A page we found promises a $750 Apple Cash reward if you complete a quick “device verification.” There is no reward, and the page does not verify your device. Instead, it sends you to app offers through affiliate tracking links.

The page is not affiliated with Apple. If you’ve landed on a page like this, close it.

Why Apple makes such good bait

Apple is one of the world’s most recognized brands, and scammers use that familiarity to make fake offers seem credible. Apple’s own scam guidance lists fake promotions offering free products and prizes among common tricks.

Current Apple news gives scammers useful cover. The new iPhone Duo is in the headlines, and we recently found a fake preorder page whose code tried to exploit older iPhones as soon as the page opened. With the iPhone Duo starting at $1,999, a promise of $750 in Apple money may catch people’s attention.

The word “verify” may also sound timely. Starting November 9, Green Dot Bank, which issues Apple Cash, will require some users to verify their identity before they can reload their balance. A fake page asking people to “verify your device” to get Apple Cash may seem more plausible in that context.

Apple Cash isn’t an Apple Gift Card

The page blurs two different things:

• Apple Cash is money you send, receive and spend through Apple Wallet.
• An Apple Gift Card adds money to your Apple Account balance for Apple purchases.

Apple warns that its gift cards can only be used for Apple purchases, and that someone asking you to pay them with one is probably a scammer. But neither Apple Cash nor an Apple Gift Card comes from a website that “unlocks” it after you install an app.

The fake site leans hard on Apple’s name. It calls the app it promotes an “Official Apple Partner” that is “Verified by Apple Cash,” and its footer claims “Copyright © 2026 Apple Inc.” None of that is true.

A “verification” that verifies nothing

We looked at the code behind the page’s three steps: Eligibility Check, Verify Device and Claim Reward.

The eligibility check is a timer. The four items that tick green, including “Location: United States,” are just labels that light up on a schedule. The page never checks where you are or what device you use. Everyone passes in under four seconds.

The device verification is an app install. The page tell users to download an app called Reco Social, then tells them to create an account, and install and play a game. We found no evidence that Reco Social or its developer created or operated the fake reward page.

When you tap Download & Open App, the page opens a link in a new tab. Five seconds later, it starts showing “Verifying device…”. Nothing is being verified. The page has no way of knowing whether you installed anything, created an account or played a game.

The reward is the same link again. Ten minutes after you tap the button, the page moves on by itself and announces “Device Verified Successfully,” whether or not you installed anything. The Claim Your $750 button doesn’t add anything to your wallet. It opens the same link as the download button.

Fake urgency

The page is built to stop you from thinking too long:

• “Only 47 spots left today” always starts at 47. It drops by one every 30 seconds and stops at 3, so it never runs out.
• The “claimed $750” pop-ups are generated at random from a list of 15 first names and 15 US states, with a random “minutes ago.” Every visitor sees a new one every 8 to 15 seconds.
• The 10-minute “Session Expires” countdown doesn’t end anything when it hits zero.

Who gets paid?

The download button doesn’t go directly to the App Store. It first goes through a tracking link on taprkr[.]com. These links can be used in affiliate marketing to credit clicks and installs to whoever sent the traffic.

The link carries a label, “recosocial-cpr.” CPR can stand for “cost per registration,” a deal where a promoter earns money when someone signs up. That label alone doesn’t confirm how this offer pays.

The destination varied in our tests. The link led to an offer labeled “playful-rewards-revshare” on iPhone and an ad network on PC. A revshare (revenue share) deal usually pays the promoter a cut of what users later spend, such as on in-app purchases.

The tracking labels suggest that promoters may earn money from registrations or spending in promoted apps, but they don’t confirm how this offer pays. Users don’t receive the promised $750.

We have no evidence that Reco Social or any app at the end of these links is behind the fake Apple page. Deceptive affiliate promoters can send traffic to legitimate apps because they may earn money for installs or signups regardless of how users were persuaded.

The page also loads a TikTok tracking pixel, which advertisers use to measure campaigns. This could mean the operators are measuring traffic from TikTok, but it doesn’t show where the link was shared.

What’s the harm if it’s “just” an app install?

Compared to a page that steals passwords or card numbers, this one can look harmless. But you still pay a price:

• You give away personal data. Creating an account means handing over your email address, phone number or social login to a service you only signed up for because of a lie.
• You may be encouraged to spend. Many mobile games make their money from in-app purchases, and with a revenue-share deal, someone profits when you spend.
• You may be set up for the next scam. Fake reward offers often come in chains. The next one may ask for your Apple Account details, card number, or a “small processing fee.”
• You lose time chasing a reward that was never coming.

How to stay safe

Keep these points in mind if you come across an Apple Cash or other Apple-related offer online:

• Don’t expect an app install to pay you in Apple Cash. Be suspicious of any “Apple” offer that asks you to download a third-party app, create an account or play a game to receive Apple Cash or an Apple Gift Card.
• Verify Apple Cash only in Settings. The real identity check is in Settings > Wallet & Apple Pay > Apple Cash. Treat any website or message that asks you to “verify” Apple Cash somewhere else as suspicious.
• Be extra careful around launches and holidays. iPhone Duo deals, giveaways and preorder offers will keep circulating. Go to apple.com or the Apple Store app yourself instead of following links.
• Check the address bar. Apple’s website is apple.com. A page on a domain like applecashgiftcard[.]com is not Apple, however much it looks like it.
• Treat countdowns and “spots left” as red flags. Fake urgency is there to rush you past the moment you’d ask, “Why would anyone give me $750 for this?”
• Already installed an app from a page like this? You didn’t earn a reward, so you can delete the app. Delete any account you created through it, cancel any subscriptions in your App Store settings, and change that password on any other accounts where you reused it.
• Never pay with gift cards, and never pay to receive a prize. As the FTC puts it, “No real business or government agency will ever tell you to buy a gift card to pay them.” If a “reward” asks for a fee, your card details or gift card codes, it’s a scam.
• Report it. Apple asks people to forward suspicious Apple-themed messages to reportphishing@apple.com. You can also report the ad or post to the platform where you saw it and, in the US, report fraud at ReportFraud.ftc.gov.

How Malwarebytes helps

Malwarebytes can help block known scam pages. Use Browser Guard with a supported browser, or Web Protection in Malwarebytes for iOS when browsing with Safari.

If you’re not sure whether a link, text or offer is real, you can ask Malwarebytes Scam Guard before you click.

“One of the best cybersecurity suites on the planet.” 

According to CNET. Read their review →

Most malware needs you to click something. This one came in the box.

Google’s Threat Intelligence Group (GTIG) says it has high confidence that Android device maker Videostrong Technology built and ran the XCPE backdoor for financial gain. Videostrong sold access to criminal affiliates, who loaded their own malware modules onto the boxes.

GTIG found that the backdoor, called x.cpe (or com.oemservice in some builds), sits in the firmware with system-level privileges. If someone uninstalls it, it reinstalls itself from the /oem/ partition when the device reboots. It could also switch off Google Play Protect app verification, allowing it to install more software without asking.

Google says Videostrong got past its compatibility and security tests by loading the malicious code after the device’s first boot. This allowed the devices to remain part of the residential proxy network.

Residential proxy networks rent out ordinary home IP addresses to customers. That makes their traffic appear to come from a legitimate consumer connection rather than a data center. This can help cybercriminals evade IP-based fraud controls and reputation systems.

The problem for users

Here’s what the backdoored set-top boxes could mean for their owners:

• Your home internet connection could be used by others. Residential proxy modules routed other people’s traffic through infected boxes and their owners’ home IP addresses.
• Ad fraud. Modules generated fake ad views and clicks in the background.
• Spying and remote access to your device. Google observed operators capturing live screenshots, injecting keystrokes, collecting account and device information, and opening reverse shells.
• More malware. Some affiliate modules were backdoors that could load further modules.
• Your IP address could be linked to activity you didn’t start. Proxy traffic can include attempts to guess account passwords, for example, and may make your home IP address appear in connection with that activity.

How to stay safe

Google and its partners took legal action to take down the domains and servers Videostrong used to control the botnet. Google says it has banned Videostrong and its future subsidiaries and affiliates from making certified Android devices, and strengthened firmware integrity checks for certified Android TV devices.

The takedown only cuts the current connection to the malicious servers. It doesn’t remove the backdoor from infected devices, and can potentially be exploited by other criminals. If you think your box may be affected, disconnect it and contact the seller or manufacturer to ask for clean firmware or a replacement. Uninstalling the app won’t remove the backdoor from the firmware.

Google hasn’t published a complete list of affected models, so owners may not be able to tell from the model name alone whether their box is infected. If you decide to replace your box:

• Buy from a reputable manufacturer.
• Be cautious about “free TV” boxes. We’ve previously reported on Superbox and similar devices.
• Be cautious about apps that pay you to share your bandwidth. They can route other people’s traffic through your internet connection.
• Stick to trusted app stores and keep Google Play Protect switched on.
• Isolate the box. Put TV boxes and other IoT gear on a separate network or VLAN with restricted outbound access. This doesn’t keep the devices themselves safe, but it does keep other devices separate.

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Apple’s latest updates include a fix for a CoreGraphics bug that may have been exploited in targeted attacks. The fix is now available for older iPhones and iPads.

Apple released security updates on October 26. Apple first fixed the flaw in iOS 26.7.1. Its latest updates also bring the fix to older devices that can’t run iOS 26, including the iPhone XS, iPhone XS Max, iPhone XR, and seventh-generation iPad.

The iOS 18.7.11 update is a backport: it brings a fix from a newer software version to an older one. Here, Apple has made the fix available to older devices running iOS 18, so they can be protected without upgrading to an operating system they don’t support.

Updates for your particular device

The table below shows which updates are available and links to Apple’s security information for each one.

How to update your Apple devices

How to update your iPhone or iPad

For iOS and iPadOS users, here’s how to check if you’re using the latest software version:

Go to Settings > General > Software Update. You will see if there are updates available and be guided through installing them.

Turn on Automatic Updates if you haven’t already—you’ll find it on the same screen.

How to update your Mac

To update macOS on any supported Mac, use the Software Update feature, which Apple designed to work consistently across all recent versions. Here are the steps:

• Click the Apple menu in the upper-left corner of your screen.
• Choose System Settings (or System Preferences on older versions).
• Select General in the sidebar, then click Software Update on the right. On older macOS, just look for Software Update directly.
• Your Mac will check for updates automatically. If updates are available, click Update Now (or Upgrade Now for major new versions) and follow the on-screen instructions. Before you upgrade to macOS Tahoe 26, please read these instructions.
• Enter your administrator password if prompted, then let your Mac finish the update (it might need to restart during this process).
• Keep your Mac plugged in and connected to the internet until the update is done.

How to update your Safari browser

Safari updates are included with macOS updates, so installing the latest version of macOS will also update Safari. To check manually:

• Open the Apple menu > System Settings > General > Software Update.
• If you see a Safari update listed separately, click Update Now to install it.
• Restart your device when prompted.

Technical details

The headline bug is CVE-2026-86950, in CoreGraphics, Apple’s framework for drawing graphics, images and PDF content. It’s an out-of-bounds write flaw, where software writes data outside the memory set aside for it. The result is that “processing a maliciously crafted file may lead to arbitrary code execution.”

Apple says it is aware of a report that the flaw may have been exploited in an “extremely sophisticated attack against specific targeted individuals” on versions of iOS before iOS 27.

That wording indicates Apple believes the bug was used in real attacks against a limited group of users.

Usually, journalists, activists and officials are the targets of this kind of attack. If you think you could be a target of highly sophisticated spyware, you should update, restart your phone, and consider applying Apple’s Lockdown Mode.

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

As Android Central reports, users have received unexpected emails telling them their phone number has been verified for secondary Google accounts.

Like me and many others, you may have one Google account for everyday use, another for work, and a third for things you would rather keep separate. But if you’re using an Android phone, those accounts may have something in common that you didn’t intend or even know about: your phone number.

Google’s own documentation confirms that phone number verification is on by default and adds your number to all Google accounts signed in on the device. This applies to both existing accounts and any you add later.

Google says phone number verification helps support features such as signing in, account recovery, Rich Communications Services (RCS) messaging, and finding or securing a lost device.

But it also means that a number you intended to use with your main account can become associated with a secondary account simply because both are signed in on the same Android device.

If you deliberately left your phone number off a secondary account, this links it to your real identity without you knowingly making that connection. Your number doesn’t automatically become public, but Google gains another way to connect accounts you wanted to keep separate.

This reminded me of an article I wrote about unexpected Google account connections: “Google Play sign-ins can be abused to track another person’s movements.” Signing in to Google Play on one phone allowed me to see its movements in Google Maps Timeline.

“After some digging I learned that my Google account was added to my wife’s phone’s accounts when I logged in on the Play Store, but was not removed when I logged out after noticing the tracking issue.”

While that particular issue should be solved by Google’s move toward device-based Timeline storage, unwanted phone number associations need to be removed manually.

How to remove your number from separate accounts

Phone manufacturers arrange their settings differently, so there may be some differences in menu names and locations. We tried to make sure everyone can follow these instructions, but there might be makes and models where you get stuck. Feel free to ask in the comments and maybe others with the same phone can help you.

Step 1: Turn off automatic phone number verification

This needs to be done on the Android phone itself:

• Open the phone’s Settings app.
• Tap Google. On some phones, this may be called Google services or Google services and preferences.
• Open All services.
• Under Privacy & security, tap Phone number verification.
• Turn off Verify phone numbers automatically, or the equivalent verification switch shown on your phone.

Turning this off does not remove numbers already added to your accounts.

Step 2: Check which accounts already have your number

This step can be done in a browser, so should be the same for everyone.

• Open a browser and type myaccount.google.com into the address bar.
• Check the account picture or initial in the top-right corner. Make sure you are looking at the account you want to inspect.
• Select Personal info.
• Find Contact info, then select Phone. Depending on the layout, you may see Phone directly.
• Select any number listed to review its details and how it is used.

To remove the number from that account, select the delete icon and follow the on-screen instructions. Repeat for each account you want to check.

Step 3: Check for other uses of the number

There’s a wrinkle. Google says changing a number in your Google Account only affects some services. Other services, such as 2-Step Verification, may use the number separately and may not all appear on the Phone page.

On each account you are cleaning up:

• Check the number’s Usage section on the Phone page to see which services are listed.
• Visit Security or Security & sign-in and review your recovery phone and 2-Step Verification settings.
• If you use another Google service that has its own phone number settings, check those settings too.

If your goal is to remove the number entirely from a particular account, don’t assume deleting it from Personal info has removed every separate use. Check those security settings as well, but make sure to keep a working alternative sign-in and recovery method before removing the number.

Android Central reports that some users say automatic verification switches itself back on after they disable it. Those are user reports, not confirmation that this happens on every phone. But if you’re concerned, check the setting again later.

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Google has published security fixes for Android. The October updates are available for Android operating system versions 14, 15, 16, 16-qpr2, and 17 where “qpr” stands for Quarterly Platform Release. QPRs are interim updates Google pushes out between major yearly cycles.

These Android security bulletins contain valuable information for Android users. The updates are important as they fix several vulnerabilities rated as Critical, which can be exploited without users even doing anything.

However, we don’t write about them very often. The main reason for that lack of attention is that many Android users aren’t able to get the updates immediately and lots of others will never see them.

Google’s October fixes list Android 14 and newer, but a substantial share of the Android ecosystem still runs older software. In the distribution figures reported about last year, roughly four in ten devices were running Android 12 or earlier. This was while Android 13 still received updates which ended early March 2026.

And then there is the patch gap caused by device vendors meaning that even phones that remain supported may have to wait until the vendors test and sometimes modify the patches, so they work with their devices. And other vendors are on a different stride. For example, Samsung lists devices including the Galaxy S22 series and several Galaxy A models on a quarterly rather than a monthly security-update schedule.

You can imagine that cybercriminals love to get their hands on known vulnerabilities that many users have not yet been able to patch. Looking at the number of users that are unable to patch immediately that makes for an enormous target group.

How to stay safe

Get the updates as soon as they are made available to you is the most important word of advice here.

For most Android phones this is the general idea: open Settings, find Software update or System update (sometimes under System or About phone), check for updates, and follow the instructions to download, install, and restart. The menu names vary between vendors and even models, but the process is broadly the same.

If that doesn’t work for you or you can’t find instructions for your specific device, post what you’re looking for in the comments. We have lots of helpful readers.

Other things you can do:

• Use up-to-date real-time anti-malware protection.
• Refrain from sideloading unless it’s absolutely necessary.
• Make sure Google Play Protect is enabled. If you are a Malwarebytes Mobile Security user, you can check this using Trusted Advisor.

Should you decide to get a new Android phone, read our blog Upgrading your Android device? Read this first.

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Free Mobile, one of France’s main cellular providers, was fined €27 million by France’s data protection regulator, the CNIL, in January over failures to protect customer data. The October 2024 breach allowed an unauthorized party to access sensitive customer records, including bank account details and login information. Since the breach, we’ve seen many poorly written scam campaigns targeting Free Mobile customers.

However, over the past few weeks, a well-written scam has appeared, closely copying the design of the official Free Mobile website and email templates.

One of our employees, who is a Free Mobile customer, received this phishing email on Wednesday, September 30. The message used the same logo and template as legitimate emails from the company, but came from the suspicious email address freemobile-regularisation[@]knowledgegrowthcenter[.]help. It included a link that appeared to point to regularisation.free.fr :

The email tells the user that an invoice of €9.99 needs to be paid to avoid having the customer’s service suspended. Clicking the link opens a redirection chain:

1. https://u2l.ai/Q5YwFz301
2. https://espace-free-mobile.pro/Ds41LE/302
3. https://espace-free-mobile.pro/Ds41LE/regularisation/?impaye=92a9e77d…200

This final domain, espace-free-mobile.pro, is hosted by Cloudflare and was registered just a month ago.

The final link opens a convincing page with a form asking for credit card details:

The phishing page looks authentic, which sets this campaign apart from many of the Free Mobile scams we’ve seen since the breach.

We initially saw the same campaign using less convincing redirection chains, like this example from July:

1. https://bly.to/93kie5u
2. https://s1181402.ha026.t.mydomain.zone/mbl/
3. https://s1181402.ha026.t.mydomain.zone/mbl/regularisation/?impaye=505…

More recently, we’ve seen more authentic-looking domains, all hosted by Cloudflare:

1. https://s.ink/jmCnZZ
2. https://freesas.info/Cf4tP/
3. https://freesas.info/Cf4tP/regularisation/?impaye=f13fa919d1a22833557…

And another example:

1. https://bly.to/jabwpf6
2. https://regularisation-free.info/portail/
3. https://regularisation-free.info/portail/regularisation/?impaye=83f91…

How to stay safe

Malwarebytes can help protect you from these threats, but treat unexpected messages about your accounts and invoices with caution:

• Don’t follow links in unsolicited emails. If a message concerns your account, open the official Free Mobile app or website directly, or call the official help line at 3244.
• Check the actual domain in your browser’s address bar to see if it matches what you expect—https://mobile.free.fr in this case.
• Malwarebytes Browser Guard detects and blocks this scam directly in your browser.
• Use an up-to-date, real-time anti-malware solution with a web protection component on all your devices.
• Malwarebytes Scam Guard can help you determine whether an email is a scam and advise you on what to do next.

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

Over the last few days, Google issued several different Chrome updates.

On September 22, Google released a Stable Channel Update for Desktop. This is the most important one for desktop users. It brings Chrome to version 154.0.8037.57 for Linux and versions 154.0.8037.57/.58 for Windows and Mac. The update includes 108 security fixes including 11 rated Critical.

It will roll out over the coming days and weeks.

One day later, Google released Chrome 155 for Android, version 155.0.8059.16, to a small percentage of users. It may not be available on Google Play for everyone yet, but keep an eye out for it. Google says it includes stability and performance improvements.

On top of these, Chrome 155 is also available in the Beta channel. The Android release is an Early Stable rollout, meaning Google sends it to a small share of users first, to spot unexpected compatibility or reliability issues before expanding it to everyone. Beta is a separate prerelease version for people who want to try upcoming features roughly four to six weeks before Stable. It is relatively polished but can still contain bugs, so it is best suited to testing rather than everyday use.

How to update Chrome

The easiest option is to allow Chrome to update automatically. But you can end up lagging behind on updates if you never close your browser or if something goes wrong, such as an extension preventing the update.

If you don’t want to wait for the rollout to reach you, manually updating is easy. open About Google Chrome from Chrome’s settings or Help menu. Chrome will check for updates. If one is available, click Relaunch to apply it.

You can find an explanation of the version numbering system and step-by-step instructions in our guide: How to update Chrome on every operating system.

Technical details

Some of the desktop security fixes deserve a closer look.

Let’s start with CVE-2026-95350, a buffer overflow flaw in ANGLE, Chrome’s graphics-translation layer.

A buffer overflow is a bug in code that allows an attack to happen when a program puts more data into an area of memory than it can hold. Essentially, the attacker writes garbage data that fills up the memory, then writes code that overwrites existing code in adjoining memory, which later gets executed by the vulnerable process.

A crafted webpage could potentially trigger the flaw, which could lead to memory safety bugs, including browser crashes or possible code execution.

Another Critical buffer overflow bug in ANGLE is tracked as CVE-2026-95281. A malicious webpage could potentially reach vulnerable graphics-processing code, so the bug may enable serious impacts such as browser compromise, but Google has not provided exploitation details.

And then there is CVE-2026-95357, an out-of-bounds write in Chrome’s GPU component. This means a program could write data outside its intended area of memory.

The GPU component is the part of Chrome that handles how graphics work with your computer’s graphics processor.

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

Researchers at Zimperium’s zLabs have analyzed an Android Trojan that uses an automated, multi-stage infection process.

What’s new is that RatHat gives a live AI assistant the keys to the accessibility tree of the infected device and uses it to determine where to tap or scroll, rather than following a hardcoded script.

The variable attack path makes it harder for signature- and rule-based mobile security tools to detect this Trojan.

It also abuses Android Debug Bridge (ADB), a legitimate tool that lets a computer communicate with an Android device. By turning on Wireless Debugging, RatHat can escape the normal app sandbox.

The attack

The infection chain is unusually elaborate for a mobile threat, combining social engineering, accessibility abuse, and remote AI decision-making into a single pipeline.

• Victims are lured through smishing (SMS phishing) texts and malicious ads that lead to fake download pages, sometimes disguised as a popular streaming app or even a browser like Chrome. These pages trick people into sideloading a malicious APK (Android Package Kit).
• Once installed, the app pressures the user into enabling Android’s Accessibility Service, using a fake “network restriction” excuse or bogus financial incentive. Accessibility services run in the background and can inspect screen content and interact with apps on the user’s behalf.
• With accessibility access, the malware silently taps through Developer Options, turns on Wireless Debugging, and reads the six-digit pairing code straight off the screen. It then pairs with the infected device without a person or computer to complete the process. This is a known, legitimate Android feature (normally used by app developers to test on a phone over Wi-Fi) that RatHat repurposes for self-escalation.
• That self-pairing gives the malware a shell-level ADB session, which it uses to drop two disguised native binaries: A Go-based “agent” that runs system commands with elevated privileges, and a reverse-proxy client that opens a persistent tunnel back to the attacker’s server, bypassing firewalls and NAT (Network Address Translation).
• To steal login credentials, the Trojan creates overlays for targeted apps, most of which are financial. These overlays can also steal one-time passwords (OTPs) and multi-factor authentication (MFA) codes.
• Perhaps its most novel capability records raw touch coordinates (where the finger touches the screen) directly from the input driver. It then matches those coordinates against a database of known keypad and pattern-lock layouts to reconstruct PIN codes and unlock patterns, completely bypassing protections against screen-reading.

Other capabilities include intercepting SMS messages, a form of semi-autonomous device control provided by the AI service, and the ability to restore the malicious app after it has been uninstalled using a hidden background program.

How to stay safe

Most of RatHat’s tricks depend on convincing someone to sideload an app and grant it accessibility permissions, which means the usual mobile security advice remains the strongest defense.

• Only install apps from Google Play or another trusted official store. This does not guarantee safety, but it significantly reduces the risk.
• Be suspicious of any app that asks you to enable Accessibility Service for reasons unrelated to accessibility. Consider Android’s Advanced Protection Mode, which Google has started using to restrict which apps can request accessibility permissions in the first place.
• Never enable Developer Options or Wireless Debugging unless you understand why you need them. Legitimate apps have no reason to ask for them.
• If you already use Malwarebytes Mobile Security on your Android, you are protected. Our Text Protection feature will have helped prevent you from tapping the link in the first place. We also detect this threat as Android/Trojan.Exploit.RatHat. If you don’t use it yet, get Malwarebytes Mobile Security here.

If your device is infected with RatHat, you will need to perform a factory reset because its persistence mechanism can survive normal app removal.

Since early May 2026, we’ve been monitoring a large phishing campaign based on T-Mobile rewards points.

The messages falsely warn that a customer’s rewards points are about to expire. They aren’t legitimate account notices: They use urgency, invented point balances, and phishing links to push recipients into acting before they can verify the claim.

A typical message says that a T-Mobile Rewards account holds 18,400 points, gives an imminent expiry date, and states that unused points will be removed under the program’s terms. These details make the message look as though it was written specifically for the recipient, even though it was sent to many people.

“T-Mobile Rewards Points Reminder: Your Points Are About to Expire

Dear Customer,

We are hereby reminding you that your T-Mobile Rewards account points are about to expire. You currently have 18,400 points, which will expire on June 4, 2026, if unused.

Your Points Overview:

Current Balance: 18,400 Points

Expiry Date: {today or tomorrow}

Points will not be recovered after this date.

Redeem Points:

Visit:

https://t-mobile.{rotating domains}.top/pay

Use the T-Mobile App: Account > Rewards & Benefits

Our points expiry policy aims to ensure the fairness of the program and encourage active participation. Please don’t let these valuable points go to waste.

Thank you for choosing T-Mobile.

Customer Service Team”

This phishing operation does not rely on a single, identical SMS. We found more than 1,000 closely related campaign templates with a semantic similarity score of at least 0.60. The 199 closest matches all scored at least 0.95.

This means the variations only change superficial elements, such as the salutation, headline, expiry date, point balance, and whether the message is called a “reminder,” “alert,” or “important update.” The central story remains the same: T-Mobile rewards points are supposedly expiring, and the recipient must follow a link to redeem them as soon as possible.

The messages use formal but generic language, such as “Dear T-Mobile Customer,” “Dear Valued Customer,” or “T-Mobile User,” rather than naming the recipient or providing verifiable account information.

The campaign began slowly before producing two huge spikes in activity. The green line shows detections of message variants seen previously, while the red line shows messages detected on the first day that particular variant appeared. We’re still seeing messages from the campaign, although activity has fallen considerably since those spikes.

The scam relies on a familiar social engineering formula: a valuable-looking reward, a deadline, and a simple action that supposedly protects the customer from losing out. A recipient who has a T-Mobile account may click first and question the message later.

The links use rotating domains designed to look as though they belong to T-Mobile. Their purpose is to persuade recipients to follow the link to supposedly redeem their points. Do not enter login credentials, personal information, payment details, or verification codes after following a link in an unsolicited message.

How to stay safe

The anonymized data used in this analysis was gathered through Text Protection in Malwarebytes Mobile Security, which alerts users to potentially malicious or scam text messages. 

You can also reduce your risk by following these tips:

• Don’t follow links in unsolicited messages. Instead, open the alleged sender’s website or app independently and check for notifications there.
• Check the domain in your browser’s address bar to make sure it matches the site you expected to visit.
• Use an up-to-date, real-time anti-malware solution with web protection.
• Malwarebytes Scam Guard can help you determine whether a message is a scam and advise you on what to do next.

The URLs in this campaign are very short-lived. The criminals used at least 81 domains over four months, but the domains follow a recognizable pattern that is blocked in Malwarebytes Browser Guard.

IOCs

Example domains showing the pattern used by the campaign:

t-mobile.biktpw[.]top

t-mobile.cugbjl[.]top

t-mobile.cymfjd[.]top

t-mobile.gdikxv[.]top

t-mobile.hdzcnb[.]top

t-mobile.koxetp[.]top

t-mobile.nxdcfp[.]top

t-mobile.pkrbai[.]top

t-mobile.qfrhkt[.]top

t-mobile.qscizj[.]top

t-mobile.tmfncb[.]top

t-mobile.vmnqsu[.]top

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

Google has released its September 2026 Pixel Update Bulletin, fixing 110 vulnerabilities, including one that it says “may be under limited, targeted exploitation.”

The bug is not described as a simple remote takeover, but as a vulnerability that could give an attacker who already has a foothold on a phone more power than they should have.

Although Pixel devices also run Android, they receive separate security updates and bug fixes from the standard monthly patches distributed to Android manufacturers because of the unique hardware platform Google controls directly and its exclusive features and capabilities.

To apply this month’s security updates, Pixel users should go to Settings > Security & privacy > System & updates > Security update, tap Install, and restart their device to complete the update process.

A supported device with the 2026-09-05 patch level is up to date. After updating, check that the Android security update level shows September 5, 2026, or later.

Technical details

Google says it there are indications that the vulnerability, tracked as CVE-2026-58704, may be under limited, targeted exploitation. Found in the cellular modem, it is a possible permission bypass caused by a logic error in the code. This could lead to remote escalation of privilege (EoP) with no additional execution privileges or user interaction needed.

The vulnerability affects the modem component of Pixel devices and is rated high severity. The modem is the part of a smartphone that handles communication with mobile networks. It allows a phone to connect for calls, texts, and mobile data. Because it is such an important component, a flaw affecting it deserves attention, even if the conditions needed to exploit it limit the number of potential victims.

The vulnerability does not mean every unpatched Pixel can be hacked from anywhere on the internet, nor has Google said that simply being within wireless range of a phone is enough. The available information indicates that an attacker needs access to an adjacent network and basic privileges on the targeted device, but it does not explain how those privileges are obtained.

Attackers commonly need more than one step to compromise a well-protected device. One weakness may give them a limited foothold, while another lets them escape restrictions and gain access to more sensitive functions or data.

This is why bugs like this can be especially useful in targeted operations. An attacker may combine the modem vulnerability with another exploit, a malicious app, stolen credentials, or physical access to the device. Each part of the chain brings the attacker one step closer to compromising the device: getting in, gaining more privileges, and accessing the information or functions they’re after.

While Android users should always install the latest update offered by their device manufacturer, this particular zero-day appears in the Pixel-specific bulletin. Google’s Pixel phones use hardware and software components that other Android manufacturers do not necessarily share, including the affected modem component. If you have another Android brand, you won’t receive this specific Pixel fix, but you should still check for your manufacturer’s latest monthly security update.

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Download for iOS → Download for Android → 

Researchers at Group-IB found that the Android banking Trojan Gigabud can create a separate work profile on an infected phone and run a cloned banking app inside it. The attacker can then carry out fraudulent transactions in the new profile, potentially separating them from signs of malware detected elsewhere on the device.

To do this, Gigabud installs Vwork, a malicious version of the legitimate open-source tool Shelter. Shelter normally lets Android users isolate apps or run second copies of them in a work profile. Vwork modifies those functions so that Gigabud can control them remotely.

The aim is to clone a target banking app into the new work profile, then let the operator commit fraud there. Group-IB says this can break the connection between malware detected in the personal profile and a risky transaction originating from the work profile, potentially weakening bank-side anti-fraud or in-app malware-detection systems that do not correlate activity across Android profiles.

Android work profiles are normally used to keep work apps and data separate from personal ones. Because apps in different profiles are isolated from each other, a banking app or security tool may not connect malware detected in the personal profile with something taking place in a cloned app in the work profile.

How an attack works

Victims are lured into sideloading a fake airline, tax, or government app through phishing sites, messages, or social media.

To take over the device, Gigabud asks for Accessibility access, overlay permission to display over other apps, and an exemption from battery-optimization. These permissions enable remote interaction and credential-theft techniques such as overlays.

The sideloaded app checks which other apps are installed and tells the operator which relevant banking targets are present.

Fake banking-login overlays steal both banking credentials and the device’s PIN.

The operator installs Vwork, which creates a new work profile on the device and clones the selected banking app. Vwork differs from Shelter in ways that make it useful to malware. It removes protections on cross-profile interaction, exposes components that can be used to set up a profile, clone and list apps, and open apps, and hides its launcher icon.

The operator can then remotely carry out transactions from the newly created profile, with the option to hide activity behind a black screen.

This is how Gigabud turns Android’s profile separation into a fraud tool: after compromising a phone, it creates a second profile, places a cloned banking app inside it, and performs the transaction from there. The result can be a dangerous gap between a malware alert in one profile and a fraudulent banking session in another.

How to stay safe

The immediate protection advice is familiar but important:

Sideloading. Install banking and other apps only from the official store or a direct link to the publisher’s website.

Install requests. Treat unsolicited requests to install an APK as a likely scam. If you’re unsure whether something’s a scam, run it through Malwarebytes Scam Guard.

Permissions. Do not enable Accessibility or “display over other apps” for a supposed airline, tax, delivery, or government app. Overlays require explicit user approval on modern Android, so a request like this is a red flag.

Protection. Use an up-to-date real-time anti-malware solution for your Android devices. Malwarebytes detects components of Gigabud as Android/Trojan.Banker.ACR577B2BA2H61, Android/Trojan.Banker.ACRF6CE8D30H46, Android/Trojan.Banker.ACR6C67829FH20, Android/Trojan.Banker.SIB02FFFFFF1112H106, Android/Trojan.Banker.SIB0181193e44H71, Android/Trojan.Banker.AUR2f2f4fb5C95, and Android/Trojan.Spy.Gigabud.xc.

Anyone who has installed a suspicious APK and granted it Accessibility access should contact their bank through a trusted channel, revoke the app’s special permissions, uninstall it, and consider a factory reset after preserving only known-good data.

A second instance of a banking app merits particular scrutiny. A separate work profile by itself is not proof of compromise because work profiles also have legitimate uses. But the presence of a cloned banking app definitely is suspicious.

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Download for iOS → Download for Android → 

WhatsApp announced on August 25 that more than one billion people now use passkeys to log back into the app.

The announcement included two other security upgrades: a stronger two-step verification method and more context for incoming calls from unknown numbers. It marks one of the largest passwordless authentication rollouts to date. Passkeys are now firmly mainstream, with the FIDO Alliance estimating that 5 billion are in use worldwide and 75% of consumers have enabled one on at least one account.

Three things changed:

1. Passkey support originally launched on Android and later extended to iOS. WhatsApp now supports multiple passkeys per account, so people who switch between an Android phone and an iPhone (or use both) can register a passkey on each device.
2. Two-step verification is moving from a simple six-digit PIN to a longer alphanumeric password that can include special characters, making it much harder to guess or brute-force.
3. On Android, WhatsApp now shows extra context about calls from numbers not saved in your contacts, including whether the number is from another country and whether you share any groups. It’s a small but useful nudge against the urgency tactics scammers rely on.

Passkeys are resistant to phishing because there is no password or SMS code to type into a fake website or hand over to a scammer. Instead, a passkey is stored on your device or in its credential manager and unlocked using your fingerprint, face, or screen-lock code. They’re also useful in regions where SMS one-time-passcode delivery is unreliable, which might explain why adoption reached a billion users so quickly.

The upgraded two-step verification password closes a real gap. PINs such as “123456” were common, weak, and reused, and a longer alphanumeric password with special characters raises the bar against account-takeover attempts, even if an attacker somehow obtains your one-time code.

The caller-context feature gives people more information to assess legitimacy before answering an unfamiliar number.

Don’t recognize that number? We’ll check it.

CHECK NOW

What WhatsApp users need to do

Users need to set up a passkey and upgrade their two-step verification password, while the caller-context feature will appear automatically on supported Android devices:

• Set up a passkey via Settings > Account > Passkeys, and follow the instructions on your device. Don’t forget to add a second one if you use both an Android and an iOS device.
• If you still use a six-digit PIN for two-step verification, upgrade to the new password format when it becomes available, especially if your PIN is predictable. You can find instructions to set up two-step verification for WhatsApp in this blog. If it’s already enabled, select Two-step verification to find the option to change your PIN.
• Add a recovery email to two-step verification if you haven’t already. It’s the only way to reset the password if you forget it.
• Android users should pay attention to the new caller-context details before answering calls from unknown numbers, treating urgency as a red flag rather than a reason to rush.

Passkeys and stronger two-step verification aren’t retroactive or forced, so accounts still relying on an old PIN or no passkey at all will remain unchanged until users upgrade them.

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Download for iOS → Download for Android → 

iPhone users are being targeted in a new tech support scam, using a fake Apple Pay notification to trick users.

Tech support scams that use fake warnings to push victims into calling a phone number have been around for years, but this page has been designed specifically for phones.

Instead of a desktop warning claiming your computer has a virus, the scam imitates familiar iPhone features in an attempt to scam you.

What happens

A page opens on your phone and appears to show Apple Pay processing a $657 App Store payment. A spinner turns. “Face ID · verifying identity” appears beneath the amount. There is a transaction ID, a padlock, and all the visual cues of a payment in progress.

A few seconds later, the story changes.

You get an alert saying your Apple ID is locked because of an unrecognized sign-in. A phone number appears under the instruction to call Apple Support immediately. When you open the transaction details, the payment is marked “Completed.” Then your phone begins speaking an alert about the unauthorized charge.

It’s all completely made up.

The page we analyzed contains no real Apple Pay transaction and no biometric verification. Instead, it uses hardcoded payment details, browser-generated speech, fake security warnings, and aggressive navigation tricks to get the victim to call the scammer.

The “Face ID” check isn’t real

The first screen is designed to make it look as though the phone itself is authorizing a payment.

In this sample, “Face ID · verifying identity” is simply an HTML element displayed beside an icon. There is no Apple Pay request and no biometric-authentication call behind it.

Apple Pay can legitimately be used on websites, but a genuine payment begins when the merchant requests it. The system then immediately displays a payment sheet for the user to review and authenticate, as Apple’s guidelines specify.

Nothing like that happens here. The scam page has simply drawn its own imitation.

The “Processing payment” spinner is equally cosmetic. The entire splash screen disappears on a timer after 2.8 seconds, regardless of anything the user does.

The receipt is fake, and the code is the same for everyone

The next screen is dressed up as a transaction receipt. It contains an amount, masked card digits, an authorization code, a transaction ID, and a green “Completed” status.

Most of those values never change.

That’s because the page hardcodes the amount as $657.00, the transaction ID as AP-2026-08-03-14:32, and the authorization code as AUTH-8F3A2B1C. Every visitor is shown the same values.

The date, however, is generated dynamically.

JavaScript calls new Date() and formats it with toLocaleString(), meaning the receipt uses the current date, time, and timezone from the victim’s device.

That creates an obvious contradiction. The fixed transaction ID contains 2026-08-03, while the date field shows the time and date when the victim happens to open the page.

A genuine transaction doesn’t rewrite its transaction date every time somebody looks at it.

The “voice alert” is generated by the browser

Once the victim opens the transaction details, the page attempts to speak:

“Unauthorized charge of six hundred fifty seven dollars from your Apple ID. Please call support immediately.”

There is no recorded Apple message behind it.

The JavaScript creates a SpeechSynthesisUtterance and sends it to window.speechSynthesis, the browser’s built-in Web Speech API to read the warning aloud.

Using a text-to-speech voice already available on the victim’s own device is a clever social-engineering touch. The warning may sound more like part of the phone itself than audio playing from a random website.

The page tries to make leaving difficult

One interesting part of this scam is the code surrounding the exit routes.

The page adds a new browser-history entry and listens for popstate, allowing it to react when a victim tries to navigate backward. It then displays a warning claiming that closing the page could expose the victim’s payments and banking information.

If the victim accepts the prompt to call support, the code navigates to a tel: URL containing the scam number. If they cancel that particular prompt, another warning appears and another history entry is added.

The page also registers handlers for beforeunload, pagehide, the context menu, an edge-swipe gesture, and common keyboard navigation shortcuts. On iOS, its pagehide handler even makes a delayed attempt to navigate directly to the telephone number.

These tricks can make the page persistent and annoying, but they don’t lock the browser or device. Modern browsers restrict what websites can do during navigation. For example, beforeunload isn’t reliably triggered on mobile, generally requires prior user interaction, and can only produce a generic browser-controlled confirmation.

In other words, the code tries several ways to stop you leaving or get you to call, but it can’t take control of the browser itself.

The phone call is the real objective

The $657 charge is bait to get you on the phone.

The support number appears prominently on the page, the red “Verify now” button points to it, and the fake security prompts repeatedly offer to dial it.

This is a well-established tech support scam tactic. The FTC warns that scammers use bogus charge notices to get victims to call, then may request remote access or pressure them into sending money through gift cards, bank transfers, cryptocurrency, or payment apps.

Apple also warns that scammers may claim someone has broken into your Apple account or made unauthorized Apple Pay charges, using urgency to stop you from contacting Apple independently.

What to do if you see a page like this

There is a simple clue worth remembering:

A security pop-up that manufactures an emergency and tells you to call the phone number displayed on the screen should be treated as a scam.

If an Apple Pay–like interface appears inside a website, remember that visual resemblance proves nothing. A site can freely mimic buttons, locks, logos, transaction IDs, and even animated spinners. What matters is whether a genuine Apple Pay payment sheet has actually been invoked.

In this case, it hasn’t. The important part of this scam is not the fake $657 payment. It is the urgency built around it to get the victim onto a call.

• Don’t tap OK, Call, or Verify. Anything you tap on the screen will either call the number or bring up another warning.
• Don’t dial the number, and don’t call it back later to complain or to check.
• Close the tab using your browser’s tab switcher. On iPhone or Android, open the tab switcher and swipe the tab away. Once the tab is closed, the scam page can no longer keep you there or try to make the call.
• If a dialog appears asking whether to leave the site, choose Leave. Web pages can ask you to stay, but they cannot stop you from leaving.
• If in doubt, check your real purchase history. Open the App Store or Settings on your device and review your Apple purchase history. If there’s no $657 charge there, there was never a charge.

If you already called and gave someone remote access to your device, take action immediately:

• Disconnect from the internet
• Uninstall any remote access software they had you install
• Change your Apple ID password and your bank passwords from a different device
• Contact your bank about any payments you sent.

Check if something is a scam

If a number like this one is on your screen or already in your call history, check it before you do anything else. Malwarebytes Scam Number Check is a free way to see whether a number has been linked to scam activity. Just put the number in and we’ll tell you if it’s likely to be a scam.

Got a screenshot or URL of a suspected scam? Upload it to Scam Guard—built in to Malwarebytes Mobile Security—and you’ll get a verdict and safety tips in seconds.

Phishing pages don’t need to be sophisticated. They just need to look convincing enough to make you trust them.

TikTok phishing often starts with an email or message designed to make you think you need to act on your account. It might claim your account has been suspended, reported, or hit with a copyright violation, or tell you that you’re eligible for verification.

The link might take you directly to a page made to look like TikTok’s login screen. If you enter your information, it can be sent straight to the scammers, including your phone number or email, password, and potentially a one-time authentication code.

With access to your account, scammers could impersonate you, target your contacts, or try to use the same password to break into your other accounts.

What to do if you get a suspicious TikTok message

If you get an unexpected email or message telling you to log in to TikTok, don’t use the link it provides. Open the real TikTok app or go directly to tiktok.com instead and check your account there.

If you’ve already entered your login information on a suspicious page, change your TikTok password immediately and check for any devices or login activity you don’t recognize.

Fake warnings and verification offers

Not every TikTok phishing link leads directly to a fake login screen. Some try to scare you with claims that your account has been suspended or reported, or that you’ve received a copyright or community-guidelines strike that needs “resolving.” Others offer something you might want, such as a verified badge, creator payout, or brand deal.

For example, a fake TikTok Verification Center might congratulate you on your performance and tell you that you’re eligible for a verified badge:

Another fake verification page asks for account information as part of a supposed verification request:

Whether the message threatens you with a problem or promises you a reward, the aim is the same: to persuade you to interact with a fake TikTok page and hand over information.

Why these TikTok scams work

Fake TikTok pages can look convincing because copying the appearance of a real website is relatively easy. But the story that gets you there is just as important.

Suspension and copyright warnings create urgency. Verification and monetization offers create an incentive. Both give you a reason to act quickly instead of stopping to check where the link has actually taken you.

How to protect your TikTok account

• Don’t use links in unexpected emails or messages asking you to log in to TikTok. Open the TikTok app or go directly to tiktok.com instead
• Treat any message about a suspension, strike, or verification eligibility as unverified until you’ve confirmed it inside the TikTok app itself
• Check the address bar before entering your login information. Make sure you’re actually on tiktok.com—a fake page can look almost identical to the real thing
• Use a password manager where possible. It won’t auto-fill your TikTok password on a different domain, which is a useful warning sign
• Turn on two-factor authentication (2FA) on your real TikTok account so a stolen password alone isn’t enough to get in
• If you’ve already entered your login information on a page like this, change your TikTok password immediately and check for any login activity or devices you don’t recognize
• Use Malwarebytes Mobile Security to help block phishing and malicious websites on your phone

Whatever story the message tells you, don’t use its link to log in. Open TikTok yourself and check your account there.

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Download for iOS → Download for Android → 

Researchers have uncovered ToxicPanda 2.0, an Android banking Trojan and remote-access tool designed for account takeover and “on-device fraud.”

Not only does ToxicPanda 2.0 have a much larger target list of banks and e-wallets, it has also expanded its capabilities by combining banking overlays, remote access, PIN capture, Android accessibility abuse, and attempted Wireless Debugging automation. Together, those functions can help operators turn a compromised phone into a platform for account takeover, financial fraud, and longer-term device control.

The core objective is on-device fraud. That means that rather than logging in from an attacker-controlled machine, the operator can carry out actions from the victim’s infected phone, taking over the device, IP address, app session, and behavioral context that banks may use when deciding whether a transaction is fraudulent.

ToxicPanda 2.0 is built around abusing Android’s Accessibility Service, a legitimate feature intended to help people interact with their devices. When a victim grants this permission to a malicious app, the malware can inspect interface elements, observe app activity, automate interactions, and place deceptive content over legitimate apps, known as overlays.

ToxicPanda has historically relied on social engineering to persuade users to sideload a malicious Android application rather than install it through Google Play. The latest campaign uses Amazon AWS-hosted buckets to deliver ToxicPanda 2.0 samples.

After installation, the dropper presents a fake installation flow, requests VPN privileges, blocks certain Google Play and Google Play Services network communications, decrypts an embedded payload, and then seeks Accessibility Service permission for the installed payload.

The consequences can include stolen banking usernames and passwords, intercepted or captured PINs, fraudulent transactions, loss of access to the device, and exposure of the phone’s screen-lock secret. An attacker that can operate inside an active banking session from the victim’s device may have a better chance of evading controls designed to identify unfamiliar devices or unusual login locations.

How to stay safe

However sophisticated it is, ToxicPanda 2.0 still relies heavily on social engineering to get targets to install the malicious app and give it the permissions it needs. So our main recommendations are:

• Avoid sideloading apps, especially from links in unsolicited messages, ads, or alleged support communications.
• Treat requests for Accessibility access, Device Administrator privileges, developer settings, and VPN permissions with particular caution, especially if it’s not clear why the app needs those permissions or if you don’t fully trust it.
• Use an up-to-date, real-time anti-malware solution for your device that can detect and block the malicious payload. Malwarebytes for Android detects apps in the ToxicPanda 2.0 campaign as Android/Trojan.Dropper.agent and Android/Trojan.FakeApp.ACR2401245FC11.

If your device is infected

Although it may require a factory reset to regain control of an infected device, there are some things you can try first:

• First, put the phone in airplane mode and turn off Wi-Fi and Bluetooth. This can cut off command-and-control communications and ongoing credential theft while you investigate.
• Use another device to freeze or closely monitor transactions, revoke active sessions, and reset your banking credentials.
• Do not interact with fake “system update” screens or unexpected prompts for Accessibility, VPN, Device Administrator, Developer Options, or Wireless Debugging.
• Start Android Safe Mode. Google recommends Safe Mode to help identify problems caused by downloaded apps. Remove recently installed or suspicious apps one at a time, reboot normally, and see whether the problem returns.
• Remove Accessibility access first. In Settings > Accessibility > Installed apps/Downloaded apps, disable any service you do not recognize. Focus on recently installed apps or anything pretending to be an update, system component, security tool, document viewer, or bank helper.
• Next, check Device Administrator rights. Go to Security & privacy > More security settings > Device admin apps and disable any unrecognized administrator before attempting removal. An app with Device Administrator privileges can make the Uninstall control unavailable.
• Then check your VPNs. Go to Settings > Network & internet > VPN or search Settings for “VPN,” and delete any VPN profile you did not deliberately install. The ToxicPanda dropper uses VPN permission as part of its reported Google Play and Google Play Services blocking process.
• Disable dangerous developer functionality. Search Settings for Developer options, turn it off entirely, and make sure Wireless debugging and USB debugging are off.
• Remove all the suspicious apps you found. Go to Settings > Apps > See all apps, enable Show system apps if necessary, then locate recently installed or unfamiliar apps. Force stop the suspicious app, clear its storage, and select Uninstall. If an app has a generic name, blank icon, odd install date, or was installed outside Google Play, treat it as suspicious. 
• Reboot normally after removal, then re-check Accessibility, Device Administrator, VPN, and Developer Options. Also review the installed-app list for a second suspicious package, since the reported campaign uses a dropper to decrypt and install its payload.

Please note: The given paths in Settings may differ depending on your device manufacturer or Android version.

If you’re having trouble removing ToxicPanda manually and you can’t install or update Malwarebytes, please reach out to our Support team. They can walk you through the process.

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Download for iOS → Download for Android → 

A Google spokesperson announced on Reddit that it has started rolling out the first version of its Advanced Flow, designed to make installing apps from unverified developers safer.

Let us explain what sideloading is, why Google Play is not 100% safe, what to look for when you’re sideloading so you can do it more safely, and how Google’s Advanced Flow helps with that.

What is sideloading?

Sideloading lets Android users install apps from outside Google Play. It can be useful, but it also creates opportunities for scams and malware.

Android’s openness is one of its enduring strengths. You are not limited to a single app store: You can install apps from a developer’s website, an alternative marketplace, an enterprise portal, or a file shared directly with you.

That is called sideloading. It is not automatically dangerous, but it removes some of the guardrails that come with conventional app-store distribution. Getting apps from the Google Play Store itself is no guarantee of safety, but there is at least some vetting. Google says it blocked more than 1.75 million policy-violating apps from being published in 2025 and banned more than 80,000 developer accounts associated with harmful apps.

There are several reasons for sideloading:

• The developer distributes an app directly from its own website
• An app is unavailable in your country or on Google Play
• An alternative app repository offers what you’re after, for example open-source software
• You need an enterprise, beta, or specialized app
• You want to install a version that is not currently offered through Google Play

But malware authors and online scammers use the same flexibility. They may impersonate banks, delivery services, government agencies, crypto platforms, news readers, or job recruiters, then urge victims to install an app to “secure” an account, receive a payment, or resolve an invented problem.

Google Play is not a free pass

Google Play has review processes, policy enforcement, developer controls, and Google Play Protect. It also runs ongoing checks after an app is published. Those measures meaningfully reduce risk, but they do not make every listing harmless or every developer trustworthy.

Threats that can still surface through official channels include:

• Trojans disguised as useful utilities, games, or financial apps
• Adware and apps that misrepresent their behavior
• Subscription traps and deceptive billing practices
• Data-harvesting apps that request more access than they need
• Sleeper apps that change behavior after passing an initial review

Google Play Protect checks Play Store apps before download and also scans apps from other sources. It can warn about, disable, or remove potentially harmful apps, but it should be viewed as one layer of security, not a substitute for scrutinizing an app before installing it.

Mobile protection, anywhere, anytime.

Try it now

In short, “available on Google Play” is a positive signal, not a security verdict.

Why sideloading requires attention

The main difference between installing from a recognized store and downloading an APK from elsewhere is not simply the file format. It is the trust chain.

When you sideload, you may have fewer assurances about:

• Who created the app
• Whether the file has been altered or repackaged
• Whether the download site is impersonating a legitimate developer
• Whether you will receive genuine updates
• Whether a scammer is manipulating you into disabling security protections

Social engineering is often the decisive factor. A convincing caller, pop-up, text, or chat message may insist that installing an app is urgent. The attacker’s goal is often to make the victim bypass warnings before they have time to question the request.

Treat any unexpected request to install an app as suspicious, especially when it comes with urgency, secrecy, a promise of money, or a claim that your bank, government, employer, or device provider requires it.

A legitimate bank, government agency, law-enforcement organization, or technical-support provider should not call or message you and instruct you to install an APK or weaken Android security settings.

How to sideload more safely

Sideload only when you have a specific reason for it, and make sure the decision came from you rather than an unexpected message or phone call.

• Start at the developer’s official site. Don’t use sponsored search results, random download portals, links sent by strangers, or lookalike domains.
• Verify the developer independently. Check the publisher’s official website, documentation, public code repository, and trusted community channels. The information supplied on the download page alone is not enough.
• Prefer established repositories. If an app is distributed outside Google Play, use a source with a strong reputation for provenance and signature verification where possible. For advanced users, it can be useful to compare an APK’s signing certificate or cryptographic hash against a value published by the developer. That is not practical for everyone, but it can help detect fakes.
• Do not install apps under pressure. End the call, close the chat, and independently research the claimed organization using contact details you find yourself.
• Keep Google Play Protect enabled. It scans apps during installation and periodically afterward, including apps installed from outside Google Play.
• Review permissions before and after installation. Be especially cautious if a simple app wants access to accessibility services, SMS messages, notifications, device administration, contacts, or screen recording.
• Keep Android and apps updated. Security fixes can protect against both operating-system flaws and known malicious app behavior.
• Use reputable mobile security software. A separate security layer can help identify risky behavior and provide additional visibility into potentially unwanted or malicious apps.
• Remove permissions and uninstall apps you no longer trust or use. An app that seemed harmless at installation can become a liability if its developer abandons it or changes direction.

How Google’s new Advanced Flow helps

Google is rolling out Advanced Flow for installing apps from developers that have not completed Android’s new identity-verification process. The feature is intended for users who understand the risks of installing unverified software but still need that flexibility.

The design is notable because it targets social-engineering attacks as well as malware. Instead of allowing an immediate, one-tap override, the flow requires users to:

• Enable developer mode in system settings. This is easy enough and helps prevent accidental or one-tap bypasses often used in high-pressure scams.
• Complete a quick safety check to make sure that no one is talking you into turning off your security. Scammers often pressure victims into disabling protections.
• Restart your device, which cuts off any remote access or active phone calls a scammer might be using to guide you.
• Wait one day, then confirm the change using biometrics, such as fingerprint or face unlock, or your device PIN. This one-time, one-day delay breaks the urgency scammers rely on, giving you time to think.

Once you have completed the process, you can choose to allow installs from unverified developers for seven days or indefinitely.

Advanced Flow does not mean Google Play is risk-free, nor does it make unverified apps inherently malicious. Developer verification establishes accountability: It connects an app to a verified developer identity, but it does not establish that every app is benign or suitable for every user.

At the end of the day, it’s up to you. Install apps because you chose them after checking the source, not because someone else manufactured an emergency.

Whether an app comes from Google Play or an external source, pause before installing. Check who made it, why it needs the permissions it asks for, whether the download route is trustworthy, and refuse when a stranger is trying to rush you. That little friction is a feature, not just a nuisance.

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Download for iOS → Download for Android → 

Most wrong-number texts are harmless. Some are the first step in a carefully planned scam. By replying, you may be confirming that your number is active and that you’re willing to engage with strangers, making you a more valuable target for future fraud. Here’s why a polite response can be worth money to cybercriminals. 

The politeness trap 

Sunday night. You’re on the couch, half-watching Netflix, when your phone buzzes. 

“Hey! Are we still on for dinner tomorrow? Don’t forget the wine ” 

You don’t recognize the number. You glance at it for two seconds, then type what most polite people would: 

“Sorry, I think you have the wrong number!” 

You put your phone down. Go back to Netflix, and forget about it within five minutes. 

On the other end, though, your reply has just told the sender something valuable. Not because of a technical exploit or an invisible cyber-attack, but because you just proved you’re the kind of person who responds to strangers politely. 

According to cybercrime intelligence reports, responsive phone numbers are worth significantly more than inactive ones. With a single reply, you’ve entered a global criminal ecosystem run by transnational syndicates that, according to analysts, moves tens of billions of dollars.  

What your reply told them 

Let’s be clear: the “wrong number” text is not a phishing link. It’s not malware. In many cases, it’s not even the scam itself. It’s a personality test. 

The scammers already have your number. They may have bought it in bulk from a data breach for a fraction of a cent per record. They already know the message was delivered because their SMS gateway received no delivery failure. Text messages remain one of the most effective ways to reach people, with exceptionally high open rates and most being read within minutes. That’s one reason scammers prefer SMS to email. 

What they don’t know is whether you’re worth spending more time on. Your reply told them three useful things:  

1. You’re responsive. You saw the message and felt compelled to reply. This immediately places you in their top 15–20% most active numbers category.  
2. You’re polite. You didn’t ignore it and didn’t respond aggressively. You wanted to help a stranger. Scammers deliberately exploit that instinct to be polite and helpful.  
3. You reply quickly. The time between their message and your reply can reveal how closely you monitor your phone, help estimate your timezone, and indicate how likely you are to respond to future messages.

The two paths your number takes 

From this moment, your story splits. Both paths described below play out across millions of phones worldwide. 

Scenario A: The slow burn 

Within minutes of your reply, another message arrives in response to yours: 

“Oh no, I’m so sorry! But honestly, you seem like a really kind person. It’s rare to find polite people these days. I’m Sarah, by the way.” 

 Some people stop the conversation there. Others reply out of curiosity or because they’re simply being friendly. A few messages later, you’re in a conversation. 

In some large scam operations, those early exchanges may be handled by AI (Artificial Intelligence) using open-source language models such as Llama or Mistral. That allows scammers to hold thousands of conversations at once and focus their time on the people who seem most likely to keep talking.  

While keeping you engaged, the AI assigns you a real-time vulnerability score based on your response time and message length. If your score crosses a certain threshold, a human operator takes over. They read the conversation, learn your name, your job, and your communication style, then continue as though nothing has changed. 

Within two or three weeks, this person has become a friend. They text you good morning, ask about your day, and send photos stolen from real social media profiles. 

Around week three, they casually mention an investment:  

“I’ve been making really good money on an investment platform lately. Almost $4,000 last month. It’s crazy.”

If you show interest, they’ll send you a link to a fake trading platform with a convincing design. You might deposit $500 to test it. The next day, your dashboard shows a fake gain of $1,800, so you invest more. A week later, the platform disappears, along with your money, and the person who texted you every day. 

According to the FBI’s Internet Crime Complaint Center (IC3), investment fraud generated more than $4.5 billion in reported losses in a single year. To be clear: while most wrong-number texts never reach this stage, victims who fall for so-called “pig butchering” scams (long-term romance/financial scams) suffer catastrophic average losses ranging between $70,000 and $75,000 per person. 

Scenario B: The silent recycling 

In this scenario, you replied “wrong number” and never heard from them again. You think you dodged the scam, but instead your number was simply moved to a different category: “Active, responsive, polite, but not susceptible to the wrong-number hook.” 

That profile still has enormous commercial value. Your number is added to a cleaned database and sold or reused for a different campaign.  

A week later you receive a text from another number:  

“Hi! I saw your profile on LinkedIn. We have an opportunity that’s a perfect fit for your background.” 

Or: 

“Your package couldn’t be delivered, update your address by clicking here.” 

Or a fake alert from your bank warning of “suspicious activity.” 

You’ll probably never connect these messages to the wrong-number text you received the week before. They’re different topics and different senders. But they may all be part of the same criminal ecosystem. The first message was simply a way to sort potential targets. Everything that follows is the actual attack. 

The most common hooks 

If you’ve received one of these messages (or something very similar), you’re not alone. These are some of the most common opening lines used in wrong-number scams, tested on millions of people and optimized to maximize response rate: 

The friend who doesn’t exist: 

• “Hey! See you tonight at 6? Don’t be late ” 
• “Are you still free tomorrow?” 
• “Did you send those files to the office?”
• “Hey Marco, are we still on for dinner tonight?” 

The concerned neighbor: 

• “Sorry to bother you, I’ve noticed your dog sometimes runs into my yard.” 
• “I found a phone number on the dog tag, is this yours?” 
• “Hi, your package was delivered to my address by mistake.” 

The professional mix-up: 

• “Hi, I tried to reach you about the delivery but you didn’t answer.” 
• “The shipment arrived at your address, can you confirm?” 
• “This is Mike from the office, did you get my earlier message?” 

The family emergency: 

• “Do you know Sarah? There’s been an emergency.” 
• “Is this [common name]’s number? Something happened.” 

The recruiter: 

• “Hi! I came across your profile, we have an incredible opportunity.” 
• “Hey, I’m reaching out about a position that matches your background perfectly.”

If you’ve received one of these messages, it doesn’t automatically mean it’s a scam. People genuinely do text the wrong number sometimes. But if the conversation quickly moves to making small talk, asking personal questions, or encouraging you to keep chatting, stop replying. 

Don’t recognize that number? We’ll check it.

CHECK NOW

The crime industry behind the text 

These messages aren’t usually sent by a lone cybercriminal. They’re part of a highly organized criminal industry with its own market dynamics and global supply chains. 

In January 2026, Cambodian and Chinese authorities arrested Chen Zhi, president of Prince Holding Group, accusing him of running a network of scam compounds across Southeast Asia where thousands of trafficked people were forced to manage these conversations. Those operations relied on underground marketplaces where criminals could buy everything they needed, from phone lists and stolen identities to AI tools and fake investment websites. 

The scale is staggering. Blockchain analytics firm Elliptic estimates the Huione Guarantee underground marketplace processed more than $134 billion in transactions. Separately, researchers at the University of Texas at Austin estimate that pig-butchering scams stole more than $75 billion in cryptocurrency over four years.  

The scam funnel: Costs and revenue 

To understand why this ecosystem is so huge, look at the math. Sending hundreds of thousands of text messages costs very little. Even if only a tiny fraction of people reply, and an even smaller number eventually send money, the profits can far outweigh the costs.  

Look at this illustrative model of a campaign sending 100,000 SMS messages: 

The figures in this model aren’t arbitrary. They combine observed pricing from underground marketplaces such as Russian Market and BidenCash with average victim losses reported by law enforcement agencies, including the FBI’s Internet Crime Complaint Center (IC3).  

Even allowing for variation between campaigns, the economics are compelling. A single campaign can cost less than $1,000 to run while generating more than $200,000 in revenue, representing a potential return on investment (ROI) of 90x to 200x. 

Those same economics are reflected in underground marketplaces, where verified, enriched contact details command significantly higher prices than raw data. In our previous investigation into underground marketplaces, we found that a typical stolen personal record sold for around 95 cents. The more criminals learn about a potential victim, the more valuable that person’s data becomes. 

The price ladder of your phone number: 

That’s a 4,000% value increase generated by a single polite reply.   

From there, scammers can enrich that record with publicly available information such as your name, employer, social media profiles, and estimated demographics using automated open-source intelligence (OSINT) techniques. 

The more complete the profile becomes, the more valuable it is. Researchers monitoring underground marketplaces have found that enriched, pre-profiled contacts command premium prices because they’re more likely to become victims of high-value pig-butchering scams that generate billions of dollars in illicit revenue each year.

How do they know who you are? 

Before that text reaches your phone, your number may already have passed through automated script pipelines capable of cross-referencing tens of thousands of records in minutes. 

Acquisition: Your number is pulled from historical data breaches, such as the Facebook leak affecting 533 million users, Twitter/X data leaks, or massive aggregated databases like Naz.api, and the Mother of All Breaches (MOAB), a collection of more than 26 billion records compiled from thousands of previous breaches. 

Automated scraping: Software queries public sources to check whether your number is linked to an active WhatsApp account, collect your profile information and picture and match the number to public LinkedIn, Instagram, and Facebook profiles. 

Data broker integration: Scammers exploit the same commercial data services used by marketing companies to associate a phone number with estimated age, address, and income bracket. 

The result is a psychographic and commercial profile that helps scammers choose the most convincing approach. If your social media shows you have a dog, you might receive the neighbor hook: “Your dog keeps getting into my yard.” If you recently changed jobs on LinkedIn, the fake headhunter hook activates. 

The human factor: Modern slavery 

There’s one aspect of these scams that’s often overlooked: many of the people sending the messages are victims themselves. 

In its August 9, 2023 policy report, the United Nations Office on Drugs and Crime (UNODC) described a human rights crisis tied to forced criminality in Southeast Asia. It estimates at least 120,000 people in Myanmar and tens of thousands in Cambodia are being held in fortified mega-compounds run by criminal syndicates. 

Many were lured by fake job adverts promising legitimate work in digital marketing or customer service. Once they cross the border, their passports are confiscated. They were stripped of freedom and forced, under the threat of violence, to spend up to 16 hours a day managing dozens of scam conversations. Those who failed to meet financial targets were often beaten, isolated, or sold to other compounds. 

When you reply to one of these messages, you’re interacting with a system designed to simultaneously exploit your financial availability and the enslavement of another human being. 

Breaking the chain 

You can’t erase your number from dark web databases: that damage may have done years ago. But you can make your profile far less valuable to scammers. 

Make yourself harder to profile: Review the privacy settings on any messaging apps and social media platforms that use your phone number. Limit who can see information such as your profile photo, status, last seen, and phone number. The less information scammers can gather automatically, the harder it is to build a detailed profile about you. On WhatsApp, for example, you can set Profile Photo, About, Status, and Last Seen to My Contacts. On Telegram, set Phone Number to Nobody. 

Report before you block: Blocking protects only you. Reporting protects everyone. When you use WhatsApp’s Report and Block function, the last five messages in the chat are sent to Meta’s security teams. If enough people report the same number, it may be permanently banned, destroying the entire active campaign on that line. 

The golden rule: If you receive an unexpected message from an unknown number, the safest response is no response at all. Don’t reply, don’t explain yourself, and don’t worry about seeming impolite. If it’s a genuine wrong number, the sender will usually realise their mistake and move on. If it’s a scam, you’ve denied the criminals exactly what they wanted: proof that your number is active and that you’re willing to engage.  

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

Apple has expanded its threat-notification system for targets of mercenary spyware.

Apple now shows a warning directly on an iPhone’s Lock Screen and in Settings when it believes the device owner has been targeted by mercenary spyware. The new on-device alert is meant to make a high-risk warning harder to overlook and complements notifications by email and through the user’s Apple Account page.

In the explanation, Apple states:

“Apple threat notifications are high-confidence alerts that a user has been individually targeted by a mercenary spyware attack, and should be taken very seriously.”

“Apple Threat Notification
Apple detected a mercenary spyware attack targeted at your iPhone. There are actions you can take now to help protect your data and device.”

Apple says its threat notifications are intended for people individually targeted by mercenary spyware attacks, which are highly sophisticated campaigns usually associated with commercial surveillance vendors and their government customers. Apple says it has notified targets in over 150 countries since the launch of the program in 2021, while the latest round of notifications reached people in 110 countries.

Mercenary spyware campaigns are usually not aimed at the average iPhone owner—at least at first. The initial targets are often people selected for who they are, what they know, or the work they do. But it would be a mistake to view this as someone else’s problem.

Attack techniques developed for narrowly targeted operations have a habit of spreading. Exploits can be reused, sold onward, reverse engineered, copied by other surveillance vendors, or adapted by criminal groups. A vulnerability initially valuable because it compromises a small number of carefully chosen devices may become much more dangerous once public disclosure, patch analysis, or exploit sharing makes them available for more widespread campaigns.

How to stay safe

Apple advises users to:

• Update your devices to the latest software, which includes the latest security fixes.
• Protect your devices with a passcode, Touch ID, or Face ID.
• Use two-factor authentication and a strong password for your Apple Account.
• Turn on Stolen Device Protection.
• Install apps from the App Store.
• Use strong and unique passwords, and passkeys where available.
• Don’t open links or attachments from unknown senders.

We’d like to add:

• Potential targets of mercenary spyware should consider applying Apple’s Lockdown Mode.
• Check if an Apple Threat Notification is real. Scammers will undoubtedly try and mimic them. You can verify a notification by signing in to your Apple account. A genuine Threat Notification will always be clearly listed there.
• If you receive an Apple Threat Notification, Apple recommends seeking expert help, such as the Digital Security Helpline from Access Now.

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Download for iOS → Download for Android → 

Researchers at Group-IB have discovered a new NFC relay malware family, purpose-built to capture live card data via NFC and forward it in real time to attackers. They dubbed it “WindRelay.”

NFC (Near Field Communication) is wireless technology that allows devices such as smartphones, payment cards, and payment terminals to communicate when they’re very close together. So, instead of stealing your physical bank card, the attackers capture NFC activity on an infected mobile phone and relay it in real time to a criminal-controlled device held against a contactless payment terminal, or an ATM that supports contactless cash withdrawals.

The researchers describe a 13-minute call impersonating a bank, in which a victim was persuaded to install an Android app labelled with the bank’s name. That app was a remote access Trojan (RAT) called SpyNote. SpyNote gave the attacker remote control of the phone and enabled the quiet installation of a second app, WindRelay.

The attackers then opened the victim’s legitimate banking app remotely and arranged a loan in the victim’s name, while also asking them to tap their physical payment card against the phone and enter its PIN. That tap let the second app forward the card’s contactless data in real time to the criminals, allowing them to make purchases or, in some cases, withdraw cash from an ATM.

This division of tasks is the important development here. The remote-access malware (SpyNote) gets the attackers into the phone, and the NFC relay malware (WindRelay) turns the victim’s physical card into something the criminals can use elsewhere at that moment.

It’s not quite as simple as it sounds, because NFC comes in a few different “flavors.” Some produce a static code. Take the card that opens my apartment building door, for example. That kind of signal can easily be copied to a device like my Flipper Zero so I can use it to open the door. But sophisticated contactless payment cards use dynamic codes. Each time you tap to pay, your card’s chip generates a unique, one-time code (often called a cryptogram or token) that cannot be reused.

That’s why the critical feature of NFC relay malware is real-time relaying. Since payment card transactions use dynamic, transaction-specific cryptographic data, timing is central to this kind of fraud.

The telephone call isn’t just the lure. It’s also the attackers’ control channel. It lets them overcome the victim’s hesitation, respond to confusion instantly, and coordinate the precise moments when the victim installs an app, taps their card, and enters a PIN.

This is part of an established and expanding NFC relay fraud category sometimes called ghost tapping. In the past, we’ve discussed NGate and SuperCard X, which are similar malware families. But the combination with SpyNote is what makes this campaign stand out.

How to protect yourself

As with many security threats, the best defense is you. The cybercriminals behind this attack can’t do anything unless you install the software on your phone, so they go through several steps to convince you to do so.

• Be skeptical of calls and text messages from people you don’t know, especially those claiming to be urgent. Scammers typically try to panic you into acting quickly. Once they get you on the phone, they can build trust, making it harder to think critically and say no.
• If you feel compelled to take action, check in with someone you trust first. If you’re still convinced the request is genuine, verify the message independently. Call your financial institution using an official number, not through the one in the text message or email.
• Never give personal details to anyone who contacts you unexpectedly, and never change your banking details at their request. A bank will not ask you to install an app from a link, text message, browser download, or other unofficial source to “secure” your card.
• Avoid sideloading apps (installing them from outside of the Google Play store), and treat unexpected Accessibility or device-control permissions as a serious warning sign.
• Use an up-to-date, real-time anti-malware solution to protect your devices.

Malwarebytes for Android detects SpyNote and WindRelay as:

• Android/Trojan.NGate.ACRBCF9BBC3C1
• Android/Trojan.NGate.ACR2401245FC5

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Download for iOS → Download for Android → 

Your phone is full again, and the warning appears at exactly the wrong moment. Suddenly you can’t update apps, record a video, or save another photo.  

The cause is rarely one giant file. Storage disappears in a steady drizzle of leftovers: temporary files an app creates and forgets, caches that grow in the background, and downloads you no longer need. None of it is dangerous, but it can gradually fill your phone’s storage. 

Junk Cleaner is a new tool in Malwarebytes for Android, available from version 5.22. It finds that clutter, shows you what’s using space, and lets you decide what to remove. 

What Junk Cleaner finds 

Junk Cleaner looks for three broad categories of storage clutter: 

• Leftover and residual files: Temporary and system-generated files that apps leave behind. 
• Old and large downloads: Files you saved but no longer use or remember. 
• (Coming soon) Hidden app caches: Storage used by apps in places Android keeps out of easy reach. 

A file showing up in one of these categories doesn’t mean it’s harmful. It just means it’s taking up space and might be worth removing. That distinction matters because Junk Cleaner is about storage, not threats. It works separately from Malwarebytes malware scanning and web protection, and it doesn’t touch your photos, messages, or documents. 

Scan, review, clean 

Junk Cleaner scans the relevant areas of your device in parallel, guided by a set of rules that can be updated as we learn about new kinds of leftover files. The results are grouped by category and show how much space each item is using. 

After the scan, you review the findings and choose what to clear. Nothing is deleted until you confirm the selection. The results are presented as a simple list showing each category and how much space you could recover. 

A quick look under the hood 

Junk Cleaner uses rules to identify patterns of clutter. These are not malware or phishing signatures. They describe file types and locations that may be worth reviewing when you need more space.  

The scanner checks the relevant directories, matches files against those rules, measures how much space each hidden cache occupies, and combines the results into a single review screen. 

Junk Cleaner automates a repetitive Android chore without turning storage cleanup into another complicated job. 

Built at a hackathon 

Junk Cleaner began as an internal hackathon project, an idea one engineer wanted to explore over a few focused days. The prototype proved useful enough to grow into a shipping feature, and reached all users in Malwarebytes for Android version 5.22. 

Turning the demo into a product meant more than polishing the screen. The team added Android permission handling, cache cleaning, and review experience needed for a feature people could rely on across different devices. 

We like that origin story because many useful features begin the same way: someone scratches an itch, builds something quickly, and turns a rough idea into a tool that can help millions of people. Future updates will bring smarter sorting, finer filters, and more control over what’s included. 

Make room for what matters 

Running out of space always seems to happen at the worst possible moment. Junk Cleaner clears away the leftovers that quietly build up, leaving more room for the photos, apps, and moments that actually matter. 

Junk Cleaner is available in Malwarebytes for Android from version 5.22. Open the app, run a scan, review the results, and reclaim your space in a few taps. 

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Download for iOS → Download for Android →