cloning Archives

AppWizard

September 10, 2026

Google Play Early Access Abused to Push Thousands of Deceptive Android Apps

Bad actors are exploiting Google Play's Early Access program to distribute misleading applications that promise money, rewards, and casino winnings. This program allows developers to gather user feedback on unreleased apps but lacks public reviews or star ratings, enabling malicious actors to launch numerous fraudulent applications without immediate scrutiny. An example is the app "Vice Streets: Open World," which mimics Grand Theft Auto, has over 1 million downloads, and recently disappeared from the store without reviews or ratings. These deceptive apps are often promoted on social media with misleading advertisements and promise cash rewards, but users face obstacles when trying to withdraw their earnings. The primary goal of these apps is to generate revenue through excessive advertisements while circumventing regulatory requirements for legitimate gambling apps. Additionally, various malware families targeting Android devices have emerged, including Hagaseca, Mantax Otax, StreamRat, and GoldFactory's use of the Gigabud banking trojan, highlighting ongoing security threats in the digital landscape.

AppWizard

September 10, 2026

Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks

The Gigabud banking trojan installs a secondary Android application called Vwork, which creates a work profile on compromised devices to evade detection from banking app security measures. This work profile separates its contents from the personal space of the device, allowing fraudulent transactions without triggering alerts. Group-IB confirmed this operational chain in Indonesia, where Gigabud has been active since 2022 and is linked to the GoldFactory group, which uses deceptive tactics to distribute the trojan. Vwork simplifies the creation of a work profile and communicates with an external server for authorization before cloning apps. The report indicates that Vwork has been detected in various countries, while approximately 1,469 devices and 1,281 logins were compromised in Indonesia, leading to estimated losses of around ,000,000. Users can check for a work profile in their phone's settings and are advised to download apps only from official stores and to deny unnecessary Accessibility access.

AppWizard

September 9, 2026

Hackers Clone Banking Apps into Hidden Profiles, Android Malware Raises New Fraud Concerns

Cybercriminals are using advanced Android malware that mimics banking applications within hidden Work Profiles to bypass traditional fraud detection systems. This method is linked to Gigabud, a Remote Access Trojan active since at least 2022, and Vwork, an application cloning tool based on open-source software. Attackers distribute phishing links via social media and messaging, tricking victims into installing malicious files disguised as legitimate utilities. Once installed, the malware seeks Accessibility permissions and other capabilities to capture screen credentials and control the device. Vwork creates an isolated Work Profile to duplicate banking apps, allowing attackers to conduct fraudulent transactions without triggering security alerts in the personal space. Instances of counterfeit financial applications operating from these isolated environments have been documented, particularly in Indonesia. Between February and July 2026, monitoring revealed around 1,469 compromised devices and 1,281 compromised account credentials in Indonesia, resulting in estimated financial losses of 8.2 crore rupees. The operation is believed to be part of a larger international campaign linked to GoldFactory, with malware targeting users in multiple countries including Brazil, Colombia, Egypt, and others. Security experts warn that unusual Work Profile installations, duplicated banking apps, and unexpected requests for Accessibility permissions indicate a compromised device. Users are advised against sideloading APK files from private messages and should limit sensitive permissions to verified applications. Researchers emphasize the need for financial institutions to adopt behavioral analysis to detect unauthorized transactions effectively.

AppWizard

September 9, 2026

Gigabud Uses Android App Cloning to Evade Fraud Detection

The Gigabud Android banking trojan can clone banking applications into a separate Android work profile, allowing fraudsters to bypass malware alerts during transactions. Research by Group-IB, released on September 9, indicates that Gigabud is used with Vwork, a modified app for cloning, attributed to the GoldFactory group. The infection has been confirmed in Indonesia but targets 11 countries, including Brazil, Colombia, Egypt, Mexico, Thailand, and Turkiye. Vwork uses Android's Work Profile feature to isolate cloned apps, making them less detectable. This allows operators to install malware, clone banking apps, and execute transactions without raising alarms. During fraud, fake login screens capture credentials, and an invisible overlay collects lock screen codes. From February to July 2026, 1,469 devices were compromised in Indonesia, with financial losses nearing 0,939. Gigabud spreads through phishing and social media, requesting permissions to control devices. Group-IB identified six behavioral signals for banks to monitor as indicators of high-risk sessions. Recommendations include device binding and downloading apps only from official stores.

AppWizard

August 20, 2026

More GTA 6 leaks reveal new details: Cloning keys, combat changes, random bird deaths

The leaker "Cyberleek" has released two new gameplay clips of Grand Theft Auto 6, featuring the male protagonist, Jason, and showcasing several gameplay mechanics. One notable feature is the "Clone Key" option for quieter car theft, differing from the traditional "Smash Window" method. The interaction system allows players to greet or taunt NPCs, and there is a quicker looting animation compared to Red Dead Redemption 2, along with a dedicated item wheel for inventory management. A peculiar moment in the clips shows birds falling from the sky, raising questions about environmental realism. Additionally, a healing item called "Zombix" is introduced, which loses effectiveness with repeated use, adding a strategic layer to health management. The official reveal is scheduled for August 27.

Tech Optimizer

July 23, 2026

Simplify AI agent orchestration with Lakebase Postgres

The auditing process has traditionally been labor-intensive, requiring extensive document reviews. CLA (CliftonLarsonAllen LLP) partnered with the Databricks Forward Deployed Engineering team to develop a document processing application that reduces extraction time from hours to minutes while maintaining quality. The application is built on the Databricks platform, utilizing technologies like Lakebase Postgres, Databricks Apps, Lakeflow Jobs, MLflow, and Unity Catalog Volumes. The application addresses challenges in document parsing, including unpredictable per-task latency, rate-limit-aware throttling, workload prioritization, cost attribution per task, and real-time progress visibility. It eliminates the need for multiple specialized systems by integrating components such as a web application for user interaction, Lakebase for state management, an orchestrator for task management, and AI agents for document processing. The task queue is supported by two Postgres tables in Lakebase, tracking task status and execution attempts. Concurrency safety is ensured through a locking mechanism, and crash recovery is facilitated by lease-based locking. The orchestrator implements rate-limit-aware throttling and idempotent webhook callbacks to manage task processing effectively. An operator dashboard provides real-time metrics on task status, agent performance, and workload costs, with live updates through Postgres LISTEN/NOTIFY events. Cost attribution is managed at the application level, allowing for detailed monitoring of expenditures. Lakebase enhances the orchestration process with features like autoscaling compute, OAuth-rotated authentication, Unity Catalog integration, and support for branching and snapshots.

AppWizard

July 21, 2026

Google Play Store update ensures you don’t forget about widgets from that shiny new app

Google has updated its Play Services to version 26.28, allowing users to display their device's IMEI number on the lock screen, which can aid in device recovery but may pose security risks. This feature is server-side and may not be available on all devices immediately. Other enhancements include audio permission requests in WebViews, Android Credential Manager support for Android TV, and various quality-of-life improvements. The Play Store has been updated to version 52.4, introducing natural language queries for search, expanded search suggestions, limited mobile data usage for app restoration in India, Nigeria, and Indonesia, and the option to add app widgets during installation. Users can update their Google System Services through their device settings.

Winsage

July 15, 2026

Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution

Cursor, a development tool, has a security vulnerability that allows arbitrary code execution by simply opening a project repository on Windows. This flaw, reported by AI security firm Mindgard, is due to the presence of a file named git.exe in the project root, which Cursor executes automatically without user prompts. Mindgard demonstrated this vulnerability by renaming Windows Calculator to git.exe and placing it in the project root, leading to multiple instances of Calculator launching upon opening the repository. Cursor has not yet released a patch or advisory for this issue, which was first reported on December 15, 2025, and remains in the latest version, 3.11, released on July 10, 2026. Users are advised to implement workarounds, such as using AppLocker or Windows App Control to block executables by name and path. Other vendors, including GitHub and Google, have encountered similar vulnerabilities, but none have released fixes. The issue highlights the risks associated with untrusted search paths in software development.

AppWizard

July 7, 2026

Minecraft Preview 26.40.30

Players can find abandoned camps in the Pale Garden and Flower Forest biomes, which include a one-time use Straw Bed crafted from three hay bales. Cushions, available in 16 colors and crafted from three wool slabs, allow players to sit comfortably but are not currently spawning in abandoned camps. Various gameplay and graphical improvements have been made, including fixes for crafting recipes, ambient sounds, and rendering issues. Additionally, there are updates to the user interface, technical features, and stability enhancements, such as improved server self-repair capabilities and bug fixes related to commands and entity behavior.

Tech Optimizer

July 2, 2026

From monolith to Lakebase to LTAP: rethinking the database from storage up

Sixteen years ago, the author began their PhD at UC Berkeley and was advised to focus on analytics rather than OLTP databases, which were considered solved. This led to the creation of Apache Spark and Databricks. However, during the development of Databricks, it was found that OLTP databases were not solved problems; they were difficult to scale and fragile. This realization led to the development of Lakebase, a serverless Postgres database designed with modern technology. Lakebase architecture separates the write-ahead log (WAL) and data files into independent, scalable services. The WAL is externalized to a service called SafeKeeper, which uses Paxos-based replication for durability, while data files are managed by PageServer, which stores them in cloud object storage. This design addresses challenges such as data loss, scaling, and performance interference between transactional and analytical workloads. Lakebase maintains compatibility with Postgres, offers unlimited storage, serverless compute, durable writes, and simpler high availability. It also introduces LTAP (Lake Transactional/Analytical Processing), which allows both transactional and analytical processing to operate on a single data copy in real time, eliminating the need for separate data copies and reducing costs. LTAP utilizes a unified storage layer that allows data to be materialized in both row and columnar formats, optimizing it for both transactional and analytical workloads. The system ensures that analytics can access the most current data without affecting transactional performance by using a log sequence number (LSN) to retrieve the latest changes. Unlike traditional CDC approaches, LTAP requires no explicit table replication, as all data is stored in a single governed copy. This architecture circumvents common issues faced by hybrid transactional/analytical processing (HTAP) systems, such as incomplete feature sets, lack of ecosystem support, and performance contention. The Lakebase architecture has unlocked capabilities like unlimited storage, elastic compute, durable writes, and instant branching, with ongoing developments anticipated in the future.