attack Archives

AppWizard

September 21, 2026

RuneScape: Dragonwilds (PC) Review

RuneScape: Dragonwilds introduces players to the new continent of Ashenfall, where they face the Dragon Queen Kuldra amidst a significant dragon threat. The game features a new biome called the Scorned Wilderness and a raid-style dungeon, requiring 40 to 60 hours of gameplay to complete its story content. It includes a sophisticated crafting system that allows for extensive customization of the game world. The combat system has been modernized, incorporating various weapon types and a nuanced parrying system, while the magic system offers unique runes that alter spell effects. Players experience skill progression through the use of tools or weapons, but the early game lacks healing potions, making it challenging. The game encourages exploration with a robust crafting system and in-game mounts, as well as the ability to create travel routes using loadstone teleporter panels. It also features dungeons with platforming elements and diverse enemy encounters. RuneScape: Dragonwilds supports full crossplay for consoles and has a roadmap for future updates.

Tech Optimizer

September 21, 2026

Thousands of hacked sites trick you into installing malware

More than 5,400 websites across over 2,200 organizations have been compromised to propagate malware, primarily affecting small businesses like clinics and online retailers. The attack mechanism involves malicious code that triggers a deceptive CAPTCHA, instructing users to execute commands that can download malware. Attackers are using the BNB Smart Chain test network to store instructions, making it harder for investigators to shut down operations. A newer variant of the attack uses WebRTC technology to establish encrypted connections for delivering additional malicious code. To protect against these threats, users should avoid pasting commands from websites, be suspicious of unusual CAPTCHA instructions, use strong antivirus protection, keep systems updated, take action if commands are executed, and small business owners should regularly verify their website's integrity.

AppWizard

September 19, 2026

New Android malware uses AI to take over your phone

A new Android malware called RatHat has emerged, analyzed by researchers from Zimperium's zLabs. It spreads through deceptive smishing texts and malicious ads that lead users to counterfeit download pages for popular apps. Once installed, it manipulates Android's Accessibility Service to gain elevated access by enabling Wireless Debugging and retrieving authentication codes without user intervention. RatHat targets finance and banking apps to steal user IDs, passwords, and MFA codes, using techniques to obtain touch coordinates for PIN recovery. It can intercept SMS messages, gain limited control of the device, and reinstall itself. Users are advised against sideloading apps and granting unnecessary accessibility permissions. Google's Advanced Protection Mode and Malwarebytes for Android can help mitigate risks associated with RatHat.

AppWizard

September 18, 2026

RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall

Cybersecurity experts have identified a new Android malware named RatHat, believed to be operated by Chinese threat actors. RatHat is distributed primarily through smishing and malvertising campaigns, leading users to deceptive download portals. It employs an automated multi-stage infection process and exploits Accessibility features along with a local ADB self-pairing mechanism to escape the Android application sandbox. The malware uses various anti-analysis techniques, including container tampering, manifest bombs, DEX bytecode poisoning, and dual string-encryption. RatHat's architecture consists of a malicious Android application, a Go agent, and an FRP reverse-proxy client, which together enable it to gain critical system permissions and perform various malicious activities such as credential capturing, screen recording, and SMS interception. Even if uninstalled, the malware retains shell access to the device, allowing attackers to reinstall it. RatHat can serialize the device's Accessibility tree to XML and communicate with a Generative AI assistant for tasks like screen coordinate determination and text extraction. The Go Agent, masquerading as a native library, exploits shell access to execute commands and establish a persistent connection to a command-and-control server via the FRP client. The C2 server can issue extensive commands to collect sensitive information, including SMS messages, credentials, files, and keystrokes, and RatHat also features a hardware-level keylogger.

BetaBeacon

September 17, 2026

Hit Roguelike Dome Keeper is Being Ported to iOS and Android – Pre-registration is Open

- Mobile version of Dome Keeper, a popular mining survival game, is in the works - Pre-registration is open on Google Play and pre-orders are available on the App Store for 899 rubles - Dome Keeper involves balancing resource extraction and defense against alien attacks - Players can enhance the dome, upgrade mining equipment, and increase movement speed with materials found - Procedurally generated maps offer a unique experience with each new run - Dome Keeper was originally released on Steam in 2022 and has sold over a million copies by October 2024

Winsage

September 16, 2026

Harden Windows Defender: 12 Steps, 99.9% [2026]

Windows 11 includes Microsoft Defender Antivirus, which operates in the background and receives automatic updates. Its default settings focus on compatibility rather than maximum security, prompting the need for configuration to enhance protection. Prerequisites for configuration include: - Windows 11 version 24H2 or 25H2 - Fully patched build number (26100.9457 or newer) - Local administrator account for certain steps - Microsoft Defender Antivirus version 4.18.x - Windows PowerShell 5.1 run as Administrator - Stable internet connection - No active third-party antivirus software Steps to enhance Microsoft Defender include: 1. Confirming the current Windows 11 build. 2. Verifying that Defender is the active antivirus using PowerShell. 3. Enabling cloud-delivered protection and automatic sample submission via PowerShell commands. 4. Activating Tamper Protection through Windows Security. 5. Enabling Controlled Folder Access to protect against ransomware. 6. Deploying Attack Surface Reduction rules in audit mode. 7. Turning on Smart App Control. 8. Enabling Core Isolation and Memory Integrity. 9. Scheduling weekly full and offline scans. 10. Creating narrow exclusions for known safe applications. 11. Enhancing network protection and SmartScreen features. 12. Running a PowerShell verification script to audit settings. These steps aim to optimize Microsoft Defender Antivirus for improved security comparable to premium solutions.

AppWizard

September 15, 2026

Unofficial PC Version of Super Smash Bros. Melee Released

An unofficial PC port of the Nintendo GameCube game Super Smash Bros. Melee has been released. The game, originally launched in 2001, features a unique damage system, various attack types, and diverse stages. It includes several game modes such as Classic Mode, Adventure Mode, and Event Matches, with unlockable characters and content. The PC version supports keyboard and gamepad inputs, allows for resolution adjustments and visual customizations, but lacks online play and widescreen support. Users need to provide their own ROM to play. This release is part of a trend of unofficial PC ports of classic games, including titles like Super Mario 64 and The Legend of Zelda: Ocarina of Time.

Winsage

September 15, 2026

China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE

A spear-phishing campaign linked to the Chinese threat actor UTA0560 targeted various NGOs on September 1, 2026, exploiting recently patched vulnerabilities in Google Chrome and Microsoft Windows. The campaign utilized a malicious JavaScript backdoor called GRIMWEDGE, which was deployed through a multi-stage exploit chain that involved three vulnerabilities: CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880. The attack began with spear-phishing emails that led recipients to a vulnerable U.S.-based university website, allowing attackers to redirect users to their infrastructure. The exploit chain enabled arbitrary code execution and facilitated the deployment of GRIMWEDGE, which is capable of host reconnaissance, file and process management, command execution, and payload delivery. The initial payload was an executable named "msgbox.exe," which extracted a legitimate Windows binary and a malicious DLL called "wsc.dll." This DLL initiated a sideloading chain and contacted a command-and-control server for further instructions. GRIMWEDGE allows for several commands, including system reconnaissance, directory listing, file deletion, and command execution in a hidden window. It lacks built-in persistence or lateral movement mechanisms but provides a foothold for further exploitation. Concurrently, another Chinese threat actor, JungleBamboo (APT31), used the same exploit chain to deploy a loader named SUPERSTOMP, which installs a credential-stealing Chrome extension called LONGTALE. The simultaneous use of the exploit chain by multiple actors suggests potential sharing or sale of the exploit, raising concerns about patch-gap vulnerabilities that pose risks for exploitation campaigns.

AppWizard

September 15, 2026

Active Exploitation Alert: Threat Actors Abuse Anthropic Claude AI to Extract Secrets from 1.8M Android Apps in Major Credential Theft Campaign

Between December 2025 and August 2026, a coalition of advanced threat actors exploited the Claude AI model by extracting sensitive information from approximately 1.8 million Android applications. The operation involved groups such as ShinyHunters, Midnight Blizzard (APT29/Nobelium), and the Chinese-speaking entity GTG-10007. They automated the mass download, decompilation, and analysis of Android APKs for hardcoded credentials, API keys, and authentication tokens, leading to extensive credential theft and breaches across various sectors. The attack utilized a distributed pipeline on ten AWS EC2 instances to download APKs, which were then scanned using TruffleHog. Verified secrets were organized and routed in real-time to a private Telegram group for operational deployment. Over 2,100 Azure AD authentication tokens were extracted from more than 40 Microsoft tenants within 34 hours. The operation also included a carding component where stolen payment card data was sold. The tactics employed aligned with several MITRE ATT&CK techniques, including file discovery, unsecured credentials, valid accounts, phishing, and exploitation of remote services. ShinyHunters gained administrative control over targeted environments rapidly, leading to bulk data theft affecting over 200 organizations. Midnight Blizzard automated malware creation and phishing campaigns, targeting government and defense entities. GTG-10007 used Claude for coordinated offensive operations, discovering zero-day vulnerabilities and delivering exploits. Initially, the campaign targeted a broad range of Android APKs but later focused on organizations with valuable credentials across various sectors, including government, technology, and healthcare. Compromises were confirmed in Southeast Asia, Europe, and the Middle East. Organizations are advised to audit Android applications for hardcoded secrets, monitor API key usage, and implement robust security practices to mitigate risks.

AppWizard

September 12, 2026

New Android Ransomware Records Screens, Steals OTPs and Secretly Takes Photos of Victims

A newly identified malware threat in the Android ecosystem, named Mantax Otax, combines ransomware with espionage capabilities. It targets users who install applications from untrustworthy sources, often through messaging apps or phishing attempts. The malware is linked to Indonesian cybercriminals and can steal sensitive information such as SMS one-time passwords, chat histories, and lock-screen PINs, facilitating account takeovers. Mantax Otax requests device-administrator rights and seeks access to SMS messages, contacts, and media files. It encrypts files on devices running Android 9 and earlier using AES encryption and demands a ransom for recovery. Although the impact is reduced on Android 10 and later due to Scoped Storage, the malware still poses significant surveillance risks. The malware collects extensive sensitive data, including contacts, call logs, and location data, and targets multi-factor authentication codes. It uses a deceptive system-lock overlay to capture PINs and has introduced features like WebSocket communications and disruptive pop-ups in its second iteration. Users are advised to be cautious when installing applications, avoid unsolicited APKs, and reject permissions that do not align with an app's purpose. In case of suspicious activity, users should disconnect from networks and seek help before entering sensitive information. Organizations should monitor for signs of this malware on managed devices.