Connect with us

Technology

Screenshot-scanning malware discovered on Apple App Store in first-of-its-kind attack

Published

on

Screenshot-scanning malware discovered on Apple App Store in first-of-its-kind attack

Every tech expert will tell you the App Store is safer than Google Play Store. Some might even claim it is impossible to download a malicious app from the App Store, but they are wrong. 

While I admit the App Store is a secure and tightly controlled ecosystem, it cannot completely shield you. Security researchers have found that hackers are targeting several apps on the App Store to spread malware that steals information from screenshots saved on a device. 

The issue also affects those downloading apps from the Google Play Store.

STAY PROTECTED & INFORMED! GET SECURITY ALERTS & EXPERT TECH TIPS — SIGN UP FOR KURT’S THE CYBERGUY REPORT NOW

A person holding an iPhone. (Kurt “CyberGuy” Knutsson )

Advertisement

How the malware works and what makes it different

According to researchers at Kaspersky, this malware campaign is more advanced than typical info stealers, both in how it works and how it spreads. Instead of relying on social engineering tricks to get users to grant permissions like most banking trojans or spyware, this malware hides inside seemingly legitimate apps and slips past Apple and Google’s security checks.

One of its standout features is Optical Character Recognition. Instead of stealing stored files, it scans screenshots saved on the device, extracts text and sends the information to remote servers.

Once installed, the malware operates stealthily, often activating only after a period of dormancy to avoid raising suspicion. It employs encrypted communication channels to send stolen data back to its operators, making it difficult to trace. Plus, it spreads through deceptive updates or hidden code within app dependencies, an approach that helps it evade initial security screenings by app store review teams.

The infection vectors vary between Apple and Google’s ecosystems. On iOS, the malware is often embedded within apps that initially pass Apple’s rigorous review process but later introduce harmful functionality through updates. On Android, the malware can exploit sideloading options, but even official Google Play apps have been found to carry these malicious payloads, sometimes hidden within SDKs (software development kits) supplied by third-party developers.

Messaging app

Messaging app in the App Store designed to lure victims.

THE HIDDEN COSTS OF FREE APPS: YOUR PERSONAL INFORMATION

Advertisement

What’s being stolen, and who’s responsible?

The scope of stolen information is alarming. This malware primarily targets crypto wallet recovery phrases but is also capable of exfiltrating login credentials, payment details, personal messages, location data and even biometric identifiers. Some versions are designed to harvest authentication tokens, allowing attackers to access accounts even if users change their passwords.

The apps serving as malware carriers include ComeCome, ChatAi, WeTink, AnyGPT and more. These range from productivity tools to entertainment and utility apps. In some cases, malicious developers create these apps with full knowledge of the malware’s purpose. In others, the issue appears to be a supply chain vulnerability, where legitimate developers unknowingly integrate compromised SDKs or third-party services that introduce malicious code into their applications.

We reached out to Apple for a comment but did not hear back before our deadline. 

App Store

Messaging app in the App Store designed to lure victims. (Kaspersky)

Apple’s response to screenshot-scanning malware discovered in App Store

Apple has removed the 11 iOS apps mentioned in Kaspersky’s report from the App Store. Furthermore, they discovered that these 11 apps shared code signatures with 89 other iOS apps, all of which had been previously rejected or removed for violating Apple’s policies, resulting in the termination of their developer accounts.

Apps requesting access to user data such as Photos, Camera or Location must provide relevant functionality or face rejection. They must also clearly explain their data usage when prompting users for permission. iOS privacy features ensure users always control whether their location information is shared with an app. Also, starting in iOS 14, the PhotoKit API — which allows apps to request access to a user’s Photos library — added additional controls to let users select only specific photos or videos to share with an app instead of providing access to their entire library. 

Advertisement

The App Store Review Guidelines mandate that developers are responsible for ensuring their entire app, including ad networks, analytics services and third-party SDKs, complies with the guidelines. Developers must carefully review and choose these components. Apps must also accurately represent their privacy practices, including those of the SDKs they use, in their privacy labels.

In 2023, the App Store rejected over 1.7 million app submissions for failing to meet its stringent privacy, security and content standards. It also rejected 248,000 app submissions found to be spam, copycats or misleading and prevented 84,000 potentially fraudulent apps from reaching users.

WHAT IS ARTIFICIAL INTELLIGENCE (AI)?

What Google is doing to stop malware 

A Google spokesperson tells CyberGuy: 

“All of the identified apps have been removed from Google Play and the developers have been banned. Android users are automatically protected from known versions of this malware by Google Play Protect, which is on by default on Android devices with Google Play Services.”

Advertisement

However, it is important to note that Google Play Protect may not be enough. Historically, it isn’t 100% foolproof at removing all known malware from Android devices. Here’s why:

What Google Play Protect can do:

  • Scans apps from the Google Play Store for known threats.
  • Warns you if an app behaves suspiciously.
  • Detects apps from unverified sources (sideloaded APKs).
  • Can disable or remove harmful apps.

What Google Play Protect can’t do:

  • It does not provide real-time protection against advanced threats like spyware, ransomware or phishing attacks.
  • It does not scan files, downloads or links outside of Play Store apps.
  • It may miss malware from third-party app stores or sideloaded apps.
  • It lacks features like VPN protection, anti-theft tools and privacy monitoring.
password

Image of a person typing in their password on screen. (Kurt “CyberGuy” Knutsson)

HOW SCAMMERS USE YOUR PERSONAL DATA FOR FINANCIAL SCAMS AND HOW TO STOP THEM

5 ways users can protect themselves from such malware

1. Use strong antivirus software: Installing strong antivirus software can add an extra layer of protection by scanning apps for malware, blocking suspicious activity and alerting you to potential threats. The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe. Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices.

2. Stick to trusted developers and well-known apps: Even though malware has been found in official app stores, users can still minimize their risk by downloading apps from reputable developers with a long track record. Before installing an app, check its developer history, read multiple reviews and look at the permissions it requests. If an app from an unknown developer suddenly gains popularity but lacks a strong review history, approach it with caution.

Advertisement

3. Review app permissions carefully: Many malicious apps disguise themselves as legitimate tools but request excessive permissions that go beyond their stated purpose. For example, a simple calculator app should not need access to your contacts, messages or location. If an app asks for permissions that seem unnecessary, consider it a red flag and either deny those permissions or avoid installing the app altogether. Go to your phone settings and check app permissions on your iPhone and Android

4. Keep your device and apps updated: Cybercriminals exploit vulnerabilities in outdated software to distribute malware. Always keep your operating system and apps updated to the latest versions, as these updates often contain critical security patches. Enabling automatic updates ensures that you stay protected without having to manually check for new versions.

5. Be wary of apps that promise too much: Many malware-infected apps lure users by offering features that seem too good to be true — such as free premium services, extreme battery optimizations or AI-powered functionality that appears unrealistic. If an app’s claims sound exaggerated or its download numbers skyrocket overnight with questionable reviews, it’s best to avoid it. Stick to apps with a transparent development team and verifiable functionalities. 

HOW TO REMOVE YOUR PRIVATE DATA FROM THE INTERNET 

Kurt’s key takeaway

The new malware campaign highlights the need for stricter vetting processes, continuous monitoring of app behavior post-approval and greater transparency from app stores regarding security risks. While Apple and Google have removed the malicious apps upon detection, the fact that they made it onto the platform in the first place exposes a gap in the existing security framework. As cybercriminals refine their methods, app stores must evolve just as quickly or risk losing the trust of the very users they claim to protect.

Advertisement

Do you think app stores should take more responsibility for malware slipping through? Let us know by writing us at Cyberguy.com/Contact

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter

Ask Kurt a question or let us know what stories you’d like us to cover.

Follow Kurt on his social channels:

Advertisement

Answers to the most-asked CyberGuy questions:

New from Kurt:

Copyright 2025 CyberGuy.com. All rights reserved.

Continue Reading
Advertisement
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Technology

The head of a Biden program that could help rural broadband has left

Published

on

The head of a Biden program that could help rural broadband has left

1. Delays in getting broadband to the people. Some states are on the 1 yard line. A bunch are on the 5 yard line. More will be getting there every week. These more-sweeping changes will only cause delays. The administration could fix the problems with the program via waiver and avoid slowdowns. Shovels could already be in the ground in three states, and they could be in the ground in half the country by the summer without the proposed changes to project selection.

2. More people will get Starlink/Kuiper, and fewer people will get fiber connection. This could be dramatic, or it could be measured, depending on where the admin sets the threshold limit, and whether states are permitted to award projects above the new threshold on the basis of value per dollar, or if they’re forced to take the cheapest proposal, even if it provides poorer service.

3. The 3 states with approved Final Proposals remain in limbo. They are currently held in NIST review regarding their proposed FPFRs (the budgets accompanying their approved final proposals).

This makes no sense – these states are ready to go, and they got the job done on time, on budget, and have plans that achieve universal coverage. If the administration cares about getting shovels in the ground, states with approved Final Proposals should move forward, ASAP.

4. West Virginia (and soon additional states) who have completed their work, but don’t have approved Final Proposals also remain in limbo. They have a final proposal ready to go that gets exceptional service to all West Virginia homes and businesses. Like the three states with approved Final Proposals, only the current administration stands between them and getting shovels in the ground. If the administration cares about getting things done, they should allow any state that comes forward with a Final Proposal under the old rules in the next couple of months move forward with that plan.

Advertisement

5. No decision has been made about how much of the existing progress the 30 states who are already performing subgrantee selection should be allowed to keep. The administration simply cannot say whether the time, taxpayer funds, and private capital that were spent on those processes will be wasted and how much states will have to re-do.

6. The wireless industry will be, effectively, shut out of the BEAD program. There will be few, if any, locations that are above any new cost limit that will be able to be more cheaply served by fixed wireless than low earth satellites.

Continue Reading

Technology

Warning signs your mail has been fraudulently redirected

Published

on

Warning signs your mail has been fraudulently redirected

Change-of-address scams involve some of the most seemingly harmless personal information getting into the wrong hands. This can lead to a whole host of problems, including financial losses and identity theft, although change-of-address fraud is technically a form of identity theft.

This kind of fraud involves a scammer impersonating you to request a change of address with the United States Postal Service (USPS). 

Once they have your mail redirected to an address they control, they can go through it at their leisure, looking for mail they can steal and information they can use to perpetrate further scams, like taking out loans or credit cards in your name or using your identity to defraud others.

STAY PROTECTED & INFORMED! GET SECURITY ALERTS & EXPERT TECH TIPS — SIGN UP FOR KURT’S THE CYBERGUY REPORT NOW

USPS delivery truck    (Kurt “CyberGuy” Knutsson)

Advertisement

Here’s how it works, step by step

This detailed breakdown explains the process of a change-of-address scam, from initial targeting to the potential consequences and warning signs to watch for. 

Targeting

A person with criminal intent gets your postal address and full name, something that’s most easily done using a so-called people search site. People search sites, also known as people finder sites, are a kind of data broker that specializes in collecting, organizing and selling access to personal information. 

Making a fraudulent change-of-address request

The scammer then mails a change-of-address request to the USPS, providing your name and a new address he has access to. The online change-of-address form is generally more secure, requiring confirmation via a bank account. That’s why scammers will almost always mail in the request.

The form requires a signature, but this is unlikely to be verified when processing the request. So, the scammer will either find an image of your signature somewhere, steal a document that includes your signature or simply sign your name any which way. 

Harvesting sensitive documents and data

Now that they’ve redirected your mail straight into their hands, the scammer just has to patiently wait for sensitive mail to arrive. They’re on the lookout for anything they can use to steal from you or defraud you. Bank statements, tax documents, checks and even your household bills can be used to commit further acts of fraud and identity theft.

Advertisement

One of the scariest things a scammer can do once he has enough of your personal information is to commit deed fraud, otherwise known as home title theft. You’re far from helpless, though. There are telltale signs that you can watch for to catch change-of-address scams early.

The signs to look out for

The most obvious sign to watch for is a sudden and persistent drop in the amount of mail entering your mailbox. This only applies to mail addressed to you by name. Mail delivered to your address without an addressee, including mail addressed to “homeowner” or “occupant,” won’t be affected by a change-of-address scam.

The other major things to keep an eye on are your credit report, credit card statements and bank statements. You can request a free credit report from one of the three credit bureaus once per year.

mailbox

A mailbox in front of a house       (Kurt “CyberGuy” Knutsson)

HOW DATA BROKERS ARE FUELING ELDER FRAUD IN AMERICA

What to do if you think your mail has been fraudulently redirected

If you have good reason to believe that someone has redirected your mail without permission, don’t hesitate to take action. The sooner you catch this, the better. Here’s what you can do:

Advertisement
  • Start by keeping detailed records: Document everything that’s led you to believe your mail has been redirected. This includes the mail you were expecting, any communication with the senders of the missed mail (such as confirming dispatch dates), suspicious phone calls, texts or emails, and any unusual activity in your online accounts, bank accounts or credit reports.
  • Reach out to the USPS for help: Use the online locator to find and contact your local U.S. Postal Inspection Service (USPIS) office. They can assist with investigating fraudulent mail redirection.
  • Take action if identity theft is suspected: If you believe you’ve become a victim of identity fraud, visit the Federal Trade Commission’s identity theft portal. This resource will help you develop a recovery plan and guide you through the steps to protect yourself.

Taking these steps will put you on the road to regaining control and getting through what can quickly become a stressful situation.

WHAT IS ARTIFICIAL INTELLIGENCE (AI)?

mail

A stack of mail   (Kurt “CyberGuy” Knutsson)

DON’T LET THIS CREDIT CARD FRAUD NIGHTMARE HAPPEN TO YOU

Stop change-of-address scammers in their tracks

Prevention is better than a cure, and, luckily, there’s a lot you can do to stop change-of-address scams before they start.

1. Invest in personal data removal services: Have your personal information removed from data broker databases, including people search sites. They’re the first port of call for many scammers. Without these companies in the mix, scammers aren’t likely to come across your address in the first place.

A reputable personal information removal service can take your data down from hundreds of sites and keep it off by resending removal requests, even as data brokers try to add your information to their databases.

Advertisement

While no service promises to remove all your data from the internet, having a removal service is great if you want to constantly monitor and automate the process of removing your information from hundreds of sites continuously over a longer period of time. Check out my top picks for data removal services here. 

2. Reduce the amount of sensitive mail in your mailbox: Start by switching to paperless options wherever available. This will dramatically reduce the amount of sensitive mail heading to your mailbox, leaving criminals with little value to steal. Check your mail daily, as soon as possible after it’s delivered. Get someone to do this for you if you’re away. Some redirection scams start with mail being stolen from your mailbox. Definitely avoid allowing your mailbox to overflow.

3. Secure your mailbox: Consider upgrading to a locked mailbox to prevent mail theft. If you live in an area prone to mail theft, this simple step can stop criminals from intercepting sensitive documents before they even reach you.

4. Use an identity theft protection service: Identity theft companies can monitor personal information like your Social Security number, phone number and email address and alert you if it is being sold on the dark web or being used to open an account.  They can also assist you in freezing your bank and credit card accounts to prevent further unauthorized use by criminals. See my tips and best picks on how to protect yourself from identity theft.

Advertisement

5. Set up USPS Informed Delivery: Enroll in USPS Informed Delivery, a free service that lets you preview images of incoming mail before it arrives. This can help you spot missing mail early and identify potential issues with mail redirection.

6. Report suspicious activity immediately: If you notice anything unusual, such as missing mail or unauthorized changes to your accounts, report it right away. Contact the USPS, your bank and the Federal Trade Commission to ensure the issue is documented and addressed promptly.

BEWARE OF FRAUDSTERS POSING AS GOVERNMENT OFFICIALS TRYING TO STEAL YOUR CASH

Kurt’s key takeaways

Change-of-address scams might sound like an unlikely threat, but they can wreak havoc on your finances and peace of mind if left unchecked. By staying alert, securing your personal information and taking proactive measures like monitoring your mail and credit, you can greatly reduce the risk of falling victim to these scams. Remember, catching fraud early is key. So, don’t hesitate to act if something feels off.

Advertisement

What do you think should be done to prevent change-of-address scams? Let us know by writing us at Cyberguy.com/Contact

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter

Ask Kurt a question or let us know what stories you’d like us to cover

Follow Kurt on his social channels

Answers to the most asked CyberGuy questions:

Advertisement

New from Kurt:

Copyright 2025 CyberGuy.com.  All rights reserved.  

Advertisement
Continue Reading

Technology

Air taxis: the latest on the flying electric cars bringing the Jetsons dream to life

Published

on

Air taxis: the latest on the flying electric cars bringing the Jetsons dream to life

There’s a future where we don’t need roads and regular folks like you and me can jump into a boat-sized electric pod and just fly anywhere on a whim. While we’ve been perfecting the miracle of human flight for more than a century, instant air transportation has long been relegated to science fiction.

But in the last decade, many companies have stepped up to help get flying cars and air taxis out of the Hollywood movie magic bubble. Startups like Joby Aviation and Archer are building electric vertical take-off and landing (eVTOL) aircraft that can taxi several people around in the sky without burning nasty fuel. The air taxi dream is already passing some regulatory milestones: the FAA has now established rules.

Although these vehicles aren’t exactly the “flying cars” we’ve imagined, this is a rapidly growing new field with big established automakers like Toyota, Hyundai, Stellantis, and others either bankrolling their own ventures or one of the dozens of startups. And there’s a whole lot of drama and unpredictability in this new industry, from fighting over “stolen” patents to the companies that’ve failed to survive, like Lilium and the Larry Page-funded Kitty Hawk. Scroll down to read the latest on air taxis.

Continue Reading

Trending