a three-month period from May 2026 through August 2026.

What is ClickFix?

ClickFix traps are built to trick people into installing or executing malicious commands on their devices. In this instance, the instructions from the backup domain trick Windows into running a command that downloads malware onto your computer.

Once installed, the malware infects the system. It can even survive PC restarts and uses a Telegram bot to send stolen info back to the hackers behind this camping The malware utilizes a tool called NetSupport RAT, which lets attackers remotely control an infected computer.

Island found that the domains rotated and other Windows malware-delivery forms were identified too suggesting that the attack is not based on a single website.

The company claims an AI tool highlighted the suspicious activity and human researchers confirmed it. However, it's not clear how many people may have been affected by this scam.

A Google spokesperson told Tom's Guide that it has already suspended accounts associated with this attack.

"Before this report was published, we suspended the advertiser accounts involved to block this scheme and updated our defenses to better detect these tactics," a spokesperson said.

We were told that Google is monitoring new attempts to utilize fake ads. Google does have a policy that does not allow misleading ads about a business, product, service or destination. Per Google, the company blocked more than 400 million misleading ads for violating Google's "Misrepresentation" policies last year.

How to avoid falling victim to online scams

The combination of malware and advertising — also known as malvertising — has a long, storied history, which means you should always be careful when clicking on any advertisement online. To stay safe, you could try using one of the best ad blockers, since Google's "sponsored" links are still technically ads; most blockers will hide them.

Beyond that, if you don't have or want an ad blocker, there are some red flags to note when using a search engine and especially if you get linked to a fake instance of ChatGPT.

As for ChatGPT, if you are an existing user or just trying it out, go to chatgpt.com; no need to search for it.

Likewise, I've covered ChatGPT outages quite frequently over the course of the last two years and even at its worst, the AI assistant never sends you to a "backup domain." Don't click that link. If ChatGPT is having issues, you can always check the OpenAI status page.

At the same time, no website verification or CAPTCHA will ever ask you to open Windows Run and paste a command. If a website asks you to press Win + R or run PowerShell, don't do it.

Finally, you should always have one of the best antivirus software solutions installed on your PC. From there, you want to ensure that your antivirus is current, updated and running on all your devices – both your computer and even your smartphone.

More from Tom's Guide

• AI agents are going rogue and causing new security headaches — but Nvidia has a way to stop them
• Apple issues emergency update for millions of iPhones, iPads, and Macs — update your devices now
• Your personal information is everywhere online — 5 ways to start removing it from the internet

Even with one of the best MacBooks, you can never be too careful when downloading new apps. Case in point: a new malicious Mac app is posing as a legitimate Apple tool to steal passwords, keychain data and more from vulnerable systems.

As reported by BleepingComputer, the app in question serves as a means to infect vulnerable Apple computers with a new Mac info-stealer. While security researchers at Jamf first observed it back in May when it was still in development, this malware is now being actively used by cybercriminals in their attacks.

Dubbed CrashStealer, what makes this Mac malware strain so dangerous is the way in which it perfectly mimics Apple’s own macOS crash reports. Although something might seem off to more discerning users, others could easily fall for this attack given how much care and attention has gone into impersonating this legitimate tool.

Here’s everything you need to know about this new Mac malware and how you can keep your own MacBook and all the sensitive data it contains safe from hackers.

Impersonating a legitimate Apple utility

In their report, Jamf’s security researchers explain how the malware hides in plain sight by posing as a meeting platform called Werkbit. While they don’t go into details about the malware’s initial distribution method, a malicious app like this could be distributed via fake ads or on a developer-focused site like GitHub.

After downloading the app, it’s mounted on your desktop just like with any new software you download for your Mac. Surprisingly, though, the hackers behind this campaign are using a signed and Apple-notarized installer to distribute their fake app. Not only does this add a sense of legitimacy to the app but it also allows it to bypass Apple’s built-in Gatekeeper security feature without any warnings whatsoever.

When launched for the first time, the app displays a fake macOS password prompt that looks strikingly similar to what you’d see when downloading new software manually as opposed to through the Mac App Store. Once a victim puts in the password for their Mac, the hackers then have everything they need to unlock their Apple Keychain which acts as macOS’ encrypted password vault and contains all sorts of sensitive info like saved credentials in Safari, app passwords, Wi-Fi passwords and more.

The CrashStealer malware isn’t just limited to stealing from your Keychain though. It can also steal browser credentials and cookies from Chrome and other Chromium-based browsers as well as Firefox. Likewise, it can steal data from 80 different crypto wallet extensions and 14 of the best password managers including 1Password, LastPass, Dashlane and more.

To get all of this stolen data off your Mac, the malware encrypts it before packaging it into hidden ZIP archives and uploading it to a hacker-controlled C&C server.

By using a signed and notarized dropper and a re-signed payload, CrashStealer is a sophisticated Mac malware that’s especially good at avoiding detection.

How to stay safe from Mac malware

If you’re worried about CrashStealer and other Mac malware, the first thing you should do is to avoid sideloading apps, or in this case, installing new apps from anywhere besides the Mac App Store.

Just like on one of the best Android smartphones, when you download new apps from websites instead of an official app store, you’re putting your devices and the data they contain at risk. Apps submitted to the Mac App Store go through rigorous security checks while those you download from a random website don’t.

Normally when you download an unverified app from the web, macOS’s built-in Gatekeeper security feature will block it or warn you before you install it. In this case, though, that doesn’t happen since the installer used in this campaign is signed and appears to be legitimate. Well, at least in Gatekeeper’s eyes.

While Gatekeeper can keep you safe from most threats, there are ones like this that manage to bypass its defenses. For this reason, you might want to consider using one of the best Mac antivirus software solutions alongside Apple’s built-in ones. That way, if something slips past Apple, your third-party antivirus software will be able to stop the threat before it can do serious damage.

Since CrashStealer is still a relatively new Mac malware, this likely won’t be the last time we see it. This is why you always need to be extra careful when downloading and installing new software onto your Apple computer.

More from Tom’s Guide

• New PamStealer Mac malware poses as a clipboard manager to steal login info
• Apple’s ‘Hide My Email’ reportedly exposing real email addresses
• GTA 6 warning: Pre-order scams are stealing users' info and spreading malware

Security researchers who focus on Apple devices have discovered a new macOS malware that appears to be surprisingly clever while it harvests data and login credentials.

According to the IT firm Jamf (via ArsTechnica), the new malware, dubbed PamStealer, can get on your Mac in two stages. First, it disguises itself as Maccy, a clipboard manager.

Apparently, PamStealer is compiled as AppleScript written in Rust that uses the Pluggable Authentication Modules interface that is built into macOS to target the device's login password, which is then sent to an attacker-controlled server.

What makes PamStealer unique is that it combines AppleScript and disk images to stealthily enter your computer. When you click the AppleScript, it opens the macOS Script Editor where the malware is buried in the file.

"Rather than relying on shell commands such as curl or zsh, the AppleScript executes a self-contained JavaScript for Automation (JXA) downloader that retrieves and stages the payload using native Objective-C APIs," the Jamf team wrote. "Combined with a Rust-based second stage and a password capture workflow that validates credentials locally through PAM, the result is a quieter execution chain than we typically observe in commodity macOS stealers."

How PamStealer works

When someone installs the false Maccy and opens the disk image, they're prompted to enter Command-R immediately. Doing so executes the malicious code inside AppleScript. This allows it to bypass com.apple.quarantine, a normal macOS feature that offers warnings and restrictions when you're opening executable files from the internet.

The second stage is a Mach-O file specifically written for Macs running Apple M-series CPUs. Rust is apparently an uncommon code for macOS infostealers. This bundles SQLite and calls it read interface, meaning it opens and reads databases files directly.

PamStealer will pop up a native password prompt that is meant to resemble a system authorization request. It reads, "“Maccy wants to make changes. Enter your password to allow this.”

Once a password is entered, it's validated through the PAM API, meaning its harder for malware defenders to detect. Additionally, it can either give a malicious actor full disk access or inject code designed to access Ethereum accounts.

“Together, these behaviors illustrate how commodity macOS stealers continue to evolve, adopting quieter execution chains and native implementations that reduce traditional detection opportunities while remaining compatible with standard macOS features,” Jamf said.

How to stay safe from PamStealer

First and foremost, Maccy is a real, legitimate app that is quite popular. If you are interested in checking the app, the only real website is maccy.app.

Jamf found the fake Maccy was being hosted at maccyapp.com, a site you should not visit.

Secondly, it's a good reminder to double and triple-check website URLs. Specifically for macOS apps, you can also see if the app in question is available in the Apple App Store. Maccy, for instance, is in the App Store.

Apple is still a pretty closed garden so if you're looking for something and want to be sure it's real, I would recommend starting there before venturing into the hinterlands of the internet.

Beyond that, your Mac does come with built-in security software in the form of XProtect. But if you need some extra protection, it might be worth investing in one of the best Mac antivirus software solutions to run alongside it.

More from Tom's Guide

• Apple’s ‘Hide My Email’ reportedly exposing real email addresses
• What is Q-Day?
• 'Amazon put identity theft victims through a Kafkaesque ordeal': FTC issues $2.5 million fine over denying requests

Even though you should always download new apps from official sources like the Google Play Store, some Android users still end up getting tricked into downloading them from websites which can be extremely dangerous. Case in point, a new Android banking trojan is currently making the rounds online that’s distributed via fake apps from malicious websites.

As reported by BleepingComputer, once installed on vulnerable Android phones, the banking trojan in question is capable of targeting over 200 banking and financial apps to drain accounts and steal crypto. Unsurprisingly, it does so by impersonating Google Chrome and TikTok as both apps are extremely popular.

The trojan installs the new Rokarolla malware which also steals lock screen credentials, your contacts, SMS data and even uses keyloggers to record everything you type into your phone.

Here’s everything you need to know about this new Android banking trojan and how you can keep your bank account safe from the cybercriminals using it in their attacks.

Masquerading as Google Play Protect

Although you should never sideload Android apps unless you absolutely have to, many people still do despite the risk. The hackers behind this campaign use fake websites to trick unsuspecting users into installing Chrome or TikTok unofficially instead of downloading these apps directly from the Google Play Store like they should.

According to a new report from the cybersecurity firm Zimperium, after downloading either app though, the hackers use an interesting trick to give potential victims the illusion of safety. For those unfamiliar, Google’s built-in security app Google Play Protect checks any new software you download for viruses. However, in this case, a fake Play Protect pop-up appears before the Rockarolla malware is actually downloaded. Given the fact that the pop-up perfectly impersonates a Play Protect warning, most users wouldn’t think twice before proceeding with this secondary download.

At this point, the damage is done and the Rockarolla malware gets to work. In total, it’s able to spoof 217 different banking and financial apps to steal your credentials. It does so by using overlays that mimic each individual app. While to the end user it appears as if they’re just logging into their online bank account, they’re actually handing over their username and password to hackers.

Another interesting trick up Rockarolla’s sleeve is that it can steal SMS notifications from your online bank as well as intercept any calls trying to warn you that something is amiss. This way, you won’t get a fraud alert and the hackers can proceed to empty your accounts one by one.

While Google continues to improve Android’s security, if you don’t download apps the right way, you too could easily end up falling victim to this and other malware.

How to stay safe from Android banking trojans

I can’t stress this enough, unless you really know what you’re doing, you should avoid sideloading apps. Sure, malicious apps do manage to sneak past Google’s defenses from time to time but for the most part, if you download new apps from the Play Store, you should be safe. The same goes for other official Android app stores like the Samsung Galaxy Store too.

From there, you want to make sure that Google Play Protect is installed and enabled on your smartphone. It’s enabled by default on all of the best Android phones but it’s always a good idea to check to make sure. For extra protection though, you can also use one of the best Android antivirus apps alongside it. You have to pay for many of them but they typically add other useful features like a VPN or password manager to help keep you safe online.

Despite constant warnings, people keep installing apps from websites instead of official stores. As long as this keeps happening, hackers are going to use it to their advantage. However, if you install new apps the way you’re supposed to, you can avoid falling victim to Rockrolla and other banking trojans like it.

More from Tom's Guide

• Popular Steam wallpaper app hijacked to spread dangerous malware — how to stay safe
• Update your Nvidia GPU drivers now to protect your PC from 9 "high-severity" vulnerabilities — here's what's at risk
• I just got hit by the Ultrahuman data breach — here's what hackers stole from my account

If your Windows or Linux computer uses one of best graphics cards made by Nvidia, you're going to want to make sure you're using the latest drivers. This week, the company issued a security alert and driver updates to combat a variety of vulnerabilities.

The alert highlights 15 issues, nine of which Nvidia has marked as "high-vulnerability." The high-risk flaws run the gamut of what bad actors can do to your PC. That includes letting hackers get access to your PC kernel, inject malicious code, steal crucial data, or gain administrative access. All the stuff you don't want happening.

For both Windows and Linux, you can download the driver update directly from Nvidia. On Windows, you'll want to make sure you upgrade to driver version 569.49.

On Linux, you want to make sure you update to version 590.48.01. The new versions were released about a week ago, so most people who have automatic updates turned on should have the update. But check your driver version just in case.

According to the alert, all Nvidia drivers before version 596.36 — version 482.53 for GTX 10-series and below — are potentially at risk from these vulnerabilities.

Keep your PC safe from malware

This is a general reminder to ensure all your drivers are up to date. Most driver releases patch security flaws like the ones outlined by Nvidia.

To be fair, some driver updates can cause issues, but later this year, Microsoft will automatically roll back bad Windows drivers to the most recent stable version. Still, keeping your drivers up to date is good practice.

If you're on PC, Microsoft releases new security updates every second Tuesday of each month.

Additionally, you'll want to ensure that Windows Defender is enabled. It largely does a great job of catching threats before they do damage.

For extra protection, you should consider the best antivirus software. Paid antivirus solutions usually update regularly, plus you often get access to VPNs, a password manager and other security goodies.

New vulnerabilities crop up all the time, but if you practice good cyber hygiene you devices and data should stay safe.

More from Tom's Guide

• Nvidia is teaming up with Span to install mini AI data centers right on the side of your house, turning residential neighborhoods into a distributed supercomputing network that actually pays homeowners for their unused electricity
• I test gaming laptops all year — here are the only 8 I recommend in 2026
• Nvidia RTX 5070 laptop GPU gets 12GB VRAM — here’s why it's a game-changer

Mac users have felt safe behind Gatekeeper — the macOS digital security guard that only lets verified, trusted apps onto your machine. But now, that gate has just developed a massive crack, as hackers have found a way to get around it undetected.

On April 22, the research team at Mosyle Security discovered two forms of malware named “Phoenix Worm” and “ShadeStager.” With them, hackers are now successfully stealing developer keys, which act like a digital passport, and by hijacking them, cybercriminals can disguise malware as Apple-approved apps.

To your MacBook, these viruses don’t look like a threat; they look like trusted guests. And with over 100 million Mac users worldwide, this blind spot means that even the most cautious users could be downloading a disaster in disguise.

How it works

The attack doesn’t start with you, but with the people who make your favorite apps. Hackers target the developers with a tag-team effort between these two new threats. First, the Phoenix Worm is snuck onto a developers system through a range of social engineering attacks — think recruiters with fake job offers or urgent coding tasks from clients.

Once it's there, Phoenix Worm is the inside man, which gives your Mac a secret ID number, waits for instructions, and even keeps watch for security software to hide further away from it.

When the coast is clear, the Phoenix Worm calls in the heavy hitter: ShadeStager. This specialist comes in and takes over developer keys, cloud credentials and secret dev tools. And while this digital heist happens behind the scenes, the fallout lands squarely on your desktop.

With these master keys, hackers can forge Apple’s verified seal of approval on any malicious file they want. By compromising the tools used to build apps, hackers are essentially poisoning the well in the Mac’s walled garden — turning a trusted developer’s reputation into a backdoor onto your private machine.

How to avoid this attack

First off, given Apple’s real focus on security, I would not be surprised if a hotfix update is deployed in the next few days to strengthen its verification process. But ultimately, while these two exploits in tandem are sophisticated, they’re not magic — they still need people to let them in.

So from a developer perspective, it’s going to be all about being extra careful of the emails being received. In fact, Apple added a warning into macOS 26.4 when you’re about to paste potentially malicious code into the Terminal app. Stop immediately if you see it.

As for most of you reading this, if you’re downloading apps outside the Mac App store, it’s about exercising some extra caution and asking yourself a couple of questions:

• Do I really know this company?
• If it’s something I’ve never heard of before, is it worth the risk?

And of course, while the Terminal warning above is more to developers, it’s good general advice for you too. If ever you see a website asking you to open the Terminal at all, that’s an automatic “close tab” moment.

Like any computer, your Mac is only as safe as the things you allow it to do, and by staying vigilant and skeptical, you can keep yourself invisible to even the most sophisticated attacks like this one.

More from Tom's Guide

• Over 1 billion Windows users at risk after disgruntled security researcher leaks Defender zero-days
• Scammers are abusing Apple account change notifications in new phishing attack — how to stay safe
• 108 malicious Chrome extensions found stealing data and injecting ads into every page you visit — delete them right now

We’ve always been told that as long as we stick to the Google Play Store and avoid sideloading, our Android phones are safe. However, a sophisticated new malware campaign has just shattered that sense of security.

As reported by BleepingComputer, researchers at the cybersecurity firm McAfee have discovered 50 malicious apps that hid in plain sight on Google's official store, racking up 2.3 million downloads while quietly infecting devices with a dangerous new Android malware strain.

Just like in previous malware campaigns, these bad apps posed as system cleaners, mobile games and other utilities. When opened, the apps in question worked as intended and to avoid suspicion, they didn’t request access to unnecessary permissions which is typically a major red flag that an app is malicious.

Although Android users who installed and used these apps didn’t get the sense that anything was off, in the background, that couldn’t be further from the truth. You see, after contacting a hacker-controlled server, the apps profiled the devices they were installed on to look for exploitable weaknesses. If any are found, the new NoVoice Android malware then seizes complete and total control over an infected device, essentially turning it into a hacker’s plaything.

Here’s everything you need to know about this new malware and why it’s one of the most dangerous strains I’ve seen yet, along with some tips and tricks to help keep you and your Android smartphone safe from hackers.

A factory-reset proof infection

With most malware, performing a factory reset on one of the best Android phones should do the trick. However, with NoVoice, that won’t work because the malware burrows into the one area a system wipe can't touch.

To do so, NoVoice establishes root access by exploiting older vulnerabilities that have since been patched. Since many people don’t update their phones as often as they should — or own older devices that no longer receive security updates — the malware is able to use this to its advantage.

After being installed via one of those 50 malicious apps, the malware collects a wide variety of device information such as hardware details, the phone’s current Android version and patch level, a list of installed apps, and root status. With this info in hand, NoVoice then reaches out to a command and control (C2) server operated by the hackers. It does this every 60 seconds; in addition to sharing info on an infected device, the malware also downloads device-specific exploits used to seize root access.

According to a blog post from McAfee, its security researchers observed 22 different exploits being used by NoVoice. By exploiting known vulnerabilities, the malware is able to bypass Android’s built-in security protections and establish several layers of persistence. NoVoice even rewrites an infected device’s core system libraries to ensure that even if a victim performs a full wipe by factory resetting their phone, the malware remains installed.

NoVoice’s creators have gone to great lengths to maintain control over infected Android phones. For instance, a watchdog daemon checks the rootkit’s integrity every 60 seconds. If part of the malware has been removed, the missing components are automatically reinstalled. If the malware can't repair itself, it forces the infected device to reboot, which triggers a fresh infection from scratch.

So far, this new malware has primarily been used to target Android users in Africa, though it’s also been deployed against users in India, the U.S., and Europe. McAfee says a main reason for this is that budget devices running older versions of Android are more common in those regions. However, any Android user running an outdated security patch is squarely in its crosshairs.

The hackers behind NoVoice have primarily used the malware to target WhatsApp. When the messaging app is launched on an infected device, NoVoice extracts sensitive data to clone a victim’s WhatsApp session. This allows hackers to effectively hijack a victim’s digital identity and message their contacts in real-time.

Given the modular nature of NoVoice though, the malware could easily be reconfigured to target banking apps or any other app running on an infected device.

How to stay safe from the NoVoice malware

Fortunately, all 50 malicious apps used to spread NoVoice have been removed from the Google Play Store. However, if any of them are already on your phone, you will need to manually uninstall them. While that would normally be enough to keep you safe, the multiple levels of persistence used by this malware mean that simply deleting one of these bad apps isn't a guaranteed fix.

To see if your Android phone is at risk, you should immediately check your security patch level. This can be found by going to Settings > About Phone > Software Information. If your device’s security patch is dated before May 1, 2021, it is vulnerable to the exact exploits NoVoice uses to gain root access.

Since a standard factory reset won’t clear this infection, your only technical option is to "reflash" your phone with its official factory firmware. This process completely replaces the corrupted system files with a clean copy, but it also wipes all of your data and can be difficult for less experienced users. If your current phone is no longer receiving Android updates and security patches, the safest move is likely to start over with a brand-new Android device.

While the full list of all 50 malicious apps hasn't been released, you can still check your device for signs of infection. Open Google Play Protect which comes pre-installed on most Android phones and run a manual scan immediately.

In an email to Tom's Guide, a Google spokesperson provided further insight into how NoVoice really only affects older Android smartphones, saying:

"Android addressed the vulnerabilities this malware relies on in security updates years ago, so if your device has been updated since May 2021, it's been protected. As an added layer of defense, Google Play Protect automatically removes these apps and blocks new installs. Users should always install the latest security updates available for their device.”

Going forward, you need to be extremely selective about the apps you install. Stick to trusted developers, check ratings, and always read reviews before hitting download. In addition to keeping Google Play Protect enabled, you may also want to run one of the best Android antivirus apps alongside it for an extra layer of defense.

NoVoice marks a significant shift in the Android malware landscape, and we may see other attackers emulate its 'reset-proof' design in the future. Until then, the best defense is to keep your device updated — and if your phone is too old to receive critical security patches, it may finally be time for an upgrade

More from Tom's Guide

• More than 220 million iPhones under attack from new DarkSword exploit — how to stay safe
• Online age verification in the USA – a complete timeline
• Identity protection company Aura suffers massive 900,000 person data breach: customer information exposed

Last year, Google added new beta features to Google Drive, designed to detect ransomware and aid file restoration where needed. Today, Google announced that those same tools are rolling out to everyone, with upgraded AI detection that can recognize 14 times as many infections as before.

onsidering today is World Backup Day, it's pretty handy to get a bunch of tools designed to protect your backups from harm.

So how does this work, exactly? The tools are built into Google Drive for desktop, and should the app detect ransomware on a connected device, it will automatically pause all file syncing. This is to stop the ransomware from interfering with files stored in your Drive account and from spreading to other connected devices.

Google Drive will start by scanning your backups for potential ransomware, and if anything is detected, it will automatically pause syncing. This is to prevent you from spreading those files to your other devices and causing significantly more damage. The user is then notified about the file, and emails will be sent out to all connected users. It's not a subtle warning and includes a list of everything you need to do to solve the issue.

The first step is to disconnect your account from the Drive client, then use the Drive restoration tool to quickly and easily restore previous versions of your files. Google stores older versions for 25 days, giving you plenty of time to retrieve your data and undo any damage caused by the ransomware attack.

This isn't designed to be a replacement for antivirus or other defensive tools that would protect from ransomware. It's an additional layer of protection designed to help you catch the problem before the damage is irreversible — and ensure you can safely restore backed-up files later.

Google Drive's tools are free to use as well, which means regular users won't have to invest in expensive or business-focused software to better protect themselves against ransomware.

Google says that ransomware protection is now enabled by default and will be available in Google Drive version 114 and later. You can set the detection level in the settings or disable these protections altogether. Since Google has said it won't scan your files to train its AI without your express permission, we recommend that you only switch it off if you have better, more powerful ransomware protection tools at your disposal.

More from Tom's Guide

• I’ve been waiting a decade for AirDrop on Android — and it’s finally fixed my biggest frustration
• I put iPhone 17 Pro Max vs Samsung Galaxy S26 Ultra through a 7-round face-off — here's which is best for you
• iPhone Fold tipped to be most 'significant overhaul' in iPhone history — here's why I agree

In order to help iPhone users know when their device’s camera and microphone were currently in use, Apple added privacy indicators back in 2020 with the release of iOS 14. Now though, the creators of the notorious Predator spyware have figured out how to completely disable them to make spying on potential victims a whole lot easier.

As reported by BleepingComputer, the European-based surveillance company Intellexa has given its spyware a major update which allows it to hide the green and orange dots that let you know when your iPhone is recording video or audio. It’s worth noting that, instead of exploiting a vulnerability in Apple’s mobile operating system, the spyware uses previously obtained kernel-level access to pull this off.

Here’s everything you need to know about this latest development with the Predator spyware along with how to keep your iPhone safe from being spied on.

Intercepting recording indicators

In order to learn more about this new Predator capability, researchers at the mobile device management firm Jamf analyzed recent spyware samples to see how Intellexa managed to disable Apple’s privacy indicators.

According to a new report, the firm’s security researchers discovered that the spyware hides all recording indicators on iOS 14 and later versions of Apple’s mobile operating system by using a single hook function in the core system application SpringBoard. This method is used whenever an iPhone’s camera or microphone is opened and the device’s sensor activity changes.

By intercepting these changes quickly, Predator is able to prevent any sensor activity changes from showing up on iPhone’s UI which means the green and orange dots won’t appear. Interestingly, since the hook nullifies all sensor update activity, it can be used to disable a device’s camera and microphone indicator at the same time.

Fortunately as Jamf’s researchers explain, “the technique outlined in this analysis requires a device to first be fully compromised, including kernel-level access to install hooks and the ability to inject code into system processes,” which means that it only works on iPhones that have already been fully hacked.

How to stay safe from spyware on your iPhone

With one of the best iPhones, you don’t have to worry about malicious apps spreading malware like on Android. However, since Apple’s phones are so popular and known for being difficult to hack, there’s a very lucrative spyware market built around them.

The good news is that with spyware, cybercriminals and others who use it in their attacks typically tend to go after high-profile targets such as CEOs, celebrities, politicians and other government officials.

Still, in order to keep your iPhone safe from spyware, the first and most important thing you can do is to keep it updated and running the latest version of iOS. The reason why is that Predator and other spyware strains often rely on now patched vulnerabilities to gain a foothold on targeted devices. By keeping your iPhone updated and restarting it at least once a week, you’re making your phone a whole lot harder to hack.

If you want to find out if there is spyware installed on your iPhone, then you should check out iVerify’s $1 Basics app. Once installed, it scans your iPhone on a monthly basis to check for the infamous Pegasus spyware created by the NSO Group but it can find other spyware strains too.

Although there isn’t an iOS equivalent to the best Android antivirus apps, one of the best Mac antivirus software suites in particular can scan an iPhone or iPad for spyware and other types of malware. When connected to a Mac via a USB cable, Intego’s Mac antivirus can scan an iPhone for viruses just like it would with an Apple computer.

The Predator spyware might not be the biggest threat to ordinary people but if you open your camera app or Apple’s Voice Memos and suddenly don’t see a green or orange privacy indicator light, you’ll now know why.

More from Tom's Guide

• A new spyware called ZeroDayRat can take over your iPhone or Android via text
• 1 billion personal records exposed in massive new data leak — full names, addresses, phone numbers and more
• 300,000+ Chrome users installed these malicious extensions posing as AI assistants — delete them right now

Most Android malware is spread through dodgy apps and sideloaded programs, meaning that you can slightly control what gets on your device. However, researchers at Kaspersky have discovered a new Android backdoor, dubbed Keenadu, that is embedded in the firmware of tablets from several manufacturers.

The new report indicates that Keenadu can be distributed via compromised firmware images, other backdoors, embedded in system apps or modified from third-party sources or even the Google Play Store.

The firmware version is the most potent and has infected more than 13,000 devices mostly in Russia, Japan, Germany, Brazil and the Netherlands. Keenadu apparently does not activate if the language or time zone is associated with China, which indicates a potential clue as to its origin.

How it works

Kaspersky researchers noted that it's mostly being used for fraudulent ads, but that it's capabilities go far beyond that. It can inject itself into the Android "Zygote" process, a core system process that launches every app on your device.

This means it can give bad actors broad control and visibility over your system.

“Keenadu is a fully functional backdoor that provides the attackers with unlimited control over the victim’s device,” Kaspersky told BleepingComputer. "It can infect every app installed on the device, install any apps from APK files, and give them any available permissions.”

The researchers also found the malware in several apps that were available on the Google Play Store, including a smart home camera app that had over 300,000 downloads.

In a confirmed example, firmware images on the Alldocube iPlay 50 mini Pro tablet were compromised, including in tablets released after the vendor was informed of the malware. The firmware has valid signatures, meaning that it's a supply-chain issue where malicious code was injected during software development or even the manufacturing process.

Here's the silver lining: if you have one of the best tablets from a flagship brand like OnePlus or Samsung, you likely won't be affected by this malware. However, lesser-known Android manufacturers or knock-off ones seem to be more dangerous, and affected vendors haven't been totally named. This is quite similar to how malware was found on millions of budget Android TV boxes last year.

How to stay safe

If you have a budget Android tablet, especially from a smaller or knock-off brand, it's worth checking for software updates. You can also try installing fresh firmware from a reliable third-party. Kaspersky did say that vendors have been notified and hopefully are working on clean firmware updates.

Beyond that, it may be safer to invest in a tablet from a trusted manufacturer. We can help you with choices of the best tablets under $500 and the best Android tablets overall.

A Google spokesperson told Android Authority that "Android users are automatically protected from known versions of this malware by Google Play Protect." The spokesperson added that Play Protect will warn you and disable apps known to exhibit Keenadu behavior.

Google Play Protect is on by default, but if you want an extra layer of protection, you can run one of the best Android antivirus apps alongside it for scanning and defending your tablet or phone.

More from Tom's Guide

• 300,000+ Chrome users installed these malicious extensions posing as AI assistants — delete them right now
• How did the FBI get Nancy Guthrie's Google Nest camera footage if it was disabled — and what does it mean for your privacy?
• I visited a VPN data center – here's what I learned

Whether you use an iPhone or an Android phone, hackers have a brand new tool that’s capable of completely hijacking it to steal your data, track your location, log your keystrokes, intercept your 2FA codes and more. The worst part? The tool is sold on the dark web with full customer support in case they run into any problems.

As reported by BleepingComputer, the new ZeroDayRAT malware is a commercial mobile spyware platform that’s currently being advertised to cybercriminals on Telegram. Thanks to its very detailed dashboard, any hacker that deploys this malware in their attacks is easily able to manage infected devices while stealing all of their data and tracking them in real-time.

Here’s everything you need to know about this new mobile threat along with what it’s capable of, along with some tips on how to stay safe so you can recognize a potential infection before it takes over your phone.

Full access to your device, location and more

ZeroDayRAT acts like a one-stop shop for hackers when it comes to the sensitive data, login info and crypto stored on one of the best iPhones or best Android phones. And to make matters worse, it can allegedly infect devices running the latest software, whether that be iOS 26 or Android 16.

In a new report, researchers at iVerify explain that they first discovered ZeroDayRAT after seeing it openly sold on Telegram at the start of this month. In addition to customer support, the malware’s developer also provides regular updates so it will remain a viable tool in a hacker’s arsenal for even longer.

ZeroDayRAT is quite sophisticated on its own with the ability to glean all kinds of useful information from an infected device. Besides a phone’s make and model, operating system version, battery life, SIM details, country of origin and lock state, the malware can also log a victim’s app usage, their text messages, notifications and more. Likewise, a hacker can also use ZeroDayRAT to activate a phone’s front and rear cameras as well as its microphone to spy on victims in real-time.

From there, GPS access gives them the ability to track a victim’s location in real time and even see their current position on Google Maps. Then with SMS access, ZeroDayRAT can capture one-time passwords to bypass two-factor authentication (2FA) which lets an attacker take over a victim’s social media and banking accounts.

If that wasn’t enough, the malware even features a cryptocurrency stealer module that scans an infected device to look for wallet IDs and balances from Coinbase, Binance, MetaMask and Trust Wallet. As we’ve seen with other malware in the past, ZeroDayRAT also uses overlay attacks to steal online banking logins as well as credentials for Apple Pay, Google Pay and PayPal.

Perhaps the most surprising thing about ZeroDayRAT for me though is its online dashboard. Right from their browser, hackers have all the info they need from devices they’ve infected with the malware to launch additional attacks and keep tabs on any that are currently underway. It’s clear a lot of work went into creating this new spyware platform and depending on how much it costs, ZeroDayRAT could become a household name among cybercriminals.

How to stay safe from spyware

As iVerify points out in its report, a ZeroDayRAT infection begins by getting a malicious binary onto a targeted device: either as an APK for Android or a payload for iOS. While we don’t know exactly how cybercriminals are spreading this spyware yet, the firm’s security researchers believe that SMS phishing or smishing is likely the easiest infection method.

Whether you have an iPhone or an Android device, you want to be on the lookout for text messages from unknown senders containing a link that try to coerce you into downloading an app. They might use a sense of urgency or other common tactics to do so. While fake text messages are one probable delivery method, phishing emails, fake app stores and links on WhatsApp or Telegram are other ways the ZeroDayRAT spyware can be distributed too.

To stay safe from this new mobile threat, your best bet is to avoid clicking on any links sent to you via text messages, emails or through social media. It’s always best to avoid clicking on anything sent from an unknown sender but I’d also recommend being wary of links sent from friends or even acquaintances that you haven’t spoken with in a while. Once hackers take over one person’s accounts, they often use them in other attacks. A message from an old friend on social media about a new app that’s changed their life or made a common task a lot easier is the kind of lure that I could easily see unsuspecting users falling for.

In order to stay safe from the latest threats, you should be using the best antivirus software on your PC or the best Mac antivirus software on your Apple computer. On mobile, the best Android antivirus apps can keep your phone safe from malware but due to Apple’s own restrictions, there aren’t any antivirus apps for iPhone. However, many antivirus makers do offer protection for iOS through their main software suites. For instance, Intego’s Mac antivirus can scan an iPhone or iPad for malware but only when it’s connected to a Mac via a USB cable.

While we haven’t heard about any major attacks carried out using the ZeroDayRAT yet, chances are, we likely will soon. I’ll be keeping a close eye on this new mobile spyware platform just in case. In the meantime though, by practicing good cyber hygiene and being careful where you click or tap, you should be able to avoid falling victim to the ZeroDayRAT and other mobile malware.

More from Tom's Guide

• 149 million logins and passwords exposed for Gmail, Facebook, Instagram and more — everything you need to know
• Total phone hijack: New Hugging Face malware grants hackers full remote access
• Massive government tech data breach expands to more than 25 million more Americans a year after it was discovered

Update: Google spokesperson says malware not found in Google Play Store.

Hackers are reportedly using the popular Hugging Face AI platform to release Android malware that can take over your device. The malware is delivered via a fake app.

For the unfamiliar, Hugging Face is an open platform that hosts AI tools and machine learning bots. Users and creators can distribute and download AL, NLP and ML models. Unfortunately, sometimes it can be used to release bad models as well.

Researchers at the cybersecurity firm Bitdefender found that this new malware first appeared in an app called TrustBastion. Hugging Face "doesn’t seem to have meaningful filters that govern what people can upload," the researchers said.

Apparently, TrustBastion pretends to be an Android antivirus program by "offering" virus protection, phishing defense and malware blocking. In reality, this app is "scareware": once you install it, it claims your device is infected and demands an update. Once you update the app, it installs the malicious code.

What this malware does

Bitdefender says TrustBastion connects to a third-party server, which then redirects to a Hugging Face repository with 6,000 commits. Despite being reported, Bitdefender says a new repository almost immediately appeared with a new name and icons, but the same malicious code.

This Trojan malware is quite powerful. According to Bitdefender, it can take screenshots, display fake login interfaces for financial serives and capture your lock screen pin. That information is then sent to a third-party server.

Malware isn't in Google Play, says Google

A Google spokesperson told Tom's Guide that according to their systems this malware and apps containing it are not in the Google Play store.

"Based on our current detection, no apps containing this malware are found on Google Play," the spokesperson said.

They added that Android users are automatically protected against "known versions of this malware" by Google Play Protect, which scans apps for malicious behavior and can warn users or block apps.

How to stay safe

The simplest thing you can do is download Android apps only from reputable sources with some form of moderation and security filtering, such as the Google Play Store or the Samsung Galaxy Store. Even in those places, be sure to scour the reviews and note the overall downloads and rating.

Avoid sideloading APKs outside of the store. If you are triple-checking that the publisher and URL are correct before you download. Be wary of any apps that ask for accessibility permissions.

You should periodically scan your Android device with Play Protect and bolster your security with some of the best Android antivirus apps.

More from Tom's Guide

• Fake Chrome extension ‘breaks’ your computer before it hits you with malware — how to stay safe
• Malicious Zoom Stealer extensions can leak your private meeting details — how to stay safe
• New malware turns trusted banking apps into phone hijacking tools — how to stay safe

A new malicious browser extension has been discovered that along with two others, are designed to steal credentials, take over browsers and more. Discovered by security researchers at Koi Security, all three extensions are believed to be created by the same threat actor and put millions of Chrome, Edge and Firefox users at risk.

This most recent malware has been dubbed Zoom Stealer and its uses 18 different extensions to steal online meeting information like URLs, embedded passwords, meeting IDs, schedule times, registration status, topics and descriptions. These extensions affect up to 2.2 million Chrome, Firefox and Edge users and are specifically designed to imitate enterprise level tools for video conferencing apps like Google Meet and Zoom.

The extensions, which succeed specifically because they perform as advertised and have positive reviews, also silently run surveillance in the background to exfiltrate details of the meeting like links, participant lists and credentials using a WebSocket connection. If a users visits a webinar registration page with one of the malicious extensions installed in their browser, the threat actors can harvest all sorts of data including information about the speakers, the hosts and the session metadata.

The Zoom Stealer campaign is the third rolled out from the threat actor known as DarkSpectre. The first, known as ShadyPanda, was found by the same researchers last month and was used to commit fraud, hijack search queries and carry out data theft from more than five million users. The second campaign, known as GhostPoster, used hidden malicious JavaScript code inside logo files in order to gain full control over a browser.

How to stay safe from malicious browser extensions

As with any other malicious extension, if you've downloaded anything that you suspect isn't entirely legitimate, you should remove it immediately.

After removing a problematic extension, you should always reset your account passwords – often, the recommendation is for all your high profile accounts like your email, online banking and social media ones too. Since this could be a hassle, you should use one of the best password managers to make it easier since many can update compromised passwords for you. A password manager can also help keep your passwords organized, safe and can automatically generate strong and unique passwords for each of your online accounts.

I also always recommend using the best antivirus software as well. An antivirus program may not have caught these malicious extensions, but they can scan for malware, spyware and viruses to help you deal with the fallout from a campaign like this one. Antivirus programs also have browser extensions that can warn you when you try to visit suspicious websites, help protect your data with cloud backups and can provide you with a VPN and other extras to add an extra layer of security to protect you when you're online.

Given how effective malicious extensions like the ones described above have been in the past, I highly doubt cybercriminals are going to stop using them soon. Instead, it's up to you to remain vigilant when it comes to downloading and using new browser extensions. When in doubt though, consider whether or not you really need a particular extension before downloading and adding it to your browser.

More from Tom's Guide

• I write about hackers for a living but these are the 3 real-world threats that worry me most — and how to avoid them in 2026
• From misinformation to AI-powered cyberattacks – the top cybersecurity risks for 2026
• I’m a security editor and these are my 3 security New Years resolutions

On October 30th, Cloudfare data identified a strange website that briefly surpassed Google as the most popular website globally. However, it wasn’t a website at all – It was a massive command-and-control server that was controlling at least 1.8 million Android devices in order to use them for nefarious purposes.

Known as Kimwolf, the botnet is now considered to be the largest of its kind (so far) and shares codebase with the previous recordbreaker, Aisuru. Though both botnets use malware to infect vulnerable devices and rely on an APK file to load and start during runtime, the threat actors learned from Aisuru and included additional features in Kimwolf to better evade detection. Capable of various malicious activities including typical DDoS attacks, it also uses proxy forwarding which allows the attackers to conceal their location and lets them bypass IP-based geo-restrictions and blacklists.

There’s also a reverse shell in the malware which gives the attackers command line access to the infected devices. This means they can run arbitrary commands or deploy additional malware on compromised devices. Likewise, they can also upload, download or modify files between devices.

Researchers at Xlab infiltrated the Kimwolf botnet in order to learn more about how it works and its scale. According to their findings, it appears to target Android devices, specifically those that are not certified by Google – which lack the search giant's extra protections like dirt cheap set top boxes and tablets.

Xlab says the Kimwolf botnet seems to consist of infected Android tv boxes on residential networks distributed across 222 countries. Their IP addresses are located in Brazil (14%), India (12.7%), and the United States (9.5%) with the remainder in (respectively) Argentina, South Africa, the Philippines, Mexico and China.

How to avoid becoming mixed up in a botnet

The recommendations here are simple: Users should avoid purchasing uncertified, off-brand Android devices, set strong passwords, update their firmware as soon as possible, and only download apps from known and trusted developers.

If you wants to stay safe, don't buy AOSP-based Android devices like off-brand TV boxes that lack official Google Play Services support. Additionally, always keep your firmware updated and install the latest security patches as soon as they become available on whichever of the best streaming devices you're currently using.

Google spokespeople have frequently advised us that "If a device isn't Play Protect certified, Google doesn't have a record of security and compatibility test results. Play Protect certified Android devices undergo extensive testing to ensure quality and user safety. Users should ensure Google Play Protect, Android’s malware protection that is one by default on devices with Google Play Services, is enabled.”

At the same time, you also want to avoid sideloading apps and stick to only using ones from the Google Play Store and other official app stores. Likewise, Android TV devices can have their remote access features disabled when not in use, which takes them offline. This can provide an extra layer of security to help protect your devices and the data on them if they've unknowingly become part of a botnet

It might also be worth investing in one of the best Wi-Fi routers or the best mesh Wi-Fi systems with security software built-in. While the best antivirus software can keep your PC safe from malware, network-wide security solutions like Netgear's Armor or TP-Link's HomeShield protect all of the devices connected to your home network from viruses and other threats. If you want our recommendation for the best official Android TV box out there, we still really like the Nvidia Shield (even though it's an older model).

What if you do own a cheap Android set top box?

If you've picked up a cheap, unofficial Android set top box and are worried about it becoming infected with malware, you definitely should be. We've covered this several times in the past and I wouldn't recommend buying one of these devices over say, a Google TV Streamer or if you're on a budget, an Onn Google TV like the Onn 4K Plus. However, if you've paid good money for an unofficial Android set top box, you're not completely out of luck.

If you head to the Google Play Store on either the device itself or on your phone or computer, you can download the ESET Smart TV Security app for free though there is a paid version as well. It lets you run manual scans for malware at any time and like Google Play Protect on one of the best Android phones, monitors any new apps you install for malware and other threats.

Now if you have some extra cash, the paid version takes things a step further with scheduled scans and anti-phishing protection at a very reasonable price of $1-3 per month or $15-20 for the year for a single device. Likewise, you can pick up one of the more advanced ESET Home plans which includes the premium version of Smart TV Security.

This should keep you safe and hold you over until your next upgrade. At which time, I highly recommend getting an official Android set top box instead.

More from Tom's Guide

• Microsoft accounts are under attack by hackers - here's how to stay safe from this age-old tactic
• Multiple Firefox add-ons infected with 'GhostPoster' malware — how to stay safe
• 200 million records exposed in massive Pornhub data breach — here’s what we know so far

Newly discovered malware DroidLock can wreak havoc on your Android phone, taking over your lock screen — even changing your login info — to prevent victims from being able to get into their devices.

According to researchers at Zimperium, the malware can lock victims' screens in order to demand a ransom, change the PIN, password or biometric data to prevent the user from accessing their own device, access complete control over the device including text messages, call logs, contacts and audio recordings. The ransomware overlay will instruct the victim to contact the attacker at a Proton email address within 24 hours, otherwise it will permanently destroy the files on the device.

The researchers say the malware is being distributed through malicious websites with links to fake apps that mimic legitimate programs. The infection begins with a dropper that tricks the users into installing an app that contains the malware. These apps then request permissions for Device Administrator and Accessibility Services via an update, which allow it to perform additional malicious actions.

Currently, the targets are largely Spanish-speaking users, but as with most malware, there’s no reason it couldn’t be scaled up.

The DroidLock malware supports 15 commands that let it send notifications, place an overlay on the screen, mute the device, reset it to factory settings, start the camera or uninstall apps. It can use the same malicious APK to place a different overlay onto the phone to steal the lock pattern; when the user draws the lock pattern on their handset, it gets sent to the attacker.

How to stay safe from ransomware

The good news is that because Zimperium shares its malware findings with the Android security team, Play Protect detects and blocks this threat from devices that are up to date.

That means if your Android device is keep current with updates, you’re in the clear – and this is precisely why we stress again and again that users need to keep their devices up to date.

The bad news is Android users are additionally recommended to avoid sideloading APKs from outside the Google Play store – unless the publisher is a trusted source. So, if you like sideloading apps, make sure to check out the publisher and the URL extensively before you download.

Also, always check to see if the permissions required by an app serve its purposes, and doesn't overstep. Be particularly wary of anything that is asking for accessibility permissions, as this is often a way that malware will try to sneak in access to your handset. And periodically scan your device with Play Protect. Keep in mind, that the best Android antivirus apps can also be of assistance here in scanning and protecting your phone.

More from Tom's Guide

• NordVPN's new email protection feature can stop phishing in real time
• New Spiderman phishing kit lets hackers instantly spoof banking sites to steal passwords and take over accounts — how to stay safe
• 4.3 billion job documents left unsecured online — names, emails, phone numbers and LinkedIn data exposed

Hackers are taking legitimate banking apps and decompiling them in order to add malicious code, then spreading them through common threat schemes like phishing lures and fake look-a-like websites. According to researchers at Group-IB, these poisoned apps may be linked to the GoldFactory group which is also known for stealing facial recognition data.

This malware campaign has enabled them to not only expose thousands of people to banking fraud, but also to get full control over an infected device. The attackers also add trojans or backdoors to the apps and in total, Group-IB found 27 original banking applications that had been tampered with so far. After injecting malicious code into an app, the hackers behind this campaign will then impersonate a government agency or service through smishing, phishing or social engineering tactics so that potential victims are fooled into visiting a website that mimics an actual government website.

For example, the initial lure might be a text from an electricity provider or the Department of Health and the attacker would direct the target to a fake website impersonating either where they would be prompted to download an infected app in order to make a payment. Some of the scams may initially establish contact with the victims over text or messaging app and then move to phone calls to provide additional instructions.

The victim may be instructed to borrow an Android device to complete the process or given a link to a website that resembles the actual Google Play Store but is used to deliver an APK file. Unfortunately, because the fake app behaves in the same way as the legitimate app would, the victim doesn’t realize that they aren't interacting with a regular government agency or business.

Once the download is complete, the victim is prompted to enable a number of unnecessary permissions on their device. This allows the threat actors to steal a victim's login credentials, as well as monitor their activity, commit financial fraud and even take over their device. The group can remove traces of their activity once they’ve completed these malicious behaviors too.

Group-IB points out that GoldFactory uses “advanced hooking malware families” – called SkyHook, FriHook, PineHook or Gigabug which can bypass many built-in app integrity checks to hid their malicious behaviors. These malware families can also allow the attackers to capture sensitive data, automate on screen actions and even remotely view and operate the victims phone.

While the victims so far have been concentrated in the areas that GoldFactory usually operates in – Vietnam, Thailand and Indonesia – the approach could easily be deployed to other countries like the U.S. or the U.K.

How to stay safe from malware

Fortunately, this campaign isn't very widespread – yet. However, as with most phishing, vishing and smishing campaigns, the best way to protect yourself is to stay calm and think critically about the messages you receive. Be extremely suspicious of any messages from a government agency or service that arrive through non-official channels. Does your power company typically send you text messages? Is it normal for the Department of Health to contact you through your mobile device?

With any unexpected message, the rules always remain the same: Never, ever click on any link or code in a message if you don't know who's sending it. Don't download anything if you don't know who is sending it and haven't verified it. If someone is contacting you requesting that you download something, hang up or don't respond to the text and contact that office independently and verify that the request is legitimate.

Likewise, you always want to check the URLs of the websites you visit or manually enter them in yourself to make sure that you're going to the correct website. Always make sure that you have the best antivirus software up and running on your devices as most of them have features that will alert you if you visit a suspicious website, or attempt to download a program that isn't legitimate. They also have additional features like a VPN, ransomware rollback and more that can help you stay safe when you go online.

This campaign may be limited to several countries in Southeast Asia now but given how successful it's been so far, I could easily see it spreading. For this reason, you want to make sure that you always practice good cyber hygiene and that you're especially wary of unsolicited messages that claim to be from a government agency or business. That way, you can avoid falling victim to this new malware campaign if it does end up spreading to other countries.

More from Tom's Guide

• New Android banking trojan lets hackers stream a live feed from your phone and control it in real time — how to stay safe
• Billions of Chrome users at risk from 13 security flaws including four high-severity ones — update your browser right now
• FBI says scammers are stealing Instagram photos to fake kidnappings for ransom money — here's how to spot it

Imagine if a hacker could gain full control of your smartphone and stream everything on its screen to their own device? Well, a new Android banking trojan allows them to do just that, but they can also tap, swipe, type and navigate through hijacked smartphones in real time.

According to a new blog post from the cybersecurity site Malwarebytes, security researchers at the online fraud management firm Cleafy have discovered a new Android malware family called Albiriox. Despite being fairly new, it already offers advanced capabilities to cybercriminals looking to deploy this banking trojan in their attacks.

First observed during September of this year, Albiriox is currently being promoted as a Malware-as-a-Service offering on dark web cybercrime forums. This means that other hackers and cybercriminals pay its creators a small fee to use it in their own malware campaigns.

What makes Albiriox a serious threat to the best Android phones is the fact that it’s explicitly designed to perform On-Device Fraud. Unlike other malware that steals banking credentials, allowing hackers to log in to a victim’s financial accounts from another device, this one enables them to do so and drain accounts directly on an infected smartphone.

Here’s everything you need to know about this new malware strain, along with some tips and tricks to help keep your Android phone safe from hackers.

Hiding behind a blank screen

Like other Android malware strains, Albiriox is often spread through malicious apps that unsuspecting users install on their devices by sideloading them. However, in one of the first Albiriox campaigns observed by Cleafy’s security researchers, they found that the hackers behind it were using fake Google Play Store pages to trick users into installing their malicious apps by making it appear legitimate.

In the example shared in a separate blog post, Cleafy points out that this fake page is almost an identical copy of the listing pages used by real Android apps on the Play Store. In fact, it even had screenshots of the fake app in question, along with ratings and installation prompts. However, once a potential victim went to install it, a malware dropper hidden inside an APK was downloaded instead, completely bypassing the Google Play Store. While some Android users would immediately see this as a major red flag, others wouldn’t due to how much effort was put into perfectly copying an actual Play Store listing page.

From there, Cleafy’s researchers noticed that the cybercriminals behind Albiriox shifted their tactics and began using phishing instead of fake websites to spread the malware. Now, instead of a direct APK download from a fake site, visitors were prompted to enter their mobile phone numbers, with the site telling them that a download link would be delivered via WhatsApp.

Once potential victims downloaded this APK file, they’re met with a fake system update interface instead of the normal one you see when installing new Android apps. This is done to trick them into granting unnecessary permissions that the Albiriox malware needs access to in order to take over their smartphone. After this is done, the final payload is loaded and installed on their phones.

Although Albiriox is a new banking trojan, it can already target over 400 banking and financial apps. Like other malware strains, it uses overlay attacks to mimic a banking app’s login page in order to steal a victim’s credentials.

Another interesting feature baked into this malware is that it can hide an attacker’s actions on a device in plain sight. For instance, if a hacker is using that stolen password to log into a user’s bank account in order to drain their funds, Albiriox can display a black screen while they operate in the background. You often see black or blank screens when an app is loading, so for most people, this behavior wouldn’t be out of the ordinary.

Likewise, since the fraud happens on the device itself, hackers using this malware can bypass multi-factor authentication and other security checks by intercepting one-time, 2FA codes and inputting them directly when prompted to do so.

How to stay safe from banking trojans

Even though Albiriox is a rapidly evolving Android banking trojan, Cleafy has only observed attacks in Austria and other European countries so far. However, since this malware is distributed online to other cybercriminals to use in their own attacks, it could easily be repackaged and used to target Android users in the U.S., Canada and other countries around the world. For that reason, it’s definitely something you want to keep on your radar and prepare for.

One of the easiest ways to prevent your Android phone from coming down with a nasty malware infection is to avoid sideloading apps altogether. I know it may seem convenient at times — like when a particular app is no longer available or can’t be downloaded in your region — but the high risk isn’t worth the reward. Fortunately, pretty much every Android smartphone has the option to install apps from unknown sources disabled by default. If you have enabled this feature, though, you might want to consider disabling it unless it’s absolutely necessary for your work, which it most likely won’t be.

From there, you want to ensure that Google Play Protect is enabled on your Android phone. This free, built-in security app automatically scans all of the new apps you download and install for malware, as well as the existing ones on your phone. To add an extra layer of security, you might want to consider running one of the best Android antivirus apps alongside it. Many of them include useful extras like a password manager, VPN and more to help keep you safe online.

Albiriox has definitely made a splash in the world of cybercriminals, thanks to its advanced capabilities and rapid development, which is why I don’t see this particular Android malware strain going anywhere anytime soon. As such, it’s up to you to practice good cyber hygiene, avoid installing apps from shady websites or ones sent to you on social media, and to keep your device updated with the latest security patches.

More from Tom's Guide

• New Android banking trojan is draining accounts and snooping on encrypted chats — how to stay safe
• You can control what your kids see in ChatGPT — here's how to enable it
• Over 4 million users hit with spyware that can turn your browser extensions into malware — how to stay safe

Editor's note: Microsoft has reached out to us regarding the story below and has issued the following update: "We have removed all the extensions identified as malicious on Edge Add-on store. When we become aware of instances that violate our policies, we take appropriate action that includes, but is not limited to, the removal of prohibited content or termination of our publishing agreement"

A long running malware operation that has evolved over several years has been turning browser extensions in Chrome and Edge into spyware through updates that added malicious functionalities. According to a report from Koi Security, the ShadyPanda campaign affects 4.3 million users who downloaded these now compromised browser extensions.

The ShadyPanda campaign consists of 20 malicious extensions on the Chrome Web Store and 125 in Edge; initial submissions of the extensions appeared in 2018, and the first signs of malicious behavior didn’t show up until five years later when a set of them posing as wallpaper and productivity tools began to show signs that something was amiss.

According to Koi Security, the malware campaign rolled out slowly, in phases, through the auto updated mechanism that is designed to keep users safe:

“Chrome and Edge’s trusted update pipeline silently delivered malware to users. No phishing. No social engineering. Just trusted extensions with quiet version bumps that turn productivity tools into surveillance platforms.”

Here's everything you need to know about this massive malicious extension campaign along with what steps you can take to secure your browser and your data right now.

From fraud to full browser access

The extensions begin their malicious activity by injecting tracking codes into legitimate links, which allowed them to earn revenue off of users' purchases. Search hijacking, where search queries are redirected, was also one of the behaviors the researchers saw. Search queries were logged, monetized, sold, manipulated and exfiltrated.

ShadyPanda can collect a range of personal information from users including browsing history, search queries, keystrokes, cookies, local and session storage, fingerprint data, and mouse clicks with coordinates. The extensions that had gained a “good” reputation were modified throughout the years to include a backdoor update that permitted an hourly remote code execution; downloading and executing arbitrary JavaScript with full browser access. This means they were capable of monitoring every website a user visited and exfiltrating browsing URLs, fingerprinting information and persistent identifiers.

Most concerningly, the extensions were able to stage adversary in the middle (AitM) attacks which means they were capable of facilitating credential theft, session hijacking and injecting code into any website. Additionally, any attempt to access the browser’s developer tools will cause it to switch to benign behavior.

While Google has since removed the extensions from the web store, Koi Security noticed the active campaign in the Microsoft Edge Add-ons platform with one extension listed as having 3 million installs.* There is no way of telling if those are inflated numbers, intended to create a sense of legitimacy though.

*Microsoft has said that this extension has since been removed.

How to stay safe from malicious browser extensions

Most of these extensions are wallpaper or productivity apps and if you've downloaded any of them, you should remove them immediately. While Koi Security lists all the extensions at the end of their report, three of the most frequently mentioned ones are Clean Master, WeTab and Infinity V+.

After removing the extensions, you should reset your account passwords – the recommendation is for all accounts across your entire online presence. Since this could be quite a serious undertaking, you may want to use one of the best password managers to make things easier. Not only can a password manager help keep your passwords organized and safe but they can also automatically create strong and unique passwords for each of your online accounts.

As always, I recommend using the best antivirus software on your computer as well. While an antivirus may not have caught these malicious extensions due to how this campaign operated, they can scan for malware, spyware and viruses even when you slip up and download something that shouldn't be on your machine. Antivirus programs also have browser extensions that can help advise you against visiting suspicious websites, help protect your data with cloud backups and can provide you with a VPN and other extras to add an extra layer of security to protect you when you're online.

Given how successful and long-running this campaign was, I doubt this is the last we've heard of ShadyPanda. However, by limiting the number of extensions you have installed and carefully vetting each one before you add it to your browser, you can keep your data and your devices safe.

More from Tom's Guide

• You can control what your kids see in ChatGPT — here's how to enable it
• New Android banking trojan is draining accounts and snooping on encrypted chats — how to stay safe
• Scammers are now using your data to craft personalized attacks — here's how you can fight back

Earlier this year, Google announced plans to make sideloading apps significantly harder to do on the best Android phones. However, many Android owners did not welcome this controversial move.

Now though, fans of sideloading apps might want to reconsider thanks to a new malware strain that can bypass encrypted chats in apps like WhatsApp and Signal and targets financial apps. This new banking trojan, dubbed Sturnus, originates in malicious APKs.

Researchers from MTI Security first discovered Sturnus (via ThreatFabric) and noted it can bypass some security measures by gaining high-level access to the contents of your screen which allows it to view those encrypted chats you thought were safe from prying eyes.

The malware can also recreate banking screens using overlay attacks to phish your login credentials and launch device-level attacks. This means that cybercriminals could remotely control take over your device. Likewise, it can also create fake Android updates to hide its activity.

How Sturnus works

According to ThreatFabric, Sturnus has been used in attacks in both Southern and Central Europe, which the cybersecurity firm claim suggests preparations for a "broader campaign."

The malware apparently uses a "chaotic mix" of plaintext, RSA and AES communications that it switches unpredictably between while sending out simple and complex messages.

According to the researchers, they suspect the malware may be transmitted via rogue attachments in messaging apps. It propagates by disguising itself as fake versions of Google Chrome and other popular apps. From there, it then gains Admin rights on the phone which enables the malware to prevent itself from being uninstalled and locking the device.

While Sturnus is designed to get around encrypted conversations, it sends stolen data back to hacker-controlled servers using an encrypted 256-bit AES key.

Sturnus appears to be in its "pre-development" stages, but the researches say it could be used as for advanced attacks right now. Unfortunately, given how dangerous it ism the only way to prevent it at the moment is to avoid downloading APK files online to sideload Android apps.

A Google spokesperson told Android Authority that according to their detection programs, there are no malicious apps in the which Play Store contain Sturnus.

How to stay safe from Android malware

First of all, to avoid falling victim to Sturnus and other Android malware strains, you shouldn't sideload apps on your devices.

Doing so puts you at serious risk of being plagued by malware, adware, spyware and other threats. Apps found in unofficial third-party app stores or downloaded as APK files don't go through the same rigorous security checks as they would on the Google Play Store or other first-party stores like the Samsung Galaxy Store.

Beyond not sideloading apps, you also want to make sure that Google Play Protect is enabled on your Android smartphone or tablet. This pre-installed security app scans all of your existing apps and any new ones you download for malware and other threats. However, you should also consider running one of the best Android antivirus apps alongside it for extra protection.

Malicious apps are one the easiest ways for hackers and other cybercriminals to establish a foothold on your devices. So it's up to you to carefully vet every app you install. Sticking to official, first-party app stores and limiting the number of apps installed on your phone should keep you relatively safe from Sturnus and other malware strains too.

More from Tom's Guide

• These 12 malicious Android apps are recording your conversations — delete them right now
• Best Android apps — free and paid
• Dogs and cats living together! Google announces Android Quick Share now works with AirDrop

Over the past six months, researchers at SecurityScored’s STRIKE team have identified a new WrtHug campaign that's been scanning for compromised devices. They’ve found 50,000 unique IPs globally that appear to have been affected by the malware campaign which targets end-of-life and outdated Asus router models. It then uses six vulnerabilities to hijack them and leaves vulnerable routers open for other hackers to use them for a variety of malicious activities.

Most of the identified and affected models that have been located were found in Taiwan, followed by Southeast Asia, Russia, Central Europe and the United States. The following Asus models are the ones currently being targets in this campaign:

• • ASUS Wireless Router 4G-AC55U
• • ASUS Wireless Router 4G-AC860U
• • ASUS Wireless Router DSL-AC68U
• • ASUS Wireless Router GT-AC5300
• • ASUS Wireless Router GT-AX11000
• • ASUS Wireless Router RT-AC1200HP
• • ASUS Wireless Router RT-AC1300GPLUS
• • ASUS Wireless Router RT-AC1300UHP

The attacks begin with an exploitation of a command injection flaw as well as other known vulnerabilities. The STRIKE team believes that the compromised routers might be used as operational relay box (ORB) networks in relay nodes to hide command-and-control (C2) operations but there are no further details in their report.

Asus issued security updates to address all six vulnerabilities used in the attacks, making it critical for router owners to update their firmware in a timely manner. Devices that are old enough to no longer be covered under support, should be replaced or have their remote access features disabled. Some of the flaws currently being exploited include:

• CVE-2023-39780 which is a major command injection flaw (also used in the AyySSHush campaign).
• CVE-2024-12912 which is an arbitrary command execution flaw.
• CVE-2025-2492 which is an improper authentication control flaw with a critical severity rating which can lead to unauthorized execution of functions. It can be triggered by a crafted request on routers that have Asus' AiCloud feature enabled.

How to keep your router safe

If you own an outdated router and especially one that's reached its end-of-life and is no longer supported, it's probably best to replace it right away with one of the best Wi-Fi routers instead. This way, your router will receive frequent software updates and security patches from their manufacturer.

However, regardless of your router model you should always apply all available security patches and firmware updates as soon as possible. Likewise, you also want to use a strong and unique password with at least 16 characters to secure your home network. To make things easier, you can always use one of the best password managers to generate one for you and then securely store it. Additionally, you can disable remote administration and reboot the device as this feature is often leveraged by hackers in their attacks.

It’s also a good idea to make sure that you’re using the best antivirus software on all of your devices as many of them offer additional security features such as a VPN that can help protect your privacy when you’re online.

By using a new router with frequent security updates, you're essentially adding an extra layer of protection for all of the devices on your home network. If you want the latest and greatest Wi-Fi tech and have the budget for it, one of the best Wi-Fi 7 routers will provide you with the best overall experience. However, if you don't mind not having access to the faster 6GHz band, one of the best Wi-Fi 6 routers will still be a major upgrade.

More from Tom's Guide

• Black Friday shoppers under attack from AI-powered scams — here's how to spot them before it's too late
• 1.3 billion leaked passwords exposed online in massive new collection — what to do now and how to check your passwords
• Critical Chrome zero-day flaw fixed by Google — update your browser right now

Last week, the cybersecurity team at Palo Alto Networks' Unit 42 published a report that detailed their discovery of a vulnerability on the best Samsung phones. The bug, tracked as CVE-2025-21042, exploits a flaw in the image processing library that left users vulnerable to a zero-day exploit for months.

Called “Landfall,” the exploit was patched by Samsung in April. However, it does appear that it had been left open since mid-2024, leaving select users vulnerable to malicious image files that could have been embedded in WhatsApp messages. These malicious DNG files may have been labeled as .jpeg files to make them appear more legitimate too. Landfall, as a zero-day flaw, would not have required any interaction from the user in order to infect the device.

The impacted devices include the following:

• Galaxy S22 series
• Galaxy S23 series
• Galaxy S24 series
• Galaxy Z Fold 4
• Galaxy Z Flip 4

What the spyware records

Once installed, the spyware is capable of recording audio, accessing and and collecting data from photos, contacts, location and call logs among other capabilities. Landfall targeted specific Samsung devices throughout the Middle East, including Iraq, Iran, Turkey and Morocco.

Again, Samsung owners are now protected from the threat as the company was informed of the danger back in September 2024 and issued a fix in April. CISA (Cybersecurity and Infrastructure Security Agency), has ordered federal agencies to patch any affected Samsung devices and it also added the bug to the Known Exploited Vulnerabilities catalog, which lists security bugs that are flagged as actively exploited in attacks. The federal agencies have until December 1st to secure vulnerable devices.

How to stay safe from spyware

Because Landfall has already been corrected through a patch, one of the best ways to ensure that you can avoid this malware – and other serious threats – is to always keep your phone's operating system up-to-date. This keeps your device protected against recent and newer threats as updates often include security patches as well as other new features that can help protect you online.

At the same time, you also want to be wary about who you connect with online and what you click on, download and install. The usual social engineering and phishing rules apply here too – if you don't know who sent the link or download, you don't need to click on it or install it.

In order to stay protected, it's also advisable that you use one of the best Android antivirus apps on your device alongside Google Play Protect as they often additional additional security features like a VPN, browser warnings about suspicious sites and both phishing and scam alerts.

Zero-day flaws are just something that phone makers have to deal with as hackers are always looking for a new, undiscovered way to gain access to our devices. However, by keeping your phone updated and practicing good cyber hygiene, you can avoid falling victim to a majority of the attacks that leverage them.

More from Tom's Guide

• This Android malware has your debit card and PIN — and it’s making withdrawals
• Phishing scam alert: This "We found your lost iPhone" text is fake and wants to steal your Apple ID
• Your personal information is everywhere online — 5 ways to start removing it from the internet

Besides digitally draining your bank account, hackers can now steal your card details to make cash withdrawals right from an ATM.

The Polish Computer Emergency Response Team (CERT Polska) has discovered a new malware strain that targets Android devices in order to steal debit card details and PIN information which are then used by hackers to make ATM withdrawals.

According to the Malwarebytes Blog, the NGate malware uses both social engineering and NFC technology to exfiltrate banking data from a victim’s phone and then an accomplice drains their account. Surprisingly no one ever has to physically steal or touch a victim's bank card to access their account.

NFC (near field communication) is a wireless technology that lets devices communicate when nearby and it’s used in smartphones, payment cards and terminals. When a mobile device is infected with the NGate malware, attackers can capture the NFC activity, forward the transaction data to devices at nearby ATMs and the stolen data is then used by an accomplice on a phone or smartwatch to take out cash. However, this sophisticated attack takes planning and requires multiple steps.

First the malware needs to be installed on the targeted device. For this, it's usually planted via social engineering tricks like phishing emails or SMS messages with warnings about fake security or technical issues with a bank account. Sometimes these fake messages are followed up with a phone call to make them appear more legitimate; the caller will then ask potential victims to download a “banking app” to help fix the issue. The app is usually from a non-official source (not the Google Play Store), and will ask for unnecessary permissions and financial information.

Once it has led the target though fake card verification, the accomplice has been fed the appropriate information to start using the debit card and PIN data at a nearby ATM. The victim often has no idea that they have been tricked. This is a sophisticated attack method not only due to the various steps involved but also because the one-time dynamic codes that are generated for the NFC technology are temporary which means they have to be used quickly.

How to stay safe from NGate malware

This malware is specific in that it requires multiple steps, so it can be easy to avoid if you can make sure to protect yourself from the layers of attack. First off, make sure to look out for social engineering tactics when dealing with strangers or those who claim to represent a bank or other business. Likewise, only download apps from the Google Play Store or trusted developers. Whatever you do, absolutely don't download banking and financial apps from links sent to you through social media, texts or unknown sources.

You also want to make sure you don't give out financial information to people you don't know. Never click on links, download anything, or use QR codes from strangers too. If someone calls, emails or texts claiming to be from your financial institution and says there is a problem with your account, delete the email, hang up, or block the text sender and reach out to your provider through an independent manner – a phone number you find on your debit card or account statement is always a good idea.

At the same time, you can also protect your mobile devices just like your laptop or computer with antivirus software. We highly recommend the best Android antivirus apps as they can scan for malware, provide phishing protection and even turn off apps that might pose a security risk. However, if you already have a subscription to the best antivirus software for your computer, you may already have the option to secure your mobile devices through it, so check with your antivirus provider to see what kind of mobile protection it offers.

Hackers and cybercriminals keep coming up with new ways to con you out of your hard-earned cash which is why its pays (literally) to stay on top of the latest attack methods and threats. And once you do, make sure you share that knowledge with your family and friends too, so they can avoid falling victim to a dangerous attack like this one.

More from Tom's Guide

• Don’t fall for this – ClickFix attacks now include video instructions and can recognize your operating system
• Google issues security warning for millions — AI-powered malware is here
• Over 200 malicious apps were downloaded more than 40 million times from the Google Play Store this year

ClickFix style attacks, which have already become an increasingly popular social engineering tool to spread malware, have now evolved to include new steps to trick users into infecting their own computers. As reported by BleepingComputer, the malware now features video instructions that guide victims through the download process in order to help them unknowingly give their machines a nasty malware infection.

In previous ClickFix attacks, targets have been fooled by social engineering style tricks – sometimes a false identity verification request or a software problem that requires a “fix” – which then leads them to a malicious webpage that requires them to copy, paste and execute code or commands. Doing so launches a payload, typically an infostealer that harvests personal or sensitive data from the victim's computer which is then sent back to the attackers.

These new ClickFIx attacks operate in much the same way. However, in the past, they would provide text instructions to trick victims into downloading code. Now though, these upgraded attacks provide embedded video which is designed to make the attack feel less suspicious to the target.

A threat actor can hide commands using JavaScript and copy them onto a user's clipboard which reduces the chance of them making any mistakes. In the same window, a timer may appear that's designed to invoke a sense of pressure and may make potential victims feel as if they're required to take action quickly. This also removes their ability to take the necessary time to verify the authenticity of the website or go through a proper, multi-step verification process.

Sometimes there may also be a counter which reads “users verified in the last hour” to add a feeling of legitimacy while making the window appear as if it's a Cloudflare bot check tool.

ClickFix attacks have been observed on all major operating systems, including macOS and Linux, however the automatic detection of the operating system and adjustment of the instructions is another new development much like these new video tutorials.

In a blog post, Push Security reveals that these advanced-style attack pages are being promoted through malvertising or malicious advertising on Google Search, exploiting known flaws in outdated WordPress plugins that compromise legitimate websites which have malicious JavaScript injected on the pages or sites that are “vibe coded” to use SEO poisoned tactics to make them rank higher in results.

How to stay safe from ClickFix attacks

The hackers behind ClickFix campaigns use your preexisting knowledge and online habits to get you to do something you otherwise normally wouldn't. They might also use a sense of urgency to get you to visit one of the malicious sites used in this campaign.

If you do see a verification pop-up with instructions, close the website immediately and whatever you do, don’t interact with it or follow its instructions.

Being asked to open a Terminal or Command Prompt window on your computer is a major red flag. Researchers have recommended that users remember that executing code on the terminal should never be a part of any online based verification process and no copied commands should ever be executed unless the user fully understands what they will do.

It also never hurts to have strong protections when online – one of the best antivirus software solutions can keep your Windows PCs protected while the best Mac antivirus software is specifically designed for your Apple computer. These paid solutions also provide you with plenty of useful extra features like secure browsers that warn you about suspicious websites and downloads, ransomware rollback, a VPN, and more.

Given that ClickFix attacks have been quite successful so far since it's the victims and not the hackers doing most of the work, I seriously doubt cybercriminals are going to stop using these tactics anytime soon. That's why it's up to you to be extremely careful online and practice good cyber hygiene at all times.

More from Tom's Guide

• Google issues security warning for millions — AI-powered malware is here
• Over 200 malicious apps were downloaded more than 40 million times from the Google Play Store this year
• These 12 malicious Android apps are recording your conversations — delete them right now

Google's Threat Intelligence Group (GTIG) is warning that bad guys are using artificial intelligence to create and deploy new malware that both utilizes and combats large language models (LLM) like Gemini when deployed.

The findings were laid out in a white paper released on Wednesday, November 5 by the GTIG. The group noted that adversaries are no longer leveraging artificial intelligence (AI) just for productivity gains, they are deploying "novel AI-enabled malware in active operations." They went on to label it a new "operational phase of AI abuse."

Malware families

Google is calling the new tools "just-in-time" AI used in at least two malware families: PromptFlux and PromptSteal, both of which use LLMs during deployment. They generate malicious scripts and obfuscate their code to avoid detection by antivirus programs. Additionally, the malware families use AI models to create malicious functions "on demand" rather than being built into the code.

Google says these tools are a nascent but significant step towards "autonomous and adaptive malware."

PromptFlux is an experimental VBScript dropper that utilizes Google Gemini to generate obfuscated VBScript variants. VBScript is mostly used for automation in Windows environments.

In this case, PromptFlux attempts to access your PC via Startup folder entries and then spreads through removable drives and mapped network shares.

"The most novel component of PROMPTFLUX is its 'Thinking Robot' module, designed to periodically query Gemini to obtain new code for evading antivirus software," GTIG says.

The researchers say that the code indicates the malware's makers are trying to create an evolving "metamorphic script."

According to Google, the Threat Intelligence researchers could not pinpoint who made PromptFlux, but did note that it appears to be used by a group for financial gain. Google also claims that it is in early development and can't yet inflict real damage.

The company says that it has disabled the malware's access to Gemini and deleted assets connected to it.

Google also highlighted a number of other malware that establish remote command-and control (FruitShell), capturing GitHub credentials (QuietVault), and one that steals and encrypts data on Windows, macOS and Linux devices (PromptLock). All of them utilize AI to work or in the case of FruitShell to bypass LLM-powered security.

Gemini abuse

Beyond malware, the paper also reports several cases where threat actors abused Gemini. In one case, a malicious actor posed as a "capture-the-flag" participant, basically acting as a students or researchers to convince Gemini to provide information that is supposed to be blocked.

Google specified a number of threats from Chinese, Iranian and North Korean threat groups that abused Gemini for phishing, data mining, increasing malware sophistication, crypto theft and creating deepfakes.

Again, Google says it has disabled the associated accounts in identified cases and reinforced its model safeguards. The company goes on to says that underground marketplaces for malicious AI-based tools is growing.

"Many underground forum advertisements mirrored language comparable to traditional marketing of legitimate AI models, citing the need to improve the efficiency of workflows and effort while simultaneously offering guidance for prospective customers interested in their offerings," the company wrote.

With AI getting more sophisticated, this seems to indicate a trend of replacing conventional malicious tools with new AI-based ones.

Google's AI approach

The paper wraps up by advocating that AI developers need to be "both bold and responsible" and that AI systems must be designed with "strong safety guardrails" to prevent these kinds of abuses.

Google says that it investigates signs of abuse in its products and uses the experience of combating bad actors to "improve safety and security for our AI models."

How to stay safe

The war against viruses and malware is ever evolving as tools on both sides become more sophisticated especially with the injection of AI.

There are ways to stay safe. As always, be wary of links and external content. If an AI tool is be used to summarize a web page, PDF, or email that content could be malicious or contain a hidden prompt to attack the AI.

Additionally, you should always limit AI access to sensitive accounts like bank accounts, email or documents that have sensitive information. Compromised AI could exploit that access.

Finally, unexpected behavior in an LLM or AI model should be treated as a red flag. If an AI model starts answerint questions strangely, reveals internal knowledge of your PC or worse, tries to perform unusual or unauthorized actions then you should stop that session.

Make sure you keep your software updated, including the best antivirus software and the LLM programs and applications you utilize. this ensures that you have the most recent and patched versions protecting you against known flaws.

More from Tom's Guide

• Hundreds of malicious apps have been downloaded 42 million times from the Google Play Store — how to stay safe
• Google Maps just got a huge AI boost for millions — 4 new upgrades you can try now
• Google Home is rolling out a major AI upgrade — here’s what to try first

A new banking Trojan has been pretending to be legitimate apps, like digital ID apps or news readers, in order to trick victims into downloading it so that it can take over their devices and steal the logins for their financial accounts. According to researchers at Cyfirma, these Trojan-filled malicious apps are specifically targeting Android users who have banking and cryptocurrency apps installed.

The malware is not only capable of stealing sensitive financial data off infected devices, but it also works quietly in the background like an infostealer, so it can avoid detection and continue to steal data from victims after the initial heist. Once it’s enabled on one of the best Android phones, it can also take over a device and read whatever is on the screen, tap buttons and even fill in forms. Likewise, it uses fake login screens to perform overlay attacks on top of real banking and cryptocurrency apps in order to steal any usernames and passwords that are entered by the victim.

After an initial check to ensure that it’s running on a real phone, it will ask users for special permissions. Like other Android malware it abuses the operating system's which Accessibility Services to do so which it says will help improve the app. However, this actually gives the hackers behind this banking trojan complete control over an infected device while also adding the malware as the device administrator app. This is a common malware tactic which is exactly why we caution against giving apps permissions that they don’t seem to need and why we say that checking the accessibility services section of your Android phone is a good way to detect potential malware.

According to the researchers, this Trojan can also connect to a remote center where it will send information about the phone itself including which banking apps are installed, and the handsets location.

Attackers can even send instructions to the malware and make it perform actions like downloading updates or deleting traces of the malicious activity. The Trojan can also silence notifications and sounds which means that users won't notice any of the malicious activity it's carrying out on their device.

Researchers say the majority of the activity they have seen from this malware is in Southeast Asia, but there’s not reason that these techniques couldn’t be used in any other country or area.

How to stay safe from Android malware

In order to protect your data and your devices from malware, the first thing you want to do is to stick to trusted sources and make sure that you're only downloading apps, especially VPNs and streaming services, from first-party app stores like the Google Play Store or from known developer sites. Never install something from a link in a forum or message sent via social media.

From there, you want to check the permissions requested by an app anytime a new one you've installed asks for control over your device, settings, accessibility services, or if it wants to install other apps. Stop and ask if its necessary. Does it need those permissions and what do you expect it to do with them?

You also want to use layered and up-to-date protection which is why I recommend installing one of the best Android antivirus apps on your phone alongside Google Play Protect. These security apps can scan for malware, dodgy downloads and any suspicious activity taking place on your device. You always want to keep your security software and your operating system up to date because that ensures that all the vulnerabilities that attackers could exploit are patched promptly.

Given that we now handle so much of our finances from our mobile devices, hackers likely won't stop developing new banking trojans and using them in their attacks anytime soon. That's why it's up to you to lock down your devices while also being extra careful online.

More from Tom's Guide

• These 12 malicious Android apps are recording your conversations — delete them right now
• Fake WhatsApp and TikTok apps are trying to fool Android users into downloading spyware — don't fall for this
• Hackers are using Google search results to spread fake apps filled with malware — don't fall for this

Have you ever worried that your phone might be listening in on your private conversations? Or worse, recording them? Well, that's exactly what could be happening if you accidentally installed a malicious app.

Security researchers at ESET have identified twelve Android apps that have been secretly recording users audio in the background. These malicious apps are used to infect the best Android phones with a spyware called VajraSpy that's being spread using social engineering techniques on Facebook Messenger and WhatsApp.

According to the researchers, the attackers first establish relationships with potential victims who are then asked to move their conversations over to another messaging app which is actually a trojan that carries VajraSpy. Once installed on a vulnerable Android phone, the spyware will then steal contact information, as well as messages, call logs and location data and it can even record ambient audio and phone calls. It can also exfilitrate information about the device itself, like its model, operating system version and network identifiers, and then send this data back to the attackers as well.

Although the ESET research in question was published last year and is currently making the rounds online again right now, some of these apps may still be on your Android device. All 12 apps have since been removed from the Play Store but it's still worth checking to see if any of them are installed on your phone or tablet. If you find any of the 12 below apps on your device, you will need to manually delete them.

• TikTalk
• MeetMe
• Let’s Chat
• Quick Chat
• Chit Chat
• YohooTalk
• Hello Cha
• Rafaqat
• Privee Talk
• Nidus
• GlowChat
• Wave Chat

How to stay safe from spyware

There are a few easy ways to stay save from spyware, and one of the main ways is to avoid links to APKs (especially ones sent to you via chat apps) which will need to be sideloaded onto your device. Instead, you should stick to downloads from official Android app stores and always check the developers name and rating, the permissions an app asks for and read the most recent user reviews.

Likewise, you always want to keep your operating system up-to-date and enable Google Play Protect as well. From there, limit app permissions to only what is necessary and watch for any unusual behaviors after your install apps that you're not sure about. Signs that your device may have become compromised include unusual battery drain, unexplained data usage, or persistent background activity you cannot explain. Particularly in the example of VajraSpy, any unexpected microphone prompts are a major warning, and repeated permission requests are a sign that deserve additional attention.

If you see any of these signs, or notifications that appear briefly and then disappear, or if your contacts are receiving odd messages from you, that's a good indicator that your device may have been infected by malware.

If your device isn't protected by one of the best Android antivirus apps, you should make sure that it is covered and that you can look for malware with real-time scans. These programs also offer additional features, like VPNs and scam alerts, that can help protect your privacy and keep you safe online.

Just because a group of malicious apps came out a long time ago doesn't mean they aren't still doing damage in the real world. This is why I always recommend limiting the number of apps you have installed overall. That way, if one is malicious or it goes bad over time, it will be a lot easier to find.

More from Tom's Guide

• 70% of Americans think antivirus will protect their online privacy – here's the real truth
• Fake WhatsApp and TikTok apps are trying to fool Android users into downloading spyware — don't fall for this
• Google just took down 224 malicious apps with 38 million installs in massive SlopAds fraud campaign — how to stay safe

A new spyware campaign is mimicking popular apps like TikTok, YouTube and WhatsApp in order to try and lure users into visiting phishing sites and downloading the ClayRat spyware.

As reported by The Hacker News, this campaign is also using Telegram channels in order to spread the spyware while the malicious sites are using artificially inflated download counts and manufactured testimonials in order to manufacture legitimacy.

Once installed, the spyware can exfiltrate a large amount of personal data like SMS messages, call logs, notifications and other device information. Additionally, it can take selfies with the front camera, send SMS messages and even place calls according to the researchers at the mobile security company Zimperium who discovered it. This is because it requires users make it the default SMS app, which gives it access to sensitive content and message functions. That way, it can capture this sensitive info and then leverage a victim's contacts to spread this malware to other targets.

Some ClayRat versions act as malware droppers, which appear as a lightweight installer that looks like a Play Store update screen. However, an encrypted payload is hidden within the apps assets. Fortunately though, this campaign is only targeting Russian users at the moment. However, in its report, Zimperium detected at least 600 samples and 50 droppers in the last 90 days. This indicates that each iteration of the ClayRat campaign is incorporating new layers of obfuscation to bypass being detected by security tools and the spyware could be used to target Android users in the U.S. and other English-speaking countries soon.

How to avoid spyware and malicious websites

Android users with Google Play Protect are safeguarded against known versions of this malware, as their devices come with this handy security tool pre-installed via Google Play Services. However, it never hurts to remember best practices when it comes to your online safety: Try to stick to known app manufacturers and websites, check the URLs of websites before visiting them and try not to click on sponsored links or ads as they can be used by hackers in their attacks.

Additionally, make sure all your devices are protected online with one of the best antivirus software solutions. While your phone like comes with Google Play Protect pre-installed, for additional security, you may want to consider running one of the best Android antivirus apps alongside it. At the same time, you want to make full use of extras included with your antivirus app or software like a VPN or a hardened browser and heed any alerts you see regarding potentially suspicious websites. Many of antivirus suites will also feature dark web alerts, identity monitoring, and more. All of these features can help protect you online and alert you immediately when something goes wrong.

As for ClayRat , given how many iterations of the spyware that have been detected so far, it's likely the cybercriminals behind it are working on new updates and adding extra malicious capabilities to it. For this reason, I don't see this spyware going away anytime soon and it's more likely that it will be used in attacks on Android users in other countries, so you'll want to keep your guard up to stay safe.

More from Tom's Guide

• Massive data leak just exposed the personal info of 6 million shoppers — how to stay safe
• Researcher finds security flaw in Gemini — but Google says it's not fixing it
• Discord customer info stolen in data breach — how to stay safe

Over 100 password managers and software solutions are being impersonated by a new malware campaign targeting macOS users to steal their personal information. As reported by Bleeping Computer, the popular password manager LastPass has already started warning users about this malicious software that is being spread through fake GitHub repositories.

Besides impersonating LastPass, this campaign is also pretending to be other password managers and software solutions including 1Password, Dropbox, Gemini, Audacity, Adobe After Effects, and SentinelOne, among more than 100 others. It's using these fake repositories to spread the Atomic macOS Stealer, also known as AMOS, which is an info-stealing malware often used in ClickFix style attacks. AMOS is a malware-as-a-service offering that can be bought by hackers and other cybercriminals for roughly $1,000/month on the dark web and typically targets the data stored on vulnerable computers.

The developers of this malware also recently added a backdoor component which gives them persistent and stealthy access to compromised systems. A large number of these deceptive GitHub repositories have been created from multiple accounts in order to optimize them to rank high in search results and to evade detection. LastPass has reported the fake repositories to GitHub but since it's easy to recreate new ones through automation from new accounts, even if they're taken down, new fraudulent ones could pop up just as quickly.

As ClickFix style attacks, the repositories feature a ‘download;' button that directs users to a secondary website where they are instructed to paste a command into the terminal to perform an installation of what seems to be legitimate software but is in actuality malware. The “ClickFix’ method takes advantage of a target not fully understanding what the commands are doing on their system; in this case the command is performing a curl request to a base64-encoded URL which then downloads an AMOS payload to the /tmp directory.

How to stay safe from ClickFix malware attacks

In order to stay safe from ClickFix style attacks, the most important thing you need to know is not to run commands on your system, especially when you don't understand them. Additionally, when looking for software online, its recommended to only trust official app stores like the Mac App Store or vendor websites while avoiding offshoots. If there isn’t a macOS version of a particular piece of software available on a company's official site, be extra wary when you find a third-party site or in this case, a GitHub page, suggesting there is one.

If you do come across a macOS port of a program you're interested in, you should ensure that it comes from a reputable source that has been vetted by the community first. Still, you are installing it at your own risk, so when in doubt, it's best to wait for an official port.

It also never hurts to have strong protections when online – one of the best antivirus software solutions can keep your Windows PCs protected while the best Mac antivirus software is specifically designed for your Apple computer. These paid solutions also provide you with plenty of extra useful features like web browsers that warn you about suspicious websites and downloads, ransomware rollback, a VPN, and more.

For those who are really worried about getting hacked or having their bank accounts drained by cybercriminals, you can't go wrong with the best identity theft protection services for even more protection. However, you'll need to sign up before a cyberattack or major security incident to take full advantage of the identity theft insurance and other protections these services offer.

ClickFix style attacks have been quite successful recently and until the general public learns to recognize and avoid them, hackers are going to keep using them in their malware campaigns. That's why it's up to you to practice good cyber hygiene and most importantly, to always be careful where you click and what you download.

More from Tom's Guide

• FBI warns hackers are impersonating crime reporting sites to steal your personal data — here’s how to tell
• Google will let you use passkeys automatically in Chrome - here's how you can switch
• Hackers are now using deepfakes in phishing scams to fool banking apps and steal your money - how to stay safe

Bad apps can be hiding in the place you least expect and that’s exactly what happened with 224 malicious apps that were recently removed from the Google Play Store following the discovery of a massive ad fraud campaign.

As reported by BleepingComputer, the campaign itself was discovered by Human’s Satori Threat Intelligence team which revealed in a new report that these apps had over 38 million downloads in total. However, it was the advanced tricks and obfuscation techniques they used to bypass Google’s defenses that really stood out.

Unlike previous ad fraud campaigns, this one spanned across the globe with users of the best Android phones downloading them from 228 countries, though they generated the most ad impressions in the U.S. (30%), India (10%) and Brazil (7%). Human’s security researchers have dubbed the campaign “SlopAds” as the malicious apps used in it had a mass produced look and feel, similar to online content created by AI image generators and other AI tools.

Here’s everything you need to know about this new ad fraud campaign including what to do if you did download one of the apps in question along with some tips and tricks to help keep your Android phone safe from adware apps.

From legitimate to malicious in an instant

In order to avoid being detected by Google’s app review process and Android’s built-in security software, the scammers behind this new ad fraud campaign went to great lengths.

For instance, if an Android user installed one of these so-called SlopAd apps directly through the Play Store of their own accord, the app would act as it normally would once installed. However, if they stumbled upon one of these apps after clicking through from the scammers’ various ad campaigns, the app would become malicious after installation.

Once the SlopAds app ran the necessary checks to see whether or not it was installed via the Play Store, it would then download an encrypted configuration file that contained links to the scammers’ ad fraud malware module, cashout servers and a JavaScript payload. From there, the app would run one final check to make sure it was installed on a legitimate Android user’s device and not being analyzed by a researcher or software before proceeding.

Now this is where things get interesting. These SlopAd apps would download four PNG images that look harmless at first glance. However, they actually use stenography to hide pieces of a malicious APK or installation file which is the driving force behind this ad fraud campaign.

After being downloaded, the images are decrypted and then reassembled on a targeted device to form the FatModule malware. Once activated, it uses hidden WebViews to collect device and browser information as well as to navigate to scammer-controlled domains which are used to cashout all of this fake ad revenue generated by these SlopAd apps.

The domains themselves impersonated videogame and news sites while continuously serving hidden WebView screens. This generated over two billion fraudulent ad impressions and clicks each day which brought in quite a lot of money for the scammers.

How to stay safe from ad fraud apps

Although Human’s Satori Threat Intelligence team hasn’t released the full list of these 224 SlopAd apps, they’ve all been taken down from the Google Play Store. Likewise, if you accidentally downloaded one, you don’t need to worry about tracking it down on your own. This is because Google has updated Android’s built-in security app Google Play Protect to warn users to uninstall any of these malicious apps that may be on their smartphones or tablets.

So besides stealing, what’s so dangerous about ad fraud and adware apps? Well, imagine if your phone was constantly loading random websites in the background throughout the day? Not only would this eat up your mobile data but it would also put unnecessary strain on your phone’s battery and other components. As such, you’d probably need to upgrade to a new device sooner rather than later if you had one of these SlopAd apps or a similar adware app installed.

I know this isn’t as pressing of a threat as your typical Android malware infection, but it’s still something you need to be aware of and look out for. Even though we’re not dealing with an infostealer or other dangerous malware here, you can see above how those who chose to sideload these apps were much more at risk than others who downloaded them from an official Android app store, in this case, the Play Store itself.

If you are worried about malware and other viruses ending up on your phone or tablet, then you might want to consider running one of the best Android antivirus apps alongside Google Play Protect. Likewise, if you want the ultimate protection from hackers, scammers and even identity thieves, then the best identity theft protection services are what you’re after. They’re more expensive but a big reason for this is that they include identity theft insurance which can range from anywhere from $1 million to $2 million. This money can be used to cover legal expenses, to get new documents and to compensate you for any funds lost to fraud.

Given how much money a major ad fraud scheme like this one can generate for scammers and other cybercriminals, this likely isn’t the last one we’ll see. In fact, due to the sophistication of this SlopAds campaign, the security researchers who uncovered it believe that the scammers behind this one we’ll likely try something very similar quite soon. So be on the lookout and as always, be careful what you download.

More from Tom's Guide

• Hackers are using Google search results to spread fake apps filled with malware — don't fall for this
• I found a phishing email in my inbox and a malicious app in my news feed — here’s how I knew they were scams
• Fake Meta suspension warnings used in new malware campaign — how to protect your devices and your data

A new FileFix attack is using novel lures in order to trick users into downloading malware. As reported byBleeping Computer, this latest version of the increasingly popular social engineering attack was first discovered by Acronis, who noticed that hackers have been using the FileFix technique and sending out fake Meta account suspensions in order to convince users to unknowingly download the StealC infostealer.

StealC can exfiltrate usernames and passwords from a wide variety of platforms including credentials stored in the cloud, credentials and authentication cookies from web browsers, credentials from messaging apps, cryptocurrency wallets, VPNs and gaming apps, and it can take screenshots of your desktop too. This new FileFix attack is tricking users by sending fake warning messages that appear to come from Meta’s support team. There's even a multi-language fake webpage users are directed to after being warned that their account is about to be suspended or disabled.

Using typical phishing urgency with a deadline of seven days, it tells targets that in order to avoid account suspension they must view an “incident report” that Meta is sharing with them. The fake incident report is a disguised PowerShell command that downloads the StealC malware onto their system though.

Users are asked to click a button that says “Copy” which resembles a file path, and are instructed to open File Explorer to paste the copied file path into the address bar which they’re told will open the “incident report.” However, the fake path contains multiple spaces at the end making it easy to miss the malicious code and it's also missing the usual # symbols that identify a ClickFix attack.

FileFix is a variant of the ClickFix family, which uses social engineering-style attacks to trick users into pasting malicious commands into operating system dialog boxes so they can ‘fix’ the problems that hackers claim they have. FileFix was created by mr.fox, a researcher, and uses the address bar in Windows' File Explorer to execute malicious commands instead of the Windows Run dialog box which is what ClickFix uses.

How to stay safe

More from Tom's Guide

• I found a phishing email in my inbox and a malicious app in my news feed — here’s how I knew they were scams
• Hackers are using Google search results to spread fake apps filled with malware — don't fall for this
• Skincare giant Clarins allegedly hit in data breach with 600,000 customers exposed — what you need to know

A new malware campaign is using SEO poisoning in order to lure victims into downloading fake versions of common apps that are malicious. As reported by Cybernews, reports that hackers are putting malware into fake apps that mimic popular legitimate ones like Signal, WhatsApp and Chrome in order to trick victims into downloading their malicious versions instead.

FortiGuard Labs researchers have identified this new attack which both tricks users and games the search algorithms by using SEO plugins and registered lookalike domains in order to get to the top of search results. Once a victim is on their fake website, they’re fooled into downloading a trojanized installer of one of many commonly searched for apps like Telegram, Deepl, Line or others.

The mimicked websites are able to deliver malware from several known families but those that have been reported include Hiddengh0st and a new Winos variant. Malicious components have been bundled into the installer packages, which appear to also download the real applications, and after launching malicious DLLs will also drop along with hidden directories, administrator privileges and functions to help the malicious code evade detection.

From there, attackers can easily collect information about the device and the victim, log keystrokes and clipboard information, load plugins for surveillance and control as well as enumerate any antivirus and security tools, or capture screen activity. The plugins that the malware can deliver also suggest the possibility that the hackers behind the attack can intercept app communications from Telegram.

How to stay safe from fake sites in search results

More from Tom's Guide

• Those urgent text messages aren't from your motor vehicle department - here's how to tell they're fake
• 7 iPhone security settings you should enable right now to lock down your smartphone
• Skincare giant Clarins allegedly hit in data breach with 600,000 customers exposed — what you need to know

Normally, when it comes to Android malware, when new strains are discovered, they often build upon a previous one. However, that’s not the case with a new Android banking trojan currently making the rounds online. Instead, it appears to be written from scratch with no code similarities to existing malware families.

As reported by The Hacker News, this new banking trojan has been dubbed RatOn by security researchers at Threat Fabric who discovered it while investigating another malware strain that uses near-field communication or NFC in its attacks to steal contactless payment info from unsuspecting Android users. The most surprising part of this new sample was the fact that it wasn’t just in a single malicious app but instead was part of a campaign involving multiple ones.

After analyzing this new campaign further, Threat Fabric found that RatOn is a fully functional banking trojan with several unique capabilities. In addition to being able to take over one of the best Android phones and the accounts on it, the banking trojan can also perform automated money transfers as well as use custom overlay attacks to trick victims into thinking their device is infected with ransomware.

Here’s everything you need to know about this new malware strain, along with some tips and tricks to keep your Android phone safe from banking trojans that can completely drain your financial accounts.

From overlays to automated money transfers

In order to trick potential victims into installing their malicious apps, the hackers behind this campaign registered several domains with adult themes, which they then used as a lure. Specifically, these fake sites contained “TikTok18+” in their names. However, Threat Fabric’s security researchers couldn’t find out how the hackers got their victims to go to these sites. In the past, I’ve seen hackers use phishing emails, random messages on social media and even fake ads to get people to click on links to their malicious sites.

If someone is foolish enough to sideload an adults-only version of TikTok onto their Android phone, what ends up getting installed is actually a malware dropper or third-party software installer. By tricking users into granting it the permission to install apps from unknown sources, the malware dropper is able to bypass Android’s built-in security protections. This is used to download and install the first payload, after which, the second payload and two more permissions are requested that are essential for hackers looking to commit on-device fraud: access to Accessibility services and Device Admin privilege.

Like other banking trojans, RatOn abuses Android’s Accessibility services to launch overlay attacks on an infected device. For those unfamiliar, these attacks involve hackers putting an overlay on top of popular banking and finance apps that is almost identical to a legitimate login screen. This way, the hackers can harvest a victim’s banking credentials to gain access to their accounts without their knowledge, as they just thought they were logging into one of their banking, finance or crypto wallet apps.

Another interesting thing cybercriminals deploying the RatOn malware can do is to use an overlay to make victims think their phone has been locked by hackers. Of course, to unlock it, they need to send over a large amount of money, just like with a ransomware attack. However, while their phone isn’t actually infected with ransomware, it is compromised by the RatOn banking trojan.

RatOn also requests access to read/write contacts and manage system settings to carry out its malicious activity. From there, a third payload is downloaded, which is actually the NFSkate malware Threat Fabric was initially looking into. By using a technique known as Ghost Tap, NFSkate can carry out NFC relay attacks and steal contactless payment info. However, with that malware strain, these attacks needed to be carried out in person within physical range of a targeted Android phone.

Now, with RatOn, this new malware can perform automated money transfers (ATS) by abusing Android’s Accessibility services. This means that hackers deploying this malware in their attacks can drain your financial accounts from anywhere in the world, as they don’t need to be in the same room with you.

How to stay safe from banking trojans

The good news here is that at the moment, RatOn is only being used to target Android users in the Czech Republic. However, like with any Android malware strain, that geographic location could just be a testing ground to make sure it works before the malware’s creators begin targeting Android phones in other countries like the U.S. or the U.K.

I’ll be keeping a close eye on RatOn and how this new Android malware strain develops, but in the meantime, here are a few tips and tricks to help keep your phone (and your bank account) safe from dangerous trojans.

For starters, you never want to sideload Android apps unless you absolutely have to. Instead, you want to download all of your new apps from official app stores like the Google Play Store and the Samsung Galaxy Store. Google will soon prevent users from sideloading altogether with the next version of Android, but for now, you should avoid doing so even if it seems like a convenient way to put new apps on your phone.

When it comes to new apps, you want to be very careful when installing them, as even good apps can go bad. This is why I highly recommend limiting the number of apps on your phone overall and then, if you find you haven’t used a particular app for quite some time, it’s best to just delete it.

To stay safe from malicious apps, you want to make sure that Google Play Protect is enabled on your phone. This free, built-in security software scans all of your existing apps, along with any new ones you download, for malware or other signs of malicious activity. For extra protection, you may also want to run one of the best Android antivirus apps alongside it.

Hackers aren’t slowing down anytime soon, and there are constantly new malware strains and banking trojans like RatOn you need to look out for. However, if you practice good cyber hygiene, avoid clicking on links from unknown senders and don’t sideload apps you’ve found on less-than-reputable sites, you should be safe.

More from Tom's Guide

• PayPal users under attack from sophisticated new phishing scam — don't fall for this
• Plex users need to change their passwords — there’s been another breach
• Macs under attack from ‘cracked’ apps spreading dangerous info-stealing malware

Hackers are once again targeting the best MacBooks and other Apple computers in an effort to infect them with dangerous malware designed to steal passwords, files, browser data and more.

As reported by Infosecurity Magazine, the cybersecurity firm Trend Micro recently discovered a new Atomic macOS Stealer campaign that uses ‘cracked’ or pirated versions of popular macOS software as a lure. When this doesn’t work, the cybercriminals behind this campaign use fake CAPTCHA to the same end.

While you might think your Mac is safer than one of the best Windows laptops, think again, as hackers now love to target Apple’s computers in their attacks. This makes sense, too, as those willing to pay more for a premium laptop will likely make better (and more profitable) targets.

Here’s everything you need to know about this new campaign along with some tips and tricks to help keep you and your Apple computer safe from hackers.

From cracked to hacked

In its report, Trend Micro reveals that this new campaign begins with an attacker tricking a macOS user into downloading a fake or cracked version of a popular app. This malicious app then acts as a Trojan horse to deliver and install the Atomic macOS Stealer onto their computer.

These fake apps could be promoted on forums, in direct messages sent over social media or even through malicious ads. When a potential victim goes to download one of them, they’re redirected to a hacker-controlled page and prompted to click on a button which reads “Download for MacOS.”

In one case analyzed by Trend Micro’s security researchers, victims saw their Macs infected with malware after trying to download a cracked version of the legitimate app CleanMyMac. While the download site appeared to be legitimate at first glance, clicking on the “Download Now” button took them to Atomic macOS Stealer landing page.

Alternatively, victims might be instructed to copy and paste commands into Apple Terminal. Doing so leads to the execution of a malicious installation script which creates a binary file that lets the hackers establish persistence on a vulnerable Mac.

From there, the script copies loads of sensitive data off an infected Apple computer, including:

• System Profile information
• Username and password
• Browser data (including cookies, web data, and login information)
• Cryptocurrency wallet data
• Telegram data
• OpenVPN profiles
• Keychain data
• Apple Notes data
• Various files from folders on the system

All of this sensitive personal data is then compressed and sent back to a hacker-controlled server to use in follow-up attacks. Likewise, this data could also be sold to other hackers on the dark web to use in their own attacks.

How to stay safe from Mac malware

Just like on one of the best iPhones, you want to stick to the Apple App Store for downloading new apps for your Mac when possible. If you do download an app from outside the App Store, make sure it’s from the website of a reputable Mac developer first.

To do so, carefully examine the URL and you also want to look for signs of misspelled words or poor grammar as these can be a dead giveaway that you’re on a malicious site and not a legitimate one. You also want to be careful how you get to a vendor’s site. Instead of clicking on ads which appear in the top results on Google and other search engines which can be faked, you want to scroll further down the page to find a company’s actual site.

Although it goes without saying, you should never download cracked or pirated software. Besides hurting developers, doing so puts you at risk since you never really know what’s inside an app you downloaded illegally. Sure, it could work as intended but there’s also a chance that it might contain malicious code designed to steal your data or worse, take over your Mac.

As for staying safe, while your Mac does come with built-in protection in the form of Gatekeeper and XProtect, you may also want to consider using one of the best Mac antivirus software solutions alongside them. Third-party antivirus software is updated more regularly and it often includes other useful extras like access to one of the best VPN services or a password manager.

Hackers will likely continue to prey on Mac users given that the old and no longer true advice that Apple computers can’t get viruses is still quite widespread. However, you can stay safe by remaining vigilant online and this is especially true when downloading new software and apps.

More from Tom's Guide

• PayPal users under attack from sophisticated new phishing scam — don't fall for this
• These iCloud Calendar invites look legitimate but are tricky phishing attacks – here’s how to tell
• Over half a million people impacted by major data breach — full names, SSNs, financial data and more exposed

More from Tom's Guide

• Over 1 Million Hit In Farmers Insurance Data Breach — Names, Addresses, Partial SSNs And More Exposed
• Dangerous Android banking trojan found lurking in malicious apps with 19 million installs — don’t fall for this
• Macs under attack from dangerous new info-stealing malware — how to stay safe

Even on official app stores, you need to be careful what you download. Case in point, 77 malicious apps with a combined total of 19 million installs were found spreading malware on the Google Play Store.

As reported by BleepingComputer, the malicious apps in question were discovered by Zscaler’s ThreatLabs team. At the time, its researchers were investigating a new campaign that uses the Anatsa banking trojan (also known as Tea Bot) to target vulnerable Android phones.

In addition to taking screenshots, intercepting and reading text messages, keylogging and device takeover, Anatsa is also able to impersonate banking and finance apps by using overlay attacks. Just last year, the trojan was able to impersonate over 600 popular apps. Now though, that number has jumped to 831 banking and finance apps according to Zscaler’s new report.

Here’s everything you need to know about this new malware campaign including some tricks and tips to help you keep your Android phone virus-free and safe from hackers.

Hiding in plain view

The reason malicious apps can be quite difficult to spot is that they often pose as seemingly harmless ones on both official and unofficial app stores. For instance, cybercriminals might create a PDF reader, flashlight or some other type of utility, trick people into downloading it using fake reviews or even fake ads and then infect their device with malware.

In Anatsa’s case, the banking trojan uses decoy apps that appear to be legitimate at first glance. However, once they're installed, this decoy app downloads a malicious payload disguised as an app update which actually includes the Anatsa banking trojan. Even though apps on the Google Play Store go through rigorous security checks just like on Apple’s App

Store, this approach allows these bad apps to avoid detection since they only become malicious after they’ve been downloaded and installed.

Once one of these malicious apps is updated and opened, Anatsa scans the apps on a victim’s phone to see which banking and finance apps they use. If one of the apps the trojan can impersonate are loaded on a victim’s phone, it then places an overlay of a login screen when they’re launched. If you opened the app for your bank and saw that you had to re-login before checking your account, you wouldn’t think twice about it, right? Well, in this case, instead of logging in, you’re actually handing over your username and password to the hackers behind this campaign who can then drain your accounts.

In addition to the Anatsa banking trojan, ZScaler’s researchers also found other malware strains being distributed by the malicious apps. As BleepingComputer points out, the Joker malware was the most popular and was found in a quarter of these malicious apps.

Just like with Anatsa, the Joker malware is able to take screenshots and access device information. However, it can also read and send text messages, steal a victim’s contacts from their phone and even sign up for premium subscription services. Likewise, the Joker variant Harly was also found in these malicious apps among other malware strains.

How to stay safe from Android malware

Normally with malware, I’d recommend not opening links or downloading attachments in emails from unknown senders or downloading new apps from suspicious sites online. However, in this situation, things are a little more tricky since all of these 77 malicious apps were available to download right on the Google Play Store.

For this reason, I always recommend that people limit the number of apps they have installed. This makes it easier to find out if you accidentally downloaded a malicious one but keep in mind, even good apps can go bad when injected with malicious code like how the Anatsa banking trojan is distributed via fake app updates.

Before downloading any new app, you want to carefully check its review score and ratings. However, since these can be faked, it’s always a good idea to look for external reviews on other sites and especially video reviews since they show you how the app in question works. It’s best to stick to well-known developers with trusted track records but before you download any app, you should first ask yourself if another one of your pre-installed apps or even your mobile operating system can accomplish the same thing. If so, skip the app.

To stay safe from Android malware, you want to make sure that Google Play Protect is enabled on your smartphone. The reason being is that this free, pre-installed app scans all of your existing apps and any new ones you download for malware. So let’s say you accidentally install one of the decoy apps used in this campaign, it would get flagged as dangerous once the Anatsa malware is downloaded after an update. For additional protection though, you might want to consider running one of the best Android antivirus apps alongside it and to help you recover funds lost to malicious apps or other malware, then the best identity theft protection might be worth investing in too.

Malicious apps provide hackers with an easy entry point into your phone as well as your digital life, so they’re not going to go away anytime soon despite Google and Apple’s best efforts. That’s why you need to be careful when installing new apps and periodically check your existing apps to make sure that nothing is amiss.

More from Tom's Guide

• Macs under attack from dangerous new info-stealing malware — how to stay safe
• Two-factor authentication provides an easy way to secure your accounts — here's how it works and how to enable it
• AI browsers can’t tell legitimate websites from malicious ones — here’s why that’s putting you at risk

More from Tom's Guide

• 7 easy changes I made that drastically improved my digital security
• AT&T agrees to $177 million data breach settlement — here's how to file a claim
• How to track your kids screen time — and the best tools to do it

In an attempt to protect yourself online, you might have downloaded a seemingly safe antivirus app that turned out to be a malicious app spreading dangerous spyware. Unfortunately, it may have come via a random Telegram or strange text message from a friend too.

The LunaSpy Android spyware program was reported on in a recent Kaspersky blog post which revealed that the spyware has been infiltrating phones since at least February of this year. Allegedly, LunaSpy can be sent via messaging apps and sold as an antivirus program and sometimes as a banking protection app.

The spyware pretends to scan your device for viruses to trick you into granting permissions to the app. However, doing so enables it to steal data, track you, and even record audio and video.

While it pretends to run antivirus scans, LunaSpy is actually swiping passwords, recording your screen, and even running commands on your phone. Kaspersky even found unused code that would allow it to steal your photos.

If you're data is stolen via LunaSpy, it's reportedly sent to over 150 command and control servers. These servers are then used by cybercriminals to communicate with and control infected devices.

How to stay safe from malicious apps

A spyware or malware infection can come from clicking on malicious links, downloading attachments in emails from unknown senders or through piracy. However, one of the most common ways to be infected is through both official and unofficial app stores.

In the LunaSpy case, it can be traced back to malicious links. With that in mind, you need to be extremely careful putting new apps on your Android phone and especially ones recommended by others through messages on social media or over text.

If you haven't heard of an app before, look for it in the Google Play Store and read reviews as well as check its ratings first. Since these can both be faked though, you'll want to look for external reviews on other sites. Video reviews are especially helpful as they give you a chance to see the app in action.

Even good apps can go bad when injected with malicious code, we recommend limiting the number of apps you have installed overall just to be safe. Fewer apps means less risk that you've downloaded a malicious one or a legitimate app that has been taken over by hackers.

For Android phones, you want to make sure that Google Play Protect is enabled on your devices. It's a free and built-in security app that scans your existing apps and any new ones you download for malware and other malicious activity. You might also want to consider running one of the best Android antivirus apps alongside it for additional protection.

Malicious apps aren't going anywhere, and suspicious links are only one prong in hackers' attempts to get sensitive data. However, if you pause before tapping on a strange link and limit the number apps on your phone, your chances of getting infected go down significantly.

Additionally, you'll want to discuss these safety practices with your younger and older family members and friends since not clicking suspicious links and investigating any new apps before you download them is key to keeping your loved ones safe from hackers.

More from Tom's Guide

• 5 Android settings you need to turn off right now because they’re a huge security risk
• I’m a security editor and this is one security rule I never break
• 12 computer security mistakes you're probably making — and what to do instead

Hackers are now using legitimate-looking software and documents to infect unsuspecting users with a new info-stealing malware capable of pilfering your passwords, credit card data and more.

As reported by The Hacker News, this new campaign is believed to be the work of Vietnamese-speaking cybercriminals who have begun deploying the PXA Stealer malware in their attacks.

First discovered by security researchers at Cisco Talos, PXA Stealer is an info-stealing malware written in Python. While it was initially used to target government organizations and businesses in the education sector throughout Europe and Asia, the hackers behind this new campaign have shifted their sights to go after ordinary people in the U.S., South Korea, the Netherlands, Hungary and Austria.

So far, SentinelOne has identified 4,000 unique IP addresses across 62 countries that have been infected by the PXA Stealer. What makes this particular malware campaign so dangerous is that in addition to how it can steal saved passwords, cookies, credit card info and any other autofill data stored in your browser as well as from crypto wallets and popular applications like Discord, the hackers behind it are also using a number of tricks and techniques to avoid detection.

Here’s everything you need to know about this new malware campaign along with some tips and tricks to help you avoid falling victim to it.

Sideloading to avoid detection

In this new wave of attacks, the hackers responsible either tricked potential victims into visiting phishing sites or convinced them to download a ZIP file which, in addition to a signed copy of the free Haihaisoft PDF Reader, also contains a malicious Dynamic link-library or DLL file.

As SentinelOne’s security researchers explain in their report, this malicious DLL file is an essential part of this campaign as it’s what allows the PXA Stealer malware to establish persistence via the Windows Registry on infected systems. However, it’s also used to download additional malicious components like Windows executables that are hosted remotely on file-sharing sites like Dropbox.

Once the PDF reader is installed and launched, this malicious DLL creates a command line script that tells Microsoft’s Edge browser to open a virus-filled PDF file. While the file doesn’t actually open and an error message is displayed, the damage is done.

Besides using a free PDF reader as a lure, the hackers behind this campaign are also using a Microsoft Word 2013 executable to distribute the PXA Stealer malware. This executable looks like your standard Word file and comes attached in emails but when opened, it uses a different malicious DLL file to achieve the same end goal: infecting your PC with info-stealing malware.

To get all of this stolen data off of your computer, the hackers behind this campaign are using Telegram as an exfiltration channel. From there, all of those stolen passwords, credit card data and other sensitive personal information is then sold on the dark web for other cybercriminals to use in their own attacks.

How to stay safe from malware

Everywhere you turn online these days, there seems to be hackers lurking around the corner waiting to infect your devices with malware in order to steal your data.

In this particular campaign, the hackers behind it used either phishing sites or malicious email attachments to trick unsuspecting users. This is why you need to be extra careful when checking your inbox.

Don’t just click on any link you see in an email. Instead, you want to hover your mouse over the link to see where it’s taking you. If you don’t recognize the URL, don’t click on the link. Likewise, when it comes to email attachments, you always want to be wary when an unknown sender attaches a file to an email they’ve sent you. When in doubt, if you don’t recognize the sender, don’t download the attachment even if it appears to be legitimate at first glance.

Given that the PXA Stealer and other malware strains often target the data you’ve stored in your browser, you should avoid keeping sensitive information in it when possible. For instance, instead of having your browser store your saved passwords, you should use one of the best password managers instead. The same thing goes for your credit card details and other sensitive information.

While I would normally recommend keeping your PC protected with the best antivirus software, the hackers behind this campaign used all sorts of clever tricks and techniques to avoid having their malware detected. In this case, it’s up to you to use your best judgement when clicking on links or downloading files online. Still, it never hurts to use a reliable antivirus to keep you protected from other viruses and threats online.

Given that the PXA Stealer was first used to target governments and educational organizations before regular people, I don’t think this is the last we’ve seen of this info-stealing malware yet. Instead, other hackers may try to use this malware strain in future attacks.

More from Tom's Guide

• I ditched my passwords for passkeys on these 3 popular services — and it took me less than 10 minutes
• What is the most private way of verifying your age?
• Email security features are being hijacked to steal Microsoft 365 logins — what you need to know

You can never be too careful when downloading a new app to your iPhone or Android phone as what may look harmless on the surface could actually be a malicious app designed to infect your device with malware.

Case in point, the mobile security firm Zimperium has discovered a new malware campaign which targets users of the best iPhones and best Android phones with over 250 malicious apps spread via 80+ malicious domains.

What sets this particular campaign apart is that in addition to posing as utility apps, many of the malicious apps used in it also posed as dating apps along with file sharing ones and car service platforms.

Once installed on a vulnerable smartphone, the apps were then used to download a dangerous info-stealing malware capable of stealing all sorts of sensitive personal data including a victim’s contacts and even their photos. The hackers behind this campaign then took things a step further, threatening to extort victims by leaking their private info and photos to their contacts or online if their demands weren't met.

Here’s everything you need to know about this new malware campaign along with some tips and tricks to help you stay safe from malicious apps and the dangers they pose to both your data and your devices.

Delete these apps right now

Before we go into the campaign itself and how it worked, you should first check your phone to make sure that you haven’t installed any of the apps below. If you have, you’re going to want to manually delete them from your devices:

• Pilatess
• Mfile
• Zcloud
• Haikiss
• WhaleS
• KingCloud
• Acloud
• Cloud-k
• AceCloud
• Lovelush
• LOVESS
• Slovehome
• Erotic-s
• BKing

I’ve highlighted just a few of them above but you can see the full list here (Google Sheet). If you take a closer look at the names of these malicious apps, you’ll notice that many of them are in Korean which makes sense given that this campaign mainly targeted users in South Korea.

Given that anyone could have shared a link to one of the malicious domains hosting these fake apps, iPhone and Android users worldwide could be impacted. Either way, it’s always a good idea to take a closer look at all of the apps you have installed and to delete any you don’t recognize or haven’t used in a while.

From phishing sites to fake apps

In a blog post detailing the inner workings of this new campaign dubbed SarangTrap, Zimperium’s security researchers explain that potential victims are first tricked into visiting carefully crafted phishing sites.

These are designed to impersonate popular brands and app stores which not only adds legitimacy to the campaign but may also entice users to download these bad apps.

Once installed, these fake apps lure users in with slick user interfaces while requesting access to loads of unnecessary permissions with the caveat that they won’t work without them. To make these apps seem more exclusive, especially the ones posing as dating apps, users are also prompted to enter a valid invitation code.

After being entered, this invitation code is sent to a hacker-controlled server for validation after which, these malicious apps then request access to the sensitive permissions they’ll use to infect a device with malware and steal personal info from it.

Besides acting as a lure, this process allows the malware to remain undetected by the best antivirus software and other security solutions designed to stop malicious activity from bad apps.

With the necessary permissions in hand, these fake apps reveal their true nature. While they look slick and polished at first, they contain no dating features or other functionality at all. Instead, they’re just a facade used by the hackers behind this campaign to gain a foothold on vulnerable devices from which they can then steal all sorts of valuable sensitive data.

When it comes to the types of data the malware spread by these fake apps is able to steal, it can download a victim’s phone number and device identifiers along with all their photos and text messages. With all this info, the hackers behind this campaign can easily extort victims, though they could also bundle it altogether and sell this data to other cybercriminals to use in their own attacks.

Surprisingly, in addition to malicious Android apps, this campaign also uses a deceptive mobile configuration profile to go after iPhone users. By installing this profile on an iPhone, the hackers are able to steal much of the same sensitive data on iOS including a victim’s contacts and photos.

How to stay safe from malicious apps

Just like with new software on your computer, you always need to be careful when installing new apps on your phone, especially as we now have so much personal and even financial info on our mobile devices.

For starters, you want to avoid sideloading apps or installing apps from unknown sources or websites. If you’re taken to a site trying to get you to install an app instead of to an official app store like the Google Play Store or Apple’s App Store, this is a major red flag and a great indication that you should avoid this particular app altogether.

When you install a new app on your devices, you want to pay close attention to the types of permissions it requests the first time that you open it. While it makes sense for a messaging app to request access to your text messages, it definitely doesn’t when a dating app does so. If any permissions seem odd or unnecessary, this is another red flag that something could be off with a particular app.

Besides being extra careful when installing new apps, I highly recommend that you limit the number of apps on your phone overall. Having a lot of apps installed makes it difficult to find malicious ones and even good apps can go bad when injected with malicious code. The fewer apps you have, the less likely it is that one of them will be malicious or turn malicious later.

If you’re using an Android phone, you want to make sure that Google Play Protect is enabled as this pre-installed security solution scans all of the new apps you download as well as all of your existing apps for malware. For extra protection though, you may also want to consider running one of the best Android antivirus apps alongside it.

While there isn't an iPhone equivalent of these apps due to Apple’s own restrictions, the best Mac antivirus software from Intego can scan your iPhone or iPad for malware when plugged into your Mac via a USB cable.

Given that downloading and installing a malicious app even accidentally can have very serious consequences, you may also want to invest in one of the best identity theft protection services. They can help you get your identity back after having it stolen as well as compensate you for any funds lost to fraud or a cyberattack.

Malicious apps are the easiest way for hackers to establish a foothold on your devices and gain leverage over you and your data which is why they aren’t going anywhere anytime soon. This is why it’s up to you to be proactive as well as careful when it comes to which apps you download and where you download them from.

More from Tom's Guide

• Your Ring cameras weren’t hacked over the weekend — here’s what actually happened
• 12 signs your phone has been hacked — and what to do next
• This Android malware poses as real apps to take you to dangerous sites and flood your phone with spam

While signs that you've been hacked may be obvious if you're on your home computer, it might be a little more subtle if you're looking for them on your smartphone. Many people still don't believe that security issues and hacks are likely on a smartphone, so they don't take precautions against such attacks, making them vulnerable to threats like phishing, malicious downloads or unsecured Wi-Fi.

However, if you don't have any antivirus protection or coverage for your smartphone and you're not practicing safe cyber practices when it comes to securing your mobile devices, they're at risk too. Here are the warning signs to look out for when it comes to mobile malware — and what to do if you suspect that you may have already been victimized by a virus or worse.

What to look for

• Pop up ads: Just like on a desktop, if you're seeing pop up ads appear on your phone, that's a big red flag warning sign. Do not click on any of these, as they can lead you to malicious websites.
• Performance issues: For example, if your phone is frequently freezing, crashing, or lagging when performing its usual tasks. Malware and viruses consume huge amounts of processing power, so your device will have problems when trying to do typical day-to-day jobs.
• Randomly rebooting or shutting down: This could be caused by malicious code, or by a hacker trying to remote control your device through the malicious code. Either way, it's never a great indicator about your device.
• Microphone or camera turning on: If either the microphone or camera turns on, when you don't turn them on yourself, it's another red flag — and it could mean that an attacker is spying on you and your activities.
• Unfamiliar apps, messages, or calls: If you see apps you don't remember installing, or calls or texts you didn't make, that's unauthorized use and it usually indicates malware.
• Unusually low battery: Malware is a battery hog, so if your phone is constantly needing a recharge for no good reason, this could be why.
• Overheating (when idle): If your device is getting quite warm when it's not working hard, again, that could be malware which will work your device's processor hard.
• Unexpected two-factor authentication requests: Two-factor and multi-factor authentication is set up as an extra layer to protect your accounts from being accessed by hackers, so if you're getting requests you don't expect it's a good indication that someone has your password and is trying to access your accounts.
• Account issues: Any unexpected password changes like reset requests, or obviously, getting locked out of accounts is reason for serious concern.
• Data spikes and/or unknown call charges: A threat actor could be using your phone to transfer data, make purchases, send messages or make calls.
• Websites look different: Whether they're redirecting you to spammy websites you don't want to be or they just appear strange, this may mean your web traffic is being hijacked.
• Unable to shut down or turn off: Malware may be keeping your device turned on.

What to do now

So you think you may have been hacked — what now? There are a few steps you can take to get control back, protect your data and your device. None of them are sure things and none of them are fool-proof but they're a good starting point.

• If you have an antivirus program installed on your mobile device, start by running a security scan that can find and (hopefully also) remove the malware.
• If you see any unfamiliar or suspicious apps, downloads or files on your phone that you don't remember installing, remove them — don't just delete the icon, but make sure you're deleting the app entirely.
• Back up essential data: Not applications or system data, but other important things that may not have been infected like your photos, contacts, and important documents.
• Check your backups: Make sure that they are from a date before the hack or infection occurred so you don't just reinfect your phone over and over again. Restore only essential, necessary data and manually reinstall apps from the app store.
• Change your passwords: This should be done as soon as possible, and should be done from a separate, uninfected device. Make sure you're creating strong, unique passwords for all your accounts, enabling multi-factor authentication whenever available and using a password manager.
• Clear cookies, cached data and saved history: Anything stored in your browser settings should get wiped clean as it could remove malicious code that is being stored there.
• Secure accounts: Review all recent activity on your online accounts, looking for any unauthorized activity, transactions or messages. If necessary, consider freezing accounts, requesting new cards or updating credentials.
• Update your operating system: An easy way to make sure you have the most up-to-date protection against malware.
• Disconnect: Disconnect your phone from Wi-Fi and cellular networks, then restart your phone in Safe Mode or Recover Mode (depending on your operating system).
• Shut it down: Perform a full shut down (when needed) and disable always on location features, which could be used by malware.
• Perform a factory reset: To be used as a last resort, and only when you have your files backed up. This can sometimes be the only way to resolve an issue.
• Notify contacts and authorities: Let your contacts know that you've been hacked so they can be on alert for any potential phishing messages, but also let your financial and banking institutions know so they can be aware of any potential identity theft or financial fraud.

Hacks can happen to anyone and it's important to realize that you're not powerless — if you stay calm, and know what to do, you can salvage a good amount of your data and even your device. Knowing what to do after a hack is just as important as knowing how to stay safe in the first place and anyone can make a mistake and quickly become a victim to a phishing scam, a malicious website or a bad Wi-Fi connection. Stay calm, stay safe and stay informed.

More from Tom's Guide

• The best Android antivirus apps in 2025
• Why aren't there antivirus apps for the iPhone?

A new version of the Konfety malware that attacks the best Android phones now uses distorted APK files as well as other methods in order to avoid being detected and analyzed.

As reported by Bleeping Computer, this latest Konfety malware strain, which is neither spyware nor a remote access trojan, can pretend it is a legitimate app by copying both the branding and names of real apps from the Google Play Store.

Konfety mimics real products available on the Play Store, though it does not reproduce the same functionality of those apps. Likewise, it's distributed and promoted through third-party stores. This is a method that researchers have sometimes called a ‘decoy twin’ or ‘evil twin’ tactic, and is exactly why it is recommended to only download software from trusted publishers and to avoid installing APK files from third-party app stores.

Still, some users will resort to searching on these marketplaces for supposedly free versions of popular apps either because they don’t have access to Google services as their Android device isn’t supported or because they don’t want to pay for legitimate software.

Here's everything you need to know about this new Android threat including some tips and tricks to help keep your phone safe from hackers and malware free.

Hiding in plain sight

Once Konfety has been installed on a victim’s device it uses a malformed ZIP structure to avoid analysis and detection, and will begin its malicious behavior. It can redirect users to dangerous websites, install unwanted apps and provide fake browser notifications. Additionally, it can produce ads using a CaramelAds SKD and exfiltrate device data like installed apps, network configuration and system information.

Thanks to the capabilities of this latest version, it can also hide its app icon and name, and then use geofencing to alter its behavior depending on the region the device is located in. It performs all its nefarious hidden features courtesy of an encrypted DEX file inside the APK which is loaded and decrypted during runtime, and contains hidden services declared in the AndroidManifest file which allows for the delivery of more dangerous modules.

Konfety also manipulates the APK files to confuse and break static analysis and reverse engineering tools by signaling that the file is encrypted when it is not, which triggers a false password prompt when trying to inspect the file. This can block or delay access to the APKs contents.

Next, critical files within the APK are declared using BZIP compression, which is not supported by analysis tools and this results in a parsing failure. Android ignores the declared method and returns to the default processing which allows Konfety to install and run on the device without issue.

How to stay safe from Android malware

More from Tom's Guide

• 5.4 million hit in major healthcare data breach — names, emails, SSNs and more exposed
• Google Gemini flaw exploited to turn AI-powered email summaries into the perfect phishing tool — everything you need to know
• This new Android attack could trick you into compromising your own phone — everything you need to know

Even if you stick to official app stores, you could end up downloading a malicious app, which is exactly what happened to 50,000 Android users who accidentally installed a dangerous banking trojan on their devices.

As reported by BleepingComputer, the Anatsa banking trojan is back as part of a new campaign that uses a malicious app posing as a PDF viewer to infect unsuspecting users of the best Android phones.

The discovery was made by security researchers at Threat Fabric who have been tracking Anatsa for years. The banking trojan is often hidden in popular utilities, and to date, it has been downloaded almost a million times.

What makes malware like this particularly dangerous is that it’s designed to target popular banking and finance apps. From JP Morgan to Capital One to TD Bank and others, Anatsa can impersonate them all and the banking trojan does this through overlay attacks. While you might think you’re logging into your bank account, if your phone is infected, you’re actually handing over your credentials to hackers who can then use them to drain your accounts and steal your hard-earned cash.

Here’s everything you need to know about this latest Anasta campaign, including some tips and tricks to help keep you and your devices safe from Android malware.

Hiding in a seemingly harmless app

Although it has since been removed, Threat Fabric’s researchers recently found the Anatsa banking trojan hiding in a PDF viewer app on the Google Play Store called “Document Viewer – File Reader” published by the developer “Hybrid Cars Simulator, Drift & Racing,” according to a new report.

Based on a screenshot of the app’s download page taken by the cybersecurity firm, more than 50,000 Android users downloaded this malicious app before it was taken down. If you did download this app, you should stop what you’re doing and immediately manually remove it from your phone.

Just like with other malicious apps, Threat Fabric found that this one used a sneaky tactic where the app was “clean” until it raked up enough users. Once it became popular, though, its creator or hackers who hijacked the app then added malicious code to it via an update.

As you might have guessed, this injected code contains the Anatsa banking trojan, which is installed on a vulnerable Android device as a separate app. By connecting to a hacker-controlled server, malware is able to get a list of targeted apps, then looks for them on the infected device. If any of them are found, then overlay attacks are used to steal user credentials from them.

This latest campaign adds a new trick, though, to prevent users from taking action until it’s too late. You know those 'down for scheduled maintenance' error messages you often see when trying to check your account balance? Well, Anatsa now shows them too over your legitimate banking apps to hide its malicious activities in the background, and by the time the message is gone, so too are your banking credentials.

Google has since removed the latest malicious app spreading the Anatsa banking trojan from the Play Store. However, if you did download it, you need to remove it and then run a full system scan using Google Play Protect. Likewise, it’s also recommended that you reset your bank credentials just in case they ended up in the wrong hands.

How to stay safe from Android malware

While I often recommend sticking to official app stores and not sideloading apps, this doesn’t always work due to malicious apps. For this reason, even if you’re extra careful when installing new apps, you could accidentally end up infecting your Android phone with malware.

This is why you want to carefully scrutinize any app you’re thinking about installing. Check its rating and reviews on the Play Store, and since these can be faked, you also want to look for external reviews on other sites. Video reviews are even better if you can find them, since they give you a chance to see the app in question in action before you download it.

At the same time, you also want to limit the number of apps you have installed on your phone overall. The reason for this is that with fewer apps, you’re less likely to have one of the apps you do have installed go bad after an update.

Likewise, it’s always a good idea to stick to known, trusted developers when installing new apps. You also want to ask yourself if you really need a new app or if one of your existing apps or even your phone itself can accomplish the same functionality.

As for staying safe from Android malware, you want to make sure that Google Play Protect is enabled on your phone. This free and pre-installed security app scans all of your existing apps and any new ones you download for malware to help keep you and your devices safe. However, for extra protection, you may want to consider installing one of the best Android antivirus apps alongside it.

Malicious apps are one of the easiest ways for hackers to establish a foothold on your devices, and as a result, I don’t see them going away anytime soon. This is why you always need to be extra careful when installing new apps on your phone, even if they come from official app stores.

More from Tom's Guide

• Nearly 2 million people hit by malicious Chrome installations that can track you — what to do now
• More than 1,200 fake Amazon sites pop up ahead of Prime Day — avoid getting scammed
• This dangerous Mac malware just got a major upgrade which makes it even harder to delete — how to stay safe

Just when you thought your Mac was safe, an updated version of a popular Mac malware strain is making the rounds online which can leave a backdoor on your computer that hackers can use as they please.

As reported by BleepingComputer, the Atomic Stealer malware was first discovered back in 2023. Since then though, it’s been constantly upgraded with new capabilities that allow it to target the best MacBooks and other Apple computers in an effort to steal keychain passwords, local files, passwords, browser cookies, stored credit card data and of course, cryptocurrency.

Now though, the Moonlock cybersecurity division of the software provider MacPaw has observed a new Atomic Stealer version that can create a backdoor on infected Macs, leaving them vulnerable to additional and more devastating attacks.

Here’s everything you need to know about this upgraded Mac malware along with some tips and tricks on how you can keep your Mac safe from hackers and virus-free.

From hidden file to backdoor

Atomic Stealer is actually a malware-as-a-service offering which means that other cybercriminals pay its creator a monthly subscription fee of $1,000 to $3,000 in order to use the malware in their own attacks.

Thanks to a tip from the independent security researcher g0njxa on X, MacPaw’s cybersecurity division was able to get their hands on a new Atomic Stealer sample that includes this updated backdoor functionality. After analyzing the sample, Moonlock found that it contains an embedded backdoor that’s able to remain on an infected Mac even after the device has been rebooted.

The executable that makes this backdoor possible is a binary file named ‘.helper’ which is downloaded and saved in a victim’s home directory after their Mac is infected with the Atomic Stealer malware. In a blog post discussing their findings, Moonlock’s security researchers explain that this binary file is hidden after an infection to make it harder to detect.

The malware’s creators are using a persistent wrapper script named ‘.agent’ which is also hidden to run ‘.helper’ in a loop as the logged-in user. Meanwhile, a LaunchDaemon (com.finder.helper) installed via AppleScript is used to ensure that this ‘.agent’ wrapper script runs every time an infected Mac is powered on.

By using a victim’s stolen password, this action is executed with elevated privileges which allows this new backdoor to be used by hackers to do things like execute commands remotely, log key strokes, introduce additional payloads or even to move laterally across a network to target other devices connected to it.

A malware infection is bad enough as it is but one that creates a backdoor into your computer is the last thing you want to deal with. This is because persistent malware is much harder to remove.

How to stay safe from Mac malware

In their blog post, Moonlock’s security researchers also explain that this new version of the Atomic Stealer malware is currently being distributed through two main avenues: cracked or pirated software and spear phishing campaigns targeting high-value users.

As such, to avoid being infected with the Atomic Stealer malware, you shouldn’t download any cracked or pirated software. Besides being illegal, downloading pirated software puts you at risk from malware since there’s no telling whether or not there may be malicious code inside. This is why you want to stick to official app stores like the Mac App Store or download software (you’ve paid for) directly from a reputable company.

When it comes to spear phishing, the less information that’s available about you online, the better. Let’s say you have a lot of cryptocurrency stored in your crypto wallet. Well just like with money in the bank, you want to keep that info to yourself instead of advertising it online via social media.

Once the hackers using Atomic Stealer have a high-profile individual in their sights, they often use fake job interviews as a means to get close to potential victims. From there, they coerce them into handing over their system password by having them enter it to enable screen sharing. This is a huge red flag since screen sharing is built into most video conferencing software and even then, you’d never have to type in your password to get it to work, especially if you aren’t the one hosting the video call.

As for staying safe from malware and other viruses, your Mac does come with built-in security software in the form of XProtect. However, given the sheer number of threats and online scams these days, it’s worth investing in one of the best Mac antivirus software solutions to run alongside it for even stronger protection.

Given how successful the Atomic Stealer malware has proven to be for hackers over the past few years, I don’t see this threat going away anytime soon. This is why you need to improve your own cyber hygiene and stay up to date on the latest threats. That way, you’ll be far less likely to fall for the tricks hackers use to gain initial access to you and your devices.

More from Tom's Guide

• More than 1,200 fake Amazon sites pop up ahead of Prime Day — avoid getting scammed
• Best Prime Day antivirus deals: 7 heavily discounted security suites to keep you safe online
• Your old accounts are an online gold mine for cybercriminals — what you need do right now to stay safe

Developed by cybersecurity researcher, mr. d0x, a FileFix attack is a new version of the ever popular ClickFix social engineering tool.

For those unfamiliar with ClickFix, it tricks users into executing malicious commands by convincing them that they need to ‘fix’ something in order to complete a task on their machines.

As reported by BleepingComputer, this new FileFix method uses the Windows File Explorer address bar instead. Mr.d0x not only discovered the new method but has demonstrated that it can be used in attacks to target company employees via the same social engineering techniques that have proven highly successful with ClickFix.

ClickFix attacks, which have surged in popularity recently, are browser-based and use a variety of tactics to get victims to click on a button in their browser that will copy a command to their Windows clipboard. The victim is then told to paste the command into PowerShell or prompted to perform an additional command in order to “fix” the issue.

This is frequently seen as a reCAPTCHA or an error that needs to be corrected via the Win+R Run Dialog. It has proven to be an extremely effective malware tool, used to spread dangerous infostealers and launch ransomware attacks.

The FileFix update created by mr.d0x is similar to a typical ClickFix attack but pastes the command into Windows File Explorer, which many users are more comfortable using. File Explorer can also execute operating system commands which means it has a functional upload feature; the ‘trick’ portion of the attack is that it no longer requires an error or an issue as a lure and may simply appear as a notification for a shared file that the user needs to locate through File Explorer.

FileFix is a phishing page that includes an ‘Open Fixe Explorer’ button that will launch File Explorer through the file upload functionality and copy the PowerShell command to the clipboard. The fake path is initially seen in the Fixe Explorer address bar, which hides the malicious command and then executes it.

How to stay safe from ClickFix attacks

The ClickFix tactic that’s currently being used in more and more in attacks is working due to the fact that it’s able to bypass the best antivirus software and many other security tools. The reason for this is that victims end up doing most of the heavy lifting themselves as the hackers behind this and similar campaigns use social engineering to coerce them into taking action.

The hackers behind this and similar campaigns use your preexisting knowledge and online habits to get you to do something you otherwise normally wouldn't. They might also use a sense of urgency to get you to visit one of the malicious sites used in this campaign.

If you do see a verification pop-up with instructions, close the website immediately and whatever you do, don’t interact with it or follow its instructions.

Being asked to open a Terminal or Command Prompt window on your computer is a major red flag. However, not everyone is as tech savvy which is why you should share what you’ve learned with both older and younger family members, friends and colleagues to help keep them safe, too.

More from Tom's Guide

• SparkKitty spyware caught stealing photos on iPhone and Android — and the reason might surprise you
• 7 online scams that can leave you broke, exposed, and feeling helpless — how to stay safe
• Over 700K people hit in major healthcare data breach — full names, SSNs, medical info and more exposed

Whether you use an iPhone or an Android phone, chances are, there’s plenty of sensitive personal and financial information on your smartphone. While hackers have been known to go after your passwords, there’s a new malware strain making the rounds online that also has your photo library in its sights.

As reported by BleepingComputer, both the best iPhones and the best Android phones are currently being targeted in a new campaign that uses SparkKitty to steal all of the images of an infected device.

According to the cybersecurity firm Kaspersky, this campaign has been active since February of last year. However, what sets it apart is the fact that the malware in question found its way onto both Apple’s App Store and the Google Play Store.

If you thought the hackers behind this campaign were after your selfies, think again. Instead, they’re looking for screenshots of crypto wallet seed phrases. For those unfamiliar, these very important phrases are the only way you can regain access to a crypto wallet if you forget your password. With them in hand though, hackers can easily drain all of your digital currency and good luck trying to get it back.

Here’s everything you need to know about this new campaign along with some tips and tricks on how you can avoid having your Android phone or even your iPhone come down with a nasty malware infection.

Infiltrating official and unofficial app stores

Just like with many other malware campaigns, this one uses malicious apps to establish a foothold on targeted devices before infecting them with SparkKitty.

In its report on the matter, Kaspersky explains that the hackers behind this campaign used the SOEX messaging app which also has cryptocurrency exchange features to target Android users directly on the Google Play Store. Meanwhile, on iPhone, they used the 币coin app on Apple’s App Store to achieve the same thing.

While Google has already removed the SOEX app from the Play Store, at the time of writing, the 币coin app is still up on the App Store and has yet to be removed by Apple. Either way, if you downloaded either of these apps, you should manually delete them right now.

At the same time, Kaspersky also found modded TikTok clones with fake online cryptocurrency stores as well as gambling apps, adult-themed games and casino apps distributing the SparkKitty malware. However, instead of being available on an official app store, these apps had to be sideloaded.

SparkKitty is embedded as fake frameworks or delivered via enterprise provisioning profiles on iOS whereas on Android, the malware is embedded in both Java and Kotlin apps. On an iPhone, the malware is automatically executed when an app starts but on Android, it’s triggered when an app launches or when a specific action like opening a certain screen type takes place.

To gain access to a victim’s photo library, SparkKitty requests access to an iPhone’s photo gallery but on Android, the malicious app used to install the malware prompts the user to grant storage permissions so that it can access any images stored on their device. Either way, once installed, the malware begins exfiltrating both existing pictures and any new ones taken on an infected phone.

From there, the malware goes through all of these stolen images, specifically looking for screenshots of crypto wallet seed phrases. When you sign up for a new crypto wallet or exchange, you’re given a seed phrase and told to write it down to store it for safekeeping.

Although taking a screenshot seems like a fast and practical way to do this, this campaign and others like it show just how dangerous doing this can be. This is why old-fashioned paper and pen is the best way to store your seed phrases. However, you should also store them under lock and key to protect them further.

How to stay safe from malicious apps spreading malware

Although you can end up with a malware infection from clicking on malicious links, downloading email attachments from unknown senders and through piracy, one of the most common ways is via malicious apps either on official or unofficial app stores.

For this reason, you need to be extremely careful when putting any new app on your iPhone or Android phone. You want to make sure that you read an app’s reviews and check its rating but since these can be faked, you also want to look for external reviews on other sites. If you can find one, video reviews are an even better option since you get to see an app in action before installing it.

It’s also worth noting that even good apps can go bad when injected with malicious code which is why I always recommend limiting the number of apps you have installed on your devices. With fewer apps installed, there’s less of a risk that you downloaded a malicious one or that a legitimate app has been hijacked by hackers.

Before downloading any new app, you first want to ask yourself if you really need it. It’s likely one of your existing apps or even your phone’s operating system is able to accomplish the same thing.

Additionally, you also want to stick to trusted and well-known apps when possible and for most people, you should never sideload any app onto your phone. The reason being is that the apps on Apple’s App Store and the Google Play Store go through rigorous security checks that both sideloaded apps and those from unofficial app stores don’t.

Bad apps do manage to slip through the cracks from time to time. However, if you aren’t carelessly downloading new ones, you’ll be far less likely to accidentally install a malicious app.

As for staying safe from mobile malware, if you have an Android phone, you want to make sure that Google Play Protect is enabled on your devices. This free and built-in security app scans all of your existing apps and any new ones you download for malware or other malicious activity to keep you safe. For extra protection though, you might also want to consider running one of the best Android antivirus apps alongside it.

While there’s no equivalent to these Android antivirus apps due to Apple’s own malware scanning restrictions, the best Mac antivirus software from Intego is able to scan both your iPhone or iPad for malware but they have to be plugged into a Mac via USB cable to do so.

Malicious apps aren’t going anywhere anytime soon given how successful they’ve been for hackers in malware campaigns like the one described above. However, if you think before you tap and limit the number of apps on your phone overall, your chances of ending up with a malware infection after downloading a malicious app will be a lot lower.

Likewise, you also want to make sure that you talk to both your younger and older family members and friends about the risks posed by malicious apps in order to keep everyone you know safe from hackers.

More from Tom's Guide

• Security warning for over 1.8 billion Gmail users — implement these critical security steps now
• 7 online scams that can leave you broke, exposed, and feeling helpless — how to stay safe
• Over 700K people hit in major healthcare data breach — full names, SSNs, medical info and more exposed

A notorious banking malware that targets the best Android phones has returned with new capabilities that make it even easier for hackers to siphon off your hard-earned cash.

As reported by Infosecurity Magazine, an updated version of the Godfather malware has been spotted online by the mobile security firm Zimperium.

Back when I first reported on this malware several years ago, it was being used by hackers to target popular banking and finance apps in countries around the world. At that time, Godfather primarily used overlay attacks to trick unsuspecting users into entering their usernames and passwords. These credentials were then used to log into their financial accounts to steal both cash and cryptocurrency.

Now though, the Godfather malware is back with a major upgrade that allows it to create virtualized versions of legitimate apps to commit fraud in real-time.

Here’s everything you need to know about this new malware threat along with some tips and tricks on how you can keep your devices and financial accounts safe from hackers.

From overlays to virtualized apps

Overlay attacks can definitely be convincing and many Android users have fallen for them in the past. However, as they require copying a banking or crypto app’s user interface and branding perfectly, this can be a lot of extra work.

To appear more convincing while making things easier for hackers, Godfather now launches virtual instances of targeted apps from within a sandboxed environment on vulnerable Android smartphones. That way, instead of having to rely on potential victims enabling the necessary permissions, the malware can now essentially clone financial apps to more easily steal credentials from potential victims.

The implication here is also huge since due to this new attack method, you can’t even trust the legitimate apps you have installed on your phone. Likewise, doing things this way allows the Godfather malware to evade detection.

Before creating virtual versions of banking and financial apps, the malware first scans an infected device to see which apps a victim actually has on their smartphone. From there, it compares a user’s installed apps against a list of targeted apps. If one of the targeted apps is found, Godfather creates a virtualized version of it that launches when a user tries to run the legitimate app.

Depending on which banking or financial app is being targeted, the malware has several different methods for stealing a user’s credentials. At the same time, it’s also able to steal the PIN or unlock pattern for an Android smartphone. Unsurprisingly, Godfather does this by using a fake overlay that’s designed to mimic a user’s actual lock screen.

To make matters worse, this malware is also able to remotely control an infected device using a number of different commands. This lets the hackers behind this campaign commit real-time fraud on an infected device oftentimes without a victim’s knowledge. For instance, with a phone’s PIN or unlock pattern, they could unlock the device when it’s in a victim’s pocket or charging overnight and steal their passwords and cash without anything seeming amiss.

How to stay safe from Android malware

Fortunately (at least for now), this upgraded version of the Godfather malware has only been used in attacks targeting Turkish Android users according to Zimperium’s report on the matter. However, this could easily change and the hackers behind this campaign could branch out to target users in other countries like the U.S., the U.K. or Canada.

As such, you’re going to want to take steps now to protect your Android smartphone and any banking or financial data it contains. The easiest way to stop Godfather and other Android malware strains in their tracks is to turn off an Android smartphone’s ability to install apps from unknown sources. This feature is disabled by default but if you’ve turned it on, you’re going to want to turn it off right now.

Many malware strains use malicious apps as a means to gain entry to a vulnerable Android smartphone and Godfather is no different. You also want to be wary about files sent to you via email or on social media as they could also contain malware.

For this reason, you want to make sure that Google Play Protect is enabled on your smartphone as this pre-installed security app can scan all of your existing apps and any new ones you download for malware. If you want extra protection though, you can always run one of the best Android antivirus apps alongside it.

Another useful step you can take to stay safe is to limit the number of apps installed on your phone overall. Since even good apps can go bad, having too many apps on your phone puts you at greater risk. Besides deleting unused apps, you also want to ask yourself whether or not you really need a new app before installing it.

Banking malware is dangerous enough on its own but now that Godfather can create virtualized copies of legitimate Android banking and financial apps, we could soon see other malware strains implementing this capability too. Thankfully, Google always tries to stay one step ahead of hackers and often updates Android to prevent these kinds of attacks from being possible in the first place. This is why you should always update your Android smartphone as soon as new software becomes available. And if you’re phone isn’t receiving updates anymore, then it’s certainly time for an upgrade.

More from Tom's Guide

• If you’re a Gmail user it’s time to implement these critical security steps
• New QR code threat can infect your phone as soon as you scan
• Hackers are still trying to break into my accounts 12 years later — here's how I managed to stop them

Sometimes the features designed to keep our computers safe can put us most at risk thanks to a worrying security flaw that can be exploited by hackers in their attacks.

As reported by BleepingComputer, a new Secure Boot bypass (tracked as CVE-2025-3052) was recently discovered that can be used to disable Windows 11’s built-in security measures to install bootkit malware.

Unlike your typical Windows malware, bootkit malware targets your computer’s boot process which allows an attacker to gain full control over your operating system before it even loads. To make matters worse, this type of malware is also persistent and can remain on your PC even after you reinstall Windows.

Here’s everything you need to know about this new Secure Boot flaw and why it’s imperative that you update your Windows PC right now to stay safe from any attacks exploiting it.

Bypassing Secure Boot

According to a new blog post, this flaw was discovered by Binarly security researcher Alex Matrosov after he found a BIOS-flashing utility online. Signed with Microsoft’s UEFI signing certificate, the utility in question was originally designed for rugged tablets. However, it can run on any of the best Windows laptops or desktops with Secure Boot enabled.

First introduced back in 2012 with the release of Windows 8, Secure Boot was created to protect against bootkit malware by ensuring that only trusted software could load during a PC’s startup sequence. Ironically, thanks to this flaw, Secure Boot-enabled PCs are now vulnerable to the very thing this security feature was designed to protect against.

Following an investigation, it was discovered that the vulnerable module in the utility found by Mastrosov had been available online since at least the end of 2022, though it wasn’t until last year that it was uploaded to the malware detection service VirusTotal.

To show how serious this flaw was, he and the team at Binarly created a proof of concept (PoC) exploit that set the LoadImage function used to enforce Secure Boot to zero which effectively disabled it. With this feature disabled, an attacker can install bootkit malware that can hide from both Windows and any security software installed on a system.

Back in February of this year, Mastrosov disclosed the flaw to Microsoft and a fix for it was created. However, while it worked to address the flaw, the software giant determined that it impacted 13 other modules which then had to be fixed as well.

How to keep your Windows PC safe

So how do you protect yourself from malware that starts before Windows even loads and can easily bypass the best antivirus software? Well, by updating your PC with the latest security updates from Microsoft.

In June’s Patch Tuesday updates, Microsoft has included a fix for this major security flaw along with patches for other recently discovered vulnerabilities. However, the company has also added 14 new hashes to its Secure Boot dbx revocation list. Fortunately for you, this updated dbx file is contained within Microsoft’s latest round of Patch Tuesday updates.

While installing the latest Windows updates may seem tedious at times, I highly recommend that you stop and take the time to do so as Microsoft often includes fixes for a variety of different security flaws while also adding new features to its operating system.

Given that Patch Tuesday takes place on the second Tuesday of every month, at least you know ahead of time when these very important updates will arrive. This way, you can set aside the time needed to install them or better yet, set your PC to install them automatically.

When dealing with security flaws that can bypass your antivirus software, the best identity theft protection services can help you recover your identity as well as any funds lost to malware or other scams as a result of them. Keep in mind though that for identity theft insurance to pay out, you need to be signed up for one of these services before an attack takes place.

Although this Secure Boot bypass is worrying, it’s worth noting that it wasn’t exploited by hackers in the wild. Instead, security researchers created an exploit for it in order to show how dangerous this flaw could be if knowledge of it ended up in the wrong hands. Either way, it’s a great reminder as to why it’s so important to keep your PC (and all of the computers in your household for that matter) up to date.

More from Tom's Guide

• Delete these 20 apps right now if you downloaded them from the Play Store — they’re malicious
• Macs under threat from new malware campaign impersonating major ISP
• These “great” deals on Facebook are not from Amazon, Rolex or Nordstrom – they’re from a network of scammers

Even though people often think Macs are safe from malware, that definitely isn’t true. Case in point, a new Atomic Stealer campaign, which is being used to infect the best MacBooks and other Apple computers with info-stealing malware, has been spotted online.

As reported by The Hacker News, the campaign was discovered by the cybersecurity firm CloudSEK, and it’s believed to be the work of Russian hackers due to comments in the malware’s source code.

What makes this campaign particularly interesting is the fact that, in addition to typosquatting, it also uses social engineering to trick unsuspecting Mac users into falling for it. For those unfamiliar, typosquatting is a type of attack where cybercriminals register lookalike domains in order to lay traps for potential victims who mistype a popular site’s URL into their browser’s address bar. While they might think they’re on a popular company’s website, instead, they’re actually on a fake site designed to mimic the real one, which is also used to spread dangerous malware.

Once infected with Atomic Stealer, the malware can steal personal and sensitive data from your Mac like passwords stored in your Apple Keychain, browser cookies, login credentials, credit card details, and more.

Here’s everything you need to know about this new malware campaign, along with some tips and tricks to prevent you from falling victim to it and other cyberattacks.

Not the Spectrum you were looking for

According to CloudSek, the hackers behind this new campaign are impersonating the U.S. internet and cable provider Spectrum using several fake websites. While Spectrum’s official website can be found at spectrum[.]com, the firm's blog post highlights one of these fake sites, which uses the URL panel-spectrum[.]net.

Once on this fake site, potential victims are asked to complete a reCAPTCHA to verify that they aren’t bots. Since many sites use this or similar forms of verification, many people might not even think twice when asked to check a box to prove they’re human. However, on the fake site shared by CloudSek, once verification fails, potential victims are then asked to complete an alternative verification instead.

However, when someone clicks on the button that reads “Alternative Verification”, a command is copied to their clipboard without their knowledge. A set of instructions appears that asks them to open a command prompt, paste the code that was copied to their clipboard, and hit “Enter” to run it on Windows. If someone is using a Mac, though, slightly different instructions are shown that lead to the same outcome: they’re computer is being infected with info-stealing malware.

On Macs, a malicious shell script is used to steal system passwords and download a variant of the Atomic Stealer malware. As CloudSek security researcher Koushik Pal points out in the company’s report, the script “uses native macOS commands to harvest credentials, bypass security mechanisms, and execute malicious binaries.”

How to stay safe from Mac malware

Given that hackers use all kinds of different tricks to lead potential victims to fake sites spreading malware, it’s always best to type a company’s website into your browser’s address bar manually. However, you should also double-check that you spelled it correctly.

If you don’t know a company’s official site, you can use a search engine to find it. One thing, though, that you want to be careful about is that you’re not clicking the first link that you see. The reason is that on Google and other search engines, the links at the top are often ads, while finding a company’s actual website often requires that you scroll a bit further down the page. The problem with clicking on an ad or a sponsored search result is that cybercriminals often use malicious ads to take users to fake sites instead of to a company’s actual site, as anyone (even hackers) can buy ad space online.

From here, it’s a matter of knowing how to identify a ClickFix attack. Many sites ask that you complete a reCAPTCHA or other form of verification before entering. However, if a site asks you to open a command window and paste something from your clipboard there before hitting “enter”, this is a major red flag. A legitimate company might ask you to select all of the images that are cars, but they would never copy code to your clipboard without your knowledge and then ask you to paste and run it somewhere else.

Although your Mac does come with built-in security software in the form of Apple’s own XProtect, it’s still a good idea to consider investing in one of the best Mac antivirus software solutions. Unlike free antivirus software, these paid options are updated more frequently and are more likely to spot and help you avoid newer malware strains like Atomic Stealer.

Given that attacks using this ClickFix technique have proven both successful and profitable for hackers and other cybercriminals, they’re not going anywhere anytime soon. This is why it makes sense to educate yourself and your family members about these sorts of threats so that you can spot any red flags before your Mac or PC becomes infected with malware.

More from Tom's Guide

• Millions of Mac owners urged to be on alert for info-stealing malware
• Does your Mac need antivirus software?
• Macs under attack from malware targeting digital wallets and Apple’s Notes app