abuse Archives

AppWizard

October 2, 2026

Android 17 Advanced Protection Locks Accessibility Services to Verified Accessibility Tools

Google has enhanced its Android security framework by restricting access to the AccessibilityService API, allowing only verified applications classified as Accessibility Tools to use these features when Advanced Protection is activated. This decision addresses the misuse of the AccessibilityService API by malicious applications that facilitate malware distribution and financial fraud. The new measures include Intrusion Logging, USB Protection, disabling WebGPU, and a Failed Authentication Lock. Developers will be notified when Advanced Protection is enabled, and users can manually enable Intrusion Logging through the Advanced Protection settings page.

AppWizard

September 21, 2026

Ahead of GTA 6’s Release, Rockstar Updates Modding Guidelines Touching on Monetization, Multiplayer

Take-Two Interactive has not confirmed the release date for Grand Theft Auto 6 on PC, but the game is anticipated to launch in November. Rockstar Games has updated its modding guidelines for GTA 6, which include prohibitions on altering storylines, combining elements from different titles, and unauthorized monetization of mods. The guidelines emphasize respect for Rockstar's intellectual property and the creator community, and they state that monetization is only allowed through approved digital storefronts. The game is set to launch on November 19 for PS5 and Xbox Series X|S, with the PC version's release date still unannounced. Additionally, Rockstar will release "Grand Theft Auto 6: The Album," featuring 34 original tracks from contemporary artists.

AppWizard

September 15, 2026

Steam Price-Fixing Lawsuit: Valve, 10 Publishers Sued [2026]

On August 27, 2026, a class action lawsuit was filed in San Mateo County Superior Court by three California gamers—Alexander Shimota, Ricardo Camargo, and John Elliott—against Valve Corporation and ten video game publishers, accusing them of colluding to maintain uniform pricing for PC games across digital storefronts. The lawsuit alleges that Valve requires publishers on its Steam platform to agree to a most-favored-nation clause, preventing them from offering lower prices on competing platforms, which stifles competition and limits consumer choice. The ten implicated publishers include Activision Blizzard, Electronic Arts, and Sony Interactive Entertainment. The lawsuit is filed under California's Cartwright Act and claims that the coordinated pricing strategy harms consumers by reducing product diversity and inflating prices. Valve's commission structure, which has largely remained unchanged, is central to the plaintiffs' argument. Valve's co-founder, Gabe Newell, has previously denied dictating prices to third-party developers. The lawsuit is distinct from a prior case, Wolfire Games v. Valve, which focuses on monopoly abuse against developers rather than consumer pricing. Additionally, Valve faces a parallel £2 billion class action in the UK regarding similar pricing allegations. The outcome of these cases could significantly impact the pricing landscape for PC games and the practices of digital storefronts.

AppWizard

September 15, 2026

Active Exploitation Alert: Threat Actors Abuse Anthropic Claude AI to Extract Secrets from 1.8M Android Apps in Major Credential Theft Campaign

Between December 2025 and August 2026, a coalition of advanced threat actors exploited the Claude AI model by extracting sensitive information from approximately 1.8 million Android applications. The operation involved groups such as ShinyHunters, Midnight Blizzard (APT29/Nobelium), and the Chinese-speaking entity GTG-10007. They automated the mass download, decompilation, and analysis of Android APKs for hardcoded credentials, API keys, and authentication tokens, leading to extensive credential theft and breaches across various sectors. The attack utilized a distributed pipeline on ten AWS EC2 instances to download APKs, which were then scanned using TruffleHog. Verified secrets were organized and routed in real-time to a private Telegram group for operational deployment. Over 2,100 Azure AD authentication tokens were extracted from more than 40 Microsoft tenants within 34 hours. The operation also included a carding component where stolen payment card data was sold. The tactics employed aligned with several MITRE ATT&CK techniques, including file discovery, unsecured credentials, valid accounts, phishing, and exploitation of remote services. ShinyHunters gained administrative control over targeted environments rapidly, leading to bulk data theft affecting over 200 organizations. Midnight Blizzard automated malware creation and phishing campaigns, targeting government and defense entities. GTG-10007 used Claude for coordinated offensive operations, discovering zero-day vulnerabilities and delivering exploits. Initially, the campaign targeted a broad range of Android APKs but later focused on organizations with valuable credentials across various sectors, including government, technology, and healthcare. Compromises were confirmed in Southeast Asia, Europe, and the Middle East. Organizations are advised to audit Android applications for hardcoded secrets, monitor API key usage, and implement robust security practices to mitigate risks.

Winsage

September 13, 2026

KTVB

Cookies and data, including IP addresses, are used to deliver and maintain Google services, monitor outages, protect against spam and fraud, and measure audience engagement. When users accept all cookies, additional uses include developing new services, placing and measuring advertisements, and displaying personalized content. If users decline all cookies, only non-personalized content and ads will be shown, influenced by current content and general location. Personalized content may include tailored video recommendations and customized homepages based on user activity. Further information on managing privacy settings is available at g.co/privacytools.

AppWizard

September 10, 2026

Tong Launches Investigation of Messaging App He Calls ‘Cesspool Of Sexual Abuse’

Attorney General William Tong has launched an investigation into MediaLab.AI Inc., the parent company of Kik, due to concerns about the app's child safety practices. Kik is described as having inadequate age verification and content screening, with about one-third of American teenagers using it, and 70% of users aged 13 to 24. The National Center on Sexual Exploitation identified Kik as a leading app for exposing children to sexual content and included it in their “Dirty Dozen” list. Between 2014 and 2020, over 2,000 federal cases involved Kik. MediaLab has attempted to improve safety by reclassifying the app to an 18+ rating and activating explicit content filters, but these efforts have been deemed insufficient. The investigation will also assess Kik's compliance with the Connecticut Data Privacy Act, focusing on the handling of sensitive data without consent.

AppWizard

September 9, 2026

Attorney General Tong Announces Investigation Into “Predator’s Paradise” Kik Messenger App

Attorney General William Tong has launched an investigation into MediaLab.AI Inc., the parent company of the messaging app Kik, following allegations of inadequate age verification and content moderation practices. Kik has been criticized for its reputation as a platform for sexual abuse, exploitation, and bullying, particularly among minors, with over one-third of American teens reportedly using the app. A 2025 report ranked Kik as the second worst app for extreme sexual content and the third worst for severe bullying, and the app has been included on the National Center on Child Exploitation's "Dirty Dozen" list. Despite claims of restricting new users to those aged 18 and older as of September 2023, evidence suggests that Kik continued to market to younger audiences, and the app maintained a "Teen" rating until early 2025. The Attorney General's office issued a notice of violation to MediaLab in July 2025 for deficiencies in Kik’s privacy practices and has issued a civil investigative demand for further records related to data processing and content moderation. This investigation is part of a broader effort to protect children from online threats in Connecticut.

AppWizard

September 8, 2026

Connecticut attorney general calls Kik messenger app a ‘predator’s paradise’

Connecticut's Attorney General, William Tong, is investigating MediaLab.AI Inc.'s messaging app, Kik, due to concerns about inadequate age assurance practices and content moderation. Child safety advocates have criticized Kik as a “predator’s paradise.” Tong described Kik as a platform with significant issues related to sexual abuse, exploitation, and bullying, lacking meaningful age verification and protections for users. The app has over one-third of American teens using it, down from 40 percent in 2016. MediaLab has only partially responded to inquiries about privacy and safety. Tong's office has issued a civil investigative demand for information on MediaLab’s data processing, content moderation, and age assurance practices to assess compliance with the Connecticut Data Privacy Act and the Connecticut Unfair Trade Practices Act.

Tech Optimizer

September 4, 2026

12-Year-Old PostgreSQL Vulnerability Enables Database, Server Takeover

A significant vulnerability in PostgreSQL, tracked as CVE-2026-6471, has been identified by cybersecurity firm Cyera. This flaw, present since 2014, allows attackers with minimal privileges to potentially take control of databases and servers. The vulnerability, known as PostGREShell, has a CVSS score of 7.2 and can be exploited for remote code execution and privilege escalation due to a missing authorization in the database's logical decoding mechanism. Attackers with 'Replication' privileges can load arbitrary files through the logical decoding plugin, executing code with the privileges of the postgres system user. This can lead to the elevation of privileges to superuser status, granting unrestricted access to all tables and the ability to execute operating system commands. All PostgreSQL versions from 9.4 to 18 are affected, with a patch available in versions 18.6, 17.11, 16.15, 15.19, and 14.24. Organizations are advised to update their PostgreSQL instances and audit their Replication accounts.

AppWizard

August 31, 2026

Home Ministry alerts about rise in financial frauds through malicious Android apps

The Indian Cyber Crime Coordination Centre (I4C) has reported a rise in financial frauds associated with malicious Android applications disguised as pornography apps. These apps, including names like "Night Play," "Reloop," and "Kyss," are promoted through ads on Facebook and Instagram, leading users to phishing websites where they are encouraged to download APK files from unverified sources. The malicious apps exploit permissions granted by users to take control of devices, potentially facilitating unauthorized financial transactions. Recommendations for safety include only installing apps from reputable sources, avoiding suspicious downloads, and regularly monitoring financial transactions. Instructions for uninstalling these apps involve starting the phone in Safe Mode, uninstalling the suspicious app, and then restarting the device.