archive Archives

Winsage

September 19, 2025

Think You Need A New PC For Windows 11? Think Again

Windows 11 has no legacy 32-bit support, but a 2005 Sun Workstation with an AMD Opteron processor can run it using a modified version called "Tiny11," which removes unnecessary components and the hardware compatibility checker. The specific version used by Sean from Action Retro is archived on Archive.org. Newer Windows 11 builds include the POPCNT operation, which the workstation's processor does not support. Additionally, Haiku is an alternative operating system that is ready for daily use.

Tech Optimizer

September 15, 2025

HiddenGh0st, Winos and kkRAT Exploit SEO, GitHub Pages in Chinese Malware Attacks

Chinese-speaking users are experiencing a sophisticated SEO poisoning campaign that uses counterfeit software sites to spread malware. Researchers from Fortinet FortiGuard Labs discovered this activity in August 2025, which involves manipulating search rankings to redirect users to fraudulent sites that deliver malware through trojanized installers. The malware families identified include HiddenGh0st and Winos, both variants of the Gh0st RAT, linked to a cybercrime group known as Silver Fox. The attack mechanism involves a script named nice.js that orchestrates the malware delivery process, leading to the installation of a malicious DLL, "EnumW.dll," which performs anti-analysis checks and extracts another DLL, "vstdlib.dll." This second DLL inflates memory usage to evade detection and is responsible for launching the main payload. The malware aims to sideload a DLL, "AIDE.dll," which establishes a Command-and-Control (C2) communication, collects victim data, and monitors user activity. Additionally, a separate campaign targeting Chinese-speaking users has been flagged by Zscaler ThreatLabz, featuring a new malware called kkRAT. This malware shares code similarities with Gh0st RAT and employs fake installer pages to deliver multiple trojans. It uses techniques to bypass security software and targets specific antivirus programs, including 360 Total Security and Kingsoft Internet Security. The installer launches shellcode that retrieves additional malicious payloads, including kkRAT, which can perform various data-gathering tasks and manipulate clipboard data to replace cryptocurrency addresses.

Tech Optimizer

September 9, 2025

The Russian trace in the history of the PostgreSQL logo

The PostgreSQL logo, known as "Slonik," was proposed in 1997 by David Yang, who suggested an elephant as the mascot due to its association with reliability and memory. The logo's design evolved over time, with significant contributions from Dmitry Samersov and designer Ekaterina Papchinskaya in 1999, who created a mockup featuring an elephant in a diamond shape. This design was later refined by Daniel Lundin, resulting in the recognizable blue elephant emblem. The name "Slonik" became embedded in the PostgreSQL community, particularly after its association with the Slony-I replication system. In 2004, the community defended the logo against a similar design by PHP, ultimately retaining it. In March 2025, Dmitry transferred the rights to the Slonik design to the PostgreSQL community under a Creative Commons license, solidifying its status as a copyrighted design.

Winsage

September 8, 2025

Is OneDrive sending all your Windows files to the cloud? Here’s why – and what you can do

When setting up a new Windows PC or completing a feature update, user data files may be relocated to the cloud, particularly when signing in with a Microsoft account on Windows 10 or 11. This creates a OneDrive folder that can lead to confusion regarding file backup, as it differs from traditional backup methods. Users with Microsoft 365 subscriptions receive 1 TB or 100 GB of OneDrive storage, while free accounts only have 5 GB. Adjusting File Explorer settings can result in cluttered views and potential duplication of folders. Users can manage OneDrive folder backup by turning it off completely or using it selectively to stay within storage limits. Microsoft's documentation on OneDrive is noted to be insufficient.

Winsage

September 8, 2025

MostereRAT Targets Windows Users With Stealth Tactics

A recent investigation by cybersecurity experts revealed a sophisticated phishing campaign utilizing a new strain of malware called MostereRAT, which targets Microsoft Windows systems. This Remote Access Trojan (RAT) allows attackers extensive control over compromised devices and employs advanced evasion techniques, including being crafted in the Easy Programming Language (EPL). MostereRAT can disable security tools, obstruct antivirus traffic, and establish secure communications with its command-and-control server through mutual TLS (mTLS). The attack begins with phishing emails aimed at Japanese users, leading to the download of a Word document that contains a concealed archive. This prompts the user to execute an embedded executable, activating the malware, which installs itself in the system directory and creates services with SYSTEM-level privileges. It also displays a deceptive message in Simplified Chinese to further spread the malware. MostereRAT can disable Windows Update, terminate antivirus processes, and impersonate the TrustedInstaller account to escalate privileges. Its functionalities include keylogging, system information collection, downloading and executing payloads, creating hidden administrator accounts, and running remote access tools like AnyDesk and TightVNC. Some components of MostereRAT's infrastructure were previously linked to a banking trojan reported in 2020.

AppWizard

September 3, 2025

Top 15 Best Android Apps

As of September 2025, the Android ecosystem offers a variety of applications aimed at enhancing productivity, customization, entertainment, and more. Key apps include: Productivity Tools: - Photo to Calendar: Converts photos/screenshots of schedules into calendar entries automatically. - Compose PDF: Merges PDFs and images offline without watermarks or internet dependency. - Forstop Helper: Manages device performance by force-stopping apps with a single tap. Customization and Utility Apps: - Installer X Revive: Advanced APK installer with features like auto-permissions and batch installations. - Material Capsule: Turns camera cutouts into functional widgets for notifications and controls. - Tap Tap Lock: Locks the phone with a tap gesture using an invisible widget. - Nothing Glyphify: Enhances glyph light functionality for Nothing Phone users with customizable notification patterns. - Icon Theming Hack: Aligns home screen icons with Material You themes using third-party icon packs. Photo and Media Management: - Photo Swooper: Organizes photos in the gallery using swipe-based actions. - Convert It: Converts audio files across multiple formats. Entertainment and Lifestyle: - Awake: An interactive alarm clock requiring puzzle-solving to turn off. - Score Peak: Displays live sports scores on the always-on display. - Widgetify for Spotify: Customizes Spotify widgets for easy access to playlists and albums. Creative Tools: - Draw Anywhere: Allows annotation or drawing over any app or content on the screen. Smart Home Integration: - Edge Smart Things: Integrates smart home controls into the Samsung edge panel for easy access.

Winsage

September 2, 2025

Threat Actors Exploit Windows Search in AnyDesk ClickFix Attack to Spread MetaStealer

Cybercriminals have developed a sophisticated variant of the ClickFix scam, utilizing human-verification social engineering and the Windows search protocol to deploy MetaStealer, an infostealer that steals credentials and sensitive data. The attack begins when a target searches for the legitimate AnyDesk tool and is redirected to a phishing page featuring a deceptive human-verification prompt. This page uses a search-ms URI scheme to connect to an attacker-controlled SMB share, presenting a malicious Windows shortcut disguised as a PDF. Executing this shortcut downloads the legitimate AnyDesk installer and retrieves a malicious "PDF" from an external server. The MSI package contains a dropper (ls26.exe) that operates similarly to known MetaStealer samples, scanning for browser credentials and exfiltrating data. The attack circumvents user suspicion by mimicking a legitimate application installation. Organizations are advised to implement strict application whitelisting, monitor Windows protocol handlers, educate users about suspicious prompts, and deploy detection rules to mitigate these threats.

Tech Optimizer

August 30, 2025

New PS1Bot Malware Campaign Uses Malvertising to Deploy Multi-Stage In-Memory Attacks

Cybersecurity experts have identified a new malware framework called PS1Bot, which features a modular architecture allowing it to perform various malicious actions, including information theft, keylogging, reconnaissance, and establishing persistent access. PS1Bot employs stealth techniques, such as in-memory execution, to minimize its digital footprint and complicate forensic investigations. Active since early 2025, it uses malvertising as a primary infection vector, delivering a compressed archive containing a JavaScript payload that downloads and executes a PowerShell script. This script connects to a command-and-control server to retrieve additional commands and can perform actions like antivirus detection, screen capture, data extraction from cryptocurrency wallets, and maintaining persistence on the infected system. The information stealer module is particularly concerning due to its ability to locate sensitive files related to cryptocurrency. PS1Bot shares technical similarities with AHK Bot and is linked to previous ransomware campaigns using Skitnet. In response to these threats, Google has implemented advanced AI systems to combat invalid traffic, achieving a 40% reduction in deceptive ad practices.

AppWizard

August 26, 2025

77 Malicious Android Apps With 19M Installs Targeted 831 Banks Worldwide

Zscaler’s ThreatLabz team identified 77 malicious applications on the Google Play Store with over 19 million installations, which target financial institutions and compromise user data. A new variant of the Anatsa banking trojan, also known as TeaBot, now targets over 831 banks globally, up from 650, and has expanded its reach to countries like Germany and South Korea. Many of these apps disguise themselves as document readers, with some exceeding 50,000 downloads. The malware downloads the Anatsa payload after installation and uses Android’s Accessibility Services to automate malicious activities, including stealing financial information and facilitating fraudulent transactions. The malware employs techniques to evade detection, such as obfuscating its code and using corrupted ZIP archives. The most prevalent Android malware identified was Joker, found in nearly 25% of the analyzed applications, known for stealing contacts and device data. A smaller subset of apps contained “maskware,” which engages in credential theft and personal data collection.

Winsage

August 24, 2025

LibreOffice 25.8 Drops Windows 7-8.1 Support, Adds Speed and AES-256 Encryption

LibreOffice 25.8 has been released by The Document Foundation, ending support for Windows 7, 8, and 8.1, meaning users on these operating systems will no longer receive updates or security patches. The new version requires a minimum of Windows 10 and includes performance enhancements, such as faster document loading and improved interoperability with Microsoft formats. Security upgrades include AES-256 encryption and PDF 2.0 export capabilities. The decision to discontinue support for older Windows versions reflects a broader industry trend towards modernization and innovation. Future versions will also require macOS 11 or later. Users on outdated systems are encouraged to evaluate alternatives or stick with earlier versions.