Generative AI Can Clone and Modify Android Apps for as Little as 88 Kopecks, Positive Technologies Warns
Specialists at Positive Technologies have shown that modern generative AI systems can rapidly create functional clones of Android applications at minimal cost, significantly lowering the entry threshold for potential attackers.
In a controlled experiment, researchers tested 90 popular applications across multiple categories. Instead of injecting malicious code, they instructed the AI models to make neutral modifications, reassemble the APK packages, and verify whether the altered apps remained operational. The results proved concerning for the security community.
Closed commercial models successfully completed the task in 84% of attempts, while models with open weights achieved a 61% success rate. On average, the AI required 14 iterations and between five and a half to nine minutes to produce a working modified version. The final cost per successful outcome ranged from 0.88 to 40.89 rubles, depending on the model and number of attempts.
These figures imply that a determined actor could attempt to modify approximately one hundred widely used applications for only a few thousand rubles. In real-world scenarios, the same process could be used to insert data-stealing functionality, change application behavior, or establish communication with external servers controlled by attackers.
The resulting counterfeit builds are easy to promote as official updates, improved versions, or applications unavailable in the Google Play store. Distribution channels include third-party app catalogs, websites, messaging platforms, and specialized online communities. Users who regularly sideload APK files from untrusted sources are particularly exposed.
Lowering the Barrier for App Modification Attacks
Positive Technologies emphasizes that generative AI has not invented a fundamentally new attack technique. Instead, it has automated and accelerated the labor-intensive process of reverse engineering and code modification that previously demanded considerable time and specialized expertise.
Developers are advised to implement stronger code protection mechanisms against analysis and tampering, actively monitor the appearance of unofficial builds, and integrate security considerations from the earliest stages of application design. Without such measures, malicious clones may appear faster than legitimate teams can release patches.
Related articles
Why HTTP to HTTPS Redirects Fall Short: Risks of Exposed Requests and the Role of HSTS Preload
A simple HTTP to HTTPS redirect satisfies basic audit requirements but leaves the initial request fully exposed in plaintext. The request carries the full path, query parameters, and cookies lacking the Secure flag, allowing observers on open Wi-Fi or compromised routers to read or tamper with traffic before TLS begins. Modern browsers such as Chrome since version 90 attempt HTTPS first, yet legacy clients, explicit http:// links in emails, scripts, and failed HTTPS fallbacks continue to send unprotected requests. HSTS instructs browsers to use HTTPS after the first successful visit, yet the header itself travels over HTTPS and cannot protect the very first connection from a new device or cleared cache. Preloading embeds the rule directly in the browser, eliminating the initial plaintext request entirely, but demands includeSubDomains and a one-year max-age, making the change effectively irreversible for months. The article recommends verifying Secure flags on all cookies, ensuring single-step redirects to the same host, and testing HSTS incrementally before considering preload.
OSINT for the Lazy Part 18: Extracting Value from Wayback Machine Archives for Bug Bounty and Security Research
The article explores passive reconnaissance techniques using web archive tools to uncover forgotten endpoints, configuration files, and sensitive parameters without directly interacting with target systems. It highlights three command-line utilities—waybackurls, gau, and waymore—that query public archives such as Wayback Machine, Common Crawl, AlienVault OTX, and URLScan to retrieve historical URLs. These tools help bug bounty hunters and penetration testers discover old API endpoints, admin panels, backup files, and JavaScript with hardcoded secrets that may still be exploitable. Installation instructions, usage examples, and filtering options are provided for each tool to maximize efficiency and reduce noise in results. The piece emphasizes that all methods remain fully passive, minimizing detection risk while requiring proper authorization before any active testing. Advanced users are advised to combine the tools for broader coverage and deeper analysis of archived responses.
OSINT Investigation Exposes Fraudulent Russian Garlic Investment Scheme Masquerading as Local Production
An in-depth OSINT probe into a Russian agricultural investment project promising 50-70% annual returns from garlic farming has revealed a likely import arbitrage operation sourcing produce from China and Uzbekistan. The project claimed ownership of over 300 hectares of fields, a proprietary seed fund, and guaranteed sales to major retailers including Magnit, Perekrestok, Pyaterochka, and Svetofor, yet public records show minimal profitability and heavy debt. Financial statements from linked cooperatives indicated just 2.2% net margin alongside loans exceeding annual revenue fourfold, pointing to reliance on continuous new investor capital. Registry checks confirmed no financial licenses, no seed-breeding status, and actual cultivated land far below advertised figures. Import declarations and equipment registrations further indicated the operation functions as a repackaging hub for foreign garlic sold under private labels. The parent group has been placed on the Bank of Russia blacklist, with related sites blocked by Roskomnadzor while Telegram channels continue aggressive marketing.
Deploying Self-Hosted Hysteria 2 Proxy on Debian-Based Linux VPS via Terminal
A detailed guide explains how to set up a personal Hysteria 2 proxy server on a KVM VPS running Debian or Ubuntu without any web panels. The process begins with generating ed25519 SSH keys, hardening the sshd_config file, and restricting access with ufw to only TCP port 22 and UDP port 443. Hysteria 2 is downloaded from GitHub, made executable, and configured using a TOML file that enables salamander obfuscation and a self-signed TLS certificate. A custom systemd unit ensures the service restarts on failure. The client configuration includes SHA256 pinning of the server certificate to prevent MITM attacks. The guide emphasizes manual CLI operations that apply equally to other services such as Nginx and stresses checking local laws before deployment.