Today was the deadline for Google to reveal how it’s complying with Judge James Donato’s order to crack open Android for third-party app stores, stop illegally tying its Google Play Billing system to its app store, and let developers link to ways to download their apps outside the Play Store in the US.
Technology
New Android malware can empty your bank account in seconds
NEWYou can now listen to Fox News articles!
Android users have been dealing with a steady rise in financial malware for years. Threats like Hydra, Anatsa and Octo have shown how attackers can take over a phone, read everything on the screen and drain accounts before you even notice anything wrong. Security updates have helped slow some of these strains, but malware authors keep adapting with new tricks.
The latest variant spotted in circulation is one of the most capable yet. It can silence your phone, take screenshots of banking apps, read clipboard entries, and even automate crypto wallet transactions. This threat is now known as Android BankBot YNRK, and it is far more advanced than typical mobile malware.
Sign up for my FREE CyberGuy ReportGet my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter
How the malware infiltrates devices
HOW ANDROID MALWARE LETS THIEVES ACCESS YOUR ATM CASH
Android banking malware is getting harder to spot as attackers use new tricks to take over phones and drain accounts. (Thomas Trutschel/Photothek via Getty Images)
BankBot YNRK hides inside fake Android apps that appear legitimate when installed. In the samples analyzed by researchers at Cyfirma, the attackers used apps that impersonated official digital ID tools. Once installed, the malware begins profiling the device by collecting details such as brand, model and installed apps. It checks whether the device is an emulator to avoid automated security analysis. It also maps known models to screen resolutions, which helps it tailor its behavior to specific phones.
To blend in, the malware can disguise itself as Google News. It does this by changing its app name and icon, then loading the real news.google.com site inside a WebView. While the victim believes the app is genuine, the malware quietly runs its background services.
One of its first actions is to mute audio and notification alerts. This prevents victims from hearing incoming messages, alarms or calls that could signal unusual account activity. It then requests access to Accessibility Services. If granted, this allows the malware to interact with the device interface just like a user. From that point onward, it can press buttons, scroll through screens and read everything displayed on the device.
BankBot YNRK also adds itself as a Device Administrator app. This makes it harder to remove and helps it restart itself after a reboot. To maintain long-term access, it schedules recurring background jobs that relaunch the malware every few seconds as long as the phone is connected to the internet.
What does the malware steal
Once the malware receives commands from its remote server, it gains near-complete control of the phone. It sends device information and installed app lists to the attackers, then receives a list of financial apps it should target. This list includes major banking apps used in Vietnam, Malaysia, Indonesia and India, along with several global cryptocurrency wallets.
With Accessibility permissions enabled, the malware can read everything shown on the screen. It captures UI metadata such as text, view IDs and button positions. This helps it reconstruct a simplified version of any app’s interface. Using this data, it can enter login details, swipe through menus or confirm transfers. It can also set text inside fields, install or remove apps, take photos, send SMS, turn call forwarding on and open banking apps in the background while the screen appears inactive.
In cryptocurrency wallets, the malware acts like an automated bot. It can open apps such as Exodus or MetaMask, read balances and seed phrases, dismiss biometric prompts, and carry out transactions. Because all actions happen through Accessibility, the attacker never needs your passwords or PINs. Anything visible on the screen is enough.
The malware also monitors the clipboard, so if users copy OTPs, account numbers or crypto keys, the data is immediately sent to the attackers. With call forwarding enabled, incoming bank verification calls can be silently redirected. All of these actions happen within seconds of the malware activating.
BankBot YNRK hides inside fake apps that look legitimate, then disguises itself as Google News while it runs in the background. (AP Photo/Don Ryan, File)
7 steps you can take to stay safe from banking malware
Banking trojans are getting harder to spot, but a few simple habits can reduce the chances of your phone getting compromised. Here are seven practical steps that help you stay protected.
FBI WARNS OVER 1 MILLION ANDROID DEVICES HIJACKED BY MALWARE
1) Install strong antivirus software
Strong antivirus software helps catch trouble early by spotting suspicious behavior before it harms your Android device or exposes your data. It checks apps as you install them, alerts you to risky permissions and blocks known malware threats. Many top antivirus options also scan links and messages for danger, which adds an important layer of protection when scams move fast.
The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.
Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com
2) Use a data-removal service to shrink your digital footprint
Data brokers quietly collect and sell your personal details, which helps scammers target you with more convincing attacks. A reputable data-removal service can find and delete your information from dozens of sites so that criminals have less to work with. This reduces spam, phishing attempts and the chances of ending up on a malware attack list.
While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.
Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com
Get a free scan to find out if your personal information is already out on the web: Cyberguy.com
3) Install apps only from trusted sources
Avoid downloading APKs from random websites, forwarded messages or social media posts. Most banking malware spreads through sideloaded apps that look official but contain hidden code. The Play Store is not perfect, but it offers scanning, app verification and regular take-downs that greatly reduce the risk of installing infected apps.
4) Keep your device and apps updated
System updates often patch security issues that attackers exploit to bypass protections. Updating your apps is just as important, since outdated versions may contain weaknesses. Turn on automatic updates so that your device stays protected without you having to check manually.
5) Use a strong password manager
A password manager helps you create long, unique passwords for every account. It also saves you from typing passwords directly into apps, which reduces the chance of malware capturing them from your clipboard or keystrokes. If one password gets exposed, the rest of your accounts remain safe.
Next, see if your email has been exposed in past breaches. Our No. 1 password manager (see Cyberguy.com) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.
Once active, the malware can read your screen, steal financial data, automate crypto transfers and intercept OTPs within seconds. (Kurt “CyberGuy” Knutsson)
Check out the best expert-reviewed password managers of 2025 at Cyberguy.com
6) Enable two-factor authentication wherever possible
2FA adds a confirmation step through an OTP, authenticator app or hardware key. Even if attackers steal your login details, they still need this second step to get in. It cannot stop malware that takes over your device, but it significantly limits how far an attacker can go with stolen credentials.
GOOGLE ISSUES WARNING ON FAKE VPN APPS
7) Review app permissions and installed apps regularly
Malware often abuses permissions such as Accessibility or Device Admin because they allow deep control over your phone. Check your settings to see which apps have these permissions and remove anything that looks unfamiliar. Also, look through your installed apps and uninstall any tool or service you do not remember adding. Regular reviews help you spot threats early before they can steal data.
Kurt’s key takeaway
BankBot YNRK is one of the most capable Android banking threats discovered recently. It combines device profiling, strong persistence, UI automation and data theft to gain full control over a victim’s financial apps. Because much of its activity relies on Accessibility permissions, a single tap from the user can give attackers complete access. Staying safe means avoiding unofficial APKs, reviewing installed apps regularly and being cautious of any sudden request to enable special permissions.
Do you think Android phone makers like Samsung or Google are doing enough to protect you from malware? Let us know by writing to us at Cyberguy.com
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter
Copyright 2025 CyberGuy.com. All rights reserved.
But Google isn’t just letting app developers do things however and whenever they’d like. The company’s quietly updated its support pages with a January 28th deadline to enroll in specific Google programs for “alternative billing” and “external content links” — and these programs will come with large alternative fees of their own, assuming Judge Donato doesn’t opt for Epic and Google’s proposed settlement instead.
While it isn’t collecting fees yet, Google says it will charge developers $2.85 for every app and $3.65 for every game a user installs within 24 hours of clicking a link that takes you outside Google’s app store to download them outside the Google ecosystem.
Plus, it’ll take a 20 percent cut of any in-app purchases and 10 percent of any auto-renewing subscriptions. Apps still need to be submitted to Google for review, use a Google API to track them, and developers have to report all transactions (including $0 free trials) if they want to participate.
Meanwhile, developers who want to offer their own billing solutions will only get a 5 percent discount compared to Google’s current fees, likely making it not worth the effort to try alternative billing at all. Google will charge 25 percent for in-app purchases and 10 percent for auto-renewing subscriptions there; devs will need to integrate a Google API to track those, and report all transactions within 24 hours.
The company will cap some of these fees at 10 percent of a developer’s first $1 million of earnings, making it a bit easier for small developers, but perhaps no easier than it is currently. Google already offers a similar cap at 15 percent, so this too is a 5 percent discount.
How will Judge James Donato react? When Apple told Judge Yvonne Gonzalez Rogers it would require a 27 percent fee for external payments in the parallel Epic v. Apple case, she found Apple in contempt of court, and an appeals court backed up that decision just days ago. However, the appeals court did suggest that Apple may be able to collect some fee, writing that:
Apple should be able to charge a commission on linked-out purchases based on the costs that are genuinely and reasonably necessary for its coordination of external links for linked-out purchases, but no more.
Google currently claims that “the fees associated with the external content links program reflect the value provided by Android and Play and support our continued investments across Android and Play.”
But Google also says it won’t collect any fees quite yet, writing:
In the future, Google intends to apply a service fee on successful transactions and downloads completed via external content links. At this time, however, Google is not assessing these fees and is therefore not requiring developers in this program to report these transactions or downloads to Google.
In their joint progress report today, Epic and Google’s lawyers write that while Epic agrees with the January 28th deadline and other requirements, “Epic has indicated that it opposes the service fees that Google announced it may implement in the future and that Epic will challenge these fees if they come into effect.”
Of course, none of this will come to pass if Judge Donato accepts Google and Epic’s proposed settlement instead, which would generally apply worldwide (instead of just in the US) and comes with lower standard transaction fees.
But Google signaled that settlement, too, would come with fees on alternative billing and external app downloads, and Judge Donato seemed skeptical of the settlement in November. He’s ordered an evidentiary hearing on January 22nd before he makes a decision.
Since Google’s support pages seem to be fluid as Epic v. Google continues, we’ve archived copies of their current text below.
Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.
NEWYou can now listen to Fox News articles!
As we head into the last stretch of December (and last-minute gift shopping), your doorstep is probably busier than ever. And if you’re anything like me, you’re probably also juggling shipping updates, tracking numbers, and “out for delivery” alerts from half a dozen retailers.
Unfortunately, scammers know this too, and they’ve likely been preparing for it all year. Like clockwork, I’ve already started seeing the usual wave of fake tracking texts hitting people’s phones. They look legit, they show up right when you’re expecting a package, and they rely on one inescapable truth: during the holiday rush, most of us are too overwhelmed to notice when something feels off.
No need to panic, though. You can still come out ahead of the scammers. I’ll show you what to look out for and how you can prevent being targeted in the first place.
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.
THE FAKE REFUND SCAM: WHY SCAMMERS LOVE HOLIDAY SHOPPERS
Holiday shoppers are being hit with a surge of fake delivery texts designed to steal personal information and account logins. (Photo by Sebastian Kahnert/picture alliance via Getty Images)
What fake delivery text messages look like
Most of these fake shipping texts include a “tracking link” that looks close enough to the real thing that you might tap without thinking twice about it. In some cases, like one Maryland woman found out, you may even receive fake deliveries with a QR code that works in a similar way.
These links usually lead to a spoofed tracking page that looks almost identical to the real thing. It’ll ask you to “confirm” your login or enter your delivery details. The moment you type anything in, scammers capture it and use it to access your real accounts.
Even worse, the “tracking link” may contain malware or spyware, triggering silent installs that can steal passwords, monitor keystrokes, or give scammers remote access to your device.
Red flags that reveal fake shipping and tracking messages
So how can you distinguish between a legitimate message for a delivery you’re actually waiting for and one of these scams? Here are the red flags I look for:
- Weird or slightly altered URLs. Scammers use domains that look almost right. Except there’s usually one extra letter, a swapped character, or a completely unfamiliar extension.
- Requests for additional payment. Real carriers don’t ask you to pay a “small fee” to release a package. That’s an instant giveaway.
- A package you’re not expecting. If the text is vague or you can’t match it to a recent order, pause before you tap anything.
- Delivery attempts at odd hours. “Missed delivery at 6:12 AM” or “late-night attempt” messages are usually fake. Carriers don’t normally operate like that.
- Updates that don’t match what you see in the retailer’s app or email. If Amazon says your package is arriving tomorrow, but a random text says it’s delayed or stuck, trust Amazon, not the text.
- Language that is designed to rush you. Anything screaming “immediate action required!” is designed to make you stop thinking and start tapping.
If a text triggers any one of these, I delete it on the spot. When in doubt, always check directly with the delivery service provider first before opening any links.
WHY YOUR HOLIDAY SHOPPING DATA NEEDS A CLEANUP NOW
Scammers are sending deceptive tracking links that mimic real carriers, hoping rushed shoppers won’t notice red flags. (Silas Stein/picture alliance via Getty Images)
How scammers know your address, phone number, and shopping habits
Scammers don’t magically know where you live or what you’ve ordered — they buy that information. There’s actually an entire industry of data brokers built on collecting and selling personal data. This can include your:
- Phone number
- Home address
- Purchase history
- Browsing patterns
- Retailers accounts and apps
- Loyalty programs
- Even preferred delivery times.
These data brokers can sell profiles containing hundreds of data points on you. And they aren’t always discerning about who they sell to. In fact, some of them have been caught intentionally selling data to scammers.
Once scammers have those details, creating a convincing delivery scam is no problem.
But scammers can’t target what they can’t find
I’ve been very vocal about the importance of keeping personal information under lock and key. And this is just one of the reasons why.
Criminals rely on your personal information to target you with these types of scams. They also need at least a phone number or email address to reach you in the first place.
So your best bet to avoid delivery scams (and, honestly, most other scams year-round) is removing your info from data brokers and people search sites. Doing this will keep your details out of circulation online and out of the wrong hands.
FBI WARNS EMAIL USERS AS HOLIDAY SCAMS SURGE
Fraudsters use spoofed shipping pages and malware to capture passwords and gain access to victims’ devices. (Martin Ollman/Getty Images)
How to remove your personal information from scammers’ reach
You can start by looking yourself up online. Searching for different combinations of your name, address, email, and phone number should bring up a bunch of people search sites. Just visit the “opt-out” page on each site to request removal of your data.
Private-database data brokers are a bit trickier. They sell data in bulk, usually to marketers and other third parties. So you won’t be able to check if they have your information. But if you look into which data brokers operate in your area, you can just send opt-out requests to them all. There’s a good chance they’ll have your information.
You can also turn to a data removal service. They completely remove the headache from this process and just automatically keep your personal info off data broker sites. If, like me, you don’t have the time to keep manually checking data broker sites and sending removal requests every few months (because your data will keep reappearing), a personal data removal service is the way to go.
While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.
Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.
Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.
Kurt’s key takeaways
Holiday delivery scams work because they blend perfectly into the chaos of December shopping. A well-timed text and a familiar tracking link are often all it takes to lower your guard. By slowing down, checking messages directly with retailers, and reducing how much of your personal data is circulating online, you can take away the advantage scammers rely on. A little caution now can save you a major headache later.
Have you received a suspicious delivery text or tracking message this holiday season? If so, tell us what it looked like and how you handled it by writing to us at Cyberguy.com.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.
Copyright 2025 CyberGuy.com. All rights reserved.
All year on The Vergecast, we’ve been tracking the many bizarre and problematic actions of FCC Chairman Brendan Carr. There has been a lot to discuss! Then, this week, ahead of one of our last episodes of the year, Carr appeared in front of the Senate Commerce Committee and spent three hours explaining how he thinks about his job, the FCC, and the state of online communication and entertainment. It was a lot.
On this episode of The Vergecast, we begin with a dissection of Carr’s testimony, his threats against broadcasters, and the ways in which he’s using old ideas about content delivery to get his political way. Nilay and David walk through some of Carr’s most important quotes, explain the history of broadband regulation, and look ahead to how Carr might bring these same tactics to internet regulation next year.
Also, an important housekeeping note: The Vergecast will be live at CES! We’ll be at the Brooklyn Bowl in Las Vegas, at 3:30PM on Wednesday, January 7th. There will be podcasting, and hanging out, and bowling. It’s going to be great, and if you’re going to be in Vegas we’d love to see you there.
Until then, if you want to know more about everything we discuss in this episode, here are some links to get you started, first on Brendan Carr:
And in the streaming wars:
And in the lightning round:
World19 seconds ago
US military launches strikes in Syria targeting Islamic State fighters after American deaths
Lifestyle48 minutes ago
The 2025 Vibe Scooch
Technology1 hour ago
Want to link from Google’s app store to your app? That’ll be $2–4 per install
World1 hour ago
Putin says Russia won’t launch new attacks on other countries ‘if you treat us with respect’
Politics1 hour ago
Trump administration touts ‘most secure border in history’ as 2.5 million migrants exit US
Florida1 year ago
Florida High School Football Rankings: Top 25 teams – Oct. 21
Connecticut2 years ago
Cleary's 21 help Le Moyne down Central Connecticut State 69-64 in OT
Oregon2 years ago
How old is Bo Nix? What to know about Oregon quarterback ahead of 2024 NFL Draft
Virginia1 year ago
99th annual Pony Swim held in Virginia
Education2 years ago
Video: ‘It Didn’t Have to Happen This Way:’ U.Va. Faculty Call for Review of Police Response to Protests
Politics1 hour ago
Trump administration touts ‘most secure border in history’ as 2.5 million migrants exit US
World2 hours ago
How the reparations loan for Ukraine fell apart at the eleventh hour
News3 hours ago
Trump’s push to end transgender care for young people opposed by pediatricians
News12 hours ago
Takeaways from an eventful 2025 election cycle
Politics13 hours ago
Judge tosses Trump-linked lawsuit targeting Chief Justice Roberts, dealing setback to Trump allies
-
Iowa5 days agoAddy Brown motivated to step up in Audi Crooks’ absence vs. UNI
-
Iowa6 days agoHow much snow did Iowa get? See Iowa’s latest snowfall totals
-
Maine3 days agoElementary-aged student killed in school bus crash in southern Maine
-
Maryland5 days agoFrigid temperatures to start the week in Maryland
-
Technology1 week agoThe Game Awards are losing their luster
-
South Dakota5 days agoNature: Snow in South Dakota
-
Nebraska1 week agoNebraska lands commitment from DL Jayden Travers adding to early Top 5 recruiting class
-
New Mexico3 days agoFamily clarifies why they believe missing New Mexico man is dead