APIs Archives

AppWizard

July 24, 2026

How to Use WorldEdit in Minecraft Java and Bedrock

WorldEdit is a tool for Minecraft that has different requirements for Java Edition and Bedrock Edition. Users must select the correct version for their Minecraft edition. For Java Edition, WorldEdit can be downloaded from EngineHub or Modrinth, while Bedrock Edition requires a separate add-on. To install WorldEdit on Java Edition, users need to download the appropriate .jar file and place it in the server's plugins or mods folder, depending on the platform. Command access must be granted based on world or server settings, and users can select blocks for editing using various commands. Basic edits can be made using commands like //set, //replace, and //undo. For Bedrock Edition, users must download the add-on package, enable experimental features, and use semicolon commands for editing. The add-on also includes item shortcuts and management commands for access. The main differences between Java and Bedrock versions include the installation process, permissions, and command prefixes.

AppWizard

July 23, 2026

Active Exploitation Alert: Fake Bahrain Alert App Deploys Advanced Android Surveillance Malware Targeting Gulf Region Users

A cyber-espionage campaign has been identified involving a counterfeit Bahrain Alert Android application designed to surveil individuals in Bahrain and the Gulf region. The app masquerades as an official civil defense tool and employs social engineering tactics to compromise Android devices, extract sensitive data, and maintain remote access. It targets high-value individuals such as activists and journalists, particularly during civil unrest and missile alerts, leveraging trusted government branding to increase infection rates. The malware features a complex, multi-stage architecture with advanced evasion techniques and is distributed through phishing links and malicious websites. It initiates a four-stage infection process, ultimately installing a remote access trojan (RAT) that enables covert surveillance and encrypted communications. The malware can monitor device activity, capture credentials, and intercept communications, while also employing mechanisms to avoid detection and maintain persistence. The campaign primarily targets Bahraini citizens, exploiting fear during crises to encourage app installation. Although there are indications of Russian-speaking developers involved, there is no definitive attribution to a specific nation-state or APT group. Mitigation strategies include monitoring for suspicious app installations, user education on verifying app authenticity, and blocking known malicious domains.

Winsage

July 14, 2026

Microsoft tests Copilot’s new PC insights feature in Windows 11

Microsoft is piloting a feature called “PC insights” in its Windows 11 Copilot app, allowing users to inquire about their computer's hardware specifications such as RAM, storage, GPU performance, processor usage, antivirus status, and battery health. The feature collects system data using Windows APIs with user consent, which can be granted as one-time or permanent access. Currently in the experimental phase, it is being rolled out in the United States and provides insights based on the device's current state. Microsoft has cautioned that the app may not always provide complete or accurate information and has reported that it consumes nearly 1GB of RAM while idle. “PC insights” serves as a troubleshooting tool to help identify performance issues without resolving them directly. Future updates may enhance its capabilities to suggest adjustments or implement configuration changes.

AppWizard

July 14, 2026

It’s Monday, and Steam is currently struggling just like the rest of us

On July 13 at 11:30 PT, Steam experienced intermittent downtime and various errors affecting the store, community hub, and game APIs. Users reported that the store and community pages had a "Very Slow" status, and Deadlock's multiplayer API showed an Internal Server Error. The Steam API displayed erratic behavior, with users encountering "Bad Gateway" errors. By the end of the day, all systems were reported to be functioning normally.

Winsage

July 14, 2026

Confused about your PC specs or hardware? Windows 11’s Copilot app is getting new powers to help you ‘understand your device’

Windows 11's Copilot app is testing a new feature called 'PC insights,' which allows users to ask questions about their device's hardware and receive direct answers. Users can inquire about specifications like RAM, storage, GPU details, processor usage, antivirus status, and battery health. The feature connects to Windows APIs and requires user permission to access system details, which can be granted temporarily or permanently. Microsoft assures that the feature is opt-in and does not allow the app to read file contents, only their sizes. Currently, 'PC insights' provides diagnostic suggestions but does not resolve issues directly, with potential future developments for proactive troubleshooting.

AppWizard

July 9, 2026

A Spotify Teardown Just Showed Us How Apps Will Actually Work on Android XR Glasses.

An APK teardown of Spotify version 9.1.66.1259 revealed plans for a Gemini experience designed for Android XR smart glasses. Users can link their Google account to access Gemini for voice-controlled playback, contextual music discovery, and real-time playlist management through prompts. The glasses can analyze the environment via a camera to suggest music based on surroundings. The architecture allows the app to run on a smartphone while the glasses act as a display and sensor, making development easier for developers by enabling them to extend existing Android apps for the glasses. This model supports the creation of lightweight AI glasses. Spotify's early preparation for Android XR glasses signals positive ecosystem development and developer engagement ahead of hardware releases. However, the use of cameras for contextual music selection raises privacy concerns. The findings are based on an unreleased build and may change before official confirmation.

Winsage

June 25, 2026

Introduction to COM usage by Windows threats

Component Object Model (COM) is a technology in Windows that enables object activation, inter-process communication, and automation across different programming languages. Malware exploits COM interfaces for activities such as lateral movement, execution, downloading, exfiltration, persistence, evasion, system discovery, and automation of Windows and Office functionalities. Reverse engineering COM-heavy binaries involves navigating GUIDs and indirect vtable calls to understand malware mechanics. Research at the AVAR 2025 conference and CARO 2026 workshop discusses methodologies for analyzing COM binaries and case studies of malware families that utilize COM. COM is an application binary interface (ABI) model that allows software components to be reused and enables interaction between different programming languages through interfaces defined at the binary level. Distributed COM (DCOM) allows clients to activate COM objects on remote systems. COM classes are identified by unique class identifiers (CLSIDs), and interfaces by interface identifiers (IIDs). The Windows registry stores COM registration data, with classes and interfaces located under specific keys. Malware often acts as a COM client, utilizing the COM runtime to instantiate classes and request interfaces. ProgIDs provide human-readable registry entries for COM classes. The CoCreateInstance function helps create class objects by resolving CLSID registrations. All COM interfaces derive from IUnknown, which manages object lifetimes and interface querying. COM has its own security model, and identifying classes and interfaces used by malware is crucial for threat researchers. Tools like ComView and OleView.NET assist in inspecting COM registrations. The analysis workflow includes identifying activation API calls, extracting CLSID and IID values, consulting registry definitions, and mapping vtable calls. Qakbot, a banking trojan, exemplifies the use of COM in malware, with its architecture enabling malicious activities like credential theft. Dynamic analysis tools can log COM-related calls in real-time to trace execution flow. Notable malware families that utilize COM include Gh0stRAT, which uses Task Scheduler COM interfaces, and the Attor platform, which employs BITS for file transfers. WarmCookie demonstrates the use of COM for persistence through Task Scheduler. Understanding COM's role in malware is essential for cybersecurity professionals.

Winsage

June 24, 2026

Windows RAT Uses Encrypted HTTP C2 and Registry Persistence After npm Infection

A malware campaign targets Windows systems through a malicious npm package named postcss-minify-selector-parser, which mimics the legitimate postcss-selector-parser. This counterfeit package installs a Remote Access Trojan (RAT) on developer machines, beginning with a multi-stage attack triggered by the installation of the package. The RAT can steal credentials, execute shell commands, and communicate with a remote attacker. Security researchers at JFrog identified this threat and reported it on June 22, 2026, noting that two additional related packages, postcss-minify-selector and aes-decode-runner-pro, are linked to the same publisher and remain live on the npm registry. The RAT employs encrypted HTTP communication with a command-and-control (C2) server and ensures persistence by creating a registry key under the Windows Run key. It has capabilities for remote shell execution, file uploads and downloads, and can steal saved login data from Google Chrome using Windows decryption APIs. The malware is designed for organized batch exfiltration of stolen data. Indicators of compromise include specific IP addresses, domains, file paths, and SHA-256 hashes associated with the malware components. JFrog advises users to remove the malicious packages, inspect their dependency trees, and treat any stored credentials as compromised.

AppWizard

June 22, 2026

Google Sets Sept. 30 Deadline for Android Developer Verification in Four Countries

Google will implement Android developer verification on September 30, 2026, in Brazil, Indonesia, Singapore, and Thailand. Certified Android devices will block installations of apps from unverified developers, affecting both Google Play and major device-maker app stores. Starting June 2026, the Android Developer Verifier will ensure apps are associated with verified developers before installation. Unregistered apps will not install via standard methods post-September 30 but can be sideloaded through a complex process. Developer registration began in March, requiring legal identification and app ownership verification. Google aims to combat malware with this initiative, which has faced backlash from open-source advocates like F-Droid and the Keep Android Open campaign. The global rollout is set for 2027, with ongoing concerns about appeals processes and the impact on pseudonymous developers.

AppWizard

June 19, 2026

Google sets timeline for Android developer verification enforcement

Android's developer verification initiative will officially roll out on September 30, 2026, initially targeting users in Brazil, Indonesia, Singapore, and Thailand. Developers in these regions must complete the verification process by the deadline. Participating app stores, including Google Play and others, will begin verifying app installations, with a global implementation planned for 2027. The initiative aims to enhance security by linking apps to verified identities. Google is introducing new APIs to facilitate app registration, including the Android Developer ID Status API and the Android Developer Console API, which will support OAuth delegation for third-party platforms. A new system service will be installed on most Android devices to verify developer registrations later this year. The Android Developer ID Status API is set for global launch in July 2026, with early access to the Android Developer Console API. Limited distribution accounts for students and hobbyists will launch globally in August 2026. Starting September 30, 2026, only apps registered by verified developers will be allowed for installation and updates on certified Android devices, although unregistered apps can still be sideloaded. Google has reported that over 99% of Play developers have completed the verification process, and developers can check their verification status in the Play Console.