Loading story…
Google announced expanded Android protections against scam messages, malicious links, bank impersonation and call-forwarding abuse, with rollout underway for eligible devices. An optional Enhanced Protection mode in Google Messages uses cloud-based Gemini models to analyze conversations with unknown senders through Private AI Compute, an encrypted processing environment Google says is inaccessible even to the company. Separate link checks combine on-device Gemini Nano with real-time web signals, while notification-based scam alerts are expanding beyond Pixel phones to hundreds of millions of additional Android devices.
Android will also extend sensitive-information masking during screen sharing to Chrome and Android WebView, prevent apps from silently enabling call forwarding, and warn users who manually activate forwarding through MMI codes. Google is expanding bank-call verification and says it has blocked more than 3 million fraudulent calls involving Banco do Brasil and Itaú Unibanco since June. Organizations supporting Android users should account for the Messages feature requiring user activation and verify availability across their device fleets; Google has not specified individual rollout schedules or the Android versions required for the screen-sharing and call-forwarding safeguards.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Google announced opt-in, cloud-based Gemini analysis for Google Messages through Private AI Compute, on-device unfamiliar-link checks, and expansion of notification-based scam alerts beyond Pixel phones. The announcement also included sensitive-data masking in Chrome and Android WebView during screen sharing, safeguards against call-forwarding abuse, and broader verified bank-call support, with protections rolling out to eligible devices.
Google reported blocking more than 3 million fraudulent calls involving Banco do Brasil and Itaú Unibanco since June 2026. Its verified bank calls system checks whether calls originate from genuine bank call centers and automatically ends calls that fail verification.
Google previously launched on-device scam detection for chat notifications on Pixel phones, warning users about suspicious messages before they opened the messaging app.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
6 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcexakep.ru
Open sourcehelpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourceghacks.net
Open sourceblog.google
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google has expanded Android protections that tie a phone number to a device and Google accounts, while also adding **fake call detection** aimed at stopping deepfake-enabled phone scams. Reporting on the new anti-scam feature indicates Android can analyze calls for signs of impersonation and other fraudulent behavior, reflecting Google’s broader push to harden mobile devices against voice-based social engineering attacks. Separate reporting on Android’s phone number verification shows Google verifies that a SIM associated with a number is physically present in a device, then links that verified number to active Google accounts for services including **RCS messaging**, account recovery, emergency features, and anti-scam protections. The process has used hidden SMS messages and now increasingly relies on carrier APIs that exchange encrypted device and SIM-related data; the feature is enabled by default, can generate “number is now verified” alerts, and has raised privacy concerns because one verified number may be associated with multiple Google accounts on the same device.
Jul 22, 2026
Google is launching **fake call detection** on Android to help stop scam calls that use caller ID spoofing and AI voice cloning to impersonate trusted contacts. The feature is rolling out globally this month for devices running **Android 12 and later**, starting with **Pixel** phones, and works through **Phone by Google** with supported **RCS** services. It is designed to warn users when a caller claims to be someone in their contacts but the call cannot be verified as coming from that person’s device. The protection uses a silent background verification process in which the caller’s phone sends an encrypted confirmation signal during the call. If that signal is missing, the recipient’s device checks whether the real contact’s phone is actually placing the call and displays an impersonation warning if not. Google said the feature is enabled by default where supported, though users can turn it off in settings, and framed the rollout as a response to growing impersonation fraud that has expanded from consumer scams into business-focused social engineering and caused billions in reported losses.
Jun 29, 2026
Google announced updated **Android Theft Protection** capabilities aimed at reducing account takeover and financial fraud risks following device theft, with availability starting on devices running **Android 16+**. The updates strengthen authentication safeguards by making **screen lock guessing** harder (longer lockout periods after repeated failed PIN/pattern/password attempts) and by improving controls around lock behavior after excessive failed authentications, including a dedicated settings toggle for *Failed Authentication Lock*. Google also expanded **Identity Check**—which requires biometric authentication for sensitive actions when the device is outside trusted places—to cover a broader set of actions and apps that use the **Android Biometric Prompt**, including third-party banking apps and **Google Password Manager**. In parallel, Android’s *Remote Lock* capabilities were highlighted as part of the theft-response toolset, giving users more control to lock a lost or stolen device and limit further misuse.
Jun 29, 2026