PA

Earthshot Prize 2024 – Full list of winners

PA

Getty Images

What is the Earthshot Prize?

Getty Images

Multiple Android devices have been infected by a new trojan dubbed “ToxicPanda”. It primarily targets bank accounts but spoofs common apps to infect devices.

Android trojan ‘ToxicPanda’ threatens banking with advanced attack strategy

Smartphones are now one of the most widely used devices to perform banking functions. Mobile banking apps offer a secure and quick pathway for on-the-go banking. However, this presents an enticing opportunity for hackers and malware creators.

Back in 2023, Trend Micro, a popular antivirus platform, detected TgToxic, a powerful Android malware. TgToxic could steal credentials and funds from crypto wallets.

It appears another hacker or a group has borrowed TgToxic’s tech, and further weaponized the malware. Attackers are still targeting Android devices, but this time, the malware is going after banking apps using a clever technique.

The Cleafy’s Threat Intelligence team first discovered ToxicPanda. Believed to have originated in China, ToxicPanda has reportedly infected over 1500 Android devices around the world. The trojan seems to be preferring Android devices in Europe and Latin America.

How does ToxicPanda infect and spread on Android devices?

ToxicPanda is primarily a banking malware. However, it acts like a trojan. Moreover, it masquerades as several popular non-banking apps. When users download and side-load infected apps on their Android devices, ToxicPanda uses sophisticated methods to evade detection. It then monitors banking activities. Gradually, it initiates money transfers from compromised devices via Account Takeover (ATO), mentioned Cleafy researchers Michele Roviello, Alessandro Strino, and Federico Valentini.

ToxicPanda isn’t spreading via the Google Play Store or other popular Android app stores. Instead, it relies on unsuspecting victims’ habit of side-loading apps on their devices.

Simply put, Android device users must exercise extreme caution while obtaining Android installer files from outside official app stores. Smartphone users must completely avoid the practice if their Android device has banking apps. Additionally, users must regularly update apps and the Android OS installed on their devices from official sources.

Several cybersecurity experts have also warned banks and financial institutions. Banking apps, as well as users, must opt for multi-factor authentication, passkeys, OTPs, and other methods to safeguard their accounts.

OpenAI has scooped up a domain name that sounds like a logical fit. TechCrunch reports that Chat.com, which was previously bought for over $15 million, is now in the hands of the ChatGPT maker.

According to the domain history website who.is, Chat.com was first registered way back in September 1996. Before OpenAI’s acquisition, it last changed hands in 2023, when HubSpot co-founder and CTO Dharmesh Shah reportedly bought it for $15.5 million. We can speculate that the executive saw the burgeoning AI chatbot industry and the concise term’s potential for a big return. It was reportedly one of the top two publicly reported domain sales ever.

OpenAI hasn’t said how much it paid for Chat.com, but it confirmed with TechCrunch that it bought the domain. And if you’re expecting drastic changes from OpenAI’s chatbot, the move isn’t likely tied to a ChatGPT rebrand. Regardless, the domain now redirects to the world-changing AI tool.

The Federal Trade Commission (FTC) announced on Tuesday that it will be taking action against the online cash app and neobank Dave, which it says used “misleading marketing to deceive consumers.” At issue is how Dave marketed $500 cash advances to consumers that it rarely offered, and the “Express Fee” it charged if customers wanted their money immediately.

The FTC claimed the service was misleading because Dave’s marketing implied that its cash advances would be “instant,” using terminology like “on the spot” to describe them, without disclosing the fees involved until after the consumer completed the sign-up process and gave Dave access to their bank account.

The fees ranged anywhere from $3 to $25, the complaint stated. If the user chose not to pay the fee, they’d have to wait two to three business days for the standard transfer to go through, the complaint says. What’s more, the FTC says, Dave would also sometimes charge a surprise fee, which it described as a “tip.” The user interface was designed to make this difficult for users to detect or avoid the fee, leading to consumers feeling scammed, according to the FTC.

This latter issue is another example of the “dark patterns” — or manipulative design practices — companies use to guide users to take actions benefiting their own goals, not the consumers. Examples of the type of behavior the FTC now wants to penalize are things like automatically checking boxes when users sign up, or showing larger buttons for the actions the company wants users to take.

According to a recent study by the agency, a majority of subscription apps and websites use dark patterns to trick consumers.

In Dave’s case, consumers were shown images of a cartoon child surrounded by food and messaging like “10 Healthy Meals,” “15 Healthy Meals,” or “20 Healthy Meals,” implying that the tip would go to providing meals for people in need. However, the FTC says that only 10 cents of each “tip” is donated and the company keeps the remaining amount. In other words, the tip doesn’t actually provide a full meal, much less 10 to 20 meals. Also, when consumers tried to lower their tip, they would see an image of the food being taken away from the child until they were left with an empty plate, the complaint says.

According to SEC filings, Dave received more than $149 million in revenue from tips from 2022 through the first six months of 2024, the FTC said.

Another issue was that Dave charges a $1 monthly membership fee debited directly from customers’ bank accounts. But when users discovered the fee, they were not able to easily cancel it, according to the complaint. Some even tried to delete their account to escape the fee and were still charged, the FTC says.

The full complaint includes several screenshots of Dave’s tricky techniques, which the FTC says are in violation of Section 5(a) of the FTC Act and the Restore Online Shoppers’ Confidence Act (ROSCA). The agency is seeking an injunction to stop Dave from continuing its behavior and may also seek a monetary award or other relief as deemed by the court.

In response to the complaint, Dave said that it’s “disappointed” the FTC has chosen to file suit.

“The FTC asserts many incorrect claims regarding Dave’s disclosures and how the Company acquires consent for the fees associated with our products,” a company statement reads. “For the avoidance of doubt, Dave’s ability to charge subscription fees and optional tips and express fees is not in question. We believe this case is another example of regulatory overreach by the FTC, and we intend to vigorously defend ourselves. We take compliance and customer transparency very seriously and believe that we have always acted within the law. We remain focused on serving our members who love and rely on our products,” it said.

By manipulating a quantum fluid, researchers could form liquid knots that never unravel. These could help us shed light on odd quantum objects from the dawn of the universe.

When tiny whirlpools called vortices form in a fluid, they can make loops that can then be knotted like a loop of string. But while a string can form knots that won’t unravel without the help of scissors, knotted vortices in a fluid break free more easily. They can explode into a diffuse swarm of…