'One install, and the phone is no longer yours' NordVPN warns of fake Ryanair, Emirates, Qatar Airways apps used to spread malware

Date:
Mon, 24 Aug 2026 14:08:13 +0000

Description:
NordVPN urges caution online over a banking Trojan masquerading as more than 65 reputable brands. Heres how to protect your phone.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter NordVPN found a malware
campaign impersonating 65 brands It tricks victims into clicking on messages requesting urgent action If you use an Android phone, its worth checking your apps Summer is still in full swing with many people out enjoying their holidays. Unfortunately, cybercriminals never stop trying to steal money by tricking people into believing they are on trustworthy websites or using legitimate apps especially when our attention is more likely to wander.

Thats what NordVPN , the pinnacle of the best VPNs , recently investigated, issuing an alert urging caution over a widespread and sophisticated malware campaign targeting Android users through highly convincing phishing schemes. The malware is posing as over 65 well-known brands, including Ryanair, Emirates, and Qatar Airways, as well as tax authorities, registry offices,
and social security systems that lure you into downloading their apps.

The dangerous trojan tracks your messages and logins, spies on you through your camera, records your voice, and bypasses two-factor authentication
before ultimately draining your bank account.

The campaign has targeted users in Southeast Asia, Latin America, and Africa. You may like Fake X-VPN installers found to spread credential-stealing
malware here's how to stay safe Hundreds of thousands at risk as NordVPN uncovers sophisticated adware campaign hidden in 50,000 pirate sites Cybercriminals are using GTA 6 hype to spread malware ahead of launch,
NordVPN warns

NordVPN the best VPN overall NordVPN came out on top in our 2026 round of VPN tests. We think it's the best VPN for most people. Were confident that virtually anyone can sign up for NordVPN and get what they need from it. Its easy to use, very secure, fast enough for gaming, and offers flawless streaming service unblocking.

Subscriptions start from $3.49 per month, and you can try it out risk-free with a 30-day money-back guarantee. View Deal What the research found NordVPN spent the last 12 months investigating the malware campaign including its infrastructure and impersonation targets analysing malware clusters and mapping more than 100 domains linked to the campaign.

It discovered that the campaign tricks users into installing an app that grants full access to their Android phones or computers by impersonating highly trustworthy companies brands people are accustomed to providing their personal data without questioning it.

Victims are lured by a variety of requests via SMS, WhatsApp, or social media that look totally innocuous, like a job opening at an airline, a cheap
flight, or a tax refund.

Once installed, the Trojan runs quietly in the background and stays active even if the phone is restarted, accessing your messages and call logs, capturing the screen, recording audio, and accessing the camera.

Attackers can even log into the victim's banking app and approve transactions themselves by using SMS interception to steal your money, as most banks implement two-factor authentication through one-time codes sent by text. What to read next Surfshark warns personal devices are a 'wide-open door' as UK Prime Minister falls for impersonation scam Apple and Google are hosting hundreds of dangerous VPN links here is why your device is at risk Hundreds of fake Chrome VPN extensions caught hijacking your traffic

Marijus Briedis, chief technology officer at NordVPN, says: "One install, and the phone is no longer yours. The attacker sees your screen, reads your SMS codes, and empties your accounts from the inside."

Trusted brands are often the most spoofed brands in phishing scams, alongside other malware 'tricks' to gain trust, such as multi-platform PR campaigns promoting malware as legitimate software, or even Chrome extensions impersonating VPNs .

However, unlike many opportunistic phishing attempts, these attacks have been particularly hard to spot, featuring extremely accurate replicas of
legitimate websites, meticulously copied and professionally translated. How
to stay safe (Image credit: Shutterstock) Briedis advises Android users to be very careful not to install apps from links received via text message . "Real airlines, banks and government bodies distribute apps through Google Play,
not SMS or WhatsApp," he stresses.

As with other AI impersonating scams , users should treat any urgent request as a warning sign : whenever there is mention of a refund or an account being blocked, check the source carefully before clicking on anything or taking any action.

Checking that a website is legitimate and does not operate from domains ending in .cc, .lol, .xyz, .mom, or .pw will be a clear safety indicator.

Furthermore, do not rely on 'the padlock icon' : an HTTPS connection merely indicates that the connection is encrypted, not that the site is genuine.

If you suspect that a suspicious app is already on your phone, disconnect
your phone from the internet, uninstall the app , change your password from another device, and contact your bank : this will ensure youre back in the clear.

And remember that if even the current UK Prime Minister can be a scam target, perhaps you should remain vigilant too. Today's best NordVPN deals NordVPN 2 Year 2.59 /mth View at NordVPN NordVPN 1 year 4.09 /mth View at NordVPN NordVPN 1 Month 11.09 /mth View at NordVPN Follow TechRadar on Google News
and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!



======================================================================
Link to news story: https://www.techradar.com/vpn/vpn-privacy-security/one-install-and-the-phone-i s-no-longer-yours-nordvpn-warns-of-fake-ryanair-emirates-qatar-airways-apps-us ed-to-spread-malware


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)