Generative AI Can Clone and Modify Android Apps for as Little as 88 Kopecks, Positive Technologies Warns

Positive Technologies researchers have demonstrated that generative AI models can successfully modify, reassemble, and preserve the functionality of Android applications in just minutes at extremely low cost. In experiments involving 90 diverse commercial apps, closed-source AI models achieved an 84% success rate while open-weight models reached 61%, requiring an average of 14 iterations and between 5.5 and 9 minutes per attempt. The cost of each successful modification ranged from 0.88 to 40.89 rubles, meaning an attacker could attempt to clone around 100 popular applications for only a few thousand rubles. Although the researchers inserted only neutral changes rather than malicious code, the same technique could be used to embed data interception, alter app behavior, or add connections to external command servers. The resulting fake APKs can then be distributed through third-party stores, websites, messengers, and online communities, primarily threatening users who sideload applications outside official marketplaces. The study shows that AI does not create entirely new attack vectors but dramatically lowers the technical barrier that previously required advanced reverse-engineering skills.

AntiMalwareJuly 14, 2026Translated from Russian

Read at source

Specialists at Positive Technologies have shown that modern generative AI systems can rapidly create functional clones of Android applications at minimal cost, significantly lowering the entry threshold for potential attackers.

In a controlled experiment, researchers tested 90 popular applications across multiple categories. Instead of injecting malicious code, they instructed the AI models to make neutral modifications, reassemble the APK packages, and verify whether the altered apps remained operational. The results proved concerning for the security community.

Closed commercial models successfully completed the task in 84% of attempts, while models with open weights achieved a 61% success rate. On average, the AI required 14 iterations and between five and a half to nine minutes to produce a working modified version. The final cost per successful outcome ranged from 0.88 to 40.89 rubles, depending on the model and number of attempts.

These figures imply that a determined actor could attempt to modify approximately one hundred widely used applications for only a few thousand rubles. In real-world scenarios, the same process could be used to insert data-stealing functionality, change application behavior, or establish communication with external servers controlled by attackers.

The resulting counterfeit builds are easy to promote as official updates, improved versions, or applications unavailable in the Google Play store. Distribution channels include third-party app catalogs, websites, messaging platforms, and specialized online communities. Users who regularly sideload APK files from untrusted sources are particularly exposed.

Lowering the Barrier for App Modification Attacks

Positive Technologies emphasizes that generative AI has not invented a fundamentally new attack technique. Instead, it has automated and accelerated the labor-intensive process of reverse engineering and code modification that previously demanded considerable time and specialized expertise.

Developers are advised to implement stronger code protection mechanisms against analysis and tampering, actively monitor the appearance of unofficial builds, and integrate security considerations from the earliest stages of application design. Without such measures, malicious clones may appear faster than legitimate teams can release patches.

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Other

Other

Mail.ru Reduces Lifetime 1TB Cloud Storage Promo to Standard 8GB Quota for Select Users

Mail.ru has begun notifying a small group of long-term Cloud Mail users that their complimentary 1TB storage, originally granted through a 2013-2014 app installation promotion, will be reduced to the standard 8GB free tier. Affected users receive personalized deadlines, with some facing storage limits starting 30 October and final deletion of excess files scheduled for 30 January 2027. The company confirmed the change impacts fewer than 0.5 percent of Cloud Mail users and stated that core free features remain available. Once the 8GB limit is exceeded, uploads, edits, and sharing are blocked while users have three months to download data or purchase additional space before files move to the trash for 14 days prior to permanent removal. This follows a similar reduction of lifetime 100GB storage performed by the service in 2024.

AntiMalwareOct 29, 2026Translated from Russian

Other

Kimi K3 Open Model Surpasses Closed AI Leaders with Million-Token Context and 896 Experts

Kimi K3 is an open-weights model that outperforms closed systems from GPT and Anthropic on several independent benchmarks. Developers achieved this by scaling three dimensions simultaneously: one million tokens of context, deeper layers, and 896 Mixture-of-Experts specialists. The team replaced the standard KV-cache with a fixed-size state matrix updated via the delta-rule, solving numerical instability by clamping the forgetting coefficient alpha between e^-5 and 1. Sequential state updates were parallelized across chips, GPUs, and multi-GPU nodes using the open-source FlashKDA kernel built on CUTLASS. Inter-layer information flow was preserved through learned pseudo-queries that selectively retrieve relevant outputs from prior blocks rather than passing full activations. Load balancing across 896 routed experts uses per-expert quantile thresholds and a distributed histogram method to guarantee fair token allocation without full sorting.

HabrOct 29, 2026Translated from Russian

Other

Innostage Completes Functional Testing of PT NGFW 1.10.3 Across 156 Criteria

Innostage has published the second part of its evaluation of PT NGFW version 1.10.3, focusing on functional capabilities rather than raw performance. The testing covered 156 individual checks grouped into categories such as basic technical features, firewalling, IDS/IPS, web filtering, malware protection, logging, routing, deployment, cryptographic controls and access management. Out of the total, 136 checks passed fully, seven passed with remarks, and 13 did not meet the predefined criteria. Key confirmed functions include high-availability clustering, centralized management via PT-MNGT, AD-based rule application, Site-to-Site VPN, TLS inspection, and Syslog integration with external security systems. Several advanced scenarios, including custom block pages, application risk classification, and centralized software distribution, were not confirmed under the test conditions. The report provides detailed protocol notes that help organizations map product capabilities against their specific infrastructure and regulatory requirements.

HabrOct 29, 2026Translated from Russian