AI

AppWizard
September 18, 2026
Cybersecurity experts have identified a new Android malware named RatHat, believed to be operated by Chinese threat actors. RatHat is distributed primarily through smishing and malvertising campaigns, leading users to deceptive download portals. It employs an automated multi-stage infection process and exploits Accessibility features along with a local ADB self-pairing mechanism to escape the Android application sandbox. The malware uses various anti-analysis techniques, including container tampering, manifest bombs, DEX bytecode poisoning, and dual string-encryption. RatHat's architecture consists of a malicious Android application, a Go agent, and an FRP reverse-proxy client, which together enable it to gain critical system permissions and perform various malicious activities such as credential capturing, screen recording, and SMS interception. Even if uninstalled, the malware retains shell access to the device, allowing attackers to reinstall it. RatHat can serialize the device's Accessibility tree to XML and communicate with a Generative AI assistant for tasks like screen coordinate determination and text extraction. The Go Agent, masquerading as a native library, exploits shell access to execute commands and establish a persistent connection to a command-and-control server via the FRP client. The C2 server can issue extensive commands to collect sensitive information, including SMS messages, credentials, files, and keystrokes, and RatHat also features a hardware-level keylogger.
AppWizard
September 18, 2026
Gemini has launched on Android Auto, but user feedback has been largely negative. Google is working on improvements, including a new destination card in Google Maps that will utilize Gemini's AI to provide information about destinations, such as reviews, essential details, practical tips, and visuals. The user interface is still being optimized, and there is no guarantee that the feature will be finalized for public release. Users have reported issues with Gemini, including problems with making calls and sending texts, distractions from excessive chatter, and app crashes. The latest updates were noted in Android Auto version 17.8, which is still in development.
AppWizard
September 18, 2026
Google has released version 2.0 of Android Bench, which focuses on managing complex development tasks rather than minor adjustments. The new version evaluates tasks that may take engineers days or weeks to complete, such as adding features and building applications. A continuous scoring method has replaced the previous pass or fail system, assessing completion rates based on functionality, visual fidelity, and adherence to instructions. Various AI models have been tested, with GPT-6 Astra achieving a 28% pass rate, significantly lower than the previous scores around 90%. No model has achieved a 100% pass rate in porting cross-platform applications, with the best reaching 80%. AI performs better in writing new code than in refactoring existing code, facing challenges with architectural complexity and runtime validation. Android Bench utilized agents from model providers for evaluations and plans to incorporate various model combinations in future updates.
AppWizard
September 18, 2026
Google has launched Android Bench 2.0, a benchmark for evaluating large language models (LLMs) and AI agents on complex Android development tasks. This version focuses on long-horizon tasks (LHTs) that are more intricate than those assessed by the original benchmark. Key tasks include upgrading dependencies, adding major new features, and building Android apps from scratch. The new grading system uses continuous scoring instead of a binary pass-or-fail method, providing a more detailed performance evaluation. Currently, GPT-6 Astra leads the leaderboard with a 28% pass rate, followed by Gemini 3.8 Flash at 8%. Other evaluated models include Claude Fable 5.1, GPT-5.6 Sol, and Claude Opus 5. Google plans to expand the leaderboard with more models and results.
Winsage
September 17, 2026
Mark Russinovich, the Chief Technology Officer of Microsoft Azure, transitioned ZoomIt, a Windows tool for screen zooming, recording, and annotation, to macOS using artificial intelligence. Originally developed to aid in teaching Windows Internals, ZoomIt has been enhanced over the years with features like screen recording and webcam overlays. Despite initial reluctance due to time constraints, Russinovich utilized AI to create a functional macOS version in just two days, significantly faster than anticipated. The AI model leveraged the original Windows code, allowing for a high-fidelity clone of ZoomIt that includes essential features. ZoomIt for macOS is now available as a free and open-source tool, requiring macOS 14 Sonoma or newer, and can be installed via Homebrew or from Microsoft’s GitHub repository. Users can access its functionalities through keyboard shortcuts and a menu bar icon.
Winsage
September 17, 2026
Microsoft will hold a Windows event on October 7 in San Francisco, marking its first major dedicated Windows gathering in over two years. The event will feature CEO Satya Nadella, Windows and Surface chief Pavan Davuluri, and NVIDIA CEO Jensen Huang, focusing on the impact of local AI on personal computing. A highlight will be the Surface Laptop Ultra, designed to compete with the MacBook Pro, featuring a custom NVIDIA RTX Spark SoC, an NVIDIA Blackwell GPU, up to 128GB of RAM, and the ability to run complex AI models on-device. Microsoft has also introduced a Workload Profile Scheduling system for efficient task distribution across CPU cores and optimized its Prism emulation layer for legacy x86 applications on ARM systems. The event is not expected to announce Windows 12, as Microsoft will focus on enhancing Windows 11. Major hardware partners like Dell, Lenovo, and ASUS are also involved in the RTX Spark ecosystem.
AppWizard
September 17, 2026
Security researchers at Zimperium have identified a new strain of Android malware called RatHat, which is linked to threat actors from China and is designed to steal sensitive credentials and banking information. RatHat infiltrates devices through phishing sites, malvertising, and SMS phishing (smishing), tricking users into downloading malicious Android package kits (APKs). The malware uses a dropper to activate its payload, which is hidden in encrypted assets, and employs techniques to bypass Android's security measures. RatHat consists of three main components: a malicious Android application, a Go agent (liblocal-service.so), and an FRP client (libmedia_codec.so). The app collects sensitive information such as banking credentials, notifications, 2FA codes, OTP keys, and screen inputs. It features a generative AI user interface-automation engine that communicates in Mandarin and can perform various tasks like determining screen coordinates and issuing navigation commands. The Go agent acts as a command-and-control executor, executing commands to bypass app-level security and manage system-level tasks. The FRP client maintains a secure reverse tunnel to the attacker's server, allowing ongoing remote access to the device. The architecture of RatHat demonstrates the inadequacy of traditional mobile security measures against such advanced threats.
Winsage
September 17, 2026
Windows 11 was released in 2021 and received mixed reactions, with users noting the removal of several familiar features from Windows 10. The taskbar was locked in place, preventing repositioning, and the ability to drag files onto taskbar applications was initially absent but restored within a year. The Start menu lost flexible resizing options, and Microsoft faced challenges in transferring established features due to the new framework. By 2026, Microsoft announced changes allowing users to relocate the taskbar, responding to user demand. The Start menu remained less flexible than its predecessor, leading to user frustration. Microsoft acknowledged the need for a movable taskbar, which was implemented in a preview by May 2026, coinciding with the September 2026 Patch Tuesday update. The integration of AI into development processes has accelerated feature implementation, but also introduced new stability issues.
Tech Optimizer
September 16, 2026
Iranian state-affiliated cyber actors are targeting dissidents, activists, and journalists using fake AI applications, counterfeit antivirus tools, and fabricated MRI scan results, primarily through a spyware family known as CHOSEN BRICK, which is designed for Windows systems. This campaign has been active since at least 2025 and affects individuals globally, including in the UK, US, and Netherlands. The malware establishes persistence via the Windows Registry Run key and communicates through Telegram, utilizing unique Bot IDs for each victim. CHOSEN BRICK is capable of extensive data collection, including capturing screenshots, recording audio, and stealing email content. Personal information from victims has been found on pro-Iranian leak sites, increasing harassment risks. Security measures should include monitoring for suspicious Registry entries and unusual communications, while users are advised to avoid unsolicited software installations and keep their systems updated. The FBI refers to this malware family as HEAVYGRAM.
Search