analysis Archives

AppWizard

April 29, 2026

New Android spyware Morpheus linked to Italian surveillance firm

Morpheus is a new spyware identified by the nonprofit organization Osservatorio Nessuno, which spreads through counterfeit Android applications that appear as legitimate updates. Attackers use SMS messages to direct victims to a fraudulent website mimicking an Internet Service Provider (ISP). The spyware installs a dropper app that deploys a concealed payload, which disguises itself as legitimate system components and manipulates users into granting dangerous permissions, including Accessibility access. Once granted, Morpheus initiates a Permission Workflow that creates a fake update overlay, disabling the touchscreen to prevent user interaction. It ensures persistence by restarting after device reboots and can request device administrator privileges. The spyware exploits overlay windows and Accessibility features to gain control of the device and bypass security measures, including disabling antivirus solutions without requiring root access. Analysis suggests Morpheus has Italian origins, with connections to an Italian firm, IPS Intelligence, known for lawful interception technologies. The spyware is capable of invasive actions such as recording audio and video, linking to WhatsApp, and compromising device security. The report highlights a network of dubious companies and shared contacts linked to the spyware's distribution.

Winsage

April 28, 2026

I investigated Windows 11’s massive 5GB monthly .msu updates. AI is only part of the problem.

Windows 11 updates have significantly increased in size, with monthly cumulative updates often exceeding 4GB and some approaching 5GB. One update can expand to nearly 9GB when extracted. Microsoft has shifted to delivering Latest Cumulative Updates (LCUs), which include all previous fixes, leading to larger update sizes over time. The introduction of Checkpoint Cumulative Updates aims to reduce this growth by establishing periodic baselines, but the effectiveness has been mixed. The May 2025 cumulative update saw a size increase from approximately 6.5GB to nearly 9GB, with new MSIX files related to semantic search and on-device AI contributing to this growth. Windows Update uses applicability logic to minimize download sizes for users, but enterprises must download full packages, resulting in increased storage costs. The average yearly storage cost for enterprises rose from about 11 GB in 2024 to 52 GB by 2026. Users can check their actual download sizes through the Windows Update settings and Event Viewer logs.

AppWizard

April 28, 2026

Now, Gemini might get proactive with timely, personalized ‘suggestions’

Google is developing a feature called "Proactive Assistance" for its Gemini app, which aims to provide users with personalized suggestions by utilizing data from connected applications, potentially including Gmail. This feature is linked to another rumored feature called "Your Day," which offers a curated overview of daily highlights. The "Proactive Assistance" feature will prioritize secure data handling and is expected to enhance user engagement by delivering tailored reminders and tasks. There are indications that this feature may have been rebranded to "Daily Brief." Additionally, Gemini has received an upgrade with Nano Banana 2 support, allowing the AI to access content in Photos and create unique images based on user memories.

AppWizard

April 28, 2026

Denuvo dealt major blow as crackers claim all non-VR games with the anti-tamper have been bypassed

Every non-VR game utilizing Denuvo DRM has been successfully compromised due to the emergence of the Hypervisor bypass, a method that deceives Denuvo into believing it is functioning correctly. This technique requires users to disable Driver Signature Enforcement, raising security concerns. The CrackWatch subreddit reports that all non-VR Denuvo games have been cracked or bypassed to some degree, with Capcom's Pragmata being completely bypassed just two days before its official launch. Cracking Denuvo within the first week of a game's release can lead to revenue losses of up to 20% for developers and publishers. Irdeto is actively developing updated security versions to address the Hypervisor bypass, assuring that these measures will not compromise game performance.

Winsage

April 28, 2026

Microsoft starts to remove AI from some of its Windows 11 apps

Microsoft is recalibrating its Copilot AI assistant, which enhances productivity across its applications. In Microsoft Word, Copilot assists with drafting, restructuring, and tone adjustment. Excel users receive help with formulas and data analysis, while PowerPoint users get support for presentations. Notepad has rebranded its Copilot features as "Writing Tools," allowing users to generate text, rewrite content, and adjust tone, but the Snipping Tool has removed all AI functionalities. Microsoft plans to introduce AI agents to the Windows taskbar for answering questions, automating tasks, and interacting with files, although this feature is still in testing.

Tech Optimizer

April 27, 2026

Kafka Has Become the Postgres of Streaming — And That Changes Everything

Recent advancements in data visualization technologies are enhancing how businesses and researchers interpret large datasets. Key trends include the integration of artificial intelligence (AI) into visualization tools, which allows for automatic generation of visual representations and reduces the expertise needed for data analysis. Interactive visualizations are becoming more common, enabling real-time data manipulation and deeper understanding. Augmented reality (AR) and virtual reality (VR) applications are also emerging, providing immersive three-dimensional perspectives of data. These developments are being adopted across various industries, including healthcare and finance, to improve decision-making and operational efficiency.

Winsage

April 27, 2026

Microsoft 365 and Outlook are down to start the work week

Microsoft 365 and Outlook are experiencing significant outages globally, with issues reported starting around 4:50 AM ET. Microsoft has acknowledged the situation and is investigating a rise in error rates linked to two scenarios as a potential cause. They are providing updates through their Microsoft 365 Status account on X and maintaining a status page for real-time information. Users are encouraged to discuss their experiences on Reddit at r/WindowsCentral.

Tech Optimizer

April 26, 2026

CanisterSprawl: pgserve Compromised on npm: Malicious Versions Harvest Credentials and Exfiltrate to a Decentralized ICP Canister

On April 21, 2026, compromised versions of pgserve (1.1.11, 1.1.12, and 1.1.13) were published on npm, containing a 1,143-line credential-harvesting script that executes during the postinstall phase of npm install. The malware functions as a supply-chain worm, reinjecting itself into other packages if it finds an npm publish token. Stolen credentials are encrypted using RSA-4096 and AES-256 and exfiltrated to a decentralized Internet Computer Protocol (ICP) canister. The last legitimate release was v1.1.10, published on April 17, 2026. The malware was detected by StepSecurity AI Package Analyst and Harden Runner, which flagged the compromised versions as Critical / Rejected and confirmed live exfiltration during analysis. The injected script performs operations such as harvesting environment variables, collecting filesystem secrets, encrypting payloads, and propagating to other npm packages and Python packages if a PyPI token is detected. The exfiltration domains have been added to a global block list.

AppWizard

April 25, 2026

GPT-5.5 topped a Minecraft building benchmark and the spatial reasoning implications go far beyond gaming

GPT-5.5 has achieved an xHigh tier result on VoxelBench, placing it at the top of a leaderboard that includes Grok 4.20 Beta, Kimi K2.5 Thinking, and Kimi K2.6. VoxelBench evaluates language models on their ability to construct three-dimensional voxel structures from text prompts, requiring models to translate verbal descriptions into precise 3D objects without images or post-processing. Human evaluators rated GPT-5.5's constructions higher than those of other models tested. Research indicates that producing spatially correct outputs is significantly more challenging than generating executable code, with geometric construction and multi-object composition being the hardest tasks. The MineBench Elo system, calibrated against skilled human Minecraft builders, shows that frontier models are approaching human-level spatial reasoning capabilities, which have implications for fields such as architecture and game development. The VoxelBench leaderboard reflects a competitive landscape where multiple models are achieving similar performance levels, indicating a shift in the AI benchmark landscape. GPT-5.5's results suggest that AI-assisted 3D design workflows may soon be viable, highlighting a transition from capability to integration challenges in the development of AI tools for design applications.

AppWizard

April 25, 2026

Android Hackers Target 800 Banking, Crypto and Social Media Apps With ‘Near-Zero Detection Rates’: Zimperium

Android hackers are targeting over 800 applications in banking, cryptocurrency, and social media sectors, utilizing four active malware families: RecruitRat, SaferRat, Astrinox, and Massiv. These malware employ advanced techniques to evade detection and execute credential theft, unauthorized financial transactions, and data exfiltration. Attackers lure victims through phishing websites, fraudulent job offers, fake software updates, text-message scams, and promotional lures. Once installed, the malware can request Accessibility permissions, obscure app icons, obstruct uninstallation, and steal sensitive information through counterfeit lock screens. They can also capture one-time passcodes, stream device screens, and overlay fake login pages on legitimate applications. The malware uses HTTPS and WebSocket communications to blend malicious traffic with normal activity and may incorporate encryption layers to avoid detection.