As Android Central reports, users have received unexpected emails telling them their phone number has been verified for secondary Google accounts.
Like me and many others, you may have one Google account for everyday use, another for work, and a third for things you would rather keep separate. But if you’re using an Android phone, those accounts may have something in common that you didn’t intend or even know about: your phone number.
Google’s own documentation confirms that phone number verification is on by default and adds your number to all Google accounts signed in on the device. This applies to both existing accounts and any you add later.
Google says phone number verification helps support features such as signing in, account recovery, Rich Communications Services (RCS) messaging, and finding or securing a lost device.
But it also means that a number you intended to use with your main account can become associated with a secondary account simply because both are signed in on the same Android device.
If you deliberately left your phone number off a secondary account, this links it to your real identity without you knowingly making that connection. Your number doesn’t automatically become public, but Google gains another way to connect accounts you wanted to keep separate.
“After some digging I learned that my Google account was added to my wife’s phone’s accounts when I logged in on the Play Store, but was not removed when I logged out after noticing the tracking issue.”
While that particular issue should be solved by Google’s move toward device-based Timeline storage, unwanted phone number associations need to be removed manually.
How to remove your number from separate accounts
Phone manufacturers arrange their settings differently, so there may be some differences in menu names and locations. We tried to make sure everyone can follow these instructions, but there might be makes and models where you get stuck. Feel free to ask in the comments and maybe others with the same phone can help you.
Step 1: Turn off automatic phone number verification
This needs to be done on the Android phone itself:
Open the phone’s Settings app.
Tap Google. On some phones, this may be called Google services or Google services and preferences.
Open All services.
Under Privacy & security, tap Phone number verification.
Turn off Verify phone numbers automatically, or the equivalent verification switch shown on your phone.
Turning this off does not remove numbers already added to your accounts.
Step 2: Check which accounts already have your number
This step can be done in a browser, so should be the same for everyone.
Open a browser and type myaccount.google.com into the address bar.
Check the account picture or initial in the top-right corner. Make sure you are looking at the account you want to inspect.
Select Personal info.
Find Contact info, then select Phone. Depending on the layout, you may see Phone directly.
Select any number listed to review its details and how it is used.
To remove the number from that account, select the delete icon and follow the on-screen instructions. Repeat for each account you want to check.
Step 3: Check for other uses of the number
There’s a wrinkle. Google says changing a number in your Google Account only affects some services. Other services, such as 2-Step Verification, may use the number separately and may not all appear on the Phone page.
On each account you are cleaning up:
Check the number’s Usage section on the Phone page to see which services are listed.
Visit Security or Security & sign-in and review your recovery phone and 2-Step Verification settings.
If you use another Google service that has its own phone number settings, check those settings too.
If your goal is to remove the number entirely from a particular account, don’t assume deleting it from Personal info has removed every separate use. Check those security settings as well, but make sure to keep a working alternative sign-in and recovery method before removing the number.
Android Central reports that some users say automatic verification switches itself back on after they disable it. Those are user reports, not confirmation that this happens on every phone. But if you’re concerned, check the setting again later.
Scammers know more about you than you think.
Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.
Only a few day ago I linked to a massive collection of original Palm OS development resources, and today we can take a look at what it was like to put all of those resources into practice: the original source code for the Palm OS port of Lemmings. With these resources combined, there’s no excuse to not building any Palm OS applications. I’d really like a modern email client, a Fediverse client, and a slightly more modern browser surely wouldn’t hurt.
This repository contains approximately 1 GB of historical Palm OS development material, collected over many years of working with the platform.
The archive includes a mixture of publicly distributed development resources, personal development material, technical references, and historical artifacts.
Amos B. Batto has published an incredibly detailed look at the state of Linux on smartphones. It’s an excellent read you really shouldn’t skip.
Five years ago, Linux phones looked like they were poised to become a viable alternative to the Android/iOS duopoly that has an iron grip on the mobile phone industry. Sadly, after a brief flash of activity and community engagement with the release of the Purism Librem 5 and the PINE64 PinePhone in 2020, the Linux phone market has generally stagnated. This stagnation occurred partly because of the problems at Purism and PINE64, but also because the available Linux SoC’s weren’t up to the task of running a modern smartphone, and the hardware industry wasn’t providing any good alternatives with good free/open source drivers. In addition, Plasma Mobile and Phosh were still inchoate mobile interfaces at the time, and there wasn’t a good distro option to run these interfaces on Android kernels with a normal integrated mobile SoC. The poor performance of the PinePhone and Librem 5 and the problems with the PinePhone Pro and the Librem 5 refunds sapped people’s enthusiasm and willingness to take a chance on the next Linux phone.
Fortunately, all of these conditions are changing, and I believe that there is now the possibility that Linux could finally become a viable alternative to Google’s Android and Apple’s iOS in the mobile space, just like desktop Linux has become a viable alternative to Windows and Mac OSX on the PC over the last three decades. This isn’t to say that mobile Linux will fundamentally challenge the business of Google or Apple, but the conditions are ripe for a small market to arise for Linux phones, similar to the way that people can currently buy Linux PCs from a number of small companies, such as TUXEDO, System76, Purism, Slimbook, ThinkPenguin, Ubuntushop.biz, Entroware, Star Labs, Juno, Laptop with Linux, Linux Certified, ArkPC, etc.
I’m not quite as optimistic as Batto, and that’s almost exclusively down to how running Android applications through compatibility layers will remain an absolute necessity for anyone trying to use one of these Linux smartphones today. As long as crucial applications and services required to function in a modern society, like banking, messaging, government services, and so on, require the use of an Android application when using a Linux smartphone, I just don’t think any significant number of people will be switching over.
What’s needed is something that will force these crucial services to become available on platforms other than Android and iOS, since I don’t think any of them will do so of their own volition. The only way I can see this happening is if the European Union, spurred on by our desire to reduce our dependence on adversarial US companies, mandates that several services marked as crucial must make themselves available on platforms other than Android and iOS.
I doubt that will happen, but I honestly don’t see Linux smartphones becoming anything more than a mere curiosity you fiddle with at home, while carrying an Android phone or iPhone as your actual phone.
Trump Mobile apparently failed to obtain necessary authorizations to operate the international calling portion of its phone service, Sen. Maggie Hassan (D-N.H.) wrote in a letter to the company today.
Her letter said Trump Mobile also doesn't appear to have submitted a required plan for fighting robocalls. Trump Mobile's key business partner, Liberty Mobile Wireless, did make a robocall database filing, but it was not complete, Hassan said.
Hassan's letter raised questions about Trump Mobile's security related to a report that hackers stole personal data of 3,615 customers and Trump Mobile's previous confirmation that a vendor it uses exposed customers' personal data on the Internet. Hassan alleged that Trump Mobile failed to follow multiple FCC filing rules that are supposed to help ensure the security of mobile services.
When I went to Google’s presentation on its new Googlebooks, it was an act of convenience. I happen to be near New York City, so I’m used to schlepping my way onto a bus for media events. As the Performance desk lead, I really don’t have any personal interest in Google’s successor to its Chromebook venture, especially since it’s packed with “AI.” So I was there mostly to support our AI expert, Ben Patterson.
But one bit of news caught my attention: You get access to the bootloader.
A brave new (old) world
This requires a bit of context. See, I’m an Android guy. I started my tech journalism career on Android-focused sites, back when smartphones were still the hottest, newest tech on the planet, and tons of people were obsessing over every new model. One of the most exciting parts of Android was the ability to modify the software fairly easily. You could “root” them to get access to all the various bits and bobs, or even load up your own custom-cooked, open-source operating system, colloquially called a ROM.
I have tried all of these flavors of custom Android ROMs.
Various
Rooting and ROMs are still a thing in the Android world, but they’ve fallen off by an order of magnitude since the glory days of 2010-2015. Somewhat because phones are far more locked down, aside from some where open access is a feature, like Google’s Pixel line or the Fairphone. But mostly it’s because phones are powerful and flexible enough to do pretty much everything you want now, no risky or skilled modifications required.
I installed an AOSP-based ROM on my Barnes & Noble Nook Color e-reader to turn it into one of the first full-power Android tablets. But I can’t remember the last time I looked at an Android phone’s bootloader, despite trying dozens (maybe hundreds!) of different ROMs back in the day.
Googlebooks are, at least in the purest technical sense, Android-powered laptops. They’re running Intel and Qualcomm chips — some of the same ones that power Windows laptops, in fact. But Android software is based on open-source code, loath as Google is to admit that these days. That means it should be possible, if not easy or straightforward, to modify it. At the NYC event I asked various representatives from Google and its hardware partners if they would allow users to wipe the laptops clean and install Windows, and they didn’t have an answer ready for me.
Foundry
Fast forward to this week, and we have confirmation via Google support that Googlebooks will arrive with an unlockable bootloader. For those of you who’ve never dug deep into an XDA forum to find a Gapps ZIP that will work with your tweaked CyanogenMod build, that means you should be able to load up custom ROMs.
That’s got the nerdiest part of my soul extremely excited. Custom ROM developers advanced Android’s early years in ways that might be invisible to those outside of that particular niche. Google, Samsung, and others apparently took direct inspiration from the ways that developers modified their software in order to improve it, particularly in terms of the user interface and performance.
You know how you can swipe up from the bottom of your phone to go home and swipe on the side to go back? How there’s an easy shortcut to turn on the rear camera flash and make a quick flashlight? Yeah, both of those showed up in custom Android ROMs and other modifications years before they were stock in either Android or iOS. The prospect of seeing users customize the operating system in Googlebooks is absolutely tantalizing.
Google
…but it’s not very likely to happen
But there’s a fly in this particular ointment. The early Android ROM scene was so vibrant specifically because millions and millions of people were excited about smartphones. It was the Wild West, and everybody wanted the fastest horse. For the same thing to happen with Googlebooks, Google’s AI-laden “reinvention” of the laptop, people will need to be excited about Googlebooks. And I don’t see that happening, not even to the degree that people were interested in Chromebooks when they debuted back in 2011.
There’s an extremely narrow slice of the consumer market for whom I think a Googlebook purchase makes sense. You need to be A) really, really happy with your Android phone, B) really want a new laptop, C) not reliant upon any tools or software that only works on Windows or Mac, and C) not particularly bothered by a lack of native game support. Oh, and you need to have a budget of about a thousand dollars or more, because even limiting the RAM to 8GB isn’t making Googlebooks cheap.
Michael Crider/Foundry
There’s a faint possibility of an exciting new world in custom laptop software. But it’s very faint indeed without a large, dedicated group of people making it happen. And as much as I want to see it, I doubt that I will.
Google has published security fixes for Android. The October updates are available for Android operating system versions 14, 15, 16, 16-qpr2, and 17 where “qpr” stands for Quarterly Platform Release. QPRs are interim updates Google pushes out between major yearly cycles.
These Android security bulletins contain valuable information for Android users. The updates are important as they fix several vulnerabilities rated as Critical, which can be exploited without users even doing anything.
However, we don’t write about them very often. The main reason for that lack of attention is that many Android users aren’t able to get the updates immediately and lots of others will never see them.
Google’s October fixes list Android 14 and newer, but a substantial share of the Android ecosystem still runs older software. In the distribution figures reported about last year, roughly four in ten devices were running Android 12 or earlier. This was while Android 13 still received updates which ended early March 2026.
And then there is the patch gap caused by device vendors meaning that even phones that remain supported may have to wait until the vendors test and sometimes modify the patches, so they work with their devices. And other vendors are on a different stride. For example, Samsung lists devices including the Galaxy S22 series and several Galaxy A models on a quarterly rather than a monthly security-update schedule.
You can imagine that cybercriminals love to get their hands on known vulnerabilities that many users have not yet been able to patch. Looking at the number of users that are unable to patch immediately that makes for an enormous target group.
How to stay safe
Get the updates as soon as they are made available to you is the most important word of advice here.
For most Android phones this is the general idea: open Settings, find Software update or System update (sometimes under System or About phone), check for updates, and follow the instructions to download, install, and restart. The menu names vary between vendors and even models, but the process is broadly the same.
If that doesn’t work for you or you can’t find instructions for your specific device, post what you’re looking for in the comments. We have lots of helpful readers.
Free Mobile, one of France’s main cellular providers, was fined €27 million by France’s data protection regulator, the CNIL, in January over failures to protect customer data. The October 2024 breach allowed an unauthorized party to access sensitive customer records, including bank account details and login information. Since the breach, we’ve seen many poorly written scam campaigns targeting Free Mobile customers.
However, over the past few weeks, a well-written scam has appeared, closely copying the design of the official Free Mobile website and email templates.
One of our employees, who is a Free Mobile customer, received this phishing email on Wednesday, September 30. The message used the same logo and template as legitimate emails from the company, but came from the suspicious email address freemobile-regularisation[@]knowledgegrowthcenter[.]help. It included a link that appeared to point to regularisation.free.fr :
The email tells the user that an invoice of €9.99 needs to be paid to avoid having the customer’s service suspended. Clicking the link opens a redirection chain:
Malwarebytes can help protect you from these threats, but treat unexpected messages about your accounts and invoices with caution:
Don’t follow links in unsolicited emails. If a message concerns your account, open the official Free Mobile app or website directly, or call the official help line at 3244.
Check the actual domain in your browser’s address bar to see if it matches what you expect—https://mobile.free.fr in this case.
Free Mobile, one of France’s main cellular providers, was fined €27 million by France’s data protection regulator, the CNIL, in January over failures to protect customer data. The October 2024 breach allowed an unauthorized party to access sensitive customer records, including bank account details and login information. Since the breach, we’ve seen many poorly written scam campaigns targeting Free Mobile customers.
However, over the past few weeks, a well-written scam has appeared, closely copying the design of the official Free Mobile website and email templates.
One of our employees, who is a Free Mobile customer, received this phishing email on Wednesday, September 30. The message used the same logo and template as legitimate emails from the company, but came from the suspicious email address freemobile-regularisation[@]knowledgegrowthcenter[.]help. It included a link that appeared to point to regularisation.free.fr :
The email tells the user that an invoice of €9.99 needs to be paid to avoid having the customer’s service suspended. Clicking the link opens a redirection chain:
Malwarebytes can help protect you from these threats, but treat unexpected messages about your accounts and invoices with caution:
Don’t follow links in unsolicited emails. If a message concerns your account, open the official Free Mobile app or website directly, or call the official help line at 3244.
Check the actual domain in your browser’s address bar to see if it matches what you expect—https://mobile.free.fr in this case.
Over the last few days, Google issued several different Chrome updates.
On September 22, Google released a Stable Channel Update for Desktop. This is the most important one for desktop users. It brings Chrome to version 154.0.8037.57 for Linux and versions 154.0.8037.57/.58 for Windows and Mac. The update includes 108 security fixes including 11 rated Critical.
It will roll out over the coming days and weeks.
One day later, Google released Chrome 155 for Android, version 155.0.8059.16, to a small percentage of users. It may not be available on Google Play for everyone yet, but keep an eye out for it. Google says it includes stability and performance improvements.
On top of these, Chrome 155 is also available in the Beta channel. The Android release is an Early Stable rollout, meaning Google sends it to a small share of users first, to spot unexpected compatibility or reliability issues before expanding it to everyone. Beta is a separate prerelease version for people who want to try upcoming features roughly four to six weeks before Stable. It is relatively polished but can still contain bugs, so it is best suited to testing rather than everyday use.
How to update Chrome
The easiest option is to allow Chrome to update automatically. But you can end up lagging behind on updates if you never close your browser or if something goes wrong, such as an extension preventing the update.
If you don’t want to wait for the rollout to reach you, manually updating is easy. open About Google Chrome from Chrome’s settings or Help menu. Chrome will check for updates. If one is available, click Relaunch to apply it.
Some of the desktop security fixes deserve a closer look.
Let’s start with CVE-2026-95350, a buffer overflow flaw in ANGLE, Chrome’s graphics-translation layer.
A buffer overflow is a bug in code that allows an attack to happen when a program puts more data into an area of memory than it can hold. Essentially, the attacker writes garbage data that fills up the memory, then writes code that overwrites existing code in adjoining memory, which later gets executed by the vulnerable process.
A crafted webpage could potentially trigger the flaw, which could lead to memory safety bugs, including browser crashes or possible code execution.
Another Critical buffer overflow bug in ANGLE is tracked as CVE-2026-95281. A malicious webpage could potentially reach vulnerable graphics-processing code, so the bug may enable serious impacts such as browser compromise, but Google has not provided exploitation details.
And then there is CVE-2026-95357, an out-of-bounds write in Chrome’s GPU component. This means a program could write data outside its intended area of memory.
The GPU component is the part of Chrome that handles how graphics work with your computer’s graphics processor.
Stop threats before they can do any harm.
Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →
Researchers at Zimperium’s zLabs have analyzed an Android Trojan that uses an automated, multi-stage infection process.
What’s new is that RatHat gives a live AI assistant the keys to the accessibility tree of the infected device and uses it to determine where to tap or scroll, rather than following a hardcoded script.
The variable attack path makes it harder for signature- and rule-based mobile security tools to detect this Trojan.
It also abuses Android Debug Bridge (ADB), a legitimate tool that lets a computer communicate with an Android device. By turning on Wireless Debugging, RatHat can escape the normal app sandbox.
The attack
The infection chain is unusually elaborate for a mobile threat, combining social engineering, accessibility abuse, and remote AI decision-making into a single pipeline.
Victims are lured through smishing (SMS phishing) texts and malicious ads that lead to fake download pages, sometimes disguised as a popular streaming app or even a browser like Chrome. These pages trick people into sideloading a malicious APK (Android Package Kit).
Once installed, the app pressures the user into enabling Android’s Accessibility Service, using a fake “network restriction” excuse or bogus financial incentive. Accessibility services run in the background and can inspect screen content and interact with apps on the user’s behalf.
With accessibility access, the malware silently taps through Developer Options, turns on Wireless Debugging, and reads the six-digit pairing code straight off the screen. It then pairs with the infected device without a person or computer to complete the process. This is a known, legitimate Android feature (normally used by app developers to test on a phone over Wi-Fi) that RatHat repurposes for self-escalation.
That self-pairing gives the malware a shell-level ADB session, which it uses to drop two disguised native binaries: A Go-based “agent” that runs system commands with elevated privileges, and a reverse-proxy client that opens a persistent tunnel back to the attacker’s server, bypassing firewalls and NAT (Network Address Translation).
To steal login credentials, the Trojan creates overlays for targeted apps, most of which are financial. These overlays can also steal one-time passwords (OTPs) and multi-factor authentication (MFA) codes.
Perhaps its most novel capability records raw touch coordinates (where the finger touches the screen) directly from the input driver. It then matches those coordinates against a database of known keypad and pattern-lock layouts to reconstruct PIN codes and unlock patterns, completely bypassing protections against screen-reading.
Other capabilities include intercepting SMS messages, a form of semi-autonomous device control provided by the AI service, and the ability to restore the malicious app after it has been uninstalled using a hidden background program.
How to stay safe
Most of RatHat’s tricks depend on convincing someone to sideload an app and grant it accessibility permissions, which means the usual mobile security advice remains the strongest defense.
Only install apps from Google Play or another trusted official store. This does not guarantee safety, but it significantly reduces the risk.
Be suspicious of any app that asks you to enable Accessibility Service for reasons unrelated to accessibility. Consider Android’s Advanced Protection Mode, which Google has started using to restrict which apps can request accessibility permissions in the first place.
Never enable Developer Options or Wireless Debugging unless you understand why you need them. Legitimate apps have no reason to ask for them.
If you already use Malwarebytes Mobile Security on your Android, you are protected. Our Text Protection feature will have helped prevent you from tapping the link in the first place. We also detect this threat as Android/Trojan.Exploit.RatHat. If you don’t use it yet, get Malwarebytes Mobile Security here.
If your device is infected with RatHat, you will need to perform a factory reset because its persistence mechanism can survive normal app removal.
Since early May 2026, we’ve been monitoring a large phishing campaign based on T-Mobile rewards points.
The messages falsely warn that a customer’s rewards points are about to expire. They aren’t legitimate account notices: They use urgency, invented point balances, and phishing links to push recipients into acting before they can verify the claim.
A typical message says that a T-Mobile Rewards account holds 18,400 points, gives an imminent expiry date, and states that unused points will be removed under the program’s terms. These details make the message look as though it was written specifically for the recipient, even though it was sent to many people.
“T-Mobile Rewards Points Reminder: Your Points Are About to Expire
Dear Customer,
We are hereby reminding you that your T-Mobile Rewards account points are about to expire. You currently have 18,400 points, which will expire on June 4, 2026, if unused.
Your Points Overview:
Current Balance: 18,400 Points
Expiry Date: {today or tomorrow}
Points will not be recovered after this date.
Redeem Points:
Visit:
https://t-mobile.{rotating domains}.top/pay
Use the T-Mobile App: Account > Rewards & Benefits
Our points expiry policy aims to ensure the fairness of the program and encourage active participation. Please don’t let these valuable points go to waste.
Thank you for choosing T-Mobile.
Customer Service Team”
This phishing operation does not rely on a single, identical SMS. We found more than 1,000 closely related campaign templates with a semantic similarity score of at least 0.60. The 199 closest matches all scored at least 0.95.
This means the variations only change superficial elements, such as the salutation, headline, expiry date, point balance, and whether the message is called a “reminder,” “alert,” or “important update.” The central story remains the same: T-Mobile rewards points are supposedly expiring, and the recipient must follow a link to redeem them as soon as possible.
The messages use formal but generic language, such as “Dear T-Mobile Customer,” “Dear Valued Customer,” or “T-Mobile User,” rather than naming the recipient or providing verifiable account information.
Detection events for the T-Mobile rewards phishing campaign
The campaign began slowly before producing two huge spikes in activity. The green line shows detections of message variants seen previously, while the red line shows messages detected on the first day that particular variant appeared. We’re still seeing messages from the campaign, although activity has fallen considerably since those spikes.
The scam relies on a familiar social engineering formula: a valuable-looking reward, a deadline, and a simple action that supposedly protects the customer from losing out. A recipient who has a T-Mobile account may click first and question the message later.
The links use rotating domains designed to look as though they belong to T-Mobile. Their purpose is to persuade recipients to follow the link to supposedly redeem their points. Do not enter login credentials, personal information, payment details, or verification codes after following a link in an unsolicited message.
How to stay safe
The anonymized data used in this analysis was gathered through Text Protection in Malwarebytes Mobile Security, which alerts users to potentially malicious or scam text messages.
You can also reduce your risk by following these tips:
Don’t follow links in unsolicited messages. Instead, open the alleged sender’s website or app independently and check for notifications there.
Check the domain in your browser’s address bar to make sure it matches the site you expected to visit.
Malwarebytes Scam Guard can help you determine whether a message is a scam and advise you on what to do next.
The URLs in this campaign are very short-lived. The criminals used at least 81 domains over four months, but the domains follow a recognizable pattern that is blocked in Malwarebytes Browser Guard.
IOCs
Example domains showing the pattern used by the campaign:
t-mobile.biktpw[.]top
t-mobile.cugbjl[.]top
t-mobile.cymfjd[.]top
t-mobile.gdikxv[.]top
t-mobile.hdzcnb[.]top
t-mobile.koxetp[.]top
t-mobile.nxdcfp[.]top
t-mobile.pkrbai[.]top
t-mobile.qfrhkt[.]top
t-mobile.qscizj[.]top
t-mobile.tmfncb[.]top
t-mobile.vmnqsu[.]top
Stop threats before they can do any harm.
Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →
Google has released its September 2026 Pixel Update Bulletin, fixing 110 vulnerabilities, including one that it says “may be under limited, targeted exploitation.”
The bug is not described as a simple remote takeover, but as a vulnerability that could give an attacker who already has a foothold on a phone more power than they should have.
Although Pixel devices also run Android, they receive separate security updates and bug fixes from the standard monthly patches distributed to Android manufacturers because of the unique hardware platform Google controls directly and its exclusive features and capabilities.
To apply this month’s security updates, Pixel users should go to Settings > Security & privacy > System & updates > Security update, tap Install, and restart their device to complete the update process.
A supported device with the 2026-09-05 patch level is up to date. After updating, check that the Android security update level shows September 5, 2026, or later.
Technical details
Google says it there are indications that the vulnerability, tracked as CVE-2026-58704, may be under limited, targeted exploitation. Found in the cellular modem, it is a possible permission bypass caused by a logic error in the code. This could lead to remote escalation of privilege (EoP) with no additional execution privileges or user interaction needed.
The vulnerability affects the modem component of Pixel devices and is rated high severity. The modem is the part of a smartphone that handles communication with mobile networks. It allows a phone to connect for calls, texts, and mobile data. Because it is such an important component, a flaw affecting it deserves attention, even if the conditions needed to exploit it limit the number of potential victims.
The vulnerability does not mean every unpatched Pixel can be hacked from anywhere on the internet, nor has Google said that simply being within wireless range of a phone is enough. The available information indicates that an attacker needs access to an adjacent network and basic privileges on the targeted device, but it does not explain how those privileges are obtained.
Attackers commonly need more than one step to compromise a well-protected device. One weakness may give them a limited foothold, while another lets them escape restrictions and gain access to more sensitive functions or data.
This is why bugs like this can be especially useful in targeted operations. An attacker may combine the modem vulnerability with another exploit, a malicious app, stolen credentials, or physical access to the device. Each part of the chain brings the attacker one step closer to compromising the device: getting in, gaining more privileges, and accessing the information or functions they’re after.
While Android users should always install the latest update offered by their device manufacturer, this particular zero-day appears in the Pixel-specific bulletin. Google’s Pixel phones use hardware and software components that other Android manufacturers do not necessarily share, including the affected modem component. If you have another Android brand, you won’t receive this specific Pixel fix, but you should still check for your manufacturer’s latest monthly security update.
Scammers know more about you than you think.
Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.
Researchers at Group-IB found that the Android banking Trojan Gigabud can create a separate work profile on an infected phone and run a cloned banking app inside it. The attacker can then carry out fraudulent transactions in the new profile, potentially separating them from signs of malware detected elsewhere on the device.
To do this, Gigabud installs Vwork, a malicious version of the legitimate open-source tool Shelter. Shelter normally lets Android users isolate apps or run second copies of them in a work profile. Vwork modifies those functions so that Gigabud can control them remotely.
The aim is to clone a target banking app into the new work profile, then let the operator commit fraud there. Group-IB says this can break the connection between malware detected in the personal profile and a risky transaction originating from the work profile, potentially weakening bank-side anti-fraud or in-app malware-detection systems that do not correlate activity across Android profiles.
Android work profiles are normally used to keep work apps and data separate from personal ones. Because apps in different profiles are isolated from each other, a banking app or security tool may not connect malware detected in the personal profile with something taking place in a cloned app in the work profile.
How an attack works
Victims are lured into sideloading a fake airline, tax, or government app through phishing sites, messages, or social media.
To take over the device, Gigabud asks for Accessibility access, overlay permission to display over other apps, and an exemption from battery-optimization. These permissions enable remote interaction and credential-theft techniques such as overlays.
The sideloaded app checks which other apps are installed and tells the operator which relevant banking targets are present.
Fake banking-login overlays steal both banking credentials and the device’s PIN.
The operator installs Vwork, which creates a new work profile on the device and clones the selected banking app. Vwork differs from Shelter in ways that make it useful to malware. It removes protections on cross-profile interaction, exposes components that can be used to set up a profile, clone and list apps, and open apps, and hides its launcher icon.
The operator can then remotely carry out transactions from the newly created profile, with the option to hide activity behind a black screen.
This is how Gigabud turns Android’s profile separation into a fraud tool: after compromising a phone, it creates a second profile, places a cloned banking app inside it, and performs the transaction from there. The result can be a dangerous gap between a malware alert in one profile and a fraudulent banking session in another.
How to stay safe
The immediate protection advice is familiar but important:
Sideloading. Install banking and other apps only from the official store or a direct link to the publisher’s website.
Install requests. Treat unsolicited requests to install an APK as a likely scam. If you’re unsure whether something’s a scam, run it through Malwarebytes Scam Guard.
Permissions. Do not enable Accessibility or “display over other apps” for a supposed airline, tax, delivery, or government app. Overlays require explicit user approval on modern Android, so a request like this is a red flag.
Protection. Use an up-to-date real-time anti-malware solution for your Android devices. Malwarebytes detects components of Gigabud as Android/Trojan.Banker.ACR577B2BA2H61, Android/Trojan.Banker.ACRF6CE8D30H46, Android/Trojan.Banker.ACR6C67829FH20, Android/Trojan.Banker.SIB02FFFFFF1112H106, Android/Trojan.Banker.SIB0181193e44H71, Android/Trojan.Banker.AUR2f2f4fb5C95, and Android/Trojan.Spy.Gigabud.xc.
Anyone who has installed a suspicious APK and granted it Accessibility access should contact their bank through a trusted channel, revoke the app’s special permissions, uninstall it, and consider a factory reset after preserving only known-good data.
A second instance of a banking app merits particular scrutiny. A separate work profile by itself is not proof of compromise because work profiles also have legitimate uses. But the presence of a cloned banking app definitely is suspicious.
Scammers know more about you than you think.
Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.
WhatsApp announced on August 25 that more than one billion people now use passkeys to log back into the app.
The announcement included two other security upgrades: a stronger two-step verification method and more context for incoming calls from unknown numbers. It marks one of the largest passwordless authentication rollouts to date. Passkeys are now firmly mainstream, with the FIDO Alliance estimating that 5 billion are in use worldwide and 75% of consumers have enabled one on at least one account.
Three things changed:
Passkey support originally launched on Android and later extended to iOS. WhatsApp now supports multiple passkeys per account, so people who switch between an Android phone and an iPhone (or use both) can register a passkey on each device.
Two-step verification is moving from a simple six-digit PIN to a longer alphanumeric password that can include special characters, making it much harder to guess or brute-force.
On Android, WhatsApp now shows extra context about calls from numbers not saved in your contacts, including whether the number is from another country and whether you share any groups. It’s a small but useful nudge against the urgency tactics scammers rely on.
Passkeys are resistant to phishing because there is no password or SMS code to type into a fake website or hand over to a scammer. Instead, a passkey is stored on your device or in its credential manager and unlocked using your fingerprint, face, or screen-lock code. They’re also useful in regions where SMS one-time-passcode delivery is unreliable, which might explain why adoption reached a billion users so quickly.
The upgraded two-step verification password closes a real gap. PINs such as “123456” were common, weak, and reused, and a longer alphanumeric password with special characters raises the bar against account-takeover attempts, even if an attacker somehow obtains your one-time code.
The caller-context feature gives people more information to assess legitimacy before answering an unfamiliar number.
Users need to set up a passkey and upgrade their two-step verification password, while the caller-context feature will appear automatically on supported Android devices:
Set up a passkey via Settings > Account > Passkeys, and follow the instructions on your device. Don’t forget to add a second one if you use both an Android and an iOS device.
If you still use a six-digit PIN for two-step verification, upgrade to the new password format when it becomes available, especially if your PIN is predictable. You can find instructions to set up two-step verification for WhatsApp in this blog. If it’s already enabled, select Two-step verification to find the option to change your PIN.
Add a recovery email to two-step verification if you haven’t already. It’s the only way to reset the password if you forget it.
Android users should pay attention to the new caller-context details before answering calls from unknown numbers, treating urgency as a red flag rather than a reason to rush.
Passkeys and stronger two-step verification aren’t retroactive or forced, so accounts still relying on an old PIN or no passkey at all will remain unchanged until users upgrade them.
Scammers know more about you than you think.
Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.
iPhone users are being targeted in a new tech support scam, using a fake Apple Pay notification to trick users.
Tech support scams that use fake warnings to push victims into calling a phone number have been around for years, but this page has been designed specifically for phones.
Instead of a desktop warning claiming your computer has a virus, the scam imitates familiar iPhone features in an attempt to scam you.
What happens
A page opens on your phone and appears to show Apple Pay processing a $657 App Store payment. A spinner turns. “Face ID · verifying identity” appears beneath the amount. There is a transaction ID, a padlock, and all the visual cues of a payment in progress.
A few seconds later, the story changes.
You get an alert saying your Apple ID is locked because of an unrecognized sign-in. A phone number appears under the instruction to call Apple Support immediately. When you open the transaction details, the payment is marked “Completed.” Then your phone begins speaking an alert about the unauthorized charge.
It’s all completely made up.
The page we analyzed contains no real Apple Pay transaction and no biometric verification. Instead, it uses hardcoded payment details, browser-generated speech, fake security warnings, and aggressive navigation tricks to get the victim to call the scammer.
The “Face ID” check isn’t real
The first screen is designed to make it look as though the phone itself is authorizing a payment.
In this sample, “Face ID · verifying identity” is simply an HTML element displayed beside an icon. There is no Apple Pay request and no biometric-authentication call behind it.
Apple Pay can legitimately be used on websites, but a genuine payment begins when the merchant requests it. The system then immediately displays a payment sheet for the user to review and authenticate, as Apple’s guidelines specify.
Nothing like that happens here. The scam page has simply drawn its own imitation.
The “Processing payment” spinner is equally cosmetic. The entire splash screen disappears on a timer after 2.8 seconds, regardless of anything the user does.
The receipt is fake, and the code is the same for everyone
The next screen is dressed up as a transaction receipt. It contains an amount, masked card digits, an authorization code, a transaction ID, and a green “Completed” status.
Most of those values never change.
That’s because the page hardcodes the amount as $657.00, the transaction ID as AP-2026-08-03-14:32, and the authorization code as AUTH-8F3A2B1C. Every visitor is shown the same values.
The date, however, is generated dynamically.
JavaScript calls new Date() and formats it with toLocaleString(), meaning the receipt uses the current date, time, and timezone from the victim’s device.
That creates an obvious contradiction. The fixed transaction ID contains 2026-08-03, while the date field shows the time and date when the victim happens to open the page.
A genuine transaction doesn’t rewrite its transaction date every time somebody looks at it.
The “voice alert” is generated by the browser
Once the victim opens the transaction details, the page attempts to speak:
“Unauthorized charge of six hundred fifty seven dollars from your Apple ID. Please call support immediately.”
There is no recorded Apple message behind it.
The JavaScript creates a SpeechSynthesisUtterance and sends it to window.speechSynthesis, the browser’s built-in Web Speech API to read the warning aloud.
Using a text-to-speech voice already available on the victim’s own device is a clever social-engineering touch. The warning may sound more like part of the phone itself than audio playing from a random website.
The page tries to make leaving difficult
One interesting part of this scam is the code surrounding the exit routes.
The page adds a new browser-history entry and listens for popstate, allowing it to react when a victim tries to navigate backward. It then displays a warning claiming that closing the page could expose the victim’s payments and banking information.
If the victim accepts the prompt to call support, the code navigates to a tel: URL containing the scam number. If they cancel that particular prompt, another warning appears and another history entry is added.
The page also registers handlers for beforeunload, pagehide, the context menu, an edge-swipe gesture, and common keyboard navigation shortcuts. On iOS, its pagehide handler even makes a delayed attempt to navigate directly to the telephone number.
These tricks can make the page persistent and annoying, but they don’t lock the browser or device. Modern browsers restrict what websites can do during navigation. For example, beforeunload isn’t reliably triggered on mobile, generally requires prior user interaction, and can only produce a generic browser-controlled confirmation.
In other words, the code tries several ways to stop you leaving or get you to call, but it can’t take control of the browser itself.
The phone call is the real objective
The $657 charge is bait to get you on the phone.
The support number appears prominently on the page, the red “Verify now” button points to it, and the fake security prompts repeatedly offer to dial it.
This is a well-established tech support scam tactic. The FTC warns that scammers use bogus charge notices to get victims to call, then may request remote access or pressure them into sending money through gift cards, bank transfers, cryptocurrency, or payment apps.
Apple also warns that scammers may claim someone has broken into your Apple account or made unauthorized Apple Pay charges, using urgency to stop you from contacting Apple independently.
What to do if you see a page like this
There is a simple clue worth remembering:
A security pop-up that manufactures an emergency and tells you to call the phone number displayed on the screen should be treated as a scam.
If an Apple Pay–like interface appears inside a website, remember that visual resemblance proves nothing. A site can freely mimic buttons, locks, logos, transaction IDs, and even animated spinners. What matters is whether a genuine Apple Pay payment sheet has actually been invoked.
In this case, it hasn’t. The important part of this scam is not the fake $657 payment. It is the urgency built around it to get the victim onto a call.
Don’t tap OK, Call, or Verify. Anything you tap on the screen will either call the number or bring up another warning.
Don’t dial the number, and don’t call it back later to complain or to check.
Close the tab using your browser’s tab switcher. On iPhone or Android, open the tab switcher and swipe the tab away. Once the tab is closed, the scam page can no longer keep you there or try to make the call.
If a dialog appears asking whether to leave the site, choose Leave. Web pages can ask you to stay, but they cannot stop you from leaving.
If in doubt, check your real purchase history. Open the App Store or Settings on your device and review your Apple purchase history. If there’s no $657 charge there, there was never a charge.
If you already called and gave someone remote access to your device, take action immediately:
Disconnect from the internet
Uninstall any remote access software they had you install
Change your Apple ID password and your bank passwords from a different device
Contact your bank about any payments you sent.
Check if something is a scam
If a number like this one is on your screen or already in your call history, check it before you do anything else. Malwarebytes Scam Number Check is a free way to see whether a number has been linked to scam activity. Just put the number in and we’ll tell you if it’s likely to be a scam.
Got a screenshot or URL of a suspected scam? Upload it to Scam Guard—built in to Malwarebytes Mobile Security—and you’ll get a verdict and safety tips in seconds.
Phishing pages don’t need to be sophisticated. They just need to look convincing enough to make you trust them.
TikTok phishing often starts with an email or message designed to make you think you need to act on your account. It might claim your account has been suspended, reported, or hit with a copyright violation, or tell you that you’re eligible for verification.
The link might take you directly to a page made to look like TikTok’s login screen. If you enter your information, it can be sent straight to the scammers, including your phone number or email, password, and potentially a one-time authentication code.
With access to your account, scammers could impersonate you, target your contacts, or try to use the same password to break into your other accounts.
What to do if you get a suspicious TikTok message
If you get an unexpected email or message telling you to log in to TikTok, don’t use the link it provides. Open the real TikTok app or go directly to tiktok.com instead and check your account there.
If you’ve already entered your login information on a suspicious page, change your TikTok password immediately and check for any devices or login activity you don’t recognize.
Fake warnings and verification offers
Not every TikTok phishing link leads directly to a fake login screen. Some try to scare you with claims that your account has been suspended or reported, or that you’ve received a copyright or community-guidelines strike that needs “resolving.” Others offer something you might want, such as a verified badge, creator payout, or brand deal.
For example, a fake TikTok Verification Center might congratulate you on your performance and tell you that you’re eligible for a verified badge:
Another fake verification page asks for account information as part of a supposed verification request:
Whether the message threatens you with a problem or promises you a reward, the aim is the same: to persuade you to interact with a fake TikTok page and hand over information.
Why these TikTok scams work
Fake TikTok pages can look convincing because copying the appearance of a real website is relatively easy. But the story that gets you there is just as important.
Suspension and copyright warnings create urgency. Verification and monetization offers create an incentive. Both give you a reason to act quickly instead of stopping to check where the link has actually taken you.
How to protect your TikTok account
Don’t use links in unexpected emails or messages asking you to log in to TikTok. Open the TikTok app or go directly to tiktok.com instead
Treat any message about a suspension, strike, or verification eligibility as unverified until you’ve confirmed it inside the TikTok app itself
Check the address bar before entering your login information. Make sure you’re actually on tiktok.com—a fake page can look almost identical to the real thing
Use a password manager where possible. It won’t auto-fill your TikTok password on a different domain, which is a useful warning sign
Turn on two-factor authentication (2FA) on your real TikTok account so a stolen password alone isn’t enough to get in
If you’ve already entered your login information on a page like this, change your TikTok password immediately and check for any login activity or devices you don’t recognize
Researchers have uncovered ToxicPanda 2.0, an Android banking Trojan and remote-access tool designed for account takeover and “on-device fraud.”
Not only does ToxicPanda 2.0 have a much larger target list of banks and e-wallets, it has also expanded its capabilities by combining banking overlays, remote access, PIN capture, Android accessibility abuse, and attempted Wireless Debugging automation. Together, those functions can help operators turn a compromised phone into a platform for account takeover, financial fraud, and longer-term device control.
The core objective is on-device fraud. That means that rather than logging in from an attacker-controlled machine, the operator can carry out actions from the victim’s infected phone, taking over the device, IP address, app session, and behavioral context that banks may use when deciding whether a transaction is fraudulent.
ToxicPanda 2.0 is built around abusing Android’s Accessibility Service, a legitimate feature intended to help people interact with their devices. When a victim grants this permission to a malicious app, the malware can inspect interface elements, observe app activity, automate interactions, and place deceptive content over legitimate apps, known as overlays.
ToxicPanda has historically relied on social engineering to persuade users to sideload a malicious Android application rather than install it through Google Play. The latest campaign uses Amazon AWS-hosted buckets to deliver ToxicPanda 2.0 samples.
After installation, the dropper presents a fake installation flow, requests VPN privileges, blocks certain Google Play and Google Play Services network communications, decrypts an embedded payload, and then seeks Accessibility Service permission for the installed payload.
The consequences can include stolen banking usernames and passwords, intercepted or captured PINs, fraudulent transactions, loss of access to the device, and exposure of the phone’s screen-lock secret. An attacker that can operate inside an active banking session from the victim’s device may have a better chance of evading controls designed to identify unfamiliar devices or unusual login locations.
How to stay safe
However sophisticated it is, ToxicPanda 2.0 still relies heavily on social engineering to get targets to install the malicious app and give it the permissions it needs. So our main recommendations are:
Avoid sideloading apps, especially from links in unsolicited messages, ads, or alleged support communications.
Treat requests for Accessibility access, Device Administrator privileges, developer settings, and VPN permissions with particular caution, especially if it’s not clear why the app needs those permissions or if you don’t fully trust it.
Use an up-to-date, real-time anti-malware solution for your device that can detect and block the malicious payload. Malwarebytes for Android detects apps in the ToxicPanda 2.0 campaign as Android/Trojan.Dropper.agent and Android/Trojan.FakeApp.ACR2401245FC11.
If your device is infected
Although it may require a factory reset to regain control of an infected device, there are some things you can try first:
First, put the phone in airplane mode and turn off Wi-Fi and Bluetooth. This can cut off command-and-control communications and ongoing credential theft while you investigate.
Use another device to freeze or closely monitor transactions, revoke active sessions, and reset your banking credentials.
Do not interact with fake “system update” screens or unexpected prompts for Accessibility, VPN, Device Administrator, Developer Options, or Wireless Debugging.
Start Android Safe Mode. Google recommends Safe Mode to help identify problems caused by downloaded apps. Remove recently installed or suspicious apps one at a time, reboot normally, and see whether the problem returns.
Remove Accessibility access first. In Settings > Accessibility > Installed apps/Downloaded apps, disable any service you do not recognize. Focus on recently installed apps or anything pretending to be an update, system component, security tool, document viewer, or bank helper.
Next, check Device Administrator rights. Go to Security & privacy > More security settings > Device admin apps and disable any unrecognized administrator before attempting removal. An app with Device Administrator privileges can make the Uninstall control unavailable.
Then check your VPNs. Go to Settings > Network & internet > VPN or search Settings for “VPN,” and delete any VPN profile you did not deliberately install. The ToxicPanda dropper uses VPN permission as part of its reported Google Play and Google Play Services blocking process.
Disable dangerous developer functionality. Search Settings for Developer options, turn it off entirely, and make sure Wireless debugging and USB debugging are off.
Remove all the suspicious apps you found. Go to Settings > Apps > See all apps, enable Show system apps if necessary, then locate recently installed or unfamiliar apps. Force stop the suspicious app, clear its storage, and select Uninstall. If an app has a generic name, blank icon, odd install date, or was installed outside Google Play, treat it as suspicious.
Reboot normally after removal, then re-check Accessibility, Device Administrator, VPN, and Developer Options. Also review the installed-app list for a second suspicious package, since the reported campaign uses a dropper to decrypt and install its payload.
Please note: The given paths in Settings may differ depending on your device manufacturer or Android version.
If you’re having trouble removing ToxicPanda manually and you can’t install or update Malwarebytes, please reach out to our Support team. They can walk you through the process.
Scammers know more about you than you think.
Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.
A Google spokesperson announced on Reddit that it has started rolling out the first version of its Advanced Flow, designed to make installing apps from unverified developers safer.
Let us explain what sideloading is, why Google Play is not 100% safe, what to look for when you’re sideloading so you can do it more safely, and how Google’s Advanced Flow helps with that.
What is sideloading?
Sideloading lets Android users install apps from outside Google Play. It can be useful, but it also creates opportunities for scams and malware.
Android’s openness is one of its enduring strengths. You are not limited to a single app store: You can install apps from a developer’s website, an alternative marketplace, an enterprise portal, or a file shared directly with you.
That is called sideloading. It is not automatically dangerous, but it removes some of the guardrails that come with conventional app-store distribution. Getting apps from the Google Play Store itself is no guarantee of safety, but there is at least some vetting. Google says it blocked more than 1.75 million policy-violating apps from being published in 2025 and banned more than 80,000 developer accounts associated with harmful apps.
There are several reasons for sideloading:
The developer distributes an app directly from its own website
An app is unavailable in your country or on Google Play
An alternative app repository offers what you’re after, for example open-source software
You need an enterprise, beta, or specialized app
You want to install a version that is not currently offered through Google Play
But malware authors and online scammers use the same flexibility. They may impersonate banks, delivery services, government agencies, crypto platforms, news readers, or job recruiters, then urge victims to install an app to “secure” an account, receive a payment, or resolve an invented problem.
Google Play is not a free pass
Google Play has review processes, policy enforcement, developer controls, and Google Play Protect. It also runs ongoing checks after an app is published. Those measures meaningfully reduce risk, but they do not make every listing harmless or every developer trustworthy.
Threats that can still surface through official channels include:
Trojans disguised as useful utilities, games, or financial apps
Adware and apps that misrepresent their behavior
Subscription traps and deceptive billing practices
Data-harvesting apps that request more access than they need
Sleeper apps that change behavior after passing an initial review
Google Play Protect checks Play Store apps before download and also scans apps from other sources. It can warn about, disable, or remove potentially harmful apps, but it should be viewed as one layer of security, not a substitute for scrutinizing an app before installing it.
In short, “available on Google Play” is a positive signal, not a security verdict.
Why sideloading requires attention
The main difference between installing from a recognized store and downloading an APK from elsewhere is not simply the file format. It is the trust chain.
When you sideload, you may have fewer assurances about:
Who created the app
Whether the file has been altered or repackaged
Whether the download site is impersonating a legitimate developer
Whether you will receive genuine updates
Whether a scammer is manipulating you into disabling security protections
Social engineering is often the decisive factor. A convincing caller, pop-up, text, or chat message may insist that installing an app is urgent. The attacker’s goal is often to make the victim bypass warnings before they have time to question the request.
Treat any unexpected request to install an app as suspicious, especially when it comes with urgency, secrecy, a promise of money, or a claim that your bank, government, employer, or device provider requires it.
A legitimate bank, government agency, law-enforcement organization, or technical-support provider should not call or message you and instruct you to install an APK or weaken Android security settings.
How to sideload more safely
Sideload only when you have a specific reason for it, and make sure the decision came from you rather than an unexpected message or phone call.
Start at the developer’s official site. Don’t use sponsored search results, random download portals, links sent by strangers, or lookalike domains.
Verify the developer independently. Check the publisher’s official website, documentation, public code repository, and trusted community channels. The information supplied on the download page alone is not enough.
Prefer established repositories. If an app is distributed outside Google Play, use a source with a strong reputation for provenance and signature verification where possible. For advanced users, it can be useful to compare an APK’s signing certificate or cryptographic hash against a value published by the developer. That is not practical for everyone, but it can help detect fakes.
Do not install apps under pressure. End the call, close the chat, and independently research the claimed organization using contact details you find yourself.
Keep Google Play Protect enabled. It scans apps during installation and periodically afterward, including apps installed from outside Google Play.
Review permissions before and after installation. Be especially cautious if a simple app wants access to accessibility services, SMS messages, notifications, device administration, contacts, or screen recording.
Keep Android and apps updated. Security fixes can protect against both operating-system flaws and known malicious app behavior.
Use reputable mobile security software. A separate security layer can help identify risky behavior and provide additional visibility into potentially unwanted or malicious apps.
Remove permissions and uninstall apps you no longer trust or use. An app that seemed harmless at installation can become a liability if its developer abandons it or changes direction.
How Google’s new Advanced Flow helps
Google is rolling out Advanced Flow for installing apps from developers that have not completed Android’s new identity-verification process. The feature is intended for users who understand the risks of installing unverified software but still need that flexibility.
The design is notable because it targets social-engineering attacks as well as malware. Instead of allowing an immediate, one-tap override, the flow requires users to:
Enable developer mode in system settings. This is easy enough and helps prevent accidental or one-tap bypasses often used in high-pressure scams.
Complete a quick safety check to make sure that no one is talking you into turning off your security. Scammers often pressure victims into disabling protections.
Restart your device, which cuts off any remote access or active phone calls a scammer might be using to guide you.
Wait one day, then confirm the change using biometrics, such as fingerprint or face unlock, or your device PIN. This one-time, one-day delay breaks the urgency scammers rely on, giving you time to think.
Once you have completed the process, you can choose to allow installs from unverified developers for seven days or indefinitely.
Advanced Flow does not mean Google Play is risk-free, nor does it make unverified apps inherently malicious. Developer verification establishes accountability: It connects an app to a verified developer identity, but it does not establish that every app is benign or suitable for every user.
At the end of the day, it’s up to you. Install apps because you chose them after checking the source, not because someone else manufactured an emergency.
Whether an app comes from Google Play or an external source, pause before installing. Check who made it, why it needs the permissions it asks for, whether the download route is trustworthy, and refuse when a stranger is trying to rush you. That little friction is a feature, not just a nuisance.
Scammers know more about you than you think.
Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.
Most wrong-number texts are harmless. Some are the first step in a carefully planned scam. By replying, you may be confirming that your number is active and that you’re willing to engage with strangers, making you a more valuable target for future fraud. Here’s why a polite response can be worth money to cybercriminals.
The politeness trap
Sunday night. You’re on the couch, half-watching Netflix, when your phone buzzes.
“Hey! Are we still on for dinner tomorrow? Don’t forget the wine ”
You don’t recognize the number. You glance at it for two seconds, then type what most polite people would:
“Sorry, I think you have the wrong number!”
You put your phone down. Go back to Netflix, and forget about it within five minutes.
On the other end, though, your reply has just told the sender something valuable. Not because of a technical exploit or an invisible cyber-attack, but because you just proved you’re the kind of person who responds to strangers politely.
According to cybercrime intelligence reports, responsive phone numbers are worth significantly more than inactive ones. With a single reply, you’ve entered a global criminal ecosystem run by transnational syndicates that, according to analysts, moves tens of billions of dollars.
What your reply told them
Let’s be clear: the “wrong number” text is not a phishing link. It’s not malware. In many cases, it’s not even the scam itself. It’s a personality test.
The scammers already have your number. They may have bought it in bulk from a data breach for a fraction of a cent per record. They already know the message was delivered because their SMS gateway received no delivery failure. Text messages remain one of the most effective ways to reach people, with exceptionally high open rates and most being read within minutes. That’s one reason scammers prefer SMS to email.
What they don’t know is whether you’re worth spending more time on. Your reply told them three useful things:
You’re responsive. You saw the message and felt compelled to reply. This immediately places you in their top 15–20% most active numbers category.
You’re polite. You didn’t ignore it and didn’t respond aggressively. You wanted to help a stranger. Scammers deliberately exploit that instinct to be polite and helpful.
You reply quickly. The time between their message and your reply can reveal how closely you monitor your phone, help estimate your timezone, and indicate how likely you are to respond to future messages.
The two paths your number takes
From this moment, your story splits. Both paths described below play out across millions of phones worldwide.
Scenario A: The slow burn
Within minutes of your reply, another message arrives in response to yours:
“Oh no, I’m so sorry! But honestly, you seem like a really kind person. It’s rare to find polite people these days. I’m Sarah, by the way.”
Some people stop the conversation there. Others reply out of curiosity or because they’re simply being friendly. A few messages later, you’re in a conversation.
In some large scam operations, those early exchanges may be handled by AI (Artificial Intelligence) using open-source language models such as Llama or Mistral. That allows scammers to hold thousands of conversations at once and focus their time on the people who seem most likely to keep talking.
While keeping you engaged, the AI assigns you a real-time vulnerability score based on your response time and message length. If your score crosses a certain threshold, a human operator takes over. They read the conversation, learn your name, your job, and your communication style, then continue as though nothing has changed.
Within two or three weeks, this person has become a friend. They text you good morning, ask about your day, and send photos stolen from real social media profiles.
Around week three, they casually mention an investment:
“I’ve been making really good money on an investment platform lately. Almost $4,000 last month. It’s crazy.”
If you show interest, they’ll send you a link to a fake trading platform with a convincing design. You might deposit $500 to test it. The next day, your dashboard shows a fake gain of $1,800, so you invest more. A week later, the platform disappears, along with your money, and the person who texted you every day.
According to the FBI’s Internet Crime Complaint Center (IC3), investment fraud generated more than $4.5 billion in reported losses in a single year. To be clear: while most wrong-number texts never reach this stage, victims who fall for so-called “pig butchering” scams (long-term romance/financial scams) suffer catastrophic average losses ranging between $70,000 and $75,000 per person.
Scenario B: The silent recycling
In this scenario, you replied “wrong number” and never heard from them again. You think you dodged the scam, but instead your number was simply moved to a different category: “Active, responsive, polite, but not susceptible to the wrong-number hook.”
That profile still has enormous commercial value. Your number is added to a cleaned database and sold or reused for a different campaign.
A week later you receive a text from another number:
“Hi! I saw your profile on LinkedIn. We have an opportunity that’s a perfect fit for your background.”
Or:
“Your package couldn’t be delivered, update your address by clicking here.”
Or a fake alert from your bank warning of “suspicious activity.”
You’ll probably never connect these messages to the wrong-number text you received the week before. They’re different topics and different senders. But they may all be part of the same criminal ecosystem. The first message was simply a way to sort potential targets. Everything that follows is the actual attack.
The most common hooks
If you’ve received one of these messages (or something very similar), you’re not alone. These are some of the most common opening lines used in wrong-number scams, tested on millions of people and optimized to maximize response rate:
The friend who doesn’t exist:
“Hey! See you tonight at 6? Don’t be late ”
“Are you still free tomorrow?”
“Did you send those files to the office?”
“Hey Marco, are we still on for dinner tonight?”
The concerned neighbor:
“Sorry to bother you, I’ve noticed your dog sometimes runs into my yard.”
“I found a phone number on the dog tag, is this yours?”
“Hi, your package was delivered to my address by mistake.”
The professional mix-up:
“Hi, I tried to reach you about the delivery but you didn’t answer.”
“The shipment arrived at your address, can you confirm?”
“This is Mike from the office, did you get my earlier message?”
The family emergency:
“Do you know Sarah? There’s been an emergency.”
“Is this [common name]’s number? Something happened.”
The recruiter:
“Hi! I came across your profile, we have an incredible opportunity.”
“Hey, I’m reaching out about a position that matches your background perfectly.”
If you’ve received one of these messages, it doesn’t automatically mean it’s a scam. People genuinely do text the wrong number sometimes. But if the conversation quickly moves to making small talk, asking personal questions, or encouraging you to keep chatting, stop replying.
These messages aren’t usually sent by a lone cybercriminal. They’re part of a highly organized criminal industry with its own market dynamics and global supply chains.
In January 2026, Cambodian and Chinese authorities arrested Chen Zhi, president of Prince Holding Group, accusing him of running a network of scam compounds across Southeast Asia where thousands of trafficked people were forced to manage these conversations. Those operations relied on underground marketplaces where criminals could buy everything they needed, from phone lists and stolen identities to AI tools and fake investment websites.
The scale is staggering. Blockchain analytics firm Elliptic estimates the Huione Guarantee underground marketplace processed more than $134 billion in transactions. Separately, researchers at the University of Texas at Austin estimate that pig-butchering scams stole more than $75 billion in cryptocurrency over four years.
The scam funnel: Costs and revenue
To understand why this ecosystem is so huge, look at the math. Sending hundreds of thousands of text messages costs very little. Even if only a tiny fraction of people reply, and an even smaller number eventually send money, the profits can far outweigh the costs.
Look at this illustrative model of a campaign sending 100,000 SMS messages:
The figures in this model aren’t arbitrary. They combine observed pricing from underground marketplaces such as Russian Market and BidenCash with average victim losses reported by law enforcement agencies, including the FBI’s Internet Crime Complaint Center (IC3).
Even allowing for variation between campaigns, the economics are compelling. A single campaign can cost less than $1,000 to run while generating more than $200,000 in revenue, representing a potential return on investment (ROI) of 90x to 200x.
Those same economics are reflected in underground marketplaces, where verified, enriched contact details command significantly higher prices than raw data. In our previous investigation into underground marketplaces, we found that a typical stolen personal record sold for around 95 cents. The more criminals learn about a potential victim, the more valuable that person’s data becomes.
That’s a 4,000% value increase generated by a single polite reply.
From there, scammers can enrich that record with publicly available information such as your name, employer, social media profiles, and estimated demographics using automated open-source intelligence (OSINT) techniques.
The more complete the profile becomes, the more valuable it is. Researchers monitoring underground marketplaces have found that enriched, pre-profiled contacts command premium prices because they’re more likely to become victims of high-value pig-butchering scams that generate billions of dollars in illicit revenue each year.
How do they know who you are?
Before that text reaches your phone, your number may already have passed through automated script pipelines capable of cross-referencing tens of thousands of records in minutes.
Acquisition: Your number is pulled from historical data breaches, such as the Facebook leak affecting 533 million users, Twitter/X data leaks, or massive aggregated databases like Naz.api, and the Mother of All Breaches (MOAB), a collection of more than 26 billion records compiled from thousands of previous breaches.
Automated scraping: Software queries public sources to check whether your number is linked to an active WhatsApp account, collect your profile information and picture and match the number to public LinkedIn, Instagram, and Facebook profiles.
Data broker integration: Scammers exploit the same commercial data services used by marketing companies to associate a phone number with estimated age, address, and income bracket.
The result is a psychographic and commercial profile that helps scammers choose the most convincing approach. If your social media shows you have a dog, you might receive the neighbor hook: “Your dog keeps getting into my yard.” If you recently changed jobs on LinkedIn, the fake headhunter hook activates.
The human factor: Modern slavery
There’s one aspect of these scams that’s often overlooked: many of the people sending the messages are victims themselves.
In its August 9, 2023 policy report, the United Nations Office on Drugs and Crime (UNODC) described a human rights crisis tied to forced criminality in Southeast Asia. It estimates at least 120,000 people in Myanmar and tens of thousands in Cambodia are being held in fortified mega-compounds run by criminal syndicates.
Many were lured by fake job adverts promising legitimate work in digital marketing or customer service. Once they cross the border, their passports are confiscated. They were stripped of freedom and forced, under the threat of violence, to spend up to 16 hours a day managing dozens of scam conversations. Those who failed to meet financial targets were often beaten, isolated, or sold to other compounds.
When you reply to one of these messages, you’re interacting with a system designed to simultaneously exploit your financial availability and the enslavement of another human being.
Breaking the chain
You can’t erase your number from dark web databases: that damage may have done years ago. But you can make your profile far less valuable to scammers.
Make yourself harder to profile: Review the privacy settings on any messaging apps and social media platforms that use your phone number. Limit who can see information such as your profile photo, status, last seen, and phone number. The less information scammers can gather automatically, the harder it is to build a detailed profile about you. On WhatsApp, for example, you can set Profile Photo, About, Status, and Last Seen to My Contacts. On Telegram, set Phone Number to Nobody.
Report before you block: Blocking protects only you. Reporting protects everyone. When you use WhatsApp’s Report and Block function, the last five messages in the chat are sent to Meta’s security teams. If enough people report the same number, it may be permanently banned, destroying the entire active campaign on that line.
The golden rule: If you receive an unexpected message from an unknown number, the safest response is no response at all. Don’t reply, don’t explain yourself, and don’t worry about seeming impolite. If it’s a genuine wrong number, the sender will usually realise their mistake and move on. If it’s a scam, you’ve denied the criminals exactly what they wanted: proof that your number is active and that you’re willing to engage.
Something feel off? Check it before you click.
Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.
Today, you can get low-quality knockoffs of just about any popular smartphone on sites like AliExpress or Temu, whether they be iPhones, Galaxy phones, or whatever else. They have terrible build quality, bottom-of-the-barrel components and specifications, and all run outdated versions of Android – badly. At the same time, various consumer electronics brands, once popular in a bygone era, sell the rights to their brand name to unknown companies, who then put these brands on generic hardware to give their products a sheen of legitimacy. That’s why today, you can still buy Nokia smartphones, Polaroid cameras, and low-effort Hi-Fi equipment from various once-respected brands.
None of this is new, however. In the late ’90s and early 2000s, companies were already doing the same thing. In fact, there’s one device from this era which combines both business practices – it’s both a cheap knockoff of a wildly successful device, and it carries a once-revered brand name. Also, just to add some juice, this story involves stolen source code.
Let’s take a look at the worst PDA of all time, the Olivetti daVinci.
€5000 incentive: Make me use Windows 11 for a month (the results were not great) > €10000: Video tour of my office and my computers/devices collection < €15000: Buy a Mac and use macOS for a month (and review it) €20000: I get an OSNews tattoo
In 1997, Palm launched the Palm Pilot, and it and its successors proved to be a massive hit. Where countless before it had failed, Palm found the magic formula to make pocket computing work. I wrote an in-depth article about Palm over 13 years ago which goes into much (much) more detail, but the reason the Palm Pilot succeeded where things like the Newton, PenPoint OS, and Windows for Pen Computing failed, is that Palm’s founder, Jeff Hawkins, realised that they were competing with paper, not with desktop computers. Instead of trying to shove the capabilities of a full personal computer into a (barely) pockatable device, a pocket computer had to be as fast and convenient as paper, and therefore extremely strict about which features to add, and which to omit.
To this day, the entirety of smartphone computing stands on the shoulders of Palm. Palm’s ideas, implementations, approaches, paradigms, and even people were absorbed by Apple and Google, where they shaped both iOS and Android. The phone you’re looking at right now has a ton of Palm DNA in it, still. After all, you’re still using the homescreen-with-apps paradigm Palm already perfected in the late ’90s and early 2000s.
The success of the Palm Pilot and its successors did not go unnoticed. Microsoft, most prominently, felt incredibly threatened by Palm’s success:
The success of Palm’s products got the attention of Microsoft, and the company pretty much announced it was going to crush Palm. According to Hawkins, Microsoft had a sales conference, where, at some point, a big target appeared on the projector screen, with the Palm logo dead in the centre of it: “we are going to crush and kill these guys”, was the central message. Hawkins recalls that he got condolence letters after that, stating things like “Sorry Jeff. Too bad.”
While Microsoft proved to be unable to “kill and crush” Palm, it did manage to build a relatively successful business selling PDAs running various incarnations of Windows CE. Together, Palm and Microsoft dominated the PDA market pretty much throughout its entire existence, and while the market was a mere fraction of the smartphone market of today, other companies still wanted a piece of this pie too. One of these companies was Olivetti, a storied Italian company with a long history making typewriters, computers, and other electronics.
I’m not going into detail about Olivetti’s history, but the company was renowned for its attention to design, creating iconic products like the Lexikon 80, Lettera 22, Elea 9003, Programma 101, and so, so many more. Olivetti also entered the personal computer market, first with a variety of custom machines featuring Z80 and later Motorola 68000 processors running a variety of custom operating systems developed by Olivetti (including its own UNIX variant, X/OS). After a few machines using MIPS and Alpha processors in the early ’90s, the company would eventually focus entirely on Intel-based PCs (including this amazing failure) running Windows. Like so many other computer makers from that era, Olivetti eventually left the PC business by selling it off in 1997.
To this day, Olivetti PCs tend to cost more on the used market than those from other brands, despite no technical merits dictating so.
At around this time, our current story begins. Seeing the success of the Palm Pilot and the emergence of copycat devices running Microsoft’s Windows CE, Olivetti wanted in on the action. And so, in the late ’90s, the company introduced the Olivetti daVinci, a line of PDAs whose software looked suspiciously like Palm OS. There’s not a ton of information out there about the development history, but it seems that while Olivetti designed the hardware, it contracted the development of the operating system out to a company from Hong Kong, Echolink Design.
And this is where things went horribly wrong for Olivetti. The software Echolink Design developed for the daVinci didn’t just look like Palm OS, it was Palm OS – at least, according to Palm. After being on the market for about a year, the Palm Pilot maker, then a subsidiary of 3Com, filed for an injunction, alleging that the daVinci operating system designed by Echolink Design contained actual Palm OS source code. In addition, Palm also filed suit against CompanionLink Software, the company that developed the Outlook synchronisation software for the daVinci. Palm won handily, and within a day of the filing, temporary restraining orders were put in place on both Olivetti and CompanionLink, stopping sales of the daVinci and its software dead in its tracks.
It seemed to have been a pretty clear-cut case. From The Wall Street Journal at the time:
U.S. District Judge James Ware ruled Olivetti’s Royal daVinci organizer contains software that appears to have been copied from the operating system for 3Com’s Palm organizers. Judge Ware said a review by a software expert found the daVinci software contains private Palm code and even grammatical mistakes that appear to have been “copied verbatim.”
It’s difficult to ascertain what code, exactly, was stolen, but my personal educated guess is that it probably involved Palm’s unique Graffiti handwriting recognition system. Graffiti actually predates the first Palm Pilot, and was available on a variety of non-Palm devices; it doesn’t seem entirely unlikely to me that the code for it escaped containment that way, eventually finding its way to Echolink Design. I’m just guessing here, though, as I can’t seem to find any of the original court documents concerning the case.
In a bind, Olivetti claimed the copied code represented less than 2% of the operating system’s code, and set about to release a new version of the software for the daVinci.
And so we end up at the device I have in my collection. Several years ago, I bought a boxed version of the Olivetti daVinci DV3, including all of its original accessories for a pittance on eBay, and I’ve been fascinated and repulsed by this device ever since. It looks like a cheap Palm knockoff, and it feels like one too; the hardware is made out a really unpleasant form of plastic, with buttons worse than what you find on the cheapest possible pack-in remote control. The case feels creaky and unrefined, like the cheapest possible children’s toy.
The display has a resolution of 128×99, much lower than the 160×160 of even the first Palm Pilot, and it’s incredibly dim and hard to read without the backlight on; even with the backlight on, it’s difficult to read anything. Worse yet, the various hardware tap targets on top of and at the bottom of the display are not backlit at all, making them unreadable in all but the most illuminated environments. Considering you need these buttons a lot, it’s a major stumbling block. Turning on the backlight is confusing, too, as it you need to hold down the on/off button (while the display is on) to engage it, something only mentioned in the manual.
The display is, of course, a resistive touchscreen, as was the norm at the time, but its precision seems much lower than anything Palm ever offered. The accompanying stylus, too, is plasticky and cheap, definitely worse than the plastic styluses Palm shipped with its earlier models, and obviously no match for the metal styluses that would accompany later models.
Finding out exactly what type of processor the daVinci DV3 uses is remarkably hard. A contemporary review by Smart Computing claims it’s using an unspecified Epson processor, without giving any further details. There’s only one source that specifically states what processor it has, and considering that source is the only person to have written a third-party application for the DV3, I’m inclined to believe they’re right (opening the device up is of no use, as the SoC is of the epoxy blob type). According to them, the DV3 runs on a Sharp SM6010 microprocessor, for which a datasheet and more detailed documentation exists. The SM6010 is a very basic 16bit single-chip microcomputer of an unspecified architecture (probably something custom and proprietary), running at 30Mhz.
The SM6010 is a 16-bit single-chip microcomputer incorporating a 16-bit CPU core, LCD controller, watchdog timer, serial interface (UART, SCI), SIR, PWM output, real time clock, A/D converter and bus controller.
The DV3 stores its operating system in flash memory – making it upgradable – and has 2MB of RAM, stated proudly all over the box and on a sticker on the device itself. Performance is actually not that bad, but it’s not quite as instant and responsive as Palm OS. The operating system and its user interface are rather inscrutable; there doesn’t seem to be a single home screen you can always go back to like on Palm OS, and closing/leaving applications/screens is done differently for each individual application/screen (tap the hardware “OK” button? An on-screen “OK” button? Press the cancel button? Tap one of the hardware application shortcuts atop the display? Who knows!).
The core tools of the DV3 are incredibly basic, and cover merely the bare necessities of a PDA in the late ’90s, with things like an address book, notes application, calendar, calculator, and a few others. There’s no consistency among any of these tools, and they all look, feel, and work just differently enough to be confusing. The daVinci is also Very Serious™, as there’s no games or even a simple drawing gimmick; in fact, while there is a button labeled “Apps.”, it doesn’t actually do anything (we’ll get back to that). There’s barely any preferences to fiddle with either.
Input is done via a terrible Graffiti ripoff called daVinci Script, which uses strokes much more cumbersome than its inspirator, not aided by the absolutely trash recognition algorithms. This input method is effectively unusable, as it’s impossible to predict which strokes will produce what character or action. Even something as simple as the right-to-left stroke to delete a character is entirely unreliable, ensuring this is more of a random character generator than a text input system. Luckily, there’s a tiny on-screen keyboard you can use to hunt and peck with the stylus, but this isn’t exactly a particularly fast input method either.
It’s hard to convey just how utterly terrible the software experience is, especially in 2026 when many people reading this lack the frame of reference of its time. This isn’t utter trash compared to what we’re used to today – this is utter trash compared to the competing devices running Palm OS and Windows Pocket PC of its time. Even in 2026, I love using Palm OS and Pocket PC, but I absolutely despise, dread, and hate using the daVinci. I’m struggling to find a comparison with something contemporary, but the best I can come up with is like comparing an Apple Watch or WearOS device with one of those cheap knock-off smartwatches that run some shitty custom low-res UI on an underpowered SoC, but honestly, even that does a disservice to these knock-off smartwatches.
The daVinci I have came with all of its original accessories. There’s a vinyl pouch, a dock, and an external, fold-up keyboard. The pouch has not withstood the test of time, and has shrunk, so much so the daVinci no longer fits inside of it. The dock is, well, a dock, and uses the connector at the bottom of the daVinci. This connector looks and feels exactly like a crunchy ISA slot from the ’80s, as if the PCB was cut off with a hacksaw. The keyboard is the most interesting, and can be connected straight to the device’s bottom connector, or to a passthrough port at the back of the dock. Unsurprisingly, this keyboard is really bad, with dome-shaped mushy rubber keys with very little stability and a featherlight base that moves at the slightest of touches, making it almost impossible to type on.
Thanks, I hate it.
I mentioned the mysterious, non-functional “Apps.” button earlier, and there’s actually a bit of history here. It turns out that Olivetti fully intended for people to write third-party applications for this thing, promising to release an SDK at some point in time. Of course, this never ended up happening as the daVinci is trash and nobody in their right mind bought one or would want to develop for it, but it does mean that somewhere out there, perhaps in an attic somewhere in Ivrea, Italy, there’s a dusty hard drive or CD-ROM carrying this unreleased official SDK.
SDK or no, there’s always someone crazy, skilled, and determined enough to develop something for any computer, and for the daVinci DV3, that person was Alex Zwiesele. Zwiesele figured out that while the official SDK was never released, the CD-ROM that came with the daVinci DV3 contained the entire operating system of the DV3 and a loader program. This was enough for Zwiesele and a few other people to start disassembling the operating system and inject their own custom code into the binary file, reassemble it, and load it onto the DV3 using the loader program.
This was not a walk in the park. Zwiesele documented the entire process on their website, and it involved Zwiesele and several others writing their own disassembler and assembler (still available from their website!) based on the available Sharp SM6010 documentation, as well as learning how to actually program for the device’s hardware. In the end, they managed to develop an actual game for the daVinci DV3, a Breakout clone. You load the game onto your DV3 in the same way you’d load the operating system; as such, the game will replace the entire operating system and load automatically on power-on. That’s as far as they got back in 2003, as efforts seem to have stalled after that.
Back when I bought my daVinci, about 6-7 years ago, I mentioned online that I had bought the worst PDA of all time, without mentioning it by name. Immediately, fellow hardcore PDA enthusiasts (we exist) knew I was talking about the daVinci. This thing is just plain trash, e-waste before the term had been popularised, a waste of everyone’s time, effort, and money. Not even its one redeeming quality – its low price of just $99 compared to the cheapest Palm device at $249 – could make anyone want to use it.
Still, I’m glad I have it in my collection, if only to serve as a reminder that shitty e-waste devices aren’t something exclusive to our current smartphone era. It also serves to underline just how great Palm OS and Windows Pocket PC (yes, I will fight you on this) really were, and how many things they each got right out of the gate. So much so that especially Palm OS laid the foundations for every smartphone we use today.
Now that I’ve finally written and published this article, I can put this abomination back in its box, and never take it out again.
Apple now shows a warning directly on an iPhone’s Lock Screen and in Settings when it believes the device owner has been targeted by mercenary spyware. The new on-device alert is meant to make a high-risk warning harder to overlook and complements notifications by email and through the user’s Apple Account page.
In the explanation, Apple states:
“Apple threat notifications are high-confidence alerts that a user has been individually targeted by a mercenary spyware attack, and should be taken very seriously.”
“Apple Threat Notification Apple detected a mercenary spyware attack targeted at your iPhone. There are actions you can take now to help protect your data and device.”
Apple says its threat notifications are intended for people individually targeted by mercenary spyware attacks, which are highly sophisticated campaigns usually associated with commercial surveillance vendors and their government customers. Apple says it has notified targets in over 150 countries since the launch of the program in 2021, while the latest round of notifications reached people in 110 countries.
Mercenary spyware campaigns are usually not aimed at the average iPhone owner—at least at first. The initial targets are often people selected for who they are, what they know, or the work they do. But it would be a mistake to view this as someone else’s problem.
Attack techniques developed for narrowly targeted operations have a habit of spreading. Exploits can be reused, sold onward, reverse engineered, copied by other surveillance vendors, or adapted by criminal groups. A vulnerability initially valuable because it compromises a small number of carefully chosen devices may become much more dangerous once public disclosure, patch analysis, or exploit sharing makes them available for more widespread campaigns.
How to stay safe
Apple advises users to:
Update your devices to the latest software, which includes the latest security fixes.
Protect your devices with a passcode, Touch ID, or Face ID.
Use strong and unique passwords, and passkeys where available.
Don’t open links or attachments from unknown senders.
We’d like to add:
Potential targets of mercenary spyware should consider applying Apple’s Lockdown Mode.
Check if an Apple Threat Notification is real. Scammers will undoubtedly try and mimic them. You can verify a notification by signing in to your Apple account. A genuine Threat Notification will always be clearly listed there.
If you receive an Apple Threat Notification, Apple recommends seeking expert help, such as the Digital Security Helpline from Access Now.
Scammers know more about you than you think.
Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.
Researchers at Group-IB have discovered a new NFC relay malware family, purpose-built to capture live card data via NFC and forward it in real time to attackers. They dubbed it “WindRelay.”
NFC (Near Field Communication) is wireless technology that allows devices such as smartphones, payment cards, and payment terminals to communicate when they’re very close together. So, instead of stealing your physical bank card, the attackers capture NFC activity on an infected mobile phone and relay it in real time to a criminal-controlled device held against a contactless payment terminal, or an ATM that supports contactless cash withdrawals.
The researchers describe a 13-minute call impersonating a bank, in which a victim was persuaded to install an Android app labelled with the bank’s name. That app was a remote access Trojan (RAT) called SpyNote. SpyNote gave the attacker remote control of the phone and enabled the quiet installation of a second app, WindRelay.
The attackers then opened the victim’s legitimate banking app remotely and arranged a loan in the victim’s name, while also asking them to tap their physical payment card against the phone and enter its PIN. That tap let the second app forward the card’s contactless data in real time to the criminals, allowing them to make purchases or, in some cases, withdraw cash from an ATM.
This division of tasks is the important development here. The remote-access malware (SpyNote) gets the attackers into the phone, and the NFC relay malware (WindRelay) turns the victim’s physical card into something the criminals can use elsewhere at that moment.
It’s not quite as simple as it sounds, because NFC comes in a few different “flavors.” Some produce a static code. Take the card that opens my apartment building door, for example. That kind of signal can easily be copied to a device like my Flipper Zero so I can use it to open the door. But sophisticated contactless payment cards use dynamic codes. Each time you tap to pay, your card’s chip generates a unique, one-time code (often called a cryptogram or token) that cannot be reused.
That’s why the critical feature of NFC relay malware is real-time relaying. Since payment card transactions use dynamic, transaction-specific cryptographic data, timing is central to this kind of fraud.
The telephone call isn’t just the lure. It’s also the attackers’ control channel. It lets them overcome the victim’s hesitation, respond to confusion instantly, and coordinate the precise moments when the victim installs an app, taps their card, and enters a PIN.
This is part of an established and expanding NFC relay fraud category sometimes called ghost tapping. In the past, we’ve discussed NGate and SuperCard X, which are similar malware families. But the combination with SpyNote is what makes this campaign stand out.
How to protect yourself
As with many security threats, the best defense is you. The cybercriminals behind this attack can’t do anything unless you install the software on your phone, so they go through several steps to convince you to do so.
Be skeptical of calls and text messages from people you don’t know, especially those claiming to be urgent. Scammers typically try to panic you into acting quickly. Once they get you on the phone, they can build trust, making it harder to think critically and say no.
If you feel compelled to take action, check in with someone you trust first. If you’re still convinced the request is genuine, verify the message independently. Call your financial institution using an official number, not through the one in the text message or email.
Never give personal details to anyone who contacts you unexpectedly, and never change your banking details at their request. A bank will not ask you to install an app from a link, text message, browser download, or other unofficial source to “secure” your card.
Avoid sideloading apps (installing them from outside of the Google Play store), and treat unexpected Accessibility or device-control permissions as a serious warning sign.
Your phone is full again, and the warning appears at exactly the wrong moment. Suddenly you can’t update apps, record a video, or save another photo.
The cause is rarely one giant file. Storage disappears in a steady drizzle of leftovers: temporary files an app creates and forgets, caches that grow in the background, and downloads you no longer need. None of it is dangerous, but it can gradually fill your phone’s storage.
Junk Cleaner is a new tool in Malwarebytes for Android, available from version 5.22. It finds that clutter, shows you what’s using space, and lets you decide what to remove.
What Junk Cleaner finds
Junk Cleaner looks for three broad categories of storage clutter:
Leftover and residual files: Temporary and system-generated files that apps leave behind.
Old and large downloads: Files you saved but no longer use or remember.
(Coming soon) Hidden app caches: Storage used by apps in places Android keeps out of easy reach.
A file showing up in one of these categories doesn’t mean it’s harmful. It just means it’s taking up space and might be worth removing. That distinction matters because Junk Cleaner is about storage, not threats. It works separately from Malwarebytes malware scanning and web protection, and it doesn’t touch your photos, messages, or documents.
Scan, review, clean
Junk Cleaner scans the relevant areas of your device in parallel, guided by a set of rules that can be updated as we learn about new kinds of leftover files. The results are grouped by category and show how much space each item is using.
After the scan, you review the findings and choose what to clear. Nothing is deleted until you confirm the selection. The results are presented as a simple list showing each category and how much space you could recover.
.kadence-column445671_58044d-dd{max-width:400px;margin-left:auto;margin-right:auto;}.wp-block-kadence-column.kb-section-dir-horizontal:not(.kb-section-md-dir-vertical)>.kt-inside-inner-col>.kadence-column445671_58044d-dd{-webkit-flex:0 1 400px;flex:0 1 400px;max-width:unset;margin-left:unset;margin-right:unset;}.kadence-column445671_58044d-dd > .kt-inside-inner-col,.kadence-column445671_58044d-dd > .kt-inside-inner-col:before{border-top-left-radius:0px;border-top-right-radius:0px;border-bottom-right-radius:0px;border-bottom-left-radius:0px;}.kadence-column445671_58044d-dd > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column445671_58044d-dd > .kt-inside-inner-col{flex-direction:column;}.kadence-column445671_58044d-dd > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column445671_58044d-dd > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column445671_58044d-dd{position:relative;}@media all and (min-width: 1025px){.wp-block-kadence-column.kb-section-dir-horizontal>.kt-inside-inner-col>.kadence-column445671_58044d-dd{-webkit-flex:0 1 400px;flex:0 1 400px;max-width:unset;margin-left:unset;margin-right:unset;}}@media all and (max-width: 1024px){.kadence-column445671_58044d-dd > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.wp-block-kadence-column.kb-section-sm-dir-vertical:not(.kb-section-sm-dir-horizontal):not(.kb-section-sm-dir-specificity)>.kt-inside-inner-col>.kadence-column445671_58044d-dd{max-width:400px;-webkit-flex:1;flex:1;margin-left:auto;margin-right:auto;}.kadence-column445671_58044d-dd > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}
A quick look under the hood
Junk Cleaner uses rules to identify patterns of clutter. These are not malware or phishing signatures. They describe file types and locations that may be worth reviewing when you need more space.
The scanner checks the relevant directories, matches files against those rules, measures how much space each hidden cache occupies, and combines the results into a single review screen.
Junk Cleaner automates a repetitive Android chore without turning storage cleanup into another complicated job.
Built at a hackathon
Junk Cleaner began as an internal hackathon project, an idea one engineer wanted to explore over a few focused days. The prototype proved useful enough to grow into a shipping feature, and reached all users in Malwarebytes for Android version 5.22.
Turning the demo into a product meant more than polishing the screen. The team added Android permission handling, cache cleaning, and review experience needed for a feature people could rely on across different devices.
We like that origin story because many useful features begin the same way: someone scratches an itch, builds something quickly, and turns a rough idea into a tool that can help millions of people. Future updates will bring smarter sorting, finer filters, and more control over what’s included.
Make room for what matters
Running out of space always seems to happen at the worst possible moment. Junk Cleaner clears away the leftovers that quietly build up, leaving more room for the photos, apps, and moments that actually matter.
Junk Cleaner is available in Malwarebytes for Android from version 5.22. Open the app, run a scan, review the results, and reclaim your space in a few taps.
Scammers know more about you than you think.
Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.
Apple’s tagline for its App Store says, “The apps you love. From a place you can trust.” You might love the apps, but can you trust the store? A federal lawsuit filed in the Northern District of California last week suggests not.
Three people have accused Apple of promoting a fake version of the Sparrow Wallet cryptocurrency app through its App Store, even though the real app’s developer had spent over a year telling Apple that he hadn’t produced a version for the mobile platform.
The fake app drained a combined $1.8 million from the victims’ wallets between May and August 2025, and now they’re furious with Apple for allowing it to happen.
How the scam worked
According to the legal complaint published courtesy of BleepingComputer, James Ramirez, Christopher Ellis, and Jalen Delgado downloaded a fake version of Sparrow Wallet from Apple’s App Store. It asked users to enter their recovery phrase (the 12 or 24 words that restore access to a crypto wallet), which is something a legitimate wallet app may also ask for during setup.
Instead of keeping that information private, though, the app handed it to the criminals running the scam. Once someone else has your recovery phrase, they have access to your wallet. If they transfer your cryptocurrency to another address, you cannot get it back.
Ramirez, Ellis, and Delgado say they lost approximately $875,000, $840,000, and $120,000 in Bitcoin, respectively.
Apple terminated the legit developer’s account
The real Sparrow Wallet is a desktop application for Windows, macOS, and Linux. It has never had an official iPhone app.
Craig Raw, the developer of the actual Sparrow Wallet, reported fake versions to Apple in the weeks leading up to January 2024 and publicly confirmed that month that the fake app was still live despite repeated reports.
About a year later, he tried a workaround to stop people from downloading the fake app by submitting a placeholder iOS app with screenshots explicitly warning users that Sparrow Wallet was not available on iOS. Apple responded by terminating his developer account. Thankfully it reversed it later, otherwise he would have been unable to maintain the macOS version.
The complaint also alleges that Apple featured the fake app in curated cryptocurrency collections alongside legitimate products, and allowed additional fake Sparrow Wallet apps onto the App Store even after consumers complained.
Apple’s official response, per TechCrunch, is that:
“apps impersonating others are a violation of its guidelines and it takes swift action to remove them.” Not swift enough, apparently.
The three users are now suing Apple, alleging that it misrepresented the App Store as trustworthy despite knowing about the fake apps. The complaint includes claims of fraudulent concealment, among others, and seeks a jury trial. The plaintiffs are seeking compensation for their losses, along with additional damages permitted under California law.
Not a one-off
Fake cryptocurrency apps are a trend. Kaspersky researchers recently identified 26 crypto wallet impersonators inside Apple’s ecosystem, all targeting seed phrases and recovery keys.
Rather than including malicious code directly inside the app, many of these scams direct users to a convincing fake App Store webpage, where they’re prompted to install another version of the app. That malicious version steals cryptocurrency recovery phrases or private keys by abusing enterprise distribution certificates intended for internal company apps.
How to stay safe
Apple points to its enforcement volume: it terminated 193,000 developer accounts and rejected more than 371,000 copycat submissions in 2025. Those figures come from Apple itself, with no mention of an independent audit. The company says that it uses a mixture of human review and machine learning to spot malicious apps.
If you use cryptocurrency on an iPhone, don’t assume that an App Store listing guarantees an app is genuine. Download apps using links from the developer’s official website whenever possible, and check that the developer actually offers an iPhone version before installing it.
The App Store is generally safer than downloading apps from elsewhere, but this case is a reminder that it is not infallible.
Scammers know more about you than you think.
Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.
If you feel like your phone has turned into a scam megaphone, you’re not alone. Robocalls have been a problem for years. Artificial intelligence (AI) is making them slicker, faster, and harder to spot.
A new investigation by Transaction Network Services (TNS) shows that while the big telecom players have stepped up caller ID authentication, many smaller providers are still lagging behind. That leaves plenty of room for criminals to keep making spoofed, AI‑voiced robocalls that seem legitimate right up until they empty your bank account.
Turning back the clock to 2019, lawmakers in the US passed the TRACED Act with a simple goal: make it harder for scammers to lie about who’s calling. The technical was solution STIR/SHAKEN, a pair of catchily-named standards that let phone networks cryptographically sign calls so downstream providers can check whether the caller ID is trustworthy.
On paper, it’s working fairly well for the major carriers. TNS reports that about 85% of voice traffic between Tier 1 networks in 2025 was signed using STIR/SHAKEN, and 93% of those calls received the highest “A” attestation. If the entire ecosystem looked like that, spoofing would become much harder.
Why spoofing still works
The same report found that most lower‑tier communications service providers—typically smaller or specialist carriers—aren’t even close to that level of protection. On average, they only use the required cryptographic signatures about 20% of the time. That means four out of five calls effectively go through the network “unsigned.”
There are reasons for this. The Federal Communications Commission (FCC) has granted some providers extensions, particularly very small and satellite providers, as long as they implement other robocall mitigation measures. Even so, the result is uneven implementation.
From a scammer’s point of view, this is great. Cybercriminals are already using AI to run increasingly sophisticated and scalable robocall attacks and know that even calls with strong authentication can be spoofed or abused when other parts of the chain are weak.
AI voice cloning can be done with just a few seconds of original audio. Combine that with call spoofing and personal information gathered from data breaches, and scammers can make a call appear to come from your bank while using a calm, familiar voice that knows your name or other personal details.
Robocalls cost almost nothing to send. Internet calling allows scammers to dial thousands of numbers for a few cents, which is why the volume is so high. Industry estimates suggest US consumers received around 55 billion robocalls in 2025, with projections creeping toward 60 billion in 2026. That’s roughly 160 million spam calls every single day in one country. Globally, that’s about 385 billion spam/robocall calls each year.
How to stay safe
What can you realistically do as a consumer, given that the network itself is still in transition and attackers are upgrading faster than some carriers?
A few habits still go a long way:
Be skeptical of urgency. Real organizations rarely need you to make immediate decisions over the phone about payments, credentials, or remote access. Hang up and call back via a number you find on their official website.
Treat caller ID as a clue, not proof. Even if the number looks familiar or matches what you see on a card or website, it can be spoofed.
Don’t press buttons or follow instructions in automated menus you didn’t expect. Many robocalls use “press 1 to speak to an agent” as the gateway into a full social‑engineering script.
Use call‑blocking and screening tools. Your phone, carrier, or security app may already offer options to block known spam numbers, send unknown callers to voicemail, or label suspicious calls.
And finally—and this is where we can help—check suspicious numbers with our Scam Number Check before you answer or call back.
Scammers know more about you than you think.
Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.
Nearly half of people encounter a scam on their phone every single day. Malwarebytes is doing something about it.
That figure comes from a 2025 Malwarebytes survey of 1,300 respondents across the US and Europe. The results paint a troubling picture. A quarter of the victims surveyed reported being harassed or blackmailed, while nearly one in five had private information exposed, and 15% lost money.
“I felt like I was in a horror movie,” said one survey respondent. “I never thought it would happen to me like this.”
Your phone is a scammer’s dream. You use it to bank, message, shop, and more. It’s an ideal gateway for anyone looking to take advantage of you. And today’s scams aren’t limited to just one app or program. They show up as texts and delivery notifications, as calls that spoof a trusted number, and as social media DMs.
Increasingly, AI is making all of this much harder to detect. Malwarebytes research found that half of people feel unprepared for the sophistication of these AI-driven threats. Phone scams now rank among the top five scam types people encounter, according to Malwarebytes Scam Guard data.
Part of the problem is misplaced trust. According to Malwarebytes’ data, roughly half of people—55% of iPhone owners and 50% of Android owners—said they believe their phone’s security is enough to keep them safe. But relying on those protections alone can leave people vulnerable.
Malwarebytes detected more than 800,000 distinct strains of Android malware last year and expects that number to cross 1 million in 2026.
Your phone needs more than just a lock screen to stay safe. That’s why we’ve rebuilt Malwarebytes Mobile Security. It puts scam protection first, and it’s backed by all our other tools to keep your phone secure.
Built for today’s scams
Here’s how Malwarebytes Mobile Security helps keep scams away from you and your data.
Scam Guard is a free AI-powered tool built into Mobile Security for both Android and iOS. Got a suspicious text, email, phone number, link, or message? Drop it into Scam Guard and get an instant read on whether it’s a scam, along with guidance on what to do next.
Text and Call Protection now catches significantly more junk and scam messages than before. Updated filtering that reviews shortened links more closely and flags suspicious content, like romance-scam language or unexpected money requests, before it reaches your inbox. Call Protection checks every incoming call against known scam and spam numbers, so you can block or flag them automatically instead of gambling on whether to pick up. It’s live now on iOS, with Android rolling out later this summer.
Malwarebytes Digital Footprint Portal’s free scannershows you which of your personal details—passwords, Social Security numbers, and more—are already exposed and offers straightforward steps to keep them safe.
Trusted Advisor gives your device a Protection Score and recommends simple steps to strengthen your security, from adjusting settings and permissions to running a scan or updating your device.
Expanded ad blocking on iOS now lets you filter Google Sponsored Ads in Safari—a browser that scammers frequently abuse to make fraudulent campaigns look legitimate.
Android Junk Cleaner removes leftover files, temporary data, and outdated cache files that build up on your device over time. A cleaner, faster phone is easier to manage and gives you the space you need to install important security updates.
There’s more
Here’s everything else Mobile Security protects you from:
Our Malware Scanner (Android) scans for and removes malware and potentially unwanted programs, including screen lockers and adware.
Real-Time Protection (Android) proactively defends against ransomware, PUPs, and phishing attempts in real time.
Wi-Fi Monitoring (iOS) warns you when you connect to an insecure network so you can take action by turning on your VPN.
Malwarebytes Privacy VPN keeps your browsing private with a fast WireGuard connection and a strict no-logs policy supported by diskless, RAM-only server infrastructure.
Phone scams aren’t going anywhere, but protecting yourself doesn’t have to be complicated. Malwarebytes Mobile Security brings together the tools you need to recognize scams, protect your privacy, and keep your phone safer, all in one app.
Aftercall is a wave of deceptive Android apps on Google Play that pose as everyday tools while bombarding users with pop-up ads after every phone call.
When an unexpected ad pops up every time you hang up a call, it will slowly drive you crazy, especially if you can’t figure out what’s causing it. The ads appear outside the app’s normal context, making it difficult for users to identify and remove the culprit.
Researchers investigating the campaign discovered a collection of these apps that masquerade as alarm clocks, calendars, and other seemingly harmless apps. After installation, they ask for permission to “appear on top” of other apps. That means they can show a full-screen ad every time you end a call, then hide themselves, making them difficult for users to find and uninstall.
Because the ads appear after you end a call, the researchers dubbed the campaign “Aftercall.”
How the Aftercall scheme works
Think of these apps as fake helpers that piggyback on your phone calls purely to generate ad impressions.
The apps disguise themselves as alarm clocks, calendars, note-taking apps, cleaners, or “super fast” messaging apps and are distributed through the Google Play Store. Researchers found dozens of new apps released every month, collectively responsible for hundreds of millions of ad impressions.
They trick users into granting overlay permissions. Because Android doesn’t allow this permission to be granted through a standard pop-up, the app has to direct users into Settings, where they must enable it manually. To persuade them, the apps invent plausible reasons. One researcher explained:
“In one example, the alarm app explains that it needs to go off even when the phone is locked – without granting permission, alarms might not appear correctly. Another app, a calendar, doesn’t even leave users a choice – it simply closes, unless they grant the permission.”
Some of these apps also request full-screen notification permissions, allowing them to show ads even when the device is locked.
Aftercall apps monitor the phone’s call state. When it changes from “ringing” to “idle,” indicating that a call has ended, they immediately launch an activity using their overlay permission to pop a screen over everything else and show an ad.
To make the ads seem more legitimate, they wrap them in a fake “call info” screen, complete with caller details, a fake profile picture, and text suggesting the ad relates to the app’s functionality. For the user, this feels like some new post-call feature rather than an unrelated app showing adverts.
They hide to avoid detection and removal. Aftercall apps remove themselves from the “Recent apps” list so when users try the usual “swipe away the suspicious app” approach, they don’t see anything obvious.
How to stay safe
Besides being incredibly annoying for users, the Aftercall campaign also wastes advertisers’ money. After all, would you buy something pushed in this way?
If you see ads pop up right after you end a call, especially alongside fake “call info,” check which apps have the “appear on top” or overlay permissions.
The exact steps vary depending on your phone manufacturer and Android version, but you can usually find them by looking at Settings > Apps > More options (3 vertical dots) > Special access > Appear on top.
Look for apps you don’t recognize, rarely use, or that shouldn’t need overlay access, such as a simple notes app, clock, or cleaner. Disable their “Allow to appear on top” or “Display over other apps” permission. If you’re confident you’ve identified the culprit, uninstall it.
Use an up-to-date, real-time anti-malware app for your device to detect and remove malicious apps.
When installing apps, think carefully before granting permissions. Does the app really need the access it’s asking for to perform its function?
Finally, make sure Google Play Protect is enabled so it can regularly scan apps for known malicious behavior.
Open the Google Play Store app on your phone.
Tap your profile icon in the top-right corner.
Tap Play Protect.
Look at the main screen or tap the Settings gear icon to see if Scan apps with Play Protect is turned on.
Scammers know more about you than you think.
Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.
OSNews covered the downfall of Nokia extensively back when it was happening, but I must admit that seeing this whole story in “retrospectives” now makes me feel so incredibly old. This story played out roughly between 2007 and 2016 – in the grand scheme of things, the end of Nokia’s phone business wasn’t that long ago! Zeit, bitte bleib stehen.
Anyway, here’s another retrospective, but this one I definitely like a bit more than the countless others we’ve seen, because it ends on the part of the story often left out: Nokia not only survived, it’s actually thriving.
The company itself ultimately survived, even if the transition wasn’t painless. Nokia’s revenues, which peaked in 2007, fell sharply through the mid-2010s before the company refocused on a decades-old business line—telecom infrastructure—that many had forgotten Nokia was even in. Nokia now ranks among the world’s top three suppliers of 5G network equipment, serving carriers across more than 125 countries, alongside Ericsson and Huawei. Although the company could never quite crack the smartphone, it now plays a key role in providing the network backbone those smartphones run on.
From a business perspective, I honestly doubt Nokia’s phone business could’ve survived to this day, even if they had responded to the arrival of the iPhone sooner, and even if they didn’t do the stupid thing of focusing on Windows Phone first and had just embraced Android right away. Obviously, a Nokia with its own touch-era smartphone operating system would never have survived – none of them did – and even if they went with Android from the onset, I think the eventual onslaught of Samsung, which has killed many a popular smartphone brand, would’ve trampled Nokia too.
In a better version of our world, Nokia would’ve survived with its own smartphone operating system, based on Symbian or not, and it would’ve been Europe’s strong, consistent answer to the Americans’ iOS and Android. While Nokia would’ve still been a business and would’ve undoubtedly tried the same anti-user shenanigans as Apple and Google, they’d at least be easier to reign in regulatory-wise. You’d hope.
The EU should’ve never allowed Nokia’s smartphone business to be sold to Microsoft.
Login
