Connect with us

Technology

Dangerous malware targets you through fake loan app

Published

on

Dangerous malware targets you through fake loan app

SpyLoan apps are everywhere and yet people keep falling for them. They promise easy loans with flexible repayment, but what they actually do is steal your personal data, including contacts, sensitive images and files. The moment you take a loan, they start blackmailing you using your own data against you.

Some of these apps do not even bother giving loans. They just grab your data and start the harassment. One such app has been making the rounds on the Play Store, racking up more than 100,000 downloads and putting thousands of Android users at risk of blackmail and extortion.

Stay protected & informed! Get security alerts & expert tech tips – sign up for Kurt’s The CyberGuy Report now.

A man scrolling on his smartphone (Kurt “CyberGuy” Knutsson)

How SpyLend malware spreads and leads to scams and extortion

SpyLend spread by posing as a credible financial management tool, “Finance Simplified,” on the Google Play Store, as reported by BleepingComputer. It attracted financially vulnerable individuals by offering fast loans with minimal documentation.

Advertisement

The app surged from 50,000 to 100,000 downloads in a single week despite red flags in user reviews about harassment and blackmail.

Once downloaded, the app requested excessive permissions far beyond what a typical financial app would need, including access to contacts, SMS messages, call logs, photos and location data. This allowed the malware to silently collect personal information from users’ devices.

The stolen data fueled a vicious cycle of scams and extortion. SpyLoan apps like SpyLend lure users with attractive loan terms, only to exploit their data for predatory lending practices. If users fail to meet repayment demands, the operators weaponize their information by harassing them, blackmailing them with threats of leaking private photos or contacting their friends and family, and creating a climate of fear and coercion.

In some cases, the extortion escalated to public shaming or even deepfake creation using stolen images, amplifying the psychological and financial toll on victims.

We reached out about this incident, and a Google spokesperson told us, “The app has been removed from Google Play. Android users are automatically protected against known versions of this malware by Google Play Protect, which is on by default on Android devices with Google Play Services. Google Play Protect can warn users or block apps known to exhibit malicious behavior, even when those apps come from sources outside of Play.” 

Advertisement

However, it is important to note that Google Play Protect may not be enough. Historically, it isn’t 100% foolproof at removing all emerging malware from Android devices.

Malicious app on Google Play (BleepingComputer) (Kurt “CyberGuy” Knutsson)

ANDROID BANKING TROJAN EVOLVES TO EVADE DETECTION AND STRIKE GLOBALLY

Sensitive data stolen by the app

SpyLend is a serious threat because it steals a huge amount of personal information. It digs into contact lists and call histories, reads text messages, including banking alerts, and grabs photos and videos from storage.

It also collects device details like the model and OS version, tracks location in real time every three seconds, records past locations and IP addresses, and it even saves the last 20 copied texts from the clipboard. On top of that, it gathers financial data like loan histories and banking SMS messages.

Advertisement

This stolen data is not just used for blackmail, as it is often sold to cybercriminals. By preying on people already struggling financially, SpyLend puts nearly every part of their digital lives at risk.

A Samsung phone (Kurt “CyberGuy” Knutsson)

ANDROID BANKING TROJAN MASQUERADES AS GOOGLE PLAY TO STEAL YOUR DATA

6 ways you can stay safe from SpyLoan apps

1) Avoid suspicious loan apps: Stick to apps from well-known banks, credit unions or lenders registered with the Consumer Financial Protection Bureau or other regulatory bodies. 

2) Install strong antivirus software: Use strong antivirus protection on all your devices to detect and prevent malicious apps. This can also protect against phishing emails and ransomware scams. The best way to safeguard yourself from malicious apps is to have antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe. Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices.

Advertisement

3) Download apps from reliable sources: It’s important to download apps only from trusted sources like the Google Play Store. You might say I am contradicting myself, but Play Store is still safer than other options out there. They have strict checks to prevent malware and other harmful software. However, even with the security measures provided by Google Play, downloading apps from the store does not guarantee 100% protection against malware or harmful software. Avoid downloading apps from unknown websites or unofficial stores, as they can pose a higher risk to your personal data and device. Never trust download links that you get through SMS.

4) Review app permissions carefully: If an app asks for unnecessary permissions, like access to your contacts, call logs or storage, do not install it. A legitimate loan app should only require essential permissions related to financial transactions.

5) Check reviews and red flags: Before installing any financial app, read user reviews carefully. If multiple people report harassment, blackmail or excessive permissions, avoid the app entirely.

6) Report and uninstall suspicious apps: If you encounter a SpyLoan app, immediately uninstall it and revoke its permissions. Report it to the Google Play Store, cybersecurity authorities and financial regulators to help prevent further victims. 

If you’ve shared sensitive information, consider changing passwords and securing your accounts. Consider using a password manager to generate and store complex passwords. Get more details about my best expert-reviewed Password Managers of 2025 here.

Advertisement

THE HIDDEN COSTS OF FREE APPS: YOUR PERSONAL INFORMATION

Kurt’s key takeaway

The promise of quick and easy money can be tempting, especially during tough times, making it easy to fall for these scams. However, there are safer and more reliable ways to take loans. As a general rule, it is best to avoid borrowing money through online apps unless they are from well-known financial institutions. Google also needs to take responsibility for allowing SpyLoan apps on the Play Store, even when user reviews clearly indicate they are malicious.

Do you think Google is doing enough to crack down on predatory loan apps? Let us know by writing us at Cyberguy.com/Contact.

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.

Ask Kurt a question or let us know what stories you’d like us to cover.

Advertisement

Follow Kurt on his social channels:

Answers to the most-asked CyberGuy questions:

New from Kurt:

Copyright 2025 CyberGuy.com. All rights reserved.

Advertisement

Technology

I’ve been waiting years for Animal Crossing’s best new features

Published

on

I’ve been waiting years for Animal Crossing’s best new features

I never felt done with my Animal Crossing: New Horizons island. Despite playing every day for two years, and racking up 1,700 hours of playtime, I somehow never finished decorating. I had plenty of ideas for my island, sure, but actually implementing them was another story: The decorating and terraforming systems that helped make New Horizons a huge success are also slow, manual, and cumbersome, and my patience for decorating and redecorating had finally worn thin.

Fast-forward a few years, and a very much unexpected update is coming to finally fix some of those pain points. Update 3.0 is launching on January 15th, 2026, alongside the Switch 2 Edition of New Horizons. And while the paid Switch 2 upgrade has some nice-to-haves (like Joy-Con 2 mouse controls for indoor decorating), it’s the free update that brings all the key new features.

I recently attended a virtual preview for the New Horizons upgrade and update, and there are two caveats: I have not yet played either the Switch 2 version or the new free content myself, and it’s hard to gauge the quality of the Switch 2 version’s visual and performance improvements over a Zoom call. (I still have some unanswered questions about the biggest performance issues on the original Switch, like the choppy frame rate on more densely decorated islands.) But seeing the 3.0 additions in action, it was easy to imagine myself finishing my island — or at least an island.

As shown in the October announcement trailer, update 3.0 makes much-needed quality-of-life fixes. You’ll finally be able to craft multiple items at once, and crafting will pull materials from your overall storage instead of your pockets, meaning you won’t have to do a bunch of inventory management just to craft some decor. Then there’s Resetti’s Reset Service, which can help you clean up entire sections of your island instantly so you don’t have to pick everything up individually in order to redecorate. Some players also noticed a very subtle but potentially impactful change to movement while terraforming that should hopefully make it a smoother process. And then, as if to show off those decorating improvements, Nintendo also added Slumber Islands.

Not to be confused with dreams, New Horizons’ online island-sharing feature, Slumber Islands are extra sandboxes for you to decorate and play with, where you can set the time of day and the weather and magically conjure up any item you have in your in-game catalog to decorate with, similar to the Happy Home Paradise DLC. You can build bridges and inclines instantly by talking to Lloid, rather than going through Tom Nook and waiting (or time traveling) a day. And while it seems like terraforming works the same on Slumber Islands, the apparent addition of strafing while terraforming — instead of having to constantly reorient yourself manually — should help at least a little bit. (It’s the first thing I’m going to test on January 15th, that’s for sure.)

Advertisement

For me, the worst part of decorating in New Horizons was having an idea, ordering all the furniture I’d need for it over the course of days, testing out the design, realizing it did not look the way I envisioned, and facing the tedious process of breaking it all down and starting over again brick by brick — or, at the very least, having to push and pull objects around for a while to see if I could make it work. The design process I saw on Nintendo’s Slumber Island during the preview, meanwhile, seemed quicker and smoother. Trying out an idea or aesthetic in that environment doesn’t sound like such a tall order.

Without any hands-on time, I can’t say if it will actually be noticeably easier to design and decorate with the 3.0 update. But I’m excited by the idea that I can go to my Slumber Island scratch pad and try out my designs before committing to them (and the cost in bells to get it all done) on my main island. And maybe, if I really like how it feels to decorate, I’ll make an entire Halloween-themed Slumber Island — the kind of island I’ve wanted to make for years but never did on my main island, where the seasons continue to change and actively ruin the vibe.

Continue Reading

Technology

Password manager fined after major data breach

Published

on

Password manager fined after major data breach

NEWYou can now listen to Fox News articles!

Any data breach affecting 1.6 million people is serious. It draws even more attention when it involves a company trusted to guard passwords. That is exactly what happened to LastPass.

The UK Information Commissioner’s Office has fined LastPass about $1.6 million for security failures tied to its 2022 breach. Regulators say those failures allowed a hacker to access a backup database and put users at risk.

Sign up for my FREE CyberGuy Report 
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

CHECK IF YOUR PASSWORDS WERE STOLEN IN HUGE LEAK

Advertisement

Why the LastPass breach still matters

LastPass is one of the most widely used password managers in the world. It serves more than 20 million individual users and around 100,000 businesses. That popularity also makes it an attractive target for cybercriminals.

The UK Information Commissioner’s Office fined LastPass for security failures tied to its 2022 breach.  (LaylaBird/Getty Images)

In 2022, LastPass confirmed that an unauthorized party accessed parts of its customer information through a third-party cloud storage service. While the incident initially raised alarms, the long-term impact has taken time to fully surface.

The ICO now says the breach affected about 1.6 million UK users alone. That scope played a major role in the size of the fine.

What regulators say went wrong

According to the ICO, LastPass failed to put strong enough technical and security controls in place. Those gaps made it possible for attackers to reach a backup database that should have been better protected.

Advertisement

The regulator added that LastPass promises to help people improve security, but failed to meet that expectation. As a result, users were left exposed even if their passwords were not directly cracked.

Were passwords exposed or decrypted?

There is still no evidence that attackers decrypted customer passwords. That point matters.

Despite the breach, security experts continue to recommend password managers for most people. Storing unique, strong passwords in an encrypted vault is still far safer than reusing weak passwords across accounts.

As one expert noted, modern breaches often succeed after identity access rather than password cracking alone. Once attackers get a foothold, the damage can spread quickly.

Although attackers accessed a backup database, there is no evidence that customer passwords were decrypted. (Kurt “CyberGuy” Knutsson)

Advertisement

Why the LastPass fine is a wake-up call for cybersecurity

The ICO called the LastPass fine a turning point. It reinforces the idea that security is about governance, staff training and supplier risk as much as software.

Users have a right to expect that companies handling sensitive data take every reasonable step to protect it.

Breaches may be inevitable, but weak safeguards are not.

LastPass on the UK data breach

We reached out to LastPass for comment on the UK fine, and a spokesperson provided CyberGuy with the following statement: 

“We have been cooperating with the UK ICO since we first reported this incident to them back in 2022. While we are disappointed with the outcome, we are pleased to see that the ICO’s decision has recognized many of the efforts we have already taken to further strengthen our platform and enhance our data security measures. Our focus remains on delivering the best possible service to the 100,000 businesses and millions of individual consumers who continue to rely on LastPass.”

Advertisement

MASSIVE DATA BREACH EXPOSES 184 MILLION PASSWORDS AND LOGINS

How to protect yourself after a password manager breach

Breaches like this are a reminder that security requires layers. No single tool can protect everything on its own.

1) Use a strong password manager correctly

Keep using a reputable password manager. Set a long, unique master password and enable two-factor authentication. Avoid reusing your master password anywhere else.

Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

Check out the best expert-reviewed password managers of 2025 at Cyberguy.com.

Advertisement

2) Rotate sensitive passwords

Change passwords for financial accounts, email accounts and work logins. Focus on services that could cause real damage if compromised.

3) Lock down your email

Your email account is the key to password resets. Use a strong password, two-factor authentication and recovery options you control. 

4) Reduce your exposed personal data

Data brokers collect and sell personal information that criminals use for targeting. A data removal service can help reduce what is publicly available about you. While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

Advertisement

The fine sends a warning to the entire cybersecurity industry. Companies that handle sensitive data must protect it with strong safeguards and oversight. (REUTERS/Andrew Kelly)

5) Watch for phishing attempts and use strong antivirus software 

After major breaches, scammers follow. Be cautious of emails claiming urgent account problems or asking for verification details. The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

6) Keep devices updated

Install updates for your operating system, browser and security tools. Many attacks rely on known vulnerabilities that updates already fix.

Kurt’s key takeaways

The fine against LastPass is about more than one company. It highlights how much trust we place in tools that manage our digital lives. Password managers remain a smart security choice. Still, this case shows why you should stay alert even when using trusted brands. Strong settings, regular reviews and layered protection matter more than ever. In the end, security works best when companies and we share the responsibility. Tools help, but habits and awareness finish the job.

Advertisement

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Do you believe companies are doing enough to protect user data, or should regulators step in more often? Let us know by writing to us at Cyberguy.com.

Sign up for my FREE CyberGuy Report 
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

Copyright 2025 CyberGuy.com.  All rights reserved.

Advertisement
Continue Reading

Technology

Silksong is getting a free expansion next year

Published

on

Silksong is getting a free expansion next year

It’s still hard to believe that Hollow Knight: Silksong actually came out this year, but now, we all have a new thing to wait for: the game is getting a free expansion in 2026, titled Sea of Sorrow. Team Cherry calls it the game’s “first big expansion.”

“New areas, bosses, tools, and more!” Team Cherry says in a blog post. “Hornet’s adventures continue in our nautically themed expansion, coming free for all players next year. We’ll keep further details a secret for now, but expect additional info shortly before Hollow Knight: Silksong – Sea of Sorrow releases.”

More than 7 million people bought Silksong, according to Team Cherry, and “millions more” played on Xbox Game Pass.

The original Hollow Knight is getting updated, too. Team Cherry is working on a Nintendo Switch 2 Edition of the game that “incorporates all the updates and enhancements that Silksong received on the platform: High frame-rate modes, higher resolutions, and many additional graphical effects.” Players who own the Switch version of the game will get the Nintendo Switch 2 Edition as a free update when it’s available in 2026.

Ahead of that launch, Team Cherry says it will be “updating all versions of the original game for current platforms, adding features and fixing bugs.” Those changes include “full 16:10 and 21:9 aspect ratio support for those of you with Steam Decks or ultrawide monitors,” and PC players can try the new updates in public beta.

Advertisement
Continue Reading

Trending