AllTrails is a popular tool for finding walking, hiking, running, and biking routes around the world. You can use it to locate trails and check user reviews, but the app has plenty of features for customizing activities, tracking conditions, and navigating (safely) in real time. Here are the tips and tricks to get the most out of AllTrails.

Scrub the elevation chart to find hill grades and obstacles

The elevation map is useful for visualizing total gain and loss on your route, but you can scrub the chart on mobile to see exactly where climbs or obstacles are on the map. For example, you can see where the grade increases (and what the percentage is) or how far you are from stream crossings or switchbacks. Open the map from the trail page or the Navigate function and drag your finger across the elevation profile to track the location marker on the map.

Stack AllTrails search filters to find less traveled trails

You may be most likely to search for trails based on length and difficulty as well as location, but AllTrails has a wealth of filters to find routes with specific features, or that are dog- or kid-friendly. You can also use filters to identify trails that are likely to be less crowded (though if a route is on AllTrails, it certainly isn't a secret). In the Search window, tap All to open available filters. Select Not very busy under Visitation and Loop under Route type (out-and-back trails can feel busier). Select a rating and add any other requirements, then hit Show trails.

Reverse engineer custom routes from other hikers’ completed activities

When you use AllTrails to log an activity or write a review, a map of your track is saved to the trail listing and visible to other users. You can disable this in Settings > Privacy settings > Content—but even if you don't display your activity, you can use those that are public to find custom routes that string multiple trails together or add a ridgeline not included in the official AllTrails track. Scroll down to the reviews section and tap the activities link to pull up maps of completed activities. Note, though, that some variations in routes may not be actual detours, and you should still follow Leave No Trace principles and stay within your skill level when it comes to difficulty.

Connect an REI membership to get a discounted AllTrails subscription

A free AllTrails account will get you most of the service's basic features, but you have to pay for a Plus subscription—$35.99 per year—for things like offline maps and wrong-turn alerts. If you have an REI membership, you get a 30% discount on paid AllTrails subscriptions, bringing the annual fee down to $24.99 per year. (A Peak subscription that usually costs $79.99 per year drops to $49.99 per year.) In the AllTrails app, go to your profile > Settings > REI Membership and follow the steps to connect your account and claim the discount.

Keyword search reviews to get specific intel about conditions

User reviews can give you a good sense of current trail conditions, such as seasonal closures and whether there are muddy or snowy conditions, as well as more global environmental considerations like bugs and river crossings. You should obviously read the most recent reviews for your route, but you can also keyword search on desktop (CTRL/CMD + F) for terms like "mud," "scramble," "snow," "gate," "bugs," or "ticks." A trail may be marked as "easy," but this can reveal issues like snowmelt that have made running water trickier to wade through. You can read the reviews from the same month in previous years too.

Open directions from the AllTrails listing to route to exact GPS coordinates

When you search trails and trailheads by name on popular mapping apps, you may not always get directions to the exact starting location pinned on AllTrails. Instead, launch directions from the AllTrails listing to use the GPS coordinates, which you can then search in Google Maps or Apple Maps. On the trail page, scroll down to Get directions, then select your preferred map app (or copy the coordinates to the clipboard).

Add waypoints during navigation to leave notes about your route

When you record an activity in AllTrails, you have the option to add a waypoint, which is essentially a note pinned to a specific location on the route. This can be useful if you want to remember details, such as tricky turns or hidden features, and you can opt into adding your waypoints to community layers to help other users. Open the Navigator in the mobile app and tap the arrow in the lower-right corner. Swipe up and tap Add Waypoint. Select the waypoint type, add details and select privacy settings, and tap Save.

Use Airplane Mode plus AllTrails offline maps to save your device’s battery

Paid AllTrails subscribers have access to offline maps that allow you to navigate routes in real time even if you don't have a signal. To ensure you don't drain your phone's battery while you're mid-hike, download offline maps for your trail in advance and then switch to Airplane Mode once you lose connection. GPS passively receives signals to triangulate your position, but it does not require the ability to transmit, so you can still follow your location on the map in Airplane Mode without straining the battery by constantly searching for a signal.

Apply AllTrails map overlays to see real-time environmental conditions

AllTrails maps have optional layers that contain a lot more data than just the route itself. All users have access to the Wildfire overlay, which shows current wildfire perimeters in the U.S. With a premium subscription, you get additional overlays for precipitation, temperature, ground conditions, snow depth, fall foliage, and community heat maps so you can see real-time environmental conditions at that specific location. A Peak subscription unlocks advanced overlays for slope angle, high-definition terrain, and public and private lands. Open a map and tap the Layers button in the upper-right corner.

Turn on Live Share to let friends and family know you're safe

Basic trail safety includes letting someone know exactly where you're going and when you plan to return. The AllTrails Live Share feature (available on paid plans) centralizes this information and shows trusted contacts where you are in real time so they can send help if things go wrong. When you share a link with safety contacts, they'll be able to see your real-time location, planned route, recorded mileage and elapsed time, estimated end time, coordinate info, and cell signal strength. They can also opt into SMS alerts. Activate Live Share under the Navigate tab—you'll need to generate a unique link each time you head out.

If you got a DM from an unverified Jon Bon Jovi account after commenting on one of his official Instagram posts, what would it take to make you believe it was really the rock star hoping to connect? And at what point when he starts asking you to send money—like lose-your-house kind of money—would you snap out of the fantasy and stop draining your bank account?

In a documentary premiering Saturday—Super Scam Me—investigative journalist Mariana van Zeller goes deep into this toxic love-bombing terrain. In a clip that Ars is exclusively debuting below, you can see how van Zeller worked with an ethical hacker, Arman the Cyber, to use a fake bitcoin receipt and bait the fake Bon Jovi, giving the victim some much-needed closure.

Scamming a romance scammer

Broadcasting on National Geographic at 9 pm ET and available to stream on Disney+ and Hulu, the documentary takes viewers on an empathetic quest to understand how the line between “lover” and “fraud victim” gets blurred in romance scams that the Federal Trade Commission says cost Americans nearly $1.5 billion in losses each year.

Read full article

Comments

The worst thing about your favorite chat app is trying to get your friends and family to use it. WhatsApp may be the most popular messaging platform in the world, but in the United States, it is hardly universally adopted. On the contrary, you'll find plenty of people who don't use it at all. In short, it's difficult to get a whole group to commit to any one platform, which can make casual video calls frustrating: If you don't use WhatsApp, and your friends are hosting a call, what are you supposed to do? You can't join a WhatsApp call without a WhatsApp account.

That's now changing. Meta, WhatsApp's parent company, announced "guest calling" on Wednesday. Now, any WhatsApp user can invite any non-WhatsApp user to a call, even if the recipient doesn't have an account. These calls still get the same core perks as traditional WhatsApp calls, Meta says: They're free and end-to-end encrypted, so you won't be compromising on your privacy by calling a non-WhatsApp user this way.

Non-WhatsApp users are still limited. Meta says these users always need a call host's approval to join. If you're a non-WhatsApp user, you'll find yourself in a waiting room until the call host lets you in. Meta also says that you can be kicked off the call at any time, and you won't be able to see other callers' phone numbers. You won't be able to send messages or add other users to the call. You are purely a participant.

How to invite someone without a WhatsApp account to a WhatsApp call

If you're trying to add a non-WhatsApp user to a call, first head to the Calls tab in the app. Here, hit (+), create a call link, then send it to the recipient. Meta says the user can open the link in their computer browser, enter their name, and join. This applies to one-on-one calls as well as calls with up to 32 people. While guests will have the aforementioned limits, they do have some features available to them. They can share their screen, react with emojis, or raise their hand.

WhatsApp isn't the first chat app to offer such a feature. Apple's FaceTime platform, for example, lets you create call links that anyone can join, whether they're calling in on an Apple device or a device running Android or Windows (or Linux, for that matter).

How GhostBat RAT Reaches Victims

GhostBat RAT's Ghost Overlay Trick

GhostBat RAT Watches 60 Financial Apps

Inside the GhostX Network Behind GhostBat RAT

Why GhostBat RAT Is Hard to Detect

Staying Safe From GhostBat RAT

Google has already added a few AI features to the Play Store, but a lot more are coming. The previously released Ask Play feature is expanding to offer more AI-powered discovery options in Google's app store, and Google is also using AI to build a recommendation engine called Game Finder. For people who have embraced AI to build their own apps, the Play Store will soon offer a way to privately host and share those creations.

Google rolled out Ask Play in 2025 as a small chatbot interface on Play Store listings. It lets you ask questions about an app or game, either by typing it in manually or choosing from a list of suggested queries. Starting today, Ask Play is expanding into a more general way to search for apps and games. You ask the robot questions, and it generates recommendations that can include detailed comparison charts. Gemini will roll out a similar capability soon.

Google's other AI discovery announcement focuses on games. The new Game Finder feature leans on all the usage data Google's app platform has hoovered up over the years, featuring insights into the way 1.2 billion people play games on Android. It builds a profile called Gamer DNA and matches you with players who have similar DNA.

Read full article

Comments

All messaging apps should let you schedule texts by default. Sometimes, you need to send a message to a friend or family member, but you don't want them to get it just yet. Maybe they're in a different time zone, and it's too early or late to politely text them; maybe they're in an important meeting, and you don't want their phone sounding or buzzing as a distraction. Either way, a scheduled message can save you: You won't forget to text them later, and they'll get the message whenever you think they should. Win-win.

Of course, this is not a standard feature in all apps yet. Some apps have it, like Telegram or iMessage, and it's a great addition when you need it. Others, like Messenger or WhatsApp, are sorely missing it. While Meta doesn't appear to have any plans to bring scheduled texts to Messenger, it does seem like WhatsApp users are getting the upgrade on the horizon. In fact, you might be able to try it out today.

Scheduling messaging in WhatsApp

As reported by WABetaInfo, WhatsApp is currently testing a new feature for users to schedule texts, photos, and videos to send at a later time. At this time, the feature works even when you're offline, so your scheduled messages will still send even if you don't have a wifi or cellular connection. In addition, the feature is not limited to single chats, as so many new messaging features are. You can schedule texts in both one-on-one and group chats, and all scheduled messages are still end-to-end encrypted.

At this time, it looks like Meta is only testing scheduling messages on WhatsApp for Android. The bright side for iPhone users is that this test is quite limited: Only select users are getting the feature at this time—and, while it's no guarantee, you should enroll in the WhatsApp beta if you want a chance at trying it out early. To start, head to WhatsApp's official beta tester page on the Google Play Store. Here, make sure you're logged into your Google Account, then enroll in the beta. Head back to the official WhatsApp Play Store page, and you should have a new update. This is the beta.

Once you're on the WhatsApp beta, you can check if you have the feature like so: Craft a new message in any chat, then tap and hold on the send button. If you have it, WhatsApp will present a pop-up, letting you cycle through a date and time to schedule your message. (You can choose to send the message in as little as 10 minutes, or as long as two weeks.) When you're ready to schedule, you can tap the green schedule button at the bottom of the menu. You can then tap the contact or group name at the top of this window, then tap "Schedule messages" to manage all scheduled texts in that thread.

Council car parks have switched away from ticket machines to cut costs, leading to extra fees for users

Drivers are unwittingly paying up to 40% more to park as more councils switch to app-only payments and force customers to pick up the tab.

Many councils across England have removed pay and display machines and replaced them with app payments, including a number in London. Most local authorities encourage drivers to pay by app to beat queues, while apps are often the only way to pay when ticket machines are out of order. However, many car park signs fail to mention that app payments may incur an additional service fee.

A website built to look almost exactly like CNN’s homepage is telling visitors to download “the new CNN app.” But it’s not CNN’s app, and has nothing to do with the news company.

The campaign doesn’t stop at CNN. It also uses fake Stremio and Avast installers hosted on similarly convincing lookalike sites, all targeting Windows users. The installers are part of the same campaign to trick people into installing legitimate remote-management software that’s already linked to the attacker’s account.

Instead of downloading the software they expected, victims install O&O Syspectr, a genuine, digitally signed remote administration tool used by IT teams to manage computers. In the wrong hands, that tool can give an attacker remote access to a victim’s PC, allowing them to run commands, install additional software, or explore files and data. The CNN, Avast, and Stremio lures all point back to the same Syspectr account.

Another lookalike site uses a fake crypto-mining browser game instead of a trusted brand, but delivers the same software from a different Syspectr account.

Here’s what we found, why your antivirus has no reason to stop it, and the one 10-second check that would have caught it every time.

What the fake CNN page looks like

The site copies CNN’s real homepage closely enough that most people wouldn’t look twice. It has current headlines, the same layout, and even a red “Live Updates” tag on a real story. A pop-up interrupts almost immediately: “Get the latest news first in the new CNN app—it’s live and free,” with a red Download button underneath.

The file behind that button is named CNN_App.setupad4693fd-d903-4791-8f58-975261c93ca2.exe—the same Syspectr installer that shows up under different branding elsewhere, down to the account ID embedded in the filename.

The same trick, impersonating other brands

A lookalike site at avast-premium[.]shop mimics Avast’s real download page closely, including the logo, review scores, and a blue “Free download” button for “Avast One.” The file behind it is named AVAST_App.setup4693fd-d903-4791-8f58-975261c93ca2.exe.

Another malicious site, stremiotv[.]online, copies Stremio, a legitimate media-center app. The file it pushes visitors to download is named Stremio_App.setup4693fd-d903-4791-8f58-975261c93ca2.exe.

Both carry the same account ID found in the CNN installer.

By impersonating trusted brands, the attackers trick visitors into installing the legitimate O&O Syspectr remote-access tool, which gives the attackers remote access to the victims’ computers.

A different kind of bait

Not every lure needs a trusted brand, however. 

syncminer[.]xyz invents its own hook instead: an “idle miner” browser game showing a slowly-ticking cryptocurrency balance, with a “Download Miner Plugin” button promising faster payouts. The identical site also runs at idleminer[.]pro with the same layout, same game, and same download.

Both distribute the same file, named oo-syspectr-setup9158bf2a-ff25-4290-b96c-2dc5eb310391.exe outright, carrying its own account ID that is different from the CNN, Avast, and Stremio lures we saw.

It’s not malware, which is why antivirus can miss it

Every one of these files is a real, digitally signed piece of software from O&O Software GmbH, a legitimate German company. Syspectr is sold openly to IT departments and gives an operator remote desktop control and an admin-level command line on whatever machine it’s installed on.

That’s why antivirus software may not stop it. Antivirus is designed to detect malicious software, not flag a legitimately signed business tool just because of how it arrived on a computer. The attacker only has to convince victims to install a legitimate remote-management tool that’s already linked to the attacker’s account.

The 10-second check that gives it away

On Windows, right-click any installer like this, choose Properties, and open the Details tab. Two fields—File description and Product name—identify every installer we examined as O&O Syspectr, alongside a copyright notice for O&O Software GmbH.

The filename can be changed by anyone distributing the file, but those embedded details come from the signed software itself. Changing them would invalidate the digital signature, so they reveal what the installer really is.

How we know these are connected

Every Syspectr installer includes the account ID of whoever generated it, embedded directly in the filename. The CNN-, Avast-, and Stremio-branded files all carry the exact same account ID, showing they were created from a single Syspectr account and simply reskinned for different lures.

The Syspectr installer distributed through the fake crypto-mining game carries a different account ID, suggesting either a second operator using the same playbook or the same group operating under another account.

What this tool can actually do

Syspectr is designed to let IT administrators manage computers remotely. Depending on the subscription level, that can include viewing system information, monitoring running processes and services, managing Microsoft Defender, and restricting USB devices.

The paid plans add the features that matter most to attackers. They allow an operator to remotely control the victim’s computer, browse files, run commands, install additional software, and make changes to the system as though they were sitting in front of it. Higher tiers add tools for managing large numbers of devices and, on compatible hardware, even allow remote access when Windows won’t boot.

These remote-control features aren’t available on free Syspectr accounts. They require a Premium subscription or higher.

O&O Software response

O&O responded quickly. Within days, the company disabled Remote Desktop and Remote Console access for free Syspectr accounts, restricting both to paid plans only.

O&O has since identified and suspended the abusive accounts, also blocking them from adding new devices. O&O’s analysis found the attackers relied exclusively on Remote Console, not Remote Desktop. The company says it will keep scanning for this pattern and tighten restrictions further if needed.

It’s a solid response and O&O clearly has a handle on how the abuse is happening. Not every vendor moves this quickly or this effectively when their software gets abused.

How to protect yourself

• Only download software from the vendor’s actual website. Search results and ads can lead to convincing fakes.
• Before running any installer you’re unsure about, on Windows you can right-click it, open Properties > Details, and check the File description and Product name fields.
• If you find O&O Syspectr installed and didn’t set it up yourself, uninstall it through Settings > Apps and run a full antivirus scan.
• If you ran an installer like this recently, change passwords for anything you accessed on that machine afterward from a clean machine.
• Protect yourself while browsing online. Malwarebytes Browser Guard blocks known scam and lookalike pages before you land on them.

Remember

Fake download sites don’t always deliver malware. Sometimes they deliver legitimate software that’s been weaponized by the person distributing it. That’s why it’s important to download software from the real vendor and, if something doesn’t feel right, check what the installer actually is before you run it.

Indicators of Compromise (IOCs)

Account ID 4693fd-d903-4791-8f58-975261c93ca2:

• app.cnn-news[.]net → CNN_App.setupad4693fd-d903-4791-8f58-975261c93ca2.exe
• avast-premium[.]shop → AVAST_App.setup4693fd-d903-4791-8f58-975261c93ca2.exe
• stremiotv[.]online → Stremio_App.setup4693fd-d903-4791-8f58-975261c93ca2.exe

Account ID  9158bf2a-ff25-4290-b96c-2dc5eb310391:

• syncminer[.]xyz → oo-syspectr-setup9158bf2a-ff25-4290-b96c-2dc5eb310391.exe
• idleminer[.]pro → oo-syspectr-setup9158bf2a-ff25-4290-b96c-2dc5eb310391.exe

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →