code Archives

Tech Optimizer

September 23, 2026

BigDiskBuster PoC Blocks Windows Defender Updates

A new tool named BigDiskBuster has been released on GitHub, which disrupts Microsoft Defender Antivirus by preventing it from installing updates. It does this by consuming available disk space during the update process, causing Defender to remain on its current version and unable to receive new platform or signature updates. BigDiskBuster operates as a local denial-of-service technique and requires prior access to the target machine to execute. The tool was created by researcher Abdelhamid Naceri, known as Nightmare Eclipse, who has previously worked on similar projects. As of now, there is no CVE identifier, patch, or advisory from Microsoft regarding this issue.

Winsage

September 23, 2026

Cisco Talos Discloses Autonomous Windows Malware: Four AI Models Direct Each Attack

Cisco Talos has disclosed a new Windows implant called CLOSEDQUORUM, which operates without human operators by using four commercial large language models (LLMs) to autonomously decide on actions after deployment. The implant is a 16.4-megabyte executable that conducts reconnaissance on the target system and sends structured prompts to the LLMs, which respond with one of four actions: steal, inject, persist, or move. When the "steal" action is chosen, it simultaneously attacks three credential stores, extracting Windows credentials, browser passwords, and cryptocurrency wallet data. The "inject" action uses either Early Bird APC injection or process hollowing based on model recommendations. For persistence, it employs three overlapping mechanisms, including a Registry Run key, a scheduled task, and a WMI event subscription. To evade detection, CLOSEDQUORUM suppresses ETW telemetry and introduces delays before executing actions. It circumvents traditional command-and-control structures by calling legitimate API endpoints, making blocking these domains impractical. Talos introduced the CAIRN toolkit for detecting AI-integrated malware, which operates on metadata and employs rule-based detection. Unlike previous AI-assisted malware, CLOSEDQUORUM automates decision-making processes entirely, highlighting a significant evolution in malware capabilities. Security teams are advised to focus on behavioral detection strategies and utilize the YARA rule and CAIRN toolkit for identifying this threat.

Winsage

September 23, 2026

Cisco Talos Discloses Autonomous Windows Malware: Four AI Models Direct Each Attack

Cisco Talos has disclosed a Windows implant called CLOSEDQUORUM, which automates cyberattack execution using four advanced commercial large language models: DeepSeek, Qwen, Mistral, and Google Gemini. The implant is a 16.4-megabyte executable that conducts reconnaissance on the system and formats the gathered data into prompts for the AI models. Each model votes on one of four actions: steal, inject, persist, or move, with the action receiving the most votes being executed. When stealing, CLOSEDQUORUM targets three credential stores, dumping LSASS memory and retrieving saved passwords from browsers and cryptocurrency wallets. The stolen data is encrypted and sent to the operator via Discord. For injection, it uses Early Bird APC injection or process hollowing based on model responses. The persist action creates three mechanisms for longevity, including a Registry Run key, a scheduled task, and a WMI event subscription. CLOSEDQUORUM evades detection by suppressing ETW telemetry and delaying activity to avoid sandbox analyses. It connects to legitimate API endpoints, making blocking ineffective without disrupting enterprise applications. Talos recommends behavioral combination detection strategies and the use of a YARA rule for detection. The CAIRN toolkit has been introduced to detect AI-integrated malware without executing binaries. Unlike previous AI-assisted malware, CLOSEDQUORUM removes human decision-making from the attack process.

AppWizard

September 23, 2026

Expert Opinions and Insights from the Tech Industry

The Android development community has historically addressed memory optimization reactively, but new performance requirements from Google Play, effective February 2027, emphasize proactive memory management. These requirements include metrics for dynamic memory usage, bitmap memory, and DEX code optimization, with apps needing at least 25% optimization coverage. Memory usage can now hinder releases even without local crash replication, necessitating its integration into the pre-production process alongside other performance metrics. Dynamic memory usage is defined as anonymous RSS plus swap, excluding file-backed data. Google Play will evaluate this across different application states and device performance categories. Bitmap memory is scrutinized for the retention of invisible bitmaps, and DEX optimization aims to reduce memory footprint and improve performance. Investigating memory growth involves using Android Studio’s Memory Profiler to monitor memory changes during specific user flows and conducting heap dumps to identify retained objects. Issues often arise from retained state, where components hold onto callbacks that reference image data, necessitating a focus on lifecycle management rather than merely cache size. Bitmap memory should be carefully managed, as the decoded size can significantly exceed the compressed file size. Downsampling images to match UI dimensions is crucial. Memory checks should occur before production, with a focus on establishing a memory budget based on actual measurements and defining representative memory scenarios for testing. A pre-release memory checklist includes running user flows repeatedly, testing on various devices, inspecting heap dumps, examining image configurations, and reviewing optimization metrics. Monitoring Android vitals and Play Console warnings is essential to detect potential issues before they lead to user-reported crashes.

AppWizard

September 23, 2026

Spotify could soon fix a major storage issue that users have complained about for years

Spotify is developing a "Cache Limit" feature for Android users that will allow them to manage the local storage used by temporary files. This feature aims to give users control over the app's caching behavior, which currently operates automatically and can accumulate several gigabytes of data over time. Users can manually clear the cache but may find it tedious. The new feature will enable users to set a cap on storage for temporary files, with notifications about the implications of their choices, such as increased data usage or potential effects on playback quality. The feature will not affect downloaded music or podcasts and is expected to first appear in the beta version of the app before being rolled out to all users.

AppWizard

September 23, 2026

RatHat Android Malware Uses AI to Target Banking Credentials in Real Time

A newly identified strain of Android malware, RatHat, utilizes generative AI to manipulate infected devices in real time. It is linked to threat actors believed to be operating out of China. RatHat serializes the device’s live Accessibility tree into XML format and communicates with a generative AI assistant to return screen coordinates, identify text, and issue navigation commands. The malware employs WebView-based HTML overlays to capture login credentials from banking and cryptocurrency applications and can infiltrate payment apps like WeChat and Alipay to extract PINs. It also features an SMS receiver and notification listener to intercept OTPs and 2FA codes. RatHat is disseminated through smishing, malvertising campaigns, and misleading third-party forums. It employs anti-analysis techniques such as container tampering, manifest bombing, DEX bytecode poisoning, string encryption, and anti-debugging. Once installed, it gains Accessibility access, activates Developer Options, and enables Wireless Debugging, allowing it to connect to the device's local ADB service and launch control agents with shell-level privileges. The malware captures raw touch coordinates to reconstruct PINs and unlock patterns, bypassing screenshot protections. It also includes persistence mechanisms that prevent uninstallation by presenting a fake Google Play failure overlay and automatically reinstalling itself if removed.

Winsage

September 22, 2026

Windows 11’s audio bugs won’t be fixed until October

Users of Windows PCs with AMD Radeon GPUs, including models such as RX 6600, RX 7700 XT, RX 7800 XT, RX 7900 GRE, RX 7900 XTX, and RX 9070 XT, may experience persistent issues until October 13th, 2026. These issues include error messages in Device Manager (Code 10), absence of audio output, unresponsive volume controls, inaccessible sound settings, and failures in multi-channel or 3D audio features. Additional problems reported are driver timeouts, black screens, missing displays, and system crashes. Issues with File Explorer and File History have emerged after September's Patch Tuesday updates, affecting the creation and accessibility of backups. Some problems have been resolved through an emergency update, including fixes for Claude Cowork and Remote Desktop Services, and a misleading Defender warning.

AppWizard

September 22, 2026

We got Googlebook’s text editor app to run on Android, and it looks great

Googlebooks have officially started pre-orders ahead of their launch on October 4. The new laptop range includes a feature called Continue On, which facilitates seamless transitions between a Googlebook and a smartphone. An early preview of the Text app, a dedicated text editor available on the Google Play Store, shows it supports various programming languages and offers syntax highlighting. The app adapts well to different screen sizes, features a tab-based layout for managing multiple projects, and includes conventional tools like find and replace. While other text editor options will be available, the native Text app is specifically designed for Googlebooks. There are currently no plans to extend this app to other Android devices.

BetaBeacon

September 22, 2026

Valve Unveils Lepton for Running Android Games on Linux

Valve has open-sourced Lepton, a project designed to enable Android games to run on Linux through Steam, specifically for the upcoming Steam Frame hardware. Lepton runs Android games inside containers, with each application having its own container. It can utilize components from the host OS, supports integration with development and debugging tools, and incorporates patches from various projects. Lepton is not a desktop Android solution for Linux users but focuses on running games within Valve's Steam ecosystem. The source code for Lepton is available on Valve's SteamOS GitLab instance.

BetaBeacon

September 22, 2026

After it revolutionized PC gaming on Linux, Valve’s new Lepton project may do the same for Android games

Valve has released the Lepton project on GitLab, which aims to bring Android games to Linux devices, with a focus on VR Android games for the Steam Frame.