New threads

The browser, promoted on Reddit, is claimed to rely on GPU to apply AI-based adblocking.

PhaseGuard AI - Adaptive Ad Blocker - Chrome Web Store

AI-powered ad blocker that learns from your browsing. No rule limits, just intelligence, whitelisting and anti-fingerprinting.

chromewebstore.google.com

Click to expand...

Back from the dead to pay for someone's grocery run?

• Researchers show how an expired contactless card can still complete a real purchase because the expiry date the terminal reads is not covered by its signature
• The attack needs physical possession of the discarded card and two ordinary smartphones, and results vary per bank, with Visa cards being susceptible in testing
• Existing EMV protections can detect the relay, but they are optional and were not enabled on any card or terminal tested, and neither Visa nor the notified banks have confirmed a fix is in the works

For a layman, the date printed on a credit card looks like a hard stop, but that might not always be the case.
Researchers at the University of Massachusetts Amherst found that a 'zombie card' past its expiration date can be persuaded to complete a contactless purchase at a real checkout terminal, creating a real security threat.

The irony is that it is not that EMV cryptography is not bypassed in any way, but rather that card expiry is enforced in a different way for contactless payments, as a policy check between two parties rather than as a fixed property of the card itself, and interestingly, the parties do not always know who is the one checking.
Dead plastic can still be used to pay under certain conditions
Building on the last part, a contactless transaction involves a card, a point-of-sale terminal, the merchant's bank, a card network, and the issuer. Each holds a fragment of the decision that eventually results in a successful or declined card transaction.

The EMV contactless flow is only selectively authenticated: some fields travel between the card and terminal in unencrypted text and are linked to cryptographic verification later, opening a potential attack vector for users with physical access to an expired card.
The exposure here is not that those fields can be read, since the expiry date is printed on the card anyway, but that it can be changed with relative ease. The Application Expiration Date that the terminal reads sits in the unprotected portion.

In the Visa configuration the team tested, that field is not covered by the card's digital signature and is subsequently not cryptographically bound to the expiry value the issuer sees in the online authorization request.
While this should not be the case, it opens an attack vector for a device between the card and the terminal that processes the charge by simply modifying the expiry value to one that is still valid. The issue is compounded by a second issue: cards carry an expiry date inside the digital certificate used to establish the card-to-terminal conversation, and researchers have found that the certificate outlasts the printed date on the plastic. In essence, a check that might have caught the problem is looking at a clock set further ahead.

The scope of the attack, however, is narrow: it affects Visa contactless cards only, with Mastercard, Discover, and American Express rejecting the altered expiry outright. It also requires physical access to the card and two smartphones to pull it off, making it a slightly more complex endeavor, to say the least.

The irony is that EMV does have a protection that would essentially undo such an attempt altogether: Relay Resistance Protocol, which measures timing to detect an inserted relay and can stop the transaction altogether, but it remains optional and was not enabled on any of the terminals or cards the researchers tested.
The team notified Visa and the relevant banks in May 2025 and again in December 2025, supplying a reproduction guide, transaction traces, and a video. Visa's report passed initial triage, and the company's red team was reproducing it.

However, as of publication, neither Visa nor the notified banks had confirmed a mitigation attempt, and Visa also did not respond to a press request from The Register for comment.

The underlying failure, however, is based on how payment decisions have now spread across multiple players, including chip, terminal, network, and bank architectures, all of which assume that expiry is someone else's problem, an approach that could come back to haunt them and their customers. For now, the researcher's advice remains important until a fix is rolled out: stop treating dead plastic as harmless, destroy the underlying chip, and cut through the card numbers to prevent abuse.

Click to expand...

What to do when attackers create passkeys of their own?

• iAuthFlow v2 sold on Russian forums lets attackers persist in email accounts
• Tool phishes logins, then secretly creates attacker‑controlled passkeys for lasting access
• Defenses include auditing passkeys, OAuth tokens, mail rules, and removing rogue methods

Security researchers have discovered a new malware toolkit which allows threat actors to log back into compromised email accounts even after the password was changed and all sessions terminated.

iAuthFlow v2 is currently being sold on Russian dark web forums for north of $10,000, a new report from cybersecurity experts from Abnormal said, as they obtained a copy of iAuthFlow v2 for analysis.

The malware primarily works as a phishing tool, trying to trick users into logging into either Google, Microsoft, iCloud, or LinkedIn. As soon as they do that, they relay the login credentials to the attackers, who log into the accounts on their end, as well - before the tool displays a “processing” page for a few seconds while, in the background, it sets up a new passkey.
How to defend against iAuthFlow v2
A passkey is an alternative means of authentication that is often touted as the “password killer”. It uses cryptographic keys stored on a device, allowing users to sign in with a fingerprint, face scan, or device PIN.

Because the secret key never leaves the device, it is resistant to phishing. However, if the threat actor is able to generate a key of their own, on the device they own, access is basically guaranteed.
The ad for the toolkit also comes with a video demo, showing how it works. In the demo, iAuthFlow v2 created the passkey six seconds after authentication.

However, generating a passkey is not that straightforward of a process and it could encounter hiccups, Abnormal hints, saying that Google, for example, might require further identity verification before allowing the change.
Usually, when a threat actor compromises an email account, terminating all sessions and changing the password is usually enough.

In this case, however, users should do a lot more: review the account for signs of compromise, including unauthorized passkeys or security keys, malicious Gmail filters and forwarding rules, recovery and delegated access changes, and unauthorized applications, Abnormal suggests.

They should also revoke relevant OAuth tokens and grants, investigate available sign-in, mail-rule, 2-Step Verification, passkey and OAuth audit events, and finally, make sure any attacker-enrolled authentication methods are removed.

Click to expand...

Key takeaways:

• Manic targets 169 apps, including banks, crypto wallets, messaging apps, government services and email clients.
• The malware can steal passwords, one-time codes and recovery phrases after gaining device permissions.
• Manic can send stolen data through nearby infected phones using WiFi Direct or Bluetooth.
• Researchers say Android users should avoid sideloading apps from unreliable sources.

Security researchers have identified new Android malware capable of sending stolen data via infected phones back to the scammers.

The newly identified Android malware is dubbed Manic and features some particularly dangerous capabilities.

“Manic sits at the intersection of Android banking malware and mobile spyware, combining financial-fraud capabilities with broader surveillance and device-control features,” ThreatFabric’s Mobile Threat Intelligence (MTI) team says in an analysis.

Manic monitors a total of 169 different apps, including banks, payment services, cryptocurrency wallets and exchanges, messaging apps, government services, authenticator apps, browsers, and email clients.
The Android malware’s primary targets are located in Ukraine. However, Manic also extends its focus to Russian and European financial institutions, global fintech and cryptocurrency services, and military-focused communications.

How does it work? According to ThreatFabric, Manic integrates multiple functions into a comprehensive fraud workflow, progressively giving attackers nearly full control over an infected device.

After obtaining Accessibility and notification access, the malware can:

Capture the victim’s PIN, password, pattern, fingerprint, or facial recognition to unlock a device.
Steal sensitive information such as passwords, one-time codes, and recovery phrases.
Use overlays or fake screens in banking and crypto apps to hide malicious activities and intercept keypad inputs.
Eavesdrop on a target’s communication by accessing text messages.
Watch the screen and interact with the device remotely by abusing Accessibility Services privileges.
All without the victims noticing anything.

The collected data and files are encrypted with AES-GCM and placed in a local queue, as the malware is looking for a route to the attacker’s Command and Control (C2) infrastructure.
A unique feature of the Manic malware is that it can send stolen data to nearby infected devices via WiFi Direct or Bluetooth. This could come in handy if the source device has no internet connection. If no route is available, the data package remains queued, and Manic tries again later.

“As a result, removing direct internet access from an infected device does not necessarily prevent data exfiltration, as another infected phone within radio range may act as its gateway,” researchers explain.

Manic is nowhere to be found in the Google Play Store. Therefore, Android users should exercise caution when sideloading APKs or apps from unreliable sources online.

Click to expand...

• Recover more than 550 file formats, including photos, videos, music, docs, emails, .zip, etc.
• Recover deleted, formatted, or otherwise inaccessible files in any data loss situations.
• Recover data from not only the internal hard drive, but also all kinds of external hard disk.

A few changes to your browser, apps, and accounts can reduce the amount of information companies collect

• Turn on your browser’s strongest tracking protections and limit third-party cookies, which can be used to follow your activity across websites.
• Review app and device permissions, especially access to your location, contacts, microphone, camera, and photos.
• Reduce the amount of information companies can connect to you by opting out of targeted advertising, removing unnecessary apps and accounts, and requesting deletion or opt-outs from data brokers when available.

Every click can leave a trail.

Websites, apps, advertisers, and other companies can collect information about what consumers search for, where they go, what they buy, and which devices they use. That information can be used to personalize services and advertising, but it can also be shared or sold and combined with information from other sources to build detailed profiles.

The Federal Trade Commission (FTC) says online tracking helps explain why consumers see ads tailored to their interests and why websites and apps remember their preferences. The agency advises consumers to use available privacy controls, opt out of targeted advertising and consider removing their information from data broker sites.

Completely eliminating online tracking can be difficult. But consumers can substantially reduce the amount of information they expose by changing a handful of settings and habits.

Start with your browser​

A good first stop is the privacy section of your web browser.

Cookies are small pieces of information stored by a browser. Some are useful: They can keep consumers signed in, remember preferences, or maintain a shopping cart. Persistent cookies, however, can remain for months or years and can be used to record activity over time. The FTC says browsers can be configured to warn users about cookies or limit the types they accept.

Consumers should look for settings that block or restrict third-party cookies and cross-site tracking. Browsers may also offer additional tracking-protection settings.

Clearing stored cookies periodically can remove some existing identifiers, although doing so may sign consumers out of websites or reset saved preferences.

And cookies aren't the whole story. Companies can use other techniques, including information about a device, operating system, IP address, and other characteristics, to identify or associate users and devices.

That means simply deleting cookies isn't a complete privacy solution.

Take a close look at app permissions​

Phones can provide companies with information that isn't available from ordinary web browsing, including precise or approximate location and access to cameras, microphones, contacts, and photos.

Consumers should periodically open their phone's privacy settings and review which apps have permission to access those features.

The question to ask is simple: Does this app actually need this information to provide the service I use?

The FTC recommends checking what information an app requests and limiting location sharing when it isn't necessary.

Consumers can also delete apps they no longer use. Fewer apps can mean fewer companies with opportunities to collect information from the device.

Say no to targeted advertising​

Major operating systems, websites, and online services commonly provide advertising or privacy settings that allow consumers to limit personalization.

Turning off personalized advertising doesn't necessarily mean consumers will see fewer ads. Instead, it can reduce the use of their activity or interests to decide which advertisements they see.

The FTC specifically recommends looking for options to opt out of targeted advertising as one way of reducing online tracking.

Consumers should check these settings periodically. A privacy choice made in a browser doesn't necessarily carry over to an app, another device, or a separate account.

Be stingy with personal information​

Tracking becomes more revealing when online activity can be tied to a person's identity.

Consumers can limit that connection by thinking twice before providing a phone number, date of birth, location, or other personal information when it isn't necessary.

Signing into a service can also make it easier for a company to associate activity across devices. The FTC has previously described account sign-ins as one way companies can deterministically link a consumer's different devices.

That doesn't mean consumers should avoid accounts altogether. But before creating one, it can be worth asking whether an account is actually necessary.

The goal isn't necessarily to disappear from the internet. It's to leave a smaller trail.

Click to expand...

Google says Gmail was not breached, despite reports claiming that 183 million Gmail passwords had leaked. According to the company, these reports are based on a misunderstanding.

The 183 million number refers to a collection of credentials gathered from infostealer malware and older data breaches, not from a direct attack on Google's systems. The confusion started after a routine update to a third-party breach notification service.

The credentials appeared in the Have I Been Pwned breach notification service, which led to the reports.

What Actually Happened With the 183 Million Credentials​

The 183 million credentials come from infostealer logs and earlier data breaches collected over time, not from a Gmail breach. These datasets combine credentials stolen from many sources by malware that grabs saved passwords from infected devices.

The data was added to Have I Been Pwned, which lets users check if their credentials have appeared in known breaches. Google says the reports misread this routine update as proof of a new Gmail attack.

"Reports of a 'Gmail security breach impacting millions of users' are false. Gmail's defenses are strong, and users remain protected," Google said. The company clarified that infostealer databases collect credentials from a wide range of sources and are not indicative of a breach targeting Gmail specifically.

Gmail was not breached, but infostealer malware can still collect valid Gmail passwords from infected devices. In these cases, the credentials come from users' own compromised machines or earlier unrelated breaches, not from Google's servers.

The risk to each user depends on whether their credentials were included in an infostealer log, not on a breach of Gmail itself.

What Gmail Users Should Do Now​

Even though Gmail was not breached, users should still check that their accounts are secure, since infostealer datasets may include valid credentials:

1. Check whether your email address appears in known breach datasets through a service like Have I Been Pwned.
2. Change your Gmail password if you suspect your credentials may have been exposed, and avoid reusing it across other services.
3. Enable two-factor authentication on your Google account, which protects the account even if the password is exposed.
4. Consider switching to a passkey for Google sign-in, which does not rely on a static password.
5. Run a reputable anti-malware scan if you suspect an infostealer infection, since these harvest saved passwords directly from the device.

Google continues to say that Gmail's defenses are strong and that the breach reports are false. It is not clear how many of the 183 million credentials actually match active Gmail accounts, since the dataset comes from many sources over time.

Users who are concerned should check their accounts with breach-checking tools instead of assuming they are either fully safe or affected by a Gmail-specific breach.

Click to expand...

Features​

• AI Voice-Priority Denoising– The core engine treats the human voice as the priority signal and rebuilds vocal detail instead of simply muting the noise around it.
  • Speech Reconstruction – Recovers muffled or partially masked words caused by heavy background interference, restoring intelligibility to speech that would otherwise be hard to understand.
  • Zero Metallic Artifacts – Avoids the robotic, underwater-sounding side effects common in older noise gate and spectral subtraction tools.
• Extreme Noise Handling– Designed to work on recordings with layered, complex, or unpredictable noise rather than a single steady tone.
  • Multi-Source Noise Removal – Strips out combinations of noise such as wind, traffic, hum, and crowd chatter from the same recording in one pass.
  • Consistent Output Quality – Applies the same cleaning standard across an entire file so the beginning and end of a long recording sound uniform.
• Direct Video Stream Passthrough– Processes the audio track of a video file without touching the video stream itself.
  • No Re-Encoding – Keeps the original video resolution, bitrate, and codec exactly as they were before processing.
  • Fast Audio Swap – Replaces the cleaned audio back into the video container quickly, without a full video export cycle.
• High-Speed Batch Processing– Built to handle large volumes of files rather than one clip at a time.
  • Folder Import – Loads hundreds of audio or video files from a directory in a single action instead of opening files one by one.
  • Unattended Cleaning – Runs through an entire batch automatically, so an editor can start a job and return once it is finished.
• 100% Offline Operation– Performs all AI processing locally on the user’s own computer.
  • No Cloud Uploads – Keeps sensitive or confidential recordings on the local machine at all times.
  • No File Length Limits – Processes recordings of any duration without the caps that many web-based tools impose.

Features​

• Edit PDF content in a breeze
• Add customized elements & crop your files
• White out PDF content and add images or links to PDF
• Convert PDF to Word, Excel, PowerPoint & other formats
• Convert emails, attachments, and folders into PDFs
• Batch-convert PDFs at one time
• Main benefits of PDF compression
• Compress files with no data loss
• Merge PDF documents in a flash
• Split PDF Documents in the blink of an eye
• Sign the document almost instantly by offering three ways of adding a signature
• Protect PDF files with a watermark, password, or encryption.

First Android malware targeting automotive head units

Kaspersky expert has discovered new Android malware designed to serve ads and build a proxy botnet. It's delivered through legitimate software for DoFun head units.

securelist.com

An in-depth research of the malware spread through the built-in updaters of Android-based automotive head unit firmware. This is the first documented case of malware found on a car head unit with an infection chain specific to that type of device.

Click to expand...

FTP Banners: The New Dead Drop Resolver Delivering Novel RATs

During an investigation, the SOCRadar Threat Research Unit (STRU) identified the active abuse of FTP banners as DDRs to distribute malicious commands...

socradar.io

Security products have become increasingly effective at detecting suspicious commands used for malware delivery. Consequently, threat actors are adopting more creative methods to bypass these defenses, such as utilizing Dead Drop Resolvers (DDRs): alternative locations, including legitimate web services or protocols, used to acquire malicious strings, Command and Control (C2) configurations, or commands.

During an investigation, the SOCRadar Threat Research Unit (STRU) identified the active abuse of FTP banners as DDRs to distribute malicious commands, a technique observed in the wild since early July 2026. Further infrastructure analysis led to the discovery of two previously undocumented Remote Access Trojans (RATs), which we have named E4del and PINHOLE.

Key Points​

• STRU discovered active abuse of FTP banners as DDRs, allowing malware stagers to fetch commands directly from the protocol’s initial response.
• While currently observed in malicious LNK files, this technique is highly versatile and easily adaptable for “ClickFix” social engineering campaigns.
• FTP-based DDRs were found delivering two previously undocumented RATs: E4del and PINHOLE, tracked as separate clusters.
• E4del is a modular, Electron-based RAT offering eight specialized commands, such as live desktop streaming, screenshot capture, and privilege escalation.
• E4del’s beaconing mechanism implements a tiered jitter system, dynamically transitioning between three distinct states (Active, Semi-Active, Inactive) based on the elapsed time since its last received task.
• PINHOLE is a sophisticated multi-stage RAT with fourteen distinct command types, including browser credential theft, file upload/download, and screenshot capture.
• To evade detection, PINHOLE employs Halo’s Gate and Early Bird APC Injection. Additionally, it leverages legitimate platforms like Pinterest and SurveyMonkey to resolve its C2 while proxying its traffic through Cloudflare Workers.
• PINHOLE operators also maintain an “FTP Stats Panel” to track script execution and IP addresses connected to their infrastructure.

Click to expand...

Microsoft has apparently found the free time to build a standalone app whose only job is switching your default search engine to Bing across every browser on your PC. It is not force-installed through Windows Update yet, and it is not available in the Microsoft Store either. It is a standalone executable hosted on Microsoft’s official download servers, and we wonder why it even exists.

The app is called Microsoft Recommended Search Settings, and once installed, it prompts you to add extensions to all your installed browsers, which does the job of switching to the Bing homepage experience. After finishing installation, you also get redirected to the Microsoft Rewards page, which is basically a bribe for switching.

Microsoft built a dedicated app that forces Bing everywhere on Windows 11, including Chrome, Firefox, and Brave

Microsoft built MicrosoftSettings.exe, an app that installs a Bing extension across Chrome and Edge, then redirects you to Microsoft Rewards.

www.windowslatest.com

Click to expand...

Conclusion

I didn't spend too much time testing Zoho Writer after that, or overall. There were quite a few snags in the process, and I felt miffed and frustrated. Perhaps I shouldn't even think about my impressions from sixteen years ago, and technically, they do not matter. The world has changed since, and 2026 is a year of different computing than back in the golden era of the desktop. And in 2026, I expect robust privacy controls and options available, even if the user has no intention of activating them. But without them, you feel like a peasant, at the whim of the big companies. Replacing one big company for another, same thing really, then.

Above all, I didn't like the hard requirement for network connection, the self updates - with no option not to do them, apparently, plus no toggle for the AI assistant. Microsoft Office compatibility is reasonable but far from stellar. Combined with the lack of flexibility in general use, I find it hard to embrace Zoho Writer as my collaborative solution. And don't get me wrong, I don't mind storing some information in the cloud. I actively use such tools, and I'm currently co-authoring a book on Artificial Intelligence ethics with a colleague, half across the globe. Yes, we use "cloud" for our work. No problem there. But. It's all done inside the browser. When a "desktop" program won't let me tweak settings, and it mandates network connectivity, my resistance goes up to eleven, even if, otherwise, I would have zero problem with the software itself. Such is the human mind, it seems.

All in all, there's no rekindled love for Zoho on my side, and I'm somewhat disappointed. I expected to be awed, and to find the Writer even more fun than before. My impression is the opposite. This recent endeavor feels disjointed, and I struggle to find a case for the clunky hybrid desktop-cloud model. The responsiveness of the UI wasn't stellar, either. With no option to easily customize the UI, and DOCX support not much above the rest of the bunch, then for me, LibreOffice remains the obvious choice, despite their stubborn insistence on ODF, which I understand, but doesn't help me get rid of Microsoft's software. In other words, Office still remains the weakest link in any Windows detox. Of course. Make what you will of this article, we shall speak soon. If you have insights why my Zoho experience wasn't so great today, feel free to ping me.

Click to expand...

Zoho Writer - Okay but somewhat confusing and too cloudy

Review of Zoho Writer hybrid desktop-cloud office program, including setup in Linux, first launch and mandatory Internet connectivity, use with and without network, UI look and feel, lack of customization and settings, Microsoft DOCX support and compatibility, performance, various quirks, some...

www.dedoimedo.com

• SoftMaker Office Professional 2026
• AdGuard (Desktop application) - it also runs on the tablet
• finally upgraded the i5-1035G1 laptop from Win11 Home to Win11 Pro and activated Windows Sandbox

Three suspected Russian cyber-espionage clusters are abusing legitimate authentication features to compromise personal accounts of people in sensitive sectors across Europe and the US, Google says.

Key takeaways
Google is tracking UNC6293, UNC7005 and UNC5976, which it assesses with high confidence to have a Russian nexus
The campaigns abuse legitimate Google OAuth, app-password and device-linking workflows rather than software vulnerabilities
UNC7005 has also used WhatsApp device linking to attach attacker-controlled devices to victims’ accounts
Targets include academics, diplomats, defense personnel, government-linked users and think-tank researchers
Legitimate sign-in pages become phishing traps
The Google Threat Intelligence Group (GTIG) says victims may encounter genuine authentication pages during these attacks. UNC6293 has asked targets to complete legitimate logins and surrender verification codes or URLs, while UNC5976 built fake file-sharing pages that redirected users through authentic Google OAuth screens.

After authentication, victims could be sent to attacker-controlled cloud projects designed to capture access tokens. Google says it disrupted at least 12 domains and related infrastructure created by UNC5976, which has since started shifting parts of its phishing infrastructure away from Google services.

WhatsApp linking gives attackers another route in
UNC7005, also tracked by Microsoft as Storm-2945, used fake invitations and secure-communication lures to target academics, diplomats and nonprofit personnel. In May and June, phishing pages impersonating WhatsApp asked victims to enter a phone number and approve a legitimate device-link request for an attacker-controlled device.

Once linked, the attacker could gain ongoing account access. Google also observed prompts for fake encrypted chats, file downloads and voice calls. One call flow used malicious JavaScript to record a target’s audio and video. In August, the same cluster used Google OAuth phishing against people connected to Europe’s defense industry.

Why this matters beyond high-profile targets
These operations are highly selective, but the techniques matter to everyone because they rely on familiar, legitimate-looking security workflows. A real Google sign-in page, QR code or WhatsApp linking prompt is not proof that the request leading to it is trustworthy.

Users should verify unexpected invitations through a separate channel, never share app passwords or verification codes, review linked WhatsApp devices, and treat unverified OAuth consent screens as a warning sign. Google also recommends that high-risk users consider its Advanced Protection Program.

Stay safer from phishing and account-takeover lures
Attackers increasingly build scams around legitimate services, so the initial message or link deserves as much scrutiny as the login page itself. Bitdefender Scamio can analyze suspicious messages, links and QR codes before you interact with them, while Bitdefender Ultimate Security adds anti-phishing, web, email and scam protection across supported devices.

Click to expand...

They say the company must prove it can be trusted before products like these get a pass.
On Tuesday, OpenAI released ChatGPT for Teens, an age-gated version of its chatbot designed for young users. The company first announced it was working on a system to automatically identify teens and restrict their usage of ChatGPT last September, following the death of 16-year-old Adam Raine, who, as alleged in a lawsuit filed by his parents, took his own life after ChatGPT acted as an enabler.

"There's no need for a teen to create a new account or change anything; if we predict you're under 18, or you've told us so, this becomes your default experience," Lauren Jonas, OpenAI's head of youth and families, told Engadget. Make no mistake, kids are already using ChatGPT at an incredible scale. At the start of last year, the Pew Research Center found about a quarter of US teens were using the chatbot for their schoolwork. Once they're using ChatGPT for Teens, the experience is designed to nudge them to use educational features OpenAI has been gradually rolling out over the last year, including Study Mode and data visualizations.

On Tuesday, the company also said it would expand its safety notifications to contact parents with linked accounts when their child has unsafe discussions around eating disorders with ChatGPT, and published an updated under-18 model spec. "ChatGPT should not use romantic language, encourage emotional dependence, or imply that it has feelings or consciousness," the company said of the new guidelines. "These stronger protections are designed to reinforce healthy, real-world relationships."

While some child safety experts Engadget spoke to were more positive about the release than others, they all agreed ChatGPT for Teens needs extensive independent testing before it can be recommended to parents and young people. They also stressed the need for OpenAI to be more transparent about how its safety mechanisms work.

Click to expand...

This goes way, way further than keeping an eye on license plates.
Flock has long pretended to be a simple automated license plate reader (ALPR) company, despite overwhelming evidence that its cameras can track a lot more than that. Now there's a report that it has been developing new AI tools that can potentially locate people by how they drive, according to Wired.

The software was reportedly called Nightshift and is now going by the name OS Investigate. It draws from a network of cameras in 6,000 communities and logs the movements of drivers in those communities, Wired reports. This could be used, for instance, to find a witness to a crime by analyzing vehicle movements near where a crime occurred. Then, that information could be cross-referenced with police case files, 911 dispatch logs and commercial identity records to find the name, home address, relatives and even friends of the potential witness.

Wired says the tool can "search for people in an area drawn on a map based on nothing more than a physical description." In other words, an officer doesn't even need a plate, name or a crime to begin searching. They just have to provide a location, a time and a pattern of behavior. The algorithm does the rest.

Click to expand...

• High-quality image scaling
• Scaling factor up to 10,000%
• Quality modes: 6
• Scaling up to 1000 megapixels
• Specialized for 8 different image layers
• Sharpness Overdrive mode in 3 variants for optimal sharpening
• Photoshop® & Lightroom Classic® plug-ins are included

• Unique cinematic look: Easily turn ordinary footage into striking black-and-white films that stand out on YouTube, TikTok, or any platform.
• Ready-to-use presets: Over 145 templates and 58 film emulations save you time while delivering professional results instantly.
• Creative flexibility: From one-click filters to expert-mode editing with 158 image filters, you can keep it simple or dive deep.
• Smooth workflow: Import and export common video formats, reduce artifacts in four stages, and preview your changes in real time.
• Optimized for modern display: User interface designed for HD and 4K, with tooltips that make every feature easy to understand.
• Professional extras (Pro version): RAW module, LUT support, and even more templates give advanced users extra creative power.

• Virus Scan – Fast hyper scans, detect and remove stubborn malware, against potential danger.
• Automatic updates – Automatic updates provides real-time protection so that your PC is always up to date and secure.
• Process Protection – Aimed at the process, our protection can ensure the safe operation of your computer.

Features​

• Multi-Platform Streaming Support— Download from all six major streaming services in one unified application.
  • Netflix Video Downloader — Save Netflix movies and TV series in MP4 or MKV at up to 1080p with immersive Dolby audio and 7X batch downloading speed.
  • Amazon Prime Video Downloader — Build a permanent offline library from Prime Video at 1080p in MP4 or MKV with lightning-fast 8X batch downloading.
  • Disney Plus Downloader — Bypass device and download limitations on Disney+ and save favorites in crystal-clear Dolby audio at 5X batch speed.
  • HBO Max Downloader — Download HBO originals and blockbusters via the built-in web player at an industry-leading 16X download speed.
  • Hulu Video Downloader — Remove Hulu’s restrictive 30-day and 48-hour viewing windows and save ad-free videos at 7X batch downloading speed.
  • Apple TV+ Downloader — Eliminate expiration timers and simultaneous download limits on Apple TV+ and save to MP4 or MKV at 5X batch speed.
• Unlimited Video Downloads— Remove device limits, region locks, and usage restrictions so your content is always accessible, on your schedule.
  • Region-Free Access — Access content regardless of geographic restrictions imposed by streaming platforms.
  • No Subscription Penalties — Downloads are yours to keep permanently, with no extra fees or expiration conditions.
• High-Speed Bulk Download— Queue and download full TV seasons or entire movie collections in one click.
  • Batch Mode — Load multiple titles simultaneously and process them all in a single batch operation.
  • Fast & Stable Technology — Purpose-built download engine ensures speed and stability even for large content libraries.
• Lossless Video Conversion— Preserve original video and audio quality with zero compression or degradation.
  • Full HD 1080p Resolution — Sharp, pixel-accurate visuals that match or closely replicate the streaming quality.
  • 5.1 Dolby Audio — Immersive surround sound preserved in every download for a true home-cinema experience.
• Customizable Output Options— Tailor every single download to your personal requirements with granular control over output settings.
  • Format Selection — Choose between MP4 (wide device compatibility) or MKV (superior container flexibility).
  • Resolution Control — Select output quality from 720p HD up to 1080p Full HD depending on your storage needs and device capabilities.
• Flexible Encoding— Select encoding options including H.264 for maximum compatibility across computers, media servers, and external devices.
  • H.264 Encoding — Widely supported codec that ensures smooth playback on virtually any modern device or media player.
  • AVI Support — Alternative encoding for legacy device compatibility.
• Subtitle and Audio Mode— Save subtitles in SRT or original embedded formats and extract audio tracks separately for standalone listening.
  • SRT Subtitle Export — Clean, editable subtitle files saved alongside your video for flexible use.
  • Separate Audio Download — Extract and save audio tracks independently for podcasting, language study, or audio-only playback.
• Multilingual Support — Download and retain audio and subtitle tracks in up to 30 languagesfor international content and language learning.
  • 30-Language Audio Tracks — Select from the full range of available audio dubs included with the original streaming content.
  • 30-Language Subtitle Tracks — Keep subtitles in your preferred language for any video, regardless of platform availability.
• Channel Controls— Precisely configure audio channel output to match your listening setup.
  • Stereo AAC — Clean two-channel audio for laptop, phone, or standard speaker output.
  • Surround DD+ (5.1) — Full Dolby Digital Plus surround sound for home theater and advanced audio systems.
• Tag Preservation— Automatically retain all metadata including titles, episode numbers, season information, cover artwork, and cast details for a neatly organized library.
  • Episode and Season Metadata — Keeps your TV show downloads properly labeled and sorted for easy navigation.
  • Cover Art Retention — Saves thumbnail and poster artwork alongside your video files for a visually clean library.
• Ad Removal— Automatically detect and strip all advertisements during the download process, delivering a completely uninterrupted final file.
  • Auto Ad Detection — No manual editing required; ads are removed seamlessly during download.
  • Clean Playback — Final video files contain only the actual content, with zero interruptions.
• Device Limit Removal— Break free from platform-enforced restrictions on how many devices can access your downloaded content.
  • Cross-Device Playback — Transfer and watch your downloaded files on any device without restriction.
  • No Re-Authentication Required — No need to log in or verify platform subscriptions during offline playback.
• Hardware Acceleration— Leverage your computer’s GPU to speed up both downloads and video processing, reducing CPU load and overall wait time.
  • GPU-Assisted Processing — Uses available graphics hardware to accelerate encoding and conversion tasks.
  • Reduced CPU Usage — Keeps your system responsive and cool even during large, multi-title batch downloads.

Features​

• Drag & Drop Photo Arrangement– Easily import and organize photos in your desired order.
  • Flexible Ordering – Arrange images based on timeline or event flow.
  • Batch Photo Import – Add multiple photos at once to streamline your workflow.
• 200+ Stylish Transition Effects– Apply professional visual transitions between slides.
  • Fade & Dissolve – Smooth transitions that gently shift between images.
  • Zoom & Pan – Add dynamic motion to still photos for added impact.
  • Slide & Wipe – Creative animations that bring flair to your video.
• MP3 Music Integration– Embed your favorite audio tracks.
  • Background Soundtrack – Create mood and rhythm with music.
  • Audio Sync Options – Adjust slide timing to match the length of the music.
• Custom Display Durations– Control how long each photo appears.
  • Individual Slide Timing – Fine-tune the display time per image.
  • Global Duration Settings – Set a default timing for all photos.
• Subtitle and Caption Support– Personalize slides with custom text.
  • Slide-by-Slide Captions – Add meaningful notes or titles.
  • Text Style Options – Choose font, size, and placement.
• Flexible Video Export Formats– Save your video in multiple formats.
  • MPEG/MP4 Export – High compatibility with devices and platforms.
  • Full HD & 4K Output – Suitable for both standard and high-end displays.
• Professional Edition Perks– Additional benefits for licensed users.
  • No Watermark – Create professional-grade videos.
  • Ad-Free Interface – Enjoy uninterrupted editing.

Bazzite, the immutable Linux distro built on Fedora Atomic Desktop technology and developed as part of the Universal Blue project with a focus exclusively on gaming, has completed its transition to Fedora 44 with the release of Bazzite Deck 44, which the project calls the biggest update in Bazzite’s history.

More importantly, the release ends the temporary split between Bazzite’s desktop and Deck images, so future updates will roll out across the entire lineup at the same time.

Bazzite’s regular desktop images had already moved to KDE Plasma 6.6 and GNOME 50 along with broader system changes. The August release now brings the Deck images onto the same base and delivers another set of improvements shared across all Bazzite editions.

One of the largest changes is a complete overhaul of the software stack for Bazzite’s handheld images. The old setup is replaced by a SteamOS-aligned stack built around InputPlumber for controller handling, emulation, and remapping; SteamOS-Manager for session switching and TDP management; PowerStation for power controls on hardware not fully supported by SteamOS-Manager; and OpenGamepadUI for additional controls Steam does not expose.

Moreover, TDP control is now handled through Steam’s Quick Access Menu, making the experience closer to Valve’s SteamOS, with OpenGamepadUI remaining available for additional hardware-specific functions and enabled by default on non-Valve handhelds.

Another major addition is the new Bazzite Updater, a graphical utility for applying system updates and browsing changelogs. It can be added directly to Steam Game Mode and controlled entirely with a gamepad, removing the need to switch to the desktop environment to manage updates.

Click to expand...

Bazzite Linux 44 Lands with Kernel 7.2, New Gaming Stack, and GUI Updater

Fedora-based Bazzite Linux 44 is out with kernel 7.2, a new SteamOS-aligned gaming stack, graphical updater, redesigned Portal, and more.

linuxiac.com

A $29 Apple AirTag hidden inside a rare book helped track a shipment to an Amazon warehouse in Las Vegas, where employees take apart books and scan their pages for AI training data.

This finding contradicts an earlier Amazon statement denying that it destroyed books during scanning. Reporter Emanuel Maiberg placed the AirTag in one book from an order of about 1,000 volumes purchased through Biblio, a marketplace that keeps buyers anonymous.

Amazon's public response avoided any reference to artificial intelligence.

Click to expand...

Executive Summary​

Point Wild Threat Intelligence analyzes a .NET-based locker sample that combines file extortion with aggressive system lockdown and Telegram-based command-and-control. The malware is distributed through common initial access vectors, such as phishing attachments, malicious links, and messaging or social-media lures, and on execution attempts to relaunch itself with administrator privileges via a UAC prompt, enforcing single-instance execution through a hardcoded mutex.
The malware’s use of the Telegram Bot API for exfiltration and victim tracking is the most operationally significant trait.

PlikanLocker: A Technical Teardown of File Locking with Telegram-Based Exfiltration | Point Wild

www.pointwild.com

The PlikanLocker routine derives a key, enumerates targeted user data file types across common directories in parallel, and locks each file with AES-CBC, appending a .locked extension and a 20-byte header (ASCII LOCK marker plus a random 16-byte IV) while processing files in 32 MB chunks. Post-locking, the malware profiles the host via WMI, captures a desktop screenshot, and exfiltrates victim metadata and locking statistics to send the attacker’s Telegram bot. It concludes by hiding the desktop, taskbar, and Start button and displaying a fullscreen locker note rendered in a retro IBM BIOS-style font, blocking user interaction and instructing the victim to contact the attacker. Instead of locking the original file in place, the malware creates a new .locked file, leaving the original file intact.

Click to expand...

Releases · AdguardTeam/AdguardForWindows

AdGuard for Windows open bug tracker. Contribute to AdguardTeam/AdguardForWindows development by creating an account on GitHub.

github.com

A brand-new version, a new major number, a fresh design — and, most importantly, truly system-wide protection. AdGuard for Windows v8.0 doesn’t just look different: it gives you clearer control over the traffic on your computer and makes the most important settings easier to reach.

Truly system-wide protection​

Alongside the DNS filtering you already had, AdGuard offers full-fledged network-level filtering. This means stronger protection and more control: you can filter all Internet traffic on your device, so your protection is system-wide.

AdGuard uses a special network driver that handles the actual sending and receiving of data, allowing us to filter traffic from every app on your device.

Click to expand...

While DNS filtering is still there, it is less flexible, and some tracking requests can still get through. This is where HTTPS filtering becomes essential. With it enabled, AdGuard can inspect traffic within Windows apps. This allows us to distinguish between legitimate content and tracking requests, even when they come from the same domain. By decrypting the traffic, AdGuard can identify the full URL and block only the tracking requests while leaving the rest of the app working just fine.

While HTTPS filtering is enabled for browsers by default, it is disabled for most other apps to ensure better compatibility. You can always enable it for extra protection: just select the application you want to filter in App management and toggle on Filter HTTPS traffic.

See what your apps are doing and take control​

To make managing traffic easier and give you a clear picture of what’s happening on your device, we’ve added two new sections: App management and Statistics.

App management​

App management lets you control how each app accesses the Internet. By default, AdGuard filters everything. As soon as an app goes online, it appears in App management, and its traffic is routed through AdGuard. From there, you can configure what to do with the app and how to filter it:

• Decide which apps have their traffic routed through AdGuard
• Choose to block ads and trackers in specific apps
• Enable HTTPS filtering in apps of your choice

We’ve also introduced Filter unknown apps, a new setting for handling apps that are not yet in the compatibility or exclusion lists. It’s on by default — new apps get regular filtering, while HTTPS interception stays off to avoid affecting app behavior.

Statistics​

Statistics show detailed network activity. The Companies section provides a perspective on all the companies that your device has sent requests to, while in Apps and Domains you see the stats specific traffic data for every app routed through AdGuard. You can quickly identify and block anything suspicious.

Not only inside updates: A complete redesign​

AdGuard for Windows has been completely redesigned. Our focus was on simplicity and ease of use. The most important tools are now front and center, while advanced settings are still available — just tucked away so they don’t overwhelm new users.

Key settings in plain sight​

The app is designed to let you enable everything you need straight from the first screen. Just click the symbols you see — they stand for blocking ads and trackers, handling cookie notices and similar annoyances, and DNS protection.

Fine-tune your protection: Head to the Protection section, where settings are clearly categorized, explained in simple terms, and enabled by one toggle.



Tracking protection: Choose a level of protection — from a simple, comfortable experience to a more advanced one, which includes deleting cookies for enhanced privacy. There is also a custom level where you can freely fine-tune everything to suit your preferences: like blocking notifications from websites or enabling anti-DPI protection.



Advanced approach to filtering: You can find low-level and network settings in Settings → App settings.

Click to expand...

For more details on new features, check the Knowledge Base.

Click to expand...

Zyxel has released firmware updates for a high-severity command injection vulnerability, tracked as CVE-2026-6837, affecting 18 wireless access point models.

The flaw exists in the export-cgi component and could allow an authenticated administrator to execute operating-system commands on vulnerable devices.

The issue affects the PKCS#12 certificate export workflow. Security researcher Mina Nageh Salama reported that the certificate export password parameter could be inserted into a shell command without safe argument handling.

Zyxel Patches Command Injection Flaw in 18 Access Points Allowing Root OS Command Execution

Zyxel patched a command injection flaw affecting 18 wireless access point models, allowing authenticated admins to execute OS commands.

cybersecuritynews.com

Click to expand...

Researcher Jeremiah Fowler found a cloud database containing more than 9 million image files accessible without authentication, WIRED reports.

The leaky bucket, containing some 450 GB of images, was traced back to a US-registered company called ClarityCheck.

In their own words, ClarityCheck says:

“Use reverse image search to identify anyone in a photo. Find names, social profiles, and online presence in seconds.”
While ClarityCheck says it does not use facial recognition, it does describe its image function as a way to identify people and find their names and social profiles.

Granted, there’s a difference.

• An image search looks for identical or visually similar images, often using image embeddings, metadata, or indexed pages.
• Facial recognition detects a face, derives face-specific features, and compares them to a structured, face-indexed collection of digital images.

But does that difference matter when your face gets uploaded and stored in an unsecured cloud environment?

It is important to remember here that faces are persistent identifiers. A leaked password can be reset, whereas a person cannot easily replace their face. When an image of someone is linked with names, social profiles, addresses, emails, or phone numbers, that information could potentially be misused for impersonation, targeted phishing, doxxing, or catfishing.

ClarityCheck disputed that the data was publicly exposed because accessing it required an unindexed URL. However, the images didn’t require authentication, and Fowler was able to discover the URLs through the site’s code.

It is unknown how long the bucket was exposed before Fowler found it. Despite earlier alerts from Fowler, ClarityCheck did not restrict access to the database until WIRED contacted the service in July.

People finder tools​

People finder tools are online services that aggregate public records, contact data, and social footprints to help locate individuals using names, phone numbers, emails, or addresses.

If you want to check whether someone on social media is using a fake or stolen profile picture because you’re worried they might be a scammer, a conventional reverse image search can help you see where else that picture appears online. You don’t need a people finder tool.

ClarityCheck, along with many others like it, requires users to confirm that they own the image, appear in it, or otherwise have the necessary rights and permission to upload it. Of course, a checkbox cannot prevent someone from lying.

There are a few pointers we want to give people who use ClarityCheck or similar tools:

• Do not upload a photo of someone else unless you have their permission or another clear legal right to do so.
• Think twice before uploading your own photo if you’re not sure how it’s going to be used, how long it will be stored, and how secure that storage is.
• Before using any service, check its policies on image retention, deletion, AI model-training use, storage, third-party sharing, and removing images.
• If you find yourself in a search result, save the URL and screenshots, request delisting from the search service, and seek removal from the original site or platform hosting the image.

---

Scammers don’t need to hack you. They just need you to click once.

Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

Click to expand...

• Automatic Analysis: Scans video files to detect and diagnose corruption.
• One-Click Repair: Fixes video files quickly with a single click after upload.

• Multi-Format Compatibility: Supports MP4, MOV, AVI, and 3GP files.
• Resolution Flexibility: Repairs videos in 4K, 1080p, and 720p without quality loss.

• Camera & Camcorder Support: Works with videos from Nikon, Canon, Sony, and other cameras.
• Smartphone Support: Repairs videos from iPhones and other smartphones.

• Context Menu Integration: Adds a repair shortcut to your file right-click menu.
• One-Click Fix: Instantly starts the repair process from the context menu.

• Sample File Matching: Uses a similar, undamaged video to improve repair accuracy.
• Advanced Repair Algorithm: Utilizes smart technology to maximize successful repairs.

• Instant Playback: Watch a short segment of the fixed video immediately.
• Damage Confirmation: Verify that the corruption is resolved before saving.

• Corrupted Video Import: Add damaged videos with the “+” button.
• Sample Video Upload: Add a sample video to boost repair success.
• Preview & Save: Check the repair result and download the fixed file.

• Multi-Scenario Support: Repairs videos corrupted by transfer, editing, compression, or recording errors.
• Universal Repair Engine: Handles all types of video corruption regardless of cause.

GenDigital said in a report shared with Cyber Security News (CSN) that the immediate risk falls on Windows users who follow unexpected browser instructions, especially requests to press Win+R, paste clipboard content, and hit Enter.

Such ClickFix-style lures have become a common delivery method for information stealers because they persuade victims to launch the malicious command themselves.

WordlistLoader stores its next-stage code as a sequence of plain English words. Each word corresponds to a single byte through a build-specific list containing 256 unique words.

The loader processes the word sequence, finds each word’s position in the list, and writes the matching byte into memory. In simple terms, a harmless-looking list of words becomes executable malware only after the loader translates it back into machine code.

This makes static inspection harder because security tools and analysts may initially encounter readable text instead of an obvious block of shellcode.

GenDigital also found a modified WordlistLoader variant that swaps the English-word list for UUID values. In that version, each UUID represents a 16-byte chunk of code, showing that the operators can change the encoding method without changing the broader execution flow.

This delivery method is particularly effective because it uses built-in Windows components rather than requiring a traditional exploit. A related WebDAV rundll32 ClickFix technique shows how attackers continue to adapt trusted system tools for malware execution.

Hackers Hide Malware Code Inside English Words to Infect Windows Users

WordlistLoader hides Amatera Stealer code inside common English words, using fake CAPTCHA pages to trick Windows users into running malware.

cybersecuritynews.com

Click to expand...

What did they find?​

In late July 2026, eSentire's Threat Response Unit (TRU) identified several ErrTraffic-generated ClickFix campaigns attempting to deliver Cruciferra - a malware loader marketed on underground forums that boasts EDR-killing capabilities. TRU found Cruciferra using a vulnerable driver to fulfill this behavior. The driver, also known as, "DCRCVDrv.sys", is signed by South Korean IT company MocoMsys and exposes an IOCTL that allows user-mode applications to terminate processes directly from the kernel. The Cruciferra Malware-as-a-Service (MaaS) first appeared in November 2025 and is currently sold for $1200 per month for the package with EDR killing features by the user Cruciferra on underground hacking forums.

Malware-as-a-Service Cocktail: ErrTraffic and Cruciferra - Killing Your EDR Since 2025

eSentire's TRU uncovered Cruciferra, an EDR-killing malware loader delivered via ClickFix campaigns using a vulnerable signed driver. Read the full threat analysis.

www.esentire.com

Click to expand...

• Screen Mirroring: Mirror your iPhone or Android phone’s screen to your Windows computer in real time so you can see what’s on your phone’s screen on a larger display.
• Flexible Connection Options: Multiple ways to connect your phone to your computer, including WiFi, QR code, and USB cable. You can choose the connection method that works best for your situation.
• Record Screen and Audio: Record your phone’s screen and audio on your computer with just one click. You can easily capture video footage or audio clips from your phone without needing any additional software.
• Take Screenshots: Take screenshots of your phone’s screen directly on your computer. This means that you can quickly and easily capture images of anything on your phone’s screen.
• Compatible with Latest iOS and Android OS: Apeaksoft Phone Mirror is designed to work with the latest iOS and Android operating systems.
• User-friendly Interface: A user-friendly interface that makes it easy to use for both novice and experienced users, so, you can start using the software right away without needing any technical skills.

Features​

• View and delete your web browsing history, including page visits by time and frequency.
• Identify top search terms and delete your search history.
• Erase internet traces and usage logs, including cookies and temporary files.
• Disable unwanted data sharing and telemetry features.
• Prevent location tracking and personalized ads.
• Limit usage rights for apps and manage app permissions.
• Get a comprehensive overview of significant events on your PC, such as running .exe files, opening files and folders, and software installations.
• Display and clear DNS cache.
• Permanently delete sensitive data.
• Optimized performance through memory management and multi-core support.

Most wrong-number texts are harmless. Some are the first step in a carefully planned scam. By replying, you may be confirming that your number is active and that you’re willing to engage with strangers, making you a more valuable target for future fraud. Here’s why a polite response can be worth money to cybercriminals.

Click to expand...

What your reply told them

Let’s be clear: the “wrong number” text is not a phishing link. It’s not malware. In many cases, it’s not even the scam itself. It’s a personality test.

The scammers already have your number. They may have bought it in bulk from a data breach for a fraction of a cent per record. They already know the message was delivered because their SMS gateway received no delivery failure. Text messages remain one of the most effective ways to reach people, with exceptionally high open rates and most being read within minutes. That’s one reason scammers prefer SMS to email.

What they don’t know is whether you’re worth spending more time on. Your reply told them three useful things:

1. You’re responsive. You saw the message and felt compelled to reply. This immediately places you in their top 15–20% most active numbers category.
2. You’re polite. You didn’t ignore it and didn’t respond aggressively. You wanted to help a stranger. Scammers deliberately exploit that instinct to be polite and helpful.
3. You reply quickly. The time between their message and your reply can reveal how closely you monitor your phone, help estimate your timezone, and indicate how likely you are to respond to future messages.

Click to expand...

Breaking the chain

You can’t erase your number from dark web databases: that damage may have done years ago. But you can make your profile far less valuable to scammers.

Make yourself harder to profile: Review the privacy settings on any messaging apps and social media platforms that use your phone number. Limit who can see information such as your profile photo, status, last seen, and phone number. The less information scammers can gather automatically, the harder it is to build a detailed profile about you. On WhatsApp, for example, you can set Profile Photo, About, Status, and Last Seen to My Contacts. On Telegram, set Phone Number to Nobody.

Report before you block: Blocking protects only you. Reporting protects everyone. When you use WhatsApp’s Report and Block function, the last five messages in the chat are sent to Meta’s security teams. If enough people report the same number, it may be permanently banned, destroying the entire active campaign on that line.

The golden rule: If you receive an unexpected message from an unknown number, the safest response is no response at all. Don’t reply, don’t explain yourself, and don’t worry about seeming impolite. If it’s a genuine wrong number, the sender will usually realise their mistake and move on. If it’s a scam, you’ve denied the criminals exactly what they wanted: proof that your number is active and that you’re willing to engage.

Click to expand...

Your polite reply to that text is worth $2 on the dark web

A polite reply to a wrong-number text may seem harmless. But scammers use it to profile their victims and fuel a multibillion-dollar fraud industry.

www.malwarebytes.com

AI is coming to your TV, whether you want it or not.

On Wednesday, Amazon said its AI assistant, Alexa+, will be rolled out to all compatible Fire TV devices in the U.S. for free, whether or not the customer has a Prime subscription. The update brings conversational search, smart home controls, and AI-powered recommendations, the company says.

Previously, Alexa+ cost $19.99 per month for anyone who didn’t have an Amazon Prime membership, and was initially made available to the new Fire TV devices the company announced last fall.

Now, Amazon says that everyone will be upgraded to Alexa+ automatically. They won’t need to download an app or sign up for a subscription. Compatible devices include all the current-generation Amazon Fire TV Sticks, the Fire TV Cube, Amazon Ember smart TVs, and other smart TVs that have Alexa+ built in, including Hisense and Panasonic.

The move follows an industry-wide push to make AI services available on more consumer electronic devices, often through non-optional upgrades like this. Google, for instance, rolled out Gemini to its Google TV platform earlier this year, replacing simple search features with AI-powered conversational modes. Roku upgraded its voice assistant to AI last year, too.

The companies point to metrics like time spent with the features to suggest positive consumer adoption trends. For instance, Amazon says that Alexa+ customers now have nearly twice as many conversations on Fire TV as they did with the original Alexa, which apparently suggests that customers with Alexa+ are no longer using their TV only as a lean-back source of entertainment, and are instead engaging with the AI, too.

Whether or not that’s a good thing is debatable.

Amazon says that with Alexa+, users don’t have to ask for shows by title, but can instead ask for suggestions based on other factors such as theme, age or popularity — for example, “a top-rated thriller” or “a historical drama with a strong female lead.”

The AI bot can also help customers manage and control their smart home, including displaying their Ring camera feeds on the TV.

Click to expand...

• Recover Data
  • Recover more than 550 file formats, including photos, videos, music, docs, emails, .zip, etc.
  • Recover deleted, formatted, or otherwise inaccessible files in any data loss situations.
  • Recover data from not only the internal hard drive but also all kinds of external hard disk.
  • 4 different recovery modes for your reference: Deleted Recovery, Format Recovery, Raw Recovery and Partition Recovery.
• Auto Scan & Preview
  • After scanning files, you can preview common file formats, including BMP, GIF, PNG, JPEG, JPG, TIF, DOC, DOCX, HTM, PDF, PPT, PPTX, RAR, XLS, XLSX, ZIP, etc.
  • Image Preview helps you find your target files and check their properties and quality before you decide to recover them.
  • Preview of documents and archives lets you confirm in advance whether each file is indeed one you want to recover, or not.

Features​

• PDF to Flipbook: Converts uploaded files into an online flipbook with smooth, realistic page-turning while preserving the original layout and visual details.
  • Layout Preservation: Keeps catalogs, magazines, brochures, and reports looking exactly as designed, page for page.
  • Natural Browsing Experience: Lets readers flip through content online the same way they would with a printed publication.
• PDF to Video: Turns a static PDF into a fully produced video with an AI-generated script and natural voiceover.
  • Synced Captions: Automatically times on-screen text to match the spoken narration for easier viewing.
  • AI Avatar Presenter: Adds an optional on-screen presenter to deliver the content in a more personal, engaging way.
  • Background Music and Effects: Adds supporting audio and visual elements so the finished video feels polished rather than robotic.
• PDF to Presentation: Builds an interactive, page-by-page slide presentation that runs directly in a browser.
  • Narration and Captions: Guides viewers through each slide with spoken explanation and matching text.
  • Shareable Link or QR Code: Lets viewers open the presentation instantly without downloading an app or file.
• PDF to Website: Generates a responsive web page from a flipbook or uploaded file without writing code.
  • AI Content Extraction: Automatically pulls key information from the source file to build the first version of the page.
  • Plain-Language Editing: Lets users request layout or content changes using simple written instructions instead of code.
  • Device-Responsive Design: Automatically adapts the page for phones, tablets, and desktop browsers.
• 3D Exhibition: Creates a virtual exhibition space that visitors can move through on any device.
  • Ready-Made Templates: Provides starting layouts for showrooms, galleries, company spaces, and school projects.
  • Free Movement and Interaction: Lets viewers explore content from every angle instead of scrolling through flat images.
• PDF to Chatbot: Adds an always-available chatbot trained on the content inside the uploaded file.
  • Instant Question Answering: Lets visitors get relevant answers without searching page by page through a document.
  • Custom Avatar and Captions: Matches the chatbot’s appearance and style to a brand’s identity.
• PDF to Document: Converts PDFs into Word, PowerPoint, Excel, and image files while keeping the original layout intact.
  • Ready for Online Hosting: Converted files can be hosted, shared instantly, and accessed from anywhere.

Create a Recastia Account

Recastia Login

recastia.com

Claim Your Gift Card - Recastia

Claim your Recastia gift card and redeem exclusive membership benefits. Log in to get your gift card code and start enjoying premium features.

recastia.com

TL;DR
Telegram has applied for the .gram top-level domain through ICANN’s 2026 round. If approved, Telegram usernames could become web-addressable domains with AI-generated websites.
This creates a new namespace for phishing, impersonation, and threat actor self-promotion, operated by a platform already deeply embedded in the threat landscape.
Telegram would become the registry operator, making it the gatekeeper for abuse reports and takedowns across potentially a billion domains.
The July 2026 t.me serverHold incident showed what happens when Telegram depends on someone else’s domain infrastructure. Owning .gram would flip that dynamic but also transfer compliance liability onto Telegram.
Security teams should start monitoring the ICANN approval process, treat Telegram username squatting as a brand protection issue, and prepare to add .gram to their detection pipelines.

Telegram's .gram Domain Bid Signals a New Threat Landscape

On August 18, Pavel Durov announced Telegram's ICANN application for the .gram domain as new phishing and impersonation risks emerge for security teams.

socradar.io

Click to expand...

Based on this early comparison, the Windows 11 26H2 preview shows a resource footprint that is effectively identical to 25H2 when running an identical knowledge worker workload. CPU utilization differs by roughly half a percentage point, memory usage is within half a percent, disk reads are unchanged, and disk writes show only a slight increase on the preview build. The 26H2 preview also runs slightly fewer processes on average, but the difference is small and well within what could change before general availability.

Windows 11 25H2 vs 26H2 preview: an early performance comparison | GO-EUC

Research is creating new knowledge

www.go-euc.com

Click to expand...

TWINLOOT Hides Its Commands Inside Microsoft Services​

For routine tasking, TWINLOOT contacts a SharePoint site hosted in the attacker’s Azure tenant every 15 seconds. Commands, execution results, passwords, and system information are exchanged through files using the Microsoft Graph API.

Because the implant authenticates directly to the attacker’s tenant, its activity does not create sign-in or audit events in the victim organization’s Entra ID records.


When operators need interactive access, TWINLOOT creates a reverse SOCKS5 connection capable of carrying up to 128 simultaneous network streams. It can use this connection to reach internal services such as Remote Desktop, SMB, WinRM, and Microsoft SQL Server.

The stealthier version of that connection runs through Microsoft Teams TURN servers. TURN infrastructure normally relays call traffic when two devices cannot connect directly. TWINLOOT places its SOCKS5 traffic inside WebRTC DataChannels and sends it through a legitimate Teams relay.

According to Ontinue’s report, this is the first known malware to use WebRTC DataChannels for command-and-control. It is also the second known malicious use of Teams TURN relays, following DragonForce’s Backdoor.Turn in June 2026.

By default, TWINLOOT’s primary communication channels end in Microsoft IP space. The implant also retains a direct TLS and WebSocket connection to attacker infrastructure as a fallback.

https://hackread.com/twinloot-malware-steals-windows-passwords-lock-screen/

Click to expand...

Apple has just released iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2 to fix various security vulnerabilities across its software platforms. The company previously released macOS 26.6.1 on August 7 to address a screen sharing vulnerability, so that’s why the platform’s version number is a bit further ahead.

Overall, iOS 26.6.1 and iPadOS 26.6.1, and macOS Tahoe 26.6.2 address various WebKit and kernel vulnerabilities, as well as a logic issue that could lead audio apps to leak sensitive information. The company also listed another vulnerability that may lead to memory corruption after processing maliciously crafted web content.

Apple also released visionOS 26.6.1 today, but details about this update aren’t available as of this writing. iOS 18.7.10 and iPadOS 18.7.10 are also available today, and they include security fixes that were first made available with iOS 26.6 and iPadOS 26.6 in late July.

Click to expand...

Apple Releases iOS 26.6.1, iPadOS 26.6.1, and macOS 26.6.2

Apple has just released iOS 26.6.1, iPadOS 26.6.1, and macOS Tahoe 26.6.2 to fix various security vulnerabilities across its software platforms.

www.thurrott.com

Executive Summary​

Nextron Research has identified a targeted campaign leveraging hiring-themed social engineering lures to distribute malware to German-speaking businesses. The attack chain employs DLL sideloading via legitimate Microsoft binaries to establish persistence and command-and-control (C2) connectivity. The campaign demonstrates sophisticated operational security practices, including the abuse of legitimate Windows utilities to evade detection and establish backdoor access.

Campaign Overview​

Attack Vector​

The campaign delivers malicious archives containing a mixture of legitimate and malicious components. The lure content consists of fake non-disclosure agreements (NDA) documents designed to appeal to hiring managers and HR personnel. Legitimate binaries include Microsoft-signed executables such as git-credential-manager.exe and bundled SSH utilities. The malicious payload is a fake-signed gcmcore.dll file positioned for sideloading exploitation.


This hybrid approach allows threat actors to bypass initial static detection mechanisms by leveraging legitimate signed binaries while concealing the actual payload within what appears to be standard development tooling.

Technical Analysis​

Infection Chain​

The infection chain begins when a user extracts an archive containing the NDA lure document and Git credential manager tooling. The legitimate git-credential-manager.exe is executed, triggering DLL sideloading. The malicious, fake-signed gcmcore.dll is then loaded by the legitimate binary during payload injection. The gcmcore.dll executes the second-stage payload—Git.dll (tracked as "Snake Agent")—for agent deployment. Finally, Snake Agent leverages the bundled ssh.exe to establish a persistent outbound SSH tunnel to the C2 infrastructure for backdoor establishment.

DLL Sideloading Exploitation​

The threat actors exploit Windows DLL search order vulnerability by placing the malicious gcmcore.dll alongside the legitimate Git Credential Manager executable. When git-credential-manager.exe executes, it preferentially loads the local malicious DLL rather than the legitimate system library, granting the attackers code execution within the process context.

Snake Agent Capabilities​

Snake Agent operates as an SSH-based C2 agent with several observed capabilities. The agent performs system reconnaissance including basic host enumeration and system information exfiltration. It supports command execution for remote command invocation on compromised systems. SSH tunneling is leveraged through the bundled ssh.exe utility to establish persistent encrypted backdoor channels to the C2 server. The agent achieves network abstraction by eliminating the need for custom network protocol implementation, instead delegating transport to SSH.


The use of SSH for C2 communication is operationally significant—it allows the threat actors to blend malicious traffic with legitimate SSH patterns, complicating network-based detection.

Indicators of Compromise (IOCs)​

File Hashes (SHA-256)​

Lure DocumentHash: c5482d8ed604923573624e220b591427e46a9391215b438a1425ab14b508810dDescription: Fake NDA document used as social engineering lure


gcmcore.dllHash: bf4f0558b49917ba40c694e8c7e837183aa476ed6354cdb07caa8d59aaafdcdeDescription: Malicious DLL sideloaded by git-credential-manager.exe


Git.dll (Snake Agent)Hash: d14d4bc85313b7e06535197bed53c5e8dce7da5922791c9ff36183e2bca0fad7Description: Second-stage C2 agent payload

Network Indicators​

C2 ServerIndicator: 103.170.154[.]120:443Type: SSH-based command-and-control endpoint

Detection Recommendations​

File-Based Detection​

Organizations should monitor for execution of git-credential-manager.exe from non-standard directories and alert on the presence of gcmcore.dll in paths where Git Credential Manager is located. File hash detection for the provided SHA-256 indicators should be implemented across endpoint security infrastructure.

Process-Based Detection​

Monitoring should focus on ssh.exe child processes spawned by unusual parent executables, with alerts configured for outbound SSH connections to uncommon destinations, particularly on port 443. Injection or code cave modifications within legitimate Microsoft binaries should be tracked.

Network-Based Detection​

Block or monitor connections to 103.170.154[.]120:443. SSH tunneling patterns with suspicious handshake anomalies should be identified. Alert on outbound SSH traffic from systems outside traditional development environments.

Mitigation Strategies​

Email security controls should flag or quarantine archives containing development tooling from external senders, particularly those claiming to relate to hiring processes. Execution control measures must implement application whitelisting to restrict execution of git-credential-manager.exe to managed development environments. DLL sideloading prevention should deploy DLL load-order abuse mitigations such as CWE-426 controls. Network segmentation requires restricting outbound SSH from non-development systems and monitoring development environment SSH traffic for anomalies. User education programs should emphasize verification of tooling authenticity and the risks of executing unfamiliar archives from hiring-related communications.

Attribution Notes​

The campaign's focus on German-speaking businesses, sophisticated tooling abuse, and operational discipline suggest a well-resourced threat actor. The hybrid use of legitimate binaries with DLL sideloading reflects awareness of modern detection techniques.

---

Report Date: August 2026
Classification: Research
Nextron Research

Click to expand...

When I try to run a scan, it stops and then tells me to restart the service. There are no exclusions and nothing of note from my start up apps. I’ve run a deep scan with Malwarebytes and it’s all good. I noticed there was a new security update for Windows and downloaded it and after restarting my PC, I’m still encountering the same issue. I’m not sure whether this is Malware related as I’m always careful of what I’m downloading and never click suspicious links. Not sure what else to do and need some help.

Click to expand...

• 37 HTTP requests
• 6 domains / 5 IPs
• Microsoft Azure Blob Storage as the main host
• Google Analytics / Google Tag Manager
• Yandex.Metrika and Yandex cookie-sync requests
• No urlscan classification at the time of scanning
• JavaScript functions with names such as:
  • <span>startCMDAnimation</span>
  • <span>showVirusNotification</span>
  • <span>detectVirus</span>
  • <span>startAntivirusDetection</span>
  • <span>startNetworkMonitoring</span>
  • <span>startCPUMonitor</span>
  • <span>activateFullscreen</span>
  • <span>startBackgroundAudio</span>

Introduction​

In early 2026, the Trellix Advanced Research Center (ARC) identified and analyzed an active DarkCrystal RAT (DCRat) campaign following a critical customer escalation. The operation relied on a judicial‑themed phishing lure, masquerading as an official “Resolución Denuncia Jurídica” (legal complaint resolution) to pressure victims into opening the attachment. Every stage of the attack required human interaction, from opening the phishing email to extracting the archive to executing the malicious components alongside trusted libraries by using DLL sideloading. In its final stage, the malware employed process hollowing to inject malicious code into a trusted system process, effectively evading detection. The end payload was DCRat, granting attackers full remote access and control. This campaign is particularly notable for legitimate, signed utility to bypass traditional security perimeters.

This blog unpacks each stage of the infection chain, revealing how attackers combine stealth, sideloading, and process injection to establish long‑term access.

https://www.trellix.com/blogs/research/signed-sealed-injected-dcrat-mechanics-2026/

Here is a refined, explanatory breakdown of the infection chain identified by Trellix ARC.

Attack kill chain​

Click to expand...

The Linux kernel is finally making the Time Stamp Counter (TSC) a hard requirement for x86 processors more than a decade after Microsoft began using it as the preferred basis for high-resolution timing on suitable Windows systems.

For those wondering, the TSC is a special 64-bit register that acts as a processor counter and has been around since the Intel Pentium era. It provides a high-resolution (a highly fine-grained) way of measuring elapsed time, and can be accessed much more quickly (as it's just a CPU register) than platform timers such as HPET (High Precision Event Timer) or the ACPI PM (power management) timer.

https://www.neowin.net/news/linux-finally-follows-windows-and-makes-a-cpu-feature-requirement-mandatory/

Click to expand...

Artificial intelligence (AI) is changing offensive security, but it has not changed the standard that matters most: a finding has to be proven before it becomes useful. AI-assisted tools can read code quickly, generate payloads, summarize attack surfaces, explain unfamiliar APIs, and run repetitive testing workflows at impressive speed. That is a real advantage for security teams. It also creates a new kind of pressure, because the industry can now produce more vulnerability-looking output than ever before.

The problem is that output is not the same as evidence. A generated report can sound polished, include a severity rating, and even contain a proof-of-concept that looks reasonable at first glance. None of that proves the bug exists in the deployed environment. None of it proves exploitability, impact, or risk. In offensive testing, the hard part has never been writing something that sounds like a vulnerability report. The hard part is demonstrating what is actually true.

That distinction is becoming more important as AI becomes more common in security workflows. AI can accelerate discovery, but validation still depends on knowledge: knowledge of systems, protocols, application behavior, identity boundaries, memory corruption, business logic, and all the implementation details that separate a plausible theory from a real exploit. The future of offensive security will not belong to people who merely produce the largest number of findings. It will belong to people and teams that can prove what matters.

AI Can Find Bugs, But Human Knowledge Still Proves Them

Artificial intelligence (AI) is changing offensive security, but it has not changed the standard that matters most: a finding has to be proven before it becomes useful. AI-assisted tools can read code quickly, generate payloads, summarize attack surfaces, explain unfamiliar APIs, and run...

www.sans.org

Click to expand...

Release v1.18.2 / 5.73.2 Latest
Sandboxie Plus 1.18.2 / 5.73.2 is a maintenance and usability update that brings several refinements to SandMan, improves compatibility with recent Windows Insider builds, and fixes a number of long-standing UI and driver-related issues.

Sandboxed-window borders have gained new outside-border modes, allowing the configured border to be drawn outside the application frame. For maximized and snapped windows, the new BorderInsideMaximized=y option, enabled by default, automatically moves the border and label inside the window so they remain visible.

SandMan now remembers manually expanded and collapsed process-tree branches across refreshes and restarts. The Auto Expand Tree option has been adjusted accordingly and now acts as the default only for items without an explicitly remembered state. Sandbox groups are likewise kept in their chosen expanded or collapsed state more reliably.

A new global BoxAliasDisplayMode allows display-only aliases to be used for sandbox names throughout SandMan, Start.exe, window titles, borders, tooltips, recovery logs, and messages, while the actual sandbox name continues to be used internally for paths and operations. Imported sandbox archives can optionally restore their saved aliases as well.

The tray menu can now provide a literal search field for quickly filtering sandboxes and groups, and automatic sandbox cleanup gained an option to restore either the active or the default snapshot after deletion. Snapshot management and refresh controls have also been integrated into the relevant settings.

Trace Log handling has been improved so automatic scrolling no longer fights manual navigation. Scrolling away from the bottom now pauses auto-scroll and presents an in-list control for resuming it.

This release also updates DynData and restores driver compatibility with the latest Windows Insider builds, including validation against Windows build 29634.

Among the fixes are corrected File Panel column persistence, more reliable open-handle reporting, improved file sorting, proper Recycle Bin deletion of expanded directory trees, and a fix for registry hive log files such as RegHive.LOG1 and RegHive.LOG2 being incorrectly treated as descendants of RegHive. Several character-versus-byte buffer size issues affecting shortcuts, window class names, configuration reads, driver-log retrieval, and icon-path IPC handling have also been corrected.

ApiTrace has been reworked to avoid stack exhaustion on Cygwin and other environments using unusually small or alternate stacks, while retaining legacy event ordering and stack capture. Stack symbol resolution has also been improved by retrying unresolved addresses after process discovery and refreshing the DbgHelp module list when necessary.

Finally, the release fixes an issue where SandMan could unnecessarily offer to install the DbgHelp add-on when it was already present, as well as a ConfidentialBox=y elevation problem that could leave the user stuck on a black screen.

For a full list of changes please review the change log.

You can support the project through donations, any help will be greatly appreciated.
If you have issues with an update installation, just uninstall the previous version keeping the sandboxie.ini and reinstall the new build.

https://github.com/sandboxie-plus/Sandboxie/releases/tag/v1.18.2
https://www.wilderssecurity.com/threads/sandboxie-plus-v1-18-2.460527/

Click to expand...

Turkish TV powerhouse Ay Yapim is launching its first AI-generated series, “Castle Walls,” which focuses on the enigmatic story of present-day Iran’s Alamut Castle.

AI-Generated Series ‘Castle Walls’ Sets Launch From Turkish TV Powerhouse Ay Yapim, Reveals Trailer (EXCLUSIVE)

Turkish TV powerhouse Ay Yapim will launch its first AI-generated series, titled 'Castle Walls,' at Mipcom.

variety.com

Click to expand...

Click to expand...

The malware was small, had a limited command set and disguised itself as legitimate Realtek software. Its most unusual feature was its configuration: the address of its command-and-control server was not stored as readable text or encrypted data, but encoded in the number of spaces on each line of a Windows `desktop.ini` file. To a user, and to many automated inspection systems, the file would appear almost empty. To the malware, those spaces spelled out its server address. We found no evidence connecting the backdoor to a known threat actor, and the original infection happened before our protection was installed. However, the implant's custom design, its deployment on only one observed machine and the absence of related samples suggest that this may have been a deliberately targeted operation rather than a failed mass campaign.

An event subscription named "Realtek"​

Most malicious WMI subscriptions are easy to spot because the query asks for something no administrator would. This one asked for something an administrator plausibly might, at a very specific time.

Our behavioural engine dumped the subscription it objected to. This is our own export of the WMI objects rather than a file the attacker left on disk, with the host name redacted:

A 12 KB Backdoor Hid Its C2 Domain in desktop.ini Whitespace

A hand-written Windows backdoor stored its command-and-control domain as the number of trailing spaces in a fake desktop.ini, and we found it on exactly one machine.

www.gendigital.com

Click to expand...

Introduction​

Acronis Threat Research Unit (TRU) has identified an ongoing campaign delivering a previously undocumented custom backdoor against Afghan telecom providers and South Asian critical infrastructure organizations. The backdoor, tracked as PATCHCORD, is a compiled C/C++ implant delivered through sector-specific lures, including fake VPN installers impersonating Afghan Telecom (AFTEL) and telecom management tools. Infrastructure pivoting uncovered SHEETCORD, a Go-based implant that builds on PATCHCORD's capabilities while abusing Google Sheets for C2 communication. The malware was actively distributed through a domain impersonating India's National Informatics Centre (NIC).

PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure

Acronis Threat Research Unit (TRU) has identified an ongoing campaign delivering a previously undocumented custom backdoor against Afghan telecom providers and South Asian critical infrastructure organizations. The backdoor, tracked as PATCHCORD, is a compiled C/C++ implant delivered through...

www.acronis.com

The campaign's infrastructure centers on a single C2 server with multiple associated domains, including domains impersonating Afghan telecom operators and a hijacked legitimate healthcare domain. An exposed staging server revealed the operator's broader toolkit, including SuperShell C2 framework, multiple RAT frameworks, credential harvesting tools, and exploit tooling for CVE-2024-6387 (regreSSHion). This research details TRU's analysis of the PATCHCORD, SHEETCORD and HACKERAI C2 Agent malware families, their C2 mechanisms and the supporting infrastructure.

TRU assesses with moderate confidence that the campaign overlaps with the APT36 (Transparent Tribe) cluster based on targeting patterns, malware similarities, shared infrastructure, and operational tradecraft.

The campaign reflects an evolution of Transparent Tribe's recent operations. While the group has historically focused on government, military and diplomatic organizations in India and the broader South Asian region, our investigation identified a stronger operational focus on Afghan telecom providers alongside government, defense and energy organizations. Combined with three previously undocumented malware families and the use of Google Sheets and GitHub Gists for C2, the campaign demonstrates continued evolution in both the group's targeting priorities and operational tradecraft.

Telecom providers remain particularly attractive targets for espionage actors because they provide access to communications infrastructure, subscriber information and government communications, enabling intelligence collection that extends well beyond a single organization.

Click to expand...

Introduction​

CoolClient is a backdoor family attributed to the HoneyMyte APT group (also known as Mustang Panda) that has been used in their cyber-espionage campaigns targeting organizations across Asia and Russia. It supports such capabilities as keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, and plugin-based extensions.

Since its first public disclosure by Sophos in 2022 and subsequent analysis by Trend Micro in 2023, CoolClient has continued to evolve. In 2025, we analyzed a newer variant that introduced clipboard theft and HTTP traffic interception for credential harvesting.

CoolClient backdoor goes deeper: HoneyMyte adds Windows kernel rootkit

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

securelist.com

In late 2025 and 2026, our latest investigation reveal another major evolution. The newest CoolClient variant can deploy a signed kernel-mode driver as a Windows service and communicate with it through IOCTL requests. The driver enhances the malware’s stealth by hiding the CoolClient process, protecting related files and registry entries, and preventing them from being inspected or modified. The overall design is comparable to the kernel-mode enhancements previously observed in ToneShell, but the CoolClient driver exposes dedicated IOCTL handlers that allow the user-mode backdoor to communicate directly with the driver.

We have observed this updated CoolClient variant and its accompanying driver in intrusions across multiple countries in Asia, including Pakistan, Mongolia, and Myanmar.

Click to expand...

Why Is F-Secure Flagging It?​

1. The .top TLD: Cheap top-level domains like .top, .xyz, and .site are heavily targeted by automated threat intelligence filters because bad actors abuse them to host cheap, disposable phishing pages or malware redirects.
2. Domain Age & Low Traffic Volume: MicYou is a legitimate open-source project (hosted by student developers on GitHub) that turns Android phones into PC microphones via USB/Wi-Fi. However, because micyou.top is a relatively small, niche site, it hasn't built up enough global Web of Trust traffic volume to overcome automated categorization filters. (at least in F-Secure's case, my addition).

WireGuard Easy, a web-based tool for deploying and managing a self-hosted WireGuard VPN server, has just released version 15.4, featuring external authentication via OAuth, along with numerous improvements in security, performance, and usability.

The new OAuth integration provides administrators with an additional method to secure access to the WireGuard Easy interface, rather than relying solely on locally managed authentication. The project has also issued specific documentation on the setup of external authentication.

Regarding security, WireGuard Easy 15.4 improves the way it handles TOTP, includes additional protections against injection attacks, and now escapes Prometheus label values. Performance has also improved, as client status data is now combined in linear time and repeated client scans triggered by CIDR changes have been eliminated.

Moreover, the option to set the Table parameter in wg0.conf has been added, and the application will now omit ip6tables operations when IPv6 is disabled, thereby eliminating an unnecessary source of errors in setups that use only IPv4.

Click to expand...

WireGuard Easy 15.4 Released with OAuth Support

The latest WireGuard Easy release adds external OAuth authentication, improves security, and speeds up client status handling.

linuxiac.com

The danger is not a single new malware family. It is a commercial layer that helps many kinds of malware reach victims with less scrutiny.

Criminals can package remote access tools, stealers, or ransomware loaders into files designed to look different each time they are delivered.

A crypter starts with a customer-supplied malicious program and encrypts or disguises it.

More capable offerings go further, adding memory-only execution, checks for virtual machines and sandboxes, process injection, persistence, and fresh versions after a file is detected.

Malware Crypter Services Sell Windows Defender, EDR and SmartScreen Bypasses to Cybercriminals

Crypter services help criminals disguise malware and bypass Windows Defender, EDR, and SmartScreen, making attacks harder to detect.

cybersecuritynews.com

Click to expand...

The problem lies in a configuration chip on certain DDR4 and DDR5 DIMMs that tells the system how much memory is installed. On affected modules, this chip lacks write protection, allowing software to modify the information it contains. This can then make Windows believe that the system has twice as much RAM as it actually does.

The researchers used this technique to bypass several of Windows’ security measures, including Virtualization-based Security (VBS) and Hypervisor-Enforced Code Integrity (HVCI). They also demonstrated attacks that can disable antivirus and EDR software, re-enable vulnerable drivers previously blocked because of their use in malware campaigns, compromise locked-down corporate systems, and bypass kernel-level game anti-cheat protections.

https://www.neowin.net/news/researchers-find-windows-11-can-be-hacked-with-no-physical-access-with-new-attack/

Click to expand...

What is pCloud?​

• pCloud Premium provides plans from 500 GB to 2 TB of storage space to help you store all of your important data.
• Using it, you are able to store all files, including documents and photos, music and videos, without worrying about running out of space.
• It comes with a backup mode of its own, which is capable of backing up folders from your computer to pCloud securely.
• In addition, it can also be used for sharing files and folders with others. You are allowed to send and receive large files to and from anyone you like.
• Also, the software is designed to allow users to encrypt sensitive files on any device.
• pCloud Premium is very useful to help you access your files from anywhere, on any device, with easy-to-use apps for Windows, Mac, iOS, Android, and Linux.

• According to Macworld, iOS 27 beta 5 contains hidden code revealing six unreleased iPhone models, including the iPhone 18 Pro, iPhone Air 2, and a foldable iPhone Ultra.
• The leaked details suggest Apple may prioritize premium devices this fall, while standard iPhone 18 models and the budget iPhone 18e could be delayed until 2027.

Click to expand...

iOS 27 beta confirms Apple’s full iPhone 18 roadmap with 6 new models

Hidden references in Apple’s latest beta reveal unreleased iPhones, including the iPhone Ultra.

www.macworld.com