actor Archives

Winsage

September 2, 2026

Fake Microsoft Edge, Kaspersky and Razer Installers Used to Compromise Windows Systems

An ongoing malware campaign is targeting Windows devices through counterfeit download pages for well-known software brands like Microsoft Edge, Kaspersky, and Razer. The campaign affects various sectors, including healthcare, manufacturing, gaming, technology, logistics, government, and education. It utilizes high-fidelity fraudulent websites that closely mimic legitimate vendors, with observed lure domains such as app-microsoft-edge[.]com[.]cn and kaspersky-lab[.]hl[.]cn. Attackers employ evasion tactics like server-side payload regeneration and create multiple copies of the same archive in quick succession. Victims are lured into downloading ZIP files that contain a bundled wrapper installer, which activates a stage-one executable in randomized directories. The malware often masquerades as legitimate software, with some payloads impersonating known applications. Persistence is achieved through scheduled tasks with unusual names, and the malware employs various evasion techniques, including deleting shadow copies and altering file permissions. Microsoft Defender has identified activity across multiple stages of the attack, including delivery, execution, and command-and-control communications. To mitigate risks, organizations are advised to block downloads from unofficial sources, enforce Tamper Protection, and implement Attack Surface Reduction rules. Indicators of compromise (IOCs) include specific lure domains and URLs associated with the campaign.

Tech Optimizer

August 31, 2026

Fake Chrome update scam could infect your computer

A fake Chrome update scam has emerged, linked to a Chrome extension called Enable Right Click & Copy - Smart Unlock + OCR, which was initially legitimate but later compromised. The extension had around 70,000 users before being removed from the Chrome Web Store on August 14 due to its malicious nature. Users may encounter deceptive warnings while browsing benign sites, urging them to download files instead of using Chrome's built-in update mechanism. Google advises against engaging with suspicious pop-ups requesting software installations. The scam highlights that trusted extensions can become threats without warning, and users should regularly review their installed extensions and check for updates directly within Chrome. Similar fake update alerts have also been reported in other Chromium-based browsers. Users are encouraged to adopt safety measures, such as using strong antivirus software, reviewing browser extensions, and being cautious with downloaded files. If a suspicious file has been executed, users should treat their computer as potentially compromised and take appropriate security actions.

AppWizard

August 31, 2026

Onimusha: Way of the Sword review

Miyamoto Musashi is the central character in Capcom's upcoming game, Way of the Sword, set to release on September 3, 2026, for £60. The game features a physics-driven combat system that emphasizes parrying and timing, with players building a "burning" meter to increase damage. Notable encounters include battles against a demon named Byakue. The game allows for straightforward controls while encouraging players to utilize environmental elements strategically. Musashi's Oni Armaments serve as secondary weapons that add depth to combat. The visuals are impressive, particularly on high-end hardware, achieving 120 fps, and the narrative explores Musashi's evolution as a warrior.

Tech Optimizer

August 31, 2026

ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions

Silver Fox is linked to the distribution of a backdoor malware called ValleyRAT, disguised as the legitimate QN Wallpaper adware application. Once installed, ValleyRAT provides complete control over the compromised machine. The malware uses DLL sideloading to operate under the guise of a legitimate process, bypassing security measures. It disables Windows Defender and adds itself to autorun entries, and can mark its process as critical, causing system crashes if terminated. Kaspersky has identified specific indicators of compromise (IoCs) including hashes, command-and-control servers, and associated domains. In 2026, Kaspersky recorded over 100,000 detections of ValleyRAT affecting more than 1,500 unique users, mainly in China and India.

AppWizard

August 29, 2026

Star Citizen spinoff Squadron 42 has been delayed yet again, citing everyone going gaga for GTA 6, even if it isn’t coming to PC yet

Squadron 42, the single-player spinoff of Star Citizen, has been postponed to 2027 due to the anticipated release of GTA 6. The new release window is set for Q2 of 2027, following an initial plan for Q4 2026. A select group of original backers and content creators will have the opportunity to experience the game on October 9th and 10th. The game features a notable cast, including Gary Oldman, Gillian Anderson, Mark Hamill, Andy Serkis, Henry Cavill, and Eric Wareheim.

AppWizard

August 29, 2026

Bland or badass? The internet is split on GTA 6’s Jason, and so is PC Gamer

The Extended Look at GTA 6 showcased a 26-minute trailer featuring a sprawling open world and new features, highlighting two playable characters: Jason and Lucia. Lucia received positive attention for her fierce persona, while Jason's reception has been mixed. Fans expressed dissatisfaction with Jason's voice acting, with comments suggesting it lacked emotion and depth. Some compared him to past Rockstar characters who were initially criticized but later became favorites, indicating potential for character development. The gaming community is actively discussing Jason, with a poll created for fans to share their opinions.

Tech Optimizer

August 26, 2026

How to Protect Against Ransomware: 13 Steps [2026]

Global ransomware attacks increased by 0.8% quarter-over-quarter in Q2 2026. The group Qilin has 279 confirmed victims, maintaining its position as the leading threat actor for four consecutive quarters. The rival group The Gentlemen saw a 62% increase in victims, reaching 269. Checkpoint Research's report indicates a shift in the ransomware landscape, challenging the narrative of declining attacks. IBM's analysis shows breaches within supply chains and third-party vendors have quadrupled over the past five years. Effective ransomware protection requires administrative access to endpoints, firewalls, and backup systems, along with specific software versions and tools. The 3-2-1-1-0 backup strategy is recommended, emphasizing offline, immutable backups. Organizations should implement multi-factor authentication (MFA) across all access points and actively patch known vulnerabilities. Network segmentation is crucial to limit ransomware spread, and canary files can provide early warnings of attacks. Regular phishing simulations and a well-documented incident response plan are essential for preparedness.

AppWizard

August 24, 2026

Ray Chase, the voice of Cyclops in X-Men ’97, has ‘1,000 freaking hours’ in Slay the Spire and is running a ‘smell build’ in Kingdom Come: Deliverance 2: ‘ I wear perfumes and walk into battle with my fancy boy outfit’

Ray Chase began his gaming journey on a DOS computer and was influenced by shareware games from his grandfather, including Duke Nukem 1 and 2, Ken's Labyrinth, and Wolfenstein 3D. He is a voice actor known for roles in hundreds of games, including Noctis in Final Fantasy 15 and Cyclops in X-Men '97. He is currently involved in the dating simulator Date Everything and is working on its next chapter. Chase enjoys playing Deltarune Chapter 5, Kingdom Come: Deliverance 2, and Mina the Hollower, praising their unique features. He has logged 600 hours in Slay the Spire, which he played from early access to release, and considers it one of his favorite games alongside Brotato. He uses Reaper and Audacity for voice recording and maintains a tidy desktop with minimal items.

AppWizard

August 23, 2026

Gunstoppable gives me the same head-empty unbridled joy as Ultrakill—it doesn’t hurt that Gabriel’s voice actor is in it too

Gunstoppable is an action roguelike video game that emphasizes instinctive gameplay through mechanics like grappling, sliding, and wall-running. Players aim to eliminate robotic adversaries while on a quest to rescue their family from a billionaire CEO who has transformed them into a combatant. The game combines engaging mechanics with a storyline that adds depth to its fast-paced action.

Winsage

August 14, 2026

Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth

The threat actor known as HoneyMyte, also referred to as Mustang Panda, has been deploying an upgraded version of the CoolClient backdoor, which includes a signed Windows kernel-mode rootkit. This rootkit enhances the malware's ability to conceal malicious processes, files, registry objects, and command-and-control (C2) network information. Victims have been identified in Myanmar, Mongolia, Pakistan, and Russia, with confirmed targets including government entities. The CoolClient backdoor is deployed as a secondary access layer following an initial PlugX infection. The kernel component activates when CoolClient gains full access to the Service Control Manager (SCM) and the SeTcbPrivilege privilege. If these conditions are not met, the malware bypasses driver deployment and advances to the final-stage implant. Kaspersky has provided indicators of compromise (IoCs), including file hashes, paths, and C2 domains. In a campaign targeting Myanmar, HoneyMyte used PlugX as the initial implant to deploy CoolClient, which involved creating Microsoft Defender exclusions and renaming a legitimate executable for DLL sideloading. Persistence is achieved through a scheduled task that executes the binary with SYSTEM privileges at startup. Execution begins when a legitimate application loads a malicious DLL, which then manages persistence, registry modifications, UAC bypass, process injection, driver deployment, and C2 communications. When privileges are granted, the malware extracts a kernel driver, writes it to disk, and establishes a driver service. The driver is digitally signed with a certificate from Nanjing Ranyi Technology Co., Ltd. The driver receives configuration data from the CoolClient user-mode component and utilizes specific IOCTL requests to register trusted processes and protect filesystem and registry paths. The rootkit can limit access rights to protected processes, hide processes by unlinking them from the active process list, and deny access to protected files and directories. It also filters C2 IPv4 addresses from network information. The driver incorporates 33 IOCTL handlers, but only three were observed in use during standard execution. Kaspersky shared several file hashes related to the malware, including those for the kernel driver and malicious DLLs. This follows earlier disclosures regarding a newer CoolClient variant and a different HoneyMyte kernel-mode rootkit documented in December 2025.