NewApp Digest
search bot

CAPTCHA

What Happens When You Make Signal Your Main Messaging App?
AppWizard
February 18, 2026

What Happens When You Make Signal Your Main Messaging App?

Signal is an open-source, encrypted messaging app known for its commitment to privacy, favored by developers, journalists, and security experts. The app prioritizes user privacy by default, encrypting all messages, calls, group chats, and files, and limiting metadata collection through features like sealed sender, disappearing messages, and view-once media. Users may face challenges such as difficulty in registering (e.g., requiring a VPN for access) and a sparse contact list, which can lead to feelings of isolation. Signal operates as a nonprofit, prioritizing user privacy over monetization and advertising. The app is designed for those who need stringent encryption, though some users may find services like WhatsApp sufficient for their needs. The experience of using Signal can create barriers to engagement and connection, despite its privacy benefits.
silver Android smartphone
Winsage
December 4, 2025

This Windows Update Pop-Up Is a Scam

Hackers have exploited Windows update screens to deliver malware disguised as a "critical security update," a tactic known as the ClickFix attack. This attack uses social engineering techniques, including fake error messages and CAPTCHA forms, to trick users into executing harmful commands. The scam appears as a pop-up mimicking the standard Windows blue screen but originates from a malicious domain. Users are prompted to paste and execute harmful commands, leading to malware installation. Researchers from Huntress have detailed this attack, noting that malicious code can be embedded within PNG images. Although recent law enforcement actions have reduced the presence of malware payloads on these domains, the threat remains. Users should be cautious of any update screens that do not show a progress indicator or require manual command input, as these are signs of a ClickFix attack. Microsoft releases security updates on the second Tuesday of each month, and users are advised to enable automatic updates and consider disabling the Windows Run box for added security.
silver Android smartphone
TrendTechie
November 26, 2025

Официальный сайт Xubuntu был взломан — вместо торрента распространялся вредоносный файл для Windows

Recent advancements in user verification technology have introduced innovative methods to confirm user identity, enhancing security and user experience. One notable implementation is a visually engaging captcha system that combines graphical elements and interactive features, prompting users to confirm their humanity through simple actions. This system may include captivating SVG graphics requiring user interaction, such as checking a box, accompanied by messages like "Please verify you are a human." Additionally, developers are exploring machine learning algorithms to analyze user behavior patterns for better differentiation between human users and bots, reducing false positives and improving security without hindering legitimate users.
JackFix Uses Fake Windows Update Pop-Ups on Adult Sites to Deliver Multiple Stealers
Winsage
November 25, 2025

JackFix Uses Fake Windows Update Pop-Ups on Adult Sites to Deliver Multiple Stealers

Cybersecurity experts have identified a new campaign that combines ClickFix tactics with counterfeit adult websites to trick users into executing harmful commands under the guise of a "critical" Windows security update. This campaign uses fake adult sites, including clones of popular platforms, as phishing mechanisms, increasing psychological pressure on victims. ClickFix-style attacks have risen significantly, accounting for 47% of all attacks, according to Microsoft data. The campaign features convincing fake Windows update screens that take over the user's screen and instruct them to execute commands that initiate malware infections. The attack begins when users are redirected to a fake adult site, where they encounter an "urgent security update." The counterfeit Windows Update screen is created using HTML and JavaScript, and it attempts to prevent users from escaping the alert. The initial command executed is an MSHTA payload that retrieves a PowerShell script from a remote server, which is designed to deliver multiple payloads, including various types of malware. The downloaded PowerShell script employs obfuscation techniques and seeks to elevate privileges, potentially allowing attackers to deploy remote access trojans (RATs) that connect to command-and-control servers. The campaign has been linked to other malware execution chains that also utilize ClickFix lures. Security researchers recommend enhancing defenses through employee training and disabling the Windows Run box to mitigate risks associated with these attacks.
ClickFix Attack Uses Steganography to Hide Malicious Code in Fake Windows Security Update Screen
Winsage
November 25, 2025

ClickFix Attack Uses Steganography to Hide Malicious Code in Fake Windows Security Update Screen

A new wave of ClickFix attacks has emerged, using fake Windows Update screens and PNG image steganography to deploy infostealing malware like LummaC2 and Rhadamanthys. The attacks trick users into executing a command by pressing Win+R and pasting a command copied to their clipboard. Attackers have shifted from using “Human Verification” lures to more convincing full-screen fake Windows Update screens. The fake update prompts users to run a command that initiates mshta.exe with a URL containing a hex-encoded IP address, leading to the download of obfuscated PowerShell and .NET loaders. A notable feature of the campaign is the use of a .NET steganographic loader that hides shellcode within the pixel data of a PNG image, which is decrypted and reconstructed in memory. The shellcode is Donut-packed and injected into processes like explorer.exe using standard Windows APIs. Huntress has been monitoring these ClickFix clusters since early October, noting the use of the IP address 141.98.80[.]175 and various paths for the initial mshta.exe stage, with subsequent PowerShell stages hosted on domains linked to the same infrastructure. Despite the disruption of Rhadamanthys’ infrastructure in mid-November, active domains continue to serve the ClickFix lure, although the Rhadamanthys payload appears to be unavailable. To mitigate the attack, disabling the Windows Run box through Group Policy or registry settings is recommended, along with monitoring for suspicious activity involving explorer.exe. User education is critical, emphasizing that legitimate processes will not require pasting commands into the Run prompt. Analysts can check the RunMRU registry key to investigate potential ClickFix abuse.
Search