News

Fake wallet apps ask for your 12-word phrase and quietly drain your crypto fundsCRIL found over 20 Play Store apps built solely to steal users’ crypto credentialsMalicious apps used WebView to fake real login pages from PancakeSwap and othersNew research by Cyble Research and Intelligence Labs (CRIL) has uncovered a large-scale phishing campaign involving more than 20 Android applications listed on the Google Play Store.These apps, which appeared to be legitimate cryptocurrency wallet tools, were created with a singular purpose: stealing users’ mnemonic phrases, the crucial 12-word keys that provide full access to crypto wallets.Once compromised, victims risk losing their entire cryptocurrency holdings, with no possibility of recovery.How the apps work and what makes them dangerousMany of the malicious apps were built using the Median framework, which enables the rapid conversion of websites into Android applications.Using this method, threat actors embedded phishing URLs directly into the app code or within privacy policy documents.These links would then load deceptive login pages via a WebView, tricking users into entering their mnemonic phrases under the false belief they were interacting with trusted wallet services such as PancakeSwap, SushiSwap, Raydium, and Hyperliquid.For example, a fraudulent PancakeSwap app used the URL hxxps://pancakefentfloyd[.]cz/api.php, which led to a phishing page mimicking the legitimate PancakeSwap interface.Likewise, a fake Raydium app redirected users to hxxps://piwalletblog[.]blog to carry out a similar scam.Despite variations in branding, these apps shared a common objective: extracting users’ private access keys.CRIL's analysis revealed that the phishing infrastructure supporting these apps was extensive. The IP address 94.156.177[.]209, used to host these malicious pages, was linked to over 50 other phishing domains.These domains imitate popular crypto platforms and are reused across multiple apps, indicating a centralized and well-resourced operation.Some malicious apps were even published under developer accounts previously associated with legitimate software, such as gaming or streaming applications, further lowering user suspicion.This tactic complicates detection, as even advanced mobile security tools may struggle to identify threats hidden behind familiar branding or developer profiles.To protect against such attacks, CRIL advises users to download apps only from verified developers and avoid any that request sensitive information.Using reputable Android antivirus or endpoint protection software, along with ensuring that Google Play Protect is enabled, adds an important, though not infallible, layer of defense.Strong, unique passwords and multi-factor authentication should be standard practice, and biometric security features should be enabled when available.Users should also avoid clicking on suspicious links received via SMS or email, and never enter sensitive information into mobile apps unless their legitimacy is certain.Ultimately, no legitimate app should ever request a full mnemonic phrase through a login prompt. If that happens, it’s likely already too late.Full list of the 22 fake apps to avoid1. Pancake Swap Package: co.median.android.pkmxaj Privacy Policy: hxxps://pancakefentfloyd.cz/privatepolicy.html2. Suiet Wallet Package: co.median.android.ljqjry Privacy Policy: hxxps://suietsiz.cz/privatepolicy.html3. Hyperliquid Package: co.median.android.jroylx Privacy Policy: hxxps://hyperliqw.sbs/privatepolicy.html4. Raydium Package: co.median.android.yakmje Privacy Policy: hxxps://raydifloyd.cz/privatepolicy.html5. Hyperliquid Package: co.median.android.aaxblp Privacy Policy: hxxps://hyperliqw.sbs/privatepolicy.html6. BullX Crypto Package: co.median.android.ozjwka Privacy Policy: hxxps://bullxni.sbs/privatepolicy.html7. OpenOcean Exchange Package: co.median.android.ozjjkx Privacy Policy: hxxps://openoceansi.sbs/privatepolicy.html8. Suiet Wallet Package: co.median.android.mpeaaw Privacy Policy: hxxps://suietsiz.cz/privatepolicy.html9. Meteora Exchange Package: co.median.android.kbxqaj Privacy Policy: hxxps://meteorafloydoverdose.sbs/privatepolicy.html10. Raydium Package: co.median.android.epwzyq Privacy Policy: hxxps://raydifloyd.cz/privatepolicy.html11. SushiSwap Package: co.median.android.pkezyz Privacy Policy: hxxps://sushijames.sbs/privatepolicy.html12. Raydium Package: co.median.android.pkzylr Privacy Policy: hxxps://raydifloyd.cz/privatepolicy.html13. SushiSwap Package: co.median.android.brlljb Privacy Policy: hxxps://sushijames.sbs/privatepolicy.html14. Hyperliquid Package: co.median.android.djerqq Privacy Policy: hxxps://hyperliqw.sbs/privatepolicy.html15. Suiet Wallet Package: co.median.android.epeall Privacy Policy: hxxps://suietwz.sbs/privatepolicy.html16. BullX Crypto Package: co.median.android.braqdy Privacy Policy: hxxps://bullxni.sbs/privatepolicy.html17. Harvest Finance blog Package: co.median.android.ljmeob Privacy Policy: hxxps://harvestfin.sbs/privatepolicy.html18. Pancake Swap Package: co.median.android.djrdyk Privacy Policy: hxxps://pancakefentfloyd.cz/privatepolicy.html19. Hyperliquid Package: co.median.android.epbdbn Privacy Policy: hxxps://hyperliqw.sbs/privatepolicy.html20. Suiet Wallet Package: co.median.android.noxmdz Privacy Policy: hxxps://suietwz.sbs/privatepolicy.html21. Raydium Package: cryptoknowledge.rays Privacy Policy: hxxps://www.termsfeed.com/live/a4ec5c75-145c-47b3-8b10-d43164f83bfc22. PancakeSwap Package: com.cryptoknowledge.quizzz Privacy Policy: hxxps://www.termsfeed.com/live/a4ec5c75-145c-47b3-8b10-d43164f83bfcYou might also likeThese are the best external hard drives in the marketCheck out the best mini PCs for all budgetsBuild your own superfast virtual 32TB Gen5 SSD with this RAID PCIe Gen5 card

A revealing demonstration with Tesla's Full Self-Driving mode is raising concerns about whether fully autonomous cars are ready to hit the streets. Tesla has reportedly pushed back the rollout of its upcoming all-electric, fully autonomous car called the Cybercab, while a recent demonstration in Austin, Texas showed a Tesla Model Y running through a school bus' flashing lights and stop signs, and hitting child-size mannequins. The tests were conducted by The Dawn Project, along with Tesla Takedown and ResistAustin, and showed Tesla's Full Self-Driving software repeating the same mistake eight times.

It's worth noting that Tesla's autonomous driving feature is formally known as Full Self-Driving (Supervised) and "requires a fully attentive driver and will display a series of escalating warnings requiring driver response." Tesla even has a warning that says, "failure to follow these instructions could cause damage, serious injury or death." However, it's not the first time that Tesla's FSD software has found itself in hot water. The Dawn Project, whose founder Dan O'Dowd is the CEO of a company that offers competing automated driving system software, previously took out ads warning about the dangers of Tesla's Full Self-Driving and how it would fail to yield around school buses. In April 2024, a Model S using Full Self-Driving was involved in a crash in Washington, where a motorcyclist died.

With anticipation building up for an eventual Cybercab rollout on June 22, the company's CEO posted some additional details on X. According to Elon Musk, Tesla is "being super paranoid about safety, so the date could shift." Beyond that, Musk also posted that the "first Tesla that drives itself from factory end of line all the way to a customer house is June 28."This article originally appeared on Engadget at https://www.engadget.com/transportation/tesla-blows-past-stopped-school-bus-and-hits-kid-sized-dummies-in-full-self-driving-tests-183756251.html?src=rss

AI-generated documents are replacing traditional forgeries and bypassing verification faster than ever imaginedSynthetic identity fraud has surged 195% globally, with Europe and North America hardest hitMost fraud now happens after onboarding, using tricks like credential stuffing and device spoofingSynthetic identity document fraud is now spreading at an alarming pace globally, driven almost entirely by the misuse of generative AI, experts have warned.New data from Sumsub has claimed the creation of fake documents using AI grew by 195% worldwide between Q1 2024 and Q1 2025.The most dramatic spike was recorded in Europe, where synthetic ID fraud surged by 378%, followed by North America (311%) and the MENA region (258%).Traditional forgery declinesThis trend appears to be gaining ground on traditional document forgery, which has declined sharply in most regions, dropping by 82% in Africa and 50% in North America - with Europe the exception, where traditional forgeries increasing by 33%.This shift suggests scammers are moving from conventional techniques to AI-generated identities, which can now be produced in seconds using largely unregulated tools.The industries most affected by this trend include crypto, trading, transportation, fintech, and gambling, all sectors which often rely on rapid onboarding processes and may not yet have strong enough safeguards to detect synthetic documents before damage is done.Compounding this vulnerability is the fact over three quarter (76%) of fraud now occurs after the onboarding stage, using methods such as device fingerprint spoofing, credential stuffing, and so-called “money muling.”“The rise of AI-generated fraud is exposing critical flaws in traditional verification systems, and this data shows sophisticated fake documents are becoming a key tool in the fraudster’s arsenal,” said Pavel Goldman-Kalaydin, Head of AI/ML at Sumsub.“We expect companies like OpenAI to strengthen safeguards controlling the use of its programs to generate passports, IDs, and other personal documents.”Parallel to this trend is a dramatic rise in deepfake-related fraud, where North America saw a staggering 1,100% increase in such cases, with Europe following at 900%.Nations like Hong Kong, Singapore, and Germany saw the highest individual surges, raising concerns about the future role of manipulated visual media in identity fraud schemes.For individuals and organizations trying to protect themselves, relying solely on conventional KYC protocols may no longer be enough. Businesses are advised to use identity management software and multi-layered verification systems for stronger protection.Consumers should also consider top-rated ID theft protection solutions, especially those that monitor for synthetic identity use. Using reputable people search tools can add an extra layer of safety when verifying unknown contacts or confirming someone’s legitimacy online.You might also likeThese are the best VPN with antivirus solutionsTake a look at our pick of the best password managersThe AI arms race: why we need AI to fight AI attacks

There's no shortage of reasons to stay off the Meta ecosystem, which includes Facebook and Instagram, but there are some places where WhatsApp remains the main form of text-based communication. The app is a great alternative to SMS, since it offers end-to-end encryption and was one of the go-to methods to send uncompressed photos and videos between iPhone and Android users before Apple adopted RCS. Even though Facebook, which later rebranded to Meta, acquired WhatsApp in 2014, it doesn't require a Facebook or Instagram account to get on WhatsApp — just a working phone number.

How to create a WhatsApp account without Facebook or Instagram

To start, you need to download WhatsApp on your smartphone. Once you open the app, you can start the registration process by entering a working phone number. After entering your phone number, you'll receive a unique six-digit code that will complete the registration process. From there, you can sort through your contacts on your attached smartphone to build out your WhatsApp network, but you won't have to involve Facebook or Instagram at any point.

Alternatively, you can request a voice call to deliver the code instead. Either way, once you complete the registration process, you have a WhatsApp account that's not tied to a Facebook or Instagram account.

How to link WhatsApp to other Meta accounts

If you change your mind and want more crossover between your Meta apps, you can go into the app's Settings panel to change that. In Settings, you can find the Accounts Center option with the Meta badge on it. Once you hit it, you'll see options to "Add Facebook account" and "Add Instagram account." Linking these accounts means Meta can offer more personalized experiences across the platforms because of the personal data that's now interconnected.

You can always remove your WhatsApp account from Meta's Account Center by going back into the same Settings panel. However, any previously combined info will stay combined, but Meta will stop combining any personal data after you remove the account.This article originally appeared on Engadget at https://www.engadget.com/social-media/how-to-set-up-a-whatsapp-account-without-facebook-or-instagram-210024705.html?src=rss