Android users have been dealing with a steady rise in financial malware for years. Threats like Hydra, Anatsa and Octo have shown how attackers can take over a phone, read everything on the screen and drain accounts before you even notice anything wrong. Security updates have helped slow some of these strains, but malware authors keep adapting with new tricks. 

The latest variant spotted in circulation is one of the most capable yet. It can silence your phone, take screenshots of banking apps, read clipboard entries, and even automate crypto wallet transactions. This threat is now known as Android BankBot YNRK, and it is far more advanced than typical mobile malware.

Sign up for my FREE CyberGuy ReportGet my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter

How the malware infiltrates devices

HOW ANDROID MALWARE LETS THIEVES ACCESS YOUR ATM CASH

Android banking malware is getting harder to spot as attackers use new tricks to take over phones and drain accounts. (Thomas Trutschel/Photothek via Getty Images)

BankBot YNRK hides inside fake Android apps that appear legitimate when installed. In the samples analyzed by researchers at Cyfirma, the attackers used apps that impersonated official digital ID tools. Once installed, the malware begins profiling the device by collecting details such as brand, model and installed apps. It checks whether the device is an emulator to avoid automated security analysis. It also maps known models to screen resolutions, which helps it tailor its behavior to specific phones.

To blend in, the malware can disguise itself as Google News. It does this by changing its app name and icon, then loading the real news.google.com site inside a WebView. While the victim believes the app is genuine, the malware quietly runs its background services.

One of its first actions is to mute audio and notification alerts. This prevents victims from hearing incoming messages, alarms or calls that could signal unusual account activity. It then requests access to Accessibility Services. If granted, this allows the malware to interact with the device interface just like a user. From that point onward, it can press buttons, scroll through screens and read everything displayed on the device.

BankBot YNRK also adds itself as a Device Administrator app. This makes it harder to remove and helps it restart itself after a reboot. To maintain long-term access, it schedules recurring background jobs that relaunch the malware every few seconds as long as the phone is connected to the internet.

What does the malware steal

Once the malware receives commands from its remote server, it gains near-complete control of the phone. It sends device information and installed app lists to the attackers, then receives a list of financial apps it should target. This list includes major banking apps used in Vietnam, Malaysia, Indonesia and India, along with several global cryptocurrency wallets.

With Accessibility permissions enabled, the malware can read everything shown on the screen. It captures UI metadata such as text, view IDs and button positions. This helps it reconstruct a simplified version of any app’s interface. Using this data, it can enter login details, swipe through menus or confirm transfers. It can also set text inside fields, install or remove apps, take photos, send SMS, turn call forwarding on and open banking apps in the background while the screen appears inactive.

In cryptocurrency wallets, the malware acts like an automated bot. It can open apps such as Exodus or MetaMask, read balances and seed phrases, dismiss biometric prompts, and carry out transactions. Because all actions happen through Accessibility, the attacker never needs your passwords or PINs. Anything visible on the screen is enough.

The malware also monitors the clipboard, so if users copy OTPs, account numbers or crypto keys, the data is immediately sent to the attackers. With call forwarding enabled, incoming bank verification calls can be silently redirected. All of these actions happen within seconds of the malware activating.

BankBot YNRK hides inside fake apps that look legitimate, then disguises itself as Google News while it runs in the background. (AP Photo/Don Ryan, File)

7 steps you can take to stay safe from banking malware

Banking trojans are getting harder to spot, but a few simple habits can reduce the chances of your phone getting compromised. Here are 7 practical steps that help you stay protected. 

FBI WARNS OVER 1 MILLION ANDROID DEVICES HIJACKED BY MALWARE

1) Install strong antivirus software

Strong antivirus software helps catch trouble early by spotting suspicious behavior before it harms your Android device or exposes your data. It checks apps as you install them, alerts you to risky permissions and blocks known malware threats. Many top antivirus options also scan links and messages for danger, which adds an important layer of protection when scams move fast.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

2) Use a data-removal service to shrink your digital footprint

Data brokers quietly collect and sell your personal details, which helps scammers target you with more convincing attacks. A reputable data-removal service can find and delete your information from dozens of sites so that criminals have less to work with. This reduces spam, phishing attempts and the chances of ending up on a malware attack list.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

3) Install apps only from trusted sources

Avoid downloading APKs from random websites, forwarded messages or social media posts. Most banking malware spreads through sideloaded apps that look official but contain hidden code. The Play Store is not perfect, but it offers scanning, app verification and regular take-downs that greatly reduce the risk of installing infected apps.

4) Keep your device and apps updated

System updates often patch security issues that attackers exploit to bypass protections. Updating your apps is just as important, since outdated versions may contain weaknesses. Turn on automatic updates so that your device stays protected without you having to check manually.

5) Use a strong password manager

A password manager helps you create long, unique passwords for every account. It also saves you from typing passwords directly into apps, which reduces the chance of malware capturing them from your clipboard or keystrokes. If one password gets exposed, the rest of your accounts remain safe.

Next, see if your email has been exposed in past breaches. Our No. 1 password manager (see Cyberguy.com) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials. 

Once active, the malware can read your screen, steal financial data, automate crypto transfers and intercept OTPs within seconds. (Kurt “CyberGuy” Knutsson)

Check out the best expert-reviewed password managers of 2025 at Cyberguy.com

6) Enable two-factor authentication wherever possible

2FA adds a confirmation step through an OTP, authenticator app or hardware key. Even if attackers steal your login details, they still need this second step to get in. It cannot stop malware that takes over your device, but it significantly limits how far an attacker can go with stolen credentials.

GOOGLE ISSUES WARNING ON FAKE VPN APPS

7) Review app permissions and installed apps regularly

Malware often abuses permissions such as Accessibility or Device Admin because they allow deep control over your phone. Check your settings to see which apps have these permissions and remove anything that looks unfamiliar. Also, look through your installed apps and uninstall any tool or service you do not remember adding. Regular reviews help you spot threats early before they can steal data.

Kurt’s key takeaway

BankBot YNRK is one of the most capable Android banking threats discovered recently. It combines device profiling, strong persistence, UI automation and data theft to gain full control over a victim’s financial apps. Because much of its activity relies on Accessibility permissions, a single tap from the user can give attackers complete access. Staying safe means avoiding unofficial APKs, reviewing installed apps regularly and being cautious of any sudden request to enable special permissions.

Do you think Android phone makers like Samsung or Google are doing enough to protect you from malware? Let us know by writing to us at Cyberguy.com

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter

Copyright 2025 CyberGuy.com.  All rights reserved.

A U.S. neurotechnology startup called Paradromics is gaining momentum in the fast-growing field of brain-computer interfaces. The FDA has approved its first human trial built to test whether its fully implantable device can restore speech for people with paralysis. This milestone gives the Austin company a strong position in a competitive space, shaping the future of neural technology.

Paradromics received Investigational Device Exemption status for the Connect-One Early Feasibility Study using its Connexus BCI. It is the first approved study to explore speech restoration with a fully implantable system. The research team wants to evaluate safety and see how well the device converts neural activity into text or a synthesized voice.

Sign up for my FREE CyberGuy Report. Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

BRAIN IMPLANT TURNS THOUGHTS INTO DIGITAL COMMANDS

How the brain implant works

The implant uses hundreds of tiny electrodes to capture detailed signals from the motor cortex where the brain forms sounds and shapes words. (Paradromics)

Paradromics developed a fully implantable speech-focused brain device called the Connexus BCI. The company designed it to capture detailed neural signals that support real-time communication for people who cannot speak. This system uses high-resolution electrodes and an implanted wireless setup to record activity from individual neurons involved in forming speech.

The Connexus BCI has a titanium body with more than 400 platinum-iridium electrodes placed just below the brain’s surface. Each electrode is thinner than a human hair. These electrodes record neural firing patterns in the motor cortex, where the brain controls the lips, tongue and larynx.

Surgeons place the implant under the skin and connect it with a thin cable to a wireless transceiver in the chest. That transceiver sends data through a secure optical link to a second transceiver worn on the body. The external unit powers the system with inductive charging similar to wireless phone chargers.

The collected signals then move to a compact computer that runs advanced language models. It analyzes the neural activity and converts it into text or into a synthetic voice based on the user’s past recordings.

Inside the Paradromics BCI human trial

The trial begins with two participants. Each person will receive one 7.5-millimeter-wide electrode array placed 1.5 millimeters into the part of the motor cortex that controls the lips, tongue and larynx. During training sessions, the volunteers will imagine speaking sentences while the device learns the neural signatures of each sound.

This is the first BCI trial that formally targets real-time synthetic voice generation. The study will also test whether the system can detect imagined hand movements and translate those signals into cursor control.

If early results meet expectations, the trial could expand to ten people. Some participants may receive two implants to capture a richer set of signals.

HOW A TINY RETINAL IMPLANT IS HELPING PEOPLE REGAIN THEIR SIGHT

Cyberguy reached out to Paradromics for comment and received the following statement:

Researchers are testing whether Paradromics’ fully implantable brain device can turn neural activity into real-time speech for people with paralysis. (Synchron)

“Communication is a fundamental human need. For people with severe motor impairment, the inability to express themselves with family and friends or request basic needs makes living difficult. The FDA approved clinical study for the Connexus Brain-Computer Interface is the first step toward a future where commercially available neurotech can restore the ability to naturally speak and seamlessly use a computer.

The fully implanted Connexus BCI is designed to record brain signals from individual neurons, capturing the massive amounts of data required for high performance applications like speech restoration and complex mouse and keyboard hand actions. Built from proven medical-grade materials, Connexus BCI is engineered for daily long-term use, backed by more than three years of stable pre-clinical recordings.

How Paradromics compares to other BCI companies

Paradromics joins Synchron and Neuralink at the front of the implanted BCI race. Synchron uses a stent-like device placed in a blood vessel to record broad neural patterns. Neuralink uses flexible threads with many recording sites to capture high-bandwidth signals from individual neurons.

Paradromics sits in the middle of these two approaches by using a fully implantable system that still captures single-neuron detail. Researchers believe this design may offer long-term stability for everyday communication.

What this means for you

This breakthrough could make a major difference for people who lost their ability to speak after ALS, stroke or spinal cord injury. A system that converts thought into speech could help them talk in real time and regain independence. It may also allow hands-free computer control, which can improve daily living.

If the trial succeeds, the tech could change how assistive communication devices work and speed up patient access to advanced tools.

During the trial, volunteers imagine speaking while advanced AI models learn their neural patterns and convert those signals into text or a synthetic voice. (Paradromics)

Take my quiz: How safe is your online security?

Think your devices and data are truly protected? Take this quick quiz to see where your digital habits stand. From passwords to Wi-Fi settings, you’ll get a personalized breakdown of what you’re doing right and what needs improvement. Take my Quiz here: Cyberguy.com 

BRAIN IMPLANT FOR EPILEPSY TESTED IN 20-MINUTE SURGERY

Kurt’s key takeaways

Paradromics is taking a careful but bold path toward practical BCI communication. The first stage is small but meaningful. It sets the foundation for devices that may restore speech with natural flow and faster response times. As more trials move forward, this field could shift from experimental to everyday use faster than many expect.

Would you trust a fully implanted brain device if it meant restoring communication for someone you care about? Let us know by writing to us at Cyberguy.com

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter

Copyright 2025 CyberGuy.com.  All rights reserved.

Attackers have a new tool that targets Microsoft 365 users at a massive scale. 

Security researchers say a phishing platform called Quantum Route Redirect, or QRR, is behind a growing wave of fake login pages hosted on nearly 1,000 domains. These pages look real enough to fool many users while also slipping past some automated scanners.

QRR runs realistic email lures that mimic DocuSign requests, payment notices, voicemail alerts or QR-code prompts. Each message routes victims to a fake Microsoft 365 login page built to harvest usernames and passwords. The kit often lives on parked or compromised legitimate domains that add a false sense of safety for anyone who clicks.

Researchers tracked QRR in 90 countries. About 76% of attacks hit US users. That scale makes QRR one of the largest phishing operations active right now.

WINDOWS 10 USERS FACE RANSOMWARE NIGHTMARE AS MICROSOFT SUPPORT ENDS IN 2025 WORLDWIDE

Sign up for my FREE CyberGuy Report 
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

Attackers use fake Microsoft security alerts to trick people into entering their Microsoft 365 passwords. (Chona Kasinger/Bloomberg via Getty Images)

A fast follow to other major Microsoft credential attacks

QRR appeared soon after Microsoft disrupted a major phishing network known as RaccoonO365. That service sold ready-made Microsoft login copies used to steal more than 5,000 sets of credentials, including accounts tied to over 20 US healthcare organizations. Subscribers paid as little as $12 a day to send thousands of phishing emails.

Microsoft’s Digital Crimes Unit later shut down 338 related websites and identified Joshua Ogundipe from Nigeria as the operator. Investigators tied him to the phishing code and a crypto wallet that earned more than $100,000. Microsoft and Health-ISAC have since filed a lawsuit in New York that accuses him of multiple cybercrime violations.

Other recent examples include kits like VoidProxy, Darcula, Morphing Meerkat and Tycoon2FA. QRR builds on these tools with automation, bot filtering and a dashboard that helps attackers run large campaigns fast.

What makes QRR so effective

QRR uses about 1,000 domains. Many are real sites that were parked or compromised, which helps the pages pass as legitimate. The URLs also follow a predictable pattern that can look normal to users at a glance.

The kit includes automated filtering that detects bots. It sends scanners to harmless pages and sends real people to the credential-harvesting site. Attackers can manage campaigns inside a control panel that logs traffic and activity. These features let them scale up quickly without technical skill.

Security analysts say organizations can no longer depend on URL scanning alone. Layered defenses and behavioral analysis have become essential for spotting threats that use domain rotation and automated evasion.

Microsoft was contacted by CyberGuy for comment but did not have anything to add at this time.

HACKERS FIND A WAY AROUND BUILT-IN WINDOWS PROTECTIONS

Why this matters for Microsoft 365 users

When attackers get your Microsoft 365 login, they can see your email, grab files and even send new phishing messages that look like they came from you. That can create a chain reaction that spreads fast. This is why the steps below all work together to block these threats before they turn into something bigger.

Steps to stay safe from QRR and other Microsoft 365 phishing attacks

Use these simple actions to shrink the risk from fake Microsoft 365 pages and look-alike emails.

1) Check the sender before you click

Take a second to look at who the email is really from. A slight misspelling, an unexpected attachment or wording that feels off is a big clue the message may be fake. 

2) Hover over links first

Before you open any link, hover your mouse over it to preview the URL. If it does not lead to the official Microsoft login page or looks odd in any way, skip it.

3) Turn on multifactor authentication (MFA)

MFA adds an extra layer adds an extra layer that makes it much harder for attackers to break in even if they have your password. Use options like app-based codes or hardware keys so phishing kits cannot bypass them.

4) Use a data removal service

Attackers often gather personal details from data broker sites to craft convincing phishing emails. A trusted data removal service scrubs your information from these sites, which cuts down on targeted scams and makes it harder for criminals to tailor fake Microsoft alerts that look real.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

QRR hides its phishing pages across nearly 1,000 domains, making the fake login screens look convincing at first glance. (Microsoft)

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

5) Update your browser and apps

Keep everything on your device up to date. Updates seal off security holes that attackers often rely on when building phishing kits like QRR.

6) Never click unknown links and use strong antivirus software

If you need to visit a sensitive site, type the address into your browser instead of tapping a link. Strong antivirus tools also help by warning you about fake websites and blocking scripts that phishing kits use to steal login details.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

MICROSOFT SOUNDS ALARM AS HACKERS TURN TEAMS PLATFORM INTO ‘REAL-WORLD DANGERS’ FOR USERS

7) Use advanced spam filtering

Most email providers offer stronger filtering settings that block risky messages before they reach you. Turn on the highest level your account allows to keep more fake Microsoft alerts out of your inbox.

8) Watch for login alerts

Turn on Microsoft account sign-in notifications so you get an alert anytime someone tries to access your account. To do this, sign in to your Microsoft account online, open Security, choose Advanced security options and switch on Sign-in alerts for any suspicious activity.

Strong sign-in alerts and phishing-resistant MFA help block these scams before criminals can take over your account.  (Drew Angerer/Getty Images)

Kurt’s key takeaways

QRR is a reminder of how quickly scammers change their tactics. Tools like this make it easy for criminals to send huge waves of fake Microsoft emails that look real at first glance. The good news is that a few smart habits can put you a step ahead. When you add stronger sign-in protection, turn on alerts and stay aware of the newest tricks, you make it much harder for attackers to sneak in.

Do you think most people can tell the difference between a real Microsoft login page and a fake one, or have phishing kits become too convincing? Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report 
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

Copyright 2025 CyberGuy.com.  All rights reserved.