Search: “super-apps”

Google’s Early Access is creating a blind spot for malicious apps

Bitdefender found thousands of Google Play Early Access apps with deceptive behavior, including ad-fraud-capable utilities requesting excessive permissions on Android devices.

Bitdefender Labs analyzed Google Play apps installed by its users and identified thousands of Early Access applications that appeared deceptive, including fake casino and reward games, misleading utilities, and apps using third-party trademarks, many promoted via social ads with AI deepfakes. Early Access apps cannot receive public reviews, removing a key warning signal users normally rely on. Some apps requested unusual permissions, such as a QR scanner seeking to replace the device launcher, which could enable hidden web views that click ads and potentially display fake login screens or capture two-factor codes. Bitdefender recommends Android Enterprise Work Profiles and notes Google Workspace admins can disable Early Access apps for their organization.

CSO Online·updated Sep 11, 12:14 UTC · 5d ago·first Sep 11, 08:36 UTC · 6d agoMalware 6 sources

Don't Trust the Super-App: A Case Study of Russia's Max

Researchers show super-apps like Russia's Max can silently capture mini-app UI, storage, network traffic, and authentication, enabling untraceable user impersonation.

The paper challenges the assumption that super-apps are trusted intermediaries, citing WeChat's passive cross-mini-app tracking, Russia's Max's entanglement with state prosecution of online speech, and Iran's Bale operating during a prolonged internet shutdown. Using Max as a case study, the authors demonstrate that a super-app can capture mini-app UI, read and write mini-app local storage, inject arbitrary JavaScript into mini-app runtimes, mediate network traffic, and control authentication context, enabling silent user impersonation without trace. They argue these capabilities are inherent to the super-app architecture and call for mobile OS and app store interventions to close the blind spot.

arXiv cs.CR·Sep 10, 17:08 UTC · 6d agoResearch1

Researchers Build WeChat Zero-Click Worm Hijacking Phones via Calls

Calif researchers built WeWorm, a zero-click worm exploiting a WeChat VoIP memory-corruption RCE that Tencent has now patched.

Calif researchers found a memory corruption flaw in WeChat's VoIP stack in July using LLM-assisted analysis and built working exploits within two days, then integrated them into WeWorm, which they call the first zero-click worm spreading through WeChat calls on iOS and Android. A crafted incoming call yields remote code execution with no user interaction, giving full control of the victim's WeChat account; the attacker only needs to be on the victim's friend list, easily achieved by compromising a contact first. Tencent confirmed the bug and shipped patches in WeChat Android 8.0.77 and iOS 8.0.76, and chaining with other OS bugs could yield full device control.

Infosecurity Magazine·Sep 9, 15:00 UTC · 7d agoExploit / PoC

Free streaming boxes may be routing criminal traffic through your home

Researchers found SuperBox streaming boxes and the CyberFlix TV app enroll home connections into the Popanet residential proxy network, routing criminal traffic.

Researchers found that SuperBox devices and the CyberFlix TV app, distributed through SuperBox's custom app store, contain Popanet proxy functionality that registers the device with servers controlled by the proxy operator, enrolling household connections into residential proxy networks. The reported configuration weakens Android safeguards with exposed ADB access, root-level privileges without authentication, and removal of app-install protections. Plume's research warns these proxy networks can also function as malware-delivery platforms, and the FBI notes foreign entities use residential proxies to conceal activity such as credential stuffing and account abuse. Malwarebytes advises disconnecting and replacing affected SuperBox/CyberFlix devices rather than factory-resetting them.

Malwarebytes Labs·Sep 4, 09:20 UTC · 12d agoMalware in the wild

Can We Stop The Ads? Taxonomy and Characterization of Smartphone Splash Ads and Existing Countermeasures

Study of 108 ad-defense implementations finds only one tool blocked splash-ad navigation across ten popular apps, and it required Accessibility permission.

The paper taxonomizes smartphone splash ads — full-screen ads at app launch that trick users into trigger mechanisms such as moving the phone — and analyzes 108 documented advertising defenses for deployment barriers. Many defenses require device rooting, jailbreaking, runtime code injection, or application modification; others need extra permissions, rule maintenance, compilation, or payment. In evaluating 13 configurations of 11 tools across 10 popular apps, only one prevented ad-triggered navigation across all ten apps, requiring Accessibility permission and leaving ads visible roughly one second before dismissal. Documented harms include delayed emergency response, driver distraction, and degraded accessibility for vision-impaired users.

arXiv cs.CR·Sep 15, 15:24 UTC · 1d agoResearch

ANY.RUN & SentinelOne: One Workspace, Instant Context for Rapid Response

ANY.RUN integrates its interactive sandbox, IOC lookups, and STIX/TAXII threat feeds natively into SentinelOne for faster automated malware triage.

ANY.RUN and SentinelOne launched connectors that embed interactive sandbox analysis and threat intelligence into the SentinelOne console via Singularity Hyperautomation. Suspicious files and URLs from alerts are automatically submitted to the ANY.RUN sandbox, with behavioral verdicts and risk scores returned into alert notes. On-demand IOC lookups draw on sandbox history from 16,000 organizations and 700,000 analysts. A separate STIX/TAXII feed streams verified malicious IPs, domains, and URLs through the SentinelOne Marketplace TAXII Connect app.

ANY.RUN·Sep 16, 06:40 UTC · 1d agoTools

Enterprise Threat Intelligence Buying Guide: How to Choose the Right Solution

ANY.RUN published a buyer's guide for enterprise threat intelligence platforms, outlining evaluation criteria and promoting its own TI products.

ANY.RUN, whose sandbox, TI Lookup, and TI Feeds products are featured throughout, published guidance for selecting an enterprise threat intelligence provider. The guide recommends defining SOC or MSSP requirements first, then weighing intelligence quality and freshness, integrations including STIX/TAXII support, privacy, scalability, and proof-of-concept testing with real alerts. It emphasizes context and enrichment over raw data volume, citing figures such as TI Lookup results in about 2 seconds and 99% validated IOCs in its feeds.

ANY.RUN·updated 08:15 UTC · 48m ago·first 07:44 UTC · 1h agoIndustry 4 sources

Product showcase: ScamNet looks for warning signs in suspicious calls and shady links

Synaptrex's ScamNet app filters scam calls, messages and websites on Apple devices using on-device AI and reputation checks.

ScamNet: Anti-Scam Suite from Synaptrex Technologies is a free consumer app (with ScamNet+ subscription) for iPhone, iPad and Mac that blocks robocalls and spam via iOS Call Blocking & Identification, filters unknown senders with an offline detection engine, and provides a Safari extension that analyzes and blocks suspicious websites. A Check/Report tool accepts phone numbers, websites, crypto addresses, text, images and audio, and a Device Shield verifies passcode, OS updates and screen-recording status.

Help Net Security·Aug 17, 00:00 UTC · Aug 17, 2026Tools

ProgramDistill: From Interactive Web Apps to Verifiable Reference-Guided SWE Tasks

ProgramDistill is a benchmark evaluating coding agents on reconstructing web app features from reference applications, testing nine frontier agents.

ProgramDistill evaluates coding agents on features discovered through interaction with fully functional reference applications, factorizing apps into features with replayable behaviors verified via gold patches. Its mine-craft-patch pipeline discovered 1,975 replay-verified behaviors across 26 applications and built 4,063 tasks without human intervention. On cumulative full-application reconstruction workflows, GPT-6 Astra achieved 49.2% and Claude Opus 5 28.8% success. In partial reconstruction, success drops from 100% to 64.0% and from 96% to 32% as restoration depth increases from 1 to 8.

Hugging Face daily papers·Sep 15, 20:00 UTC · 1d agoAI research

US Finance Under Phishing Pressure: What the SOC Data Reveals?

ANY.RUN SOC telemetry shows escalating phishing campaigns against US finance, including Vercel-hosted RMM attacks abusing legitimate services.

ANY.RUN analyzed SOC telemetry data on phishing targeting the US financial sector, concluding that the scale and security impact should not be understated. The analysis highlights modern campaigns such as Vercel-hosted attacks that deliver remote monitoring and management (RMM) tools. It notes that attackers increasingly abuse legitimate services and everyday workflow tools to deliver phishing, making detection harder for SOC teams.

ANY.RUN·Aug 26, 09:17 UTC · 21d agoPhishing & fraud in the wild

Counterfeit installers to system compromise: Tracking a deceptive software download campaign

Microsoft tracks a counterfeit software-installer campaign compromising multinationals' China operations, moderately linked to the Silver Fox (Yinhu) actor.

Microsoft Defender Experts is tracking an active campaign using spoofed software download sites for brands such as Razer, Kaspersky, Microsoft Edge, Calibre, and Baidu Netdisk on .com.cn and .hl.cn domains, delivering installer archives whose hashes change per download, indicating server-side payload generation. The implants establish persistence, weaken security protections, and communicate with attacker-controlled infrastructure, with confirmed compromises across healthcare, manufacturing, gaming, technology, logistics, government, and education. Microsoft assesses with moderate confidence that the activity matches the publicly reported Silver Fox (Yinhu) fake software campaign; it has not attributed it to a nation-state actor.

Microsoft Security Blog·Sep 1, 22:48 UTC · 15d agoThreat actor in the wild1

ZeroTokens Phishing Platform Steers Attacks in Real Time

ZeroTokens phishing platform hands operators live control of victim sessions in ongoing attacks targeting 53 financial brands.

ZeroTokens is a phishing platform that gives operators real-time control of victim sessions, allowing attacks to be steered mid-operation. The platform is being used in campaigns targeting 53 financial brands. Live session control increases the effectiveness of credential and session token theft against banking and finance customers.

Infosecurity Magazine·Aug 25, 14:30 UTC · 22d agoPhishing & fraud in the wild

Novel-reading apps used users' phones to generate fake ad traffic

Help Net Security·Aug 6, 00:00 UTC · Aug 6, 2026Threat actor1

“This is the AI men actually use”: Meta ads pushed apps nudifying real teens

TTP found Meta ran ads for AI nudify apps using real photos of minors, including a CSAM ad, drawing scrutiny from US and Australian regulators.

The Tech Transparency Project reported that Meta served ads for AI nudify apps using photos of real teens, which collectively reached over 29,000 people in the EU and 6,800 in the UK, with about 80% of ads shown in the US. A Facebook page posing as representing the Church of Jesus Christ of Latter-day Saints ran a CSAM ad that Meta only disabled after TTP flagged it. Michigan and Florida attorneys general are investigating, Senator Mark Warner has demanded action, and Australia's eSafety regulator requested information from Meta at a senior level. Meta said flagged ads averaged fewer than 200 impressions with total spend under $5,000.

Ars Technica · AI·Sep 8, 18:43 UTC · 8d agoAI safety & security

How to Keep Malware’s Rotating Infrastructure From Becoming a Detection Gap

ANY.RUN marketing piece argues SOC detection lags rotating malware and phishing infrastructure, citing a 46-country campaign and 3DBlast kit to promote TI feeds.

ANY.RUN describes how malware and phishing campaigns rotate domains and hosting, making single-IOC blocking ineffective for SOC teams. One investigated phishing campaign spanned 46 countries with 425 kit URLs across 240 hosts, 94% of which were seen for only a single day. A phishing kit dubbed 3DBlast impersonates Microsoft 365 and Google using BitB, AiTM, OAuth device-code phishing and DOM relay techniques. The article is primarily a promotion for ANY.RUN TI Feeds and TI Lookup products.

Cyber Security News·Sep 15, 15:36 UTC · 1d agoIndustry

Release Notes: Faster TI Investigations, Fresh Threat Research, and 650+ Threat Coverage Updates

ANY.RUN August release adds TI Lookup connections view, 81 behavior signatures, 16 YARA rules, 559 Suricata rules, and three new threat intelligence reports.

ANY.RUN released August product updates expanding its Threat Intelligence Lookup with a Connections block for pivoting between related observables (domains, IPs, URLs), JSON export for retrohunting and SIEM/NDR integration, and hidden whitelisted data by default. Detection coverage grew with 81 new behavior signatures, 16 YARA rules, and 559 Suricata rules covering malware execution, phishing, and C2 traffic. Three new Threat Intelligence Reports cover a US-focused RMM phishing campaign across 46 countries, the Mirage2FA phishing-as-a-service targeting Microsoft 365 (1,249 sandbox sessions, 9,332 potential compromise events), and a threat brief on OVERLORD RAT, CRPX0, and TRIBACK loader.

ANY.RUN·Sep 3, 09:11 UTC · 13d agoTools1

New Android malware relays bank cards to fraudsters while victims still hold them

Group-IB discovered WindRelay Android malware that streams NFC card data in real time, paired with SpyNote RAT, targeting Czechia, Slovakia, and Slovenia.

Group-IB identified WindRelay, an Android malware that uses NFC to communicate with victims' payment cards and relays the exchange live to attacker-controlled terminals. Fraudsters impersonate bank staff by phone, trick victims into installing a personalized SpyNote RAT, then silently deploy WindRelay to cash out using the victim-entered PIN. Researchers traced 23 samples on VirusTotal from November 2025 to July 2026, four C2 IPs, and campaigns against Czechia, Slovakia, and Slovenia. No affected apps were found on Google Play, and Google Play Protect detects known versions.

Help Net Security·Aug 17, 08:29 UTC · Aug 17, 2026Malware in the wild

Structural Jailbreaks Generalize but Do Not Compound: A cross-provider and multilingual study of Involuntary In-Context Learning

Researchers show IICL structural jailbreaks generalize to Google Gemini, lifting attack success to 80-100% on harm and financial benchmarks; non-English prompts attenuate it.

The study red-teams two Google Gemini models with Involuntary In-Context Learning (IICL), a structural jailbreak reframing harmful requests as the final cell of a data-labeling task. IICL lifts attack success from at most 6.7% to 80-90% on HarmBench and 97-100% on financial abuse (FinProof), an order of magnitude above prior results on OpenAI's GPT-5.4. Against a compounding hypothesis, forcing IICL output into Spanish, Hindi, or Arabic attenuates the attack in 11 of 12 conditions, attributed to a 'relevance curse' producing lower-quality harmful content in lower-resource languages. Findings replicate under an independent non-Google judge (Cohen's kappa 0.86 over 377 paired verdicts).

arXiv cs.CR·Sep 8, 07:38 UTC · 9d agoAI safety & security