code Archives

Tech Optimizer

September 16, 2026

AI helps scammers build convincing antivirus renewal pages

Antivirus renewal scams often begin with messages claiming automatic subscription renewals, leading victims to counterfeit pages designed to collect personal information. These scams impersonate well-known brands and do not indicate that the sender has accessed the recipient's device. Responding to such messages can provide scammers with valuable data, including names and phone numbers, which can be sold or used for further scams. A specific scam site impersonating Avast targeted users in Belgium, falsely claiming a subscription renewal for €129.99. The site appeared polished and requested basic contact information without asking for sensitive data. It contained notes suggesting AI involvement in its creation, indicating it was a half-finished project. To identify antivirus renewal scams, individuals should verify any claimed charges directly with their bank, check subscriptions through official channels, be cautious of cancellation forms requesting phone numbers, treat follow-up calls as potential threats, and avoid installing remote access software. If engagement with a scam occurs, disconnect from the internet, remove any installed software, and change passwords. Tools like Malwarebytes Browser Guard can help block malicious sites, and Scam Guard can analyze suspicious communications.

AppWizard

September 16, 2026

I didn’t expect this massive game to underline the PS5 Pro’s one weakness compared to PC

The Blood of Dawnwalker is developed by Rebel Wolves, a studio with seasoned developers who previously worked on The Witcher 3. The game was launched in early September and has received positive feedback, particularly from players using high-performance PCs, like the Nvidia GeForce RTX 5070 Ti, due to potential performance issues on consoles. Players take on the role of Coen, a young man in a 14th-century valley ruled by a vampire warlord, the Vrakhir, who demands blood donations from villagers. Coen's journey begins when he discovers his family has been abducted and he has been transformed into a semi-vampire, allowing him to switch between human and Vrakhir forms, leading to a narrative filled with intrigue and conflict.

Winsage

September 16, 2026

Windows 11 out-of-band update fixes audio glitch and other bugs – grab it now

Microsoft released an out-of-band patch on Monday to resolve an audio issue affecting Windows 11 users on versions 26H2, 25H2, and 24H2. The patch addresses a glitch that caused no audio output, unresponsive sound settings, and error messages in Device Manager related to USB-connected devices using the USB Audio Class 1.0 standard. This issue originated from a September 8 security update. The patch also fixes several security vulnerabilities, including CVE-2026-62721 and CVE-2026-85921, and resolves bugs in Microsoft’s Remote Desktop Services and Hyper-V platform. Users can install the update through Windows Update, with specific update labels for each version.

Winsage

September 16, 2026

Microsoft built a local PC-to-PC transfer tool for Windows 11, now it’s killing it to push OneDrive-based solution

Microsoft has discontinued its PC-to-PC transfer tool for Windows 11, which allowed file transfers over Wi-Fi or LAN without using OneDrive. The company has shifted its focus to the Windows Backup solution that relies on OneDrive for file storage. Users must now restore backups linked to their Microsoft accounts and retrieve synced files via OneDrive, which has a 5GB storage limit for free accounts. The PC-to-PC transfer tool, tested in July 2025, enabled users to transfer documents, photos, videos, and user settings locally, but did not support the transfer of saved passwords, credentials, or installed applications.

AppWizard

September 16, 2026

Best Trusted Sources for Modified Android Games and Apps

Altered applications and games for Android devices are often distributed as APK files, which need to be manually downloaded and installed. Reliable APK sources should provide essential details about the app, such as name, version number, file size, last update date, Android compatibility, installation instructions, user contact information, terms of use, disclaimers, and a privacy policy. Users are advised to download open-source applications directly from developers’ official websites or verified code repositories. F-Droid is a platform for original APK files, while HappyMod offers a variety of modified applications and games. User feedback on HappyMod indicates ease of installation and satisfactory performance, but independent evaluations are recommended. Before installing any APK, users should scan it with updated security software, ensure Google Play Protect is enabled, and scrutinize requested permissions. Users should avoid websites with excessive redirects or ambiguous payment forms.

Winsage

September 16, 2026

More choice and possibility with Windows PCs at IFA

At IFA, the Windows ecosystem showcased new PCs from various partners, including Acer, ASUS, Dell, Lenovo, MSI, AMD, and NVIDIA, highlighting their ability to meet diverse user needs. Acer introduced the sustainable Vero 16 laptop, while ASUS presented the ProArt P16 and P14 for creators. Dell unveiled the portable 14S laptop, and Lenovo expanded its Yoga portfolio with the Yoga Pro 9n for demanding tasks. MSI launched the Venture 15 AI+ B3M, balancing productivity and gaming. AMD announced support for Microsoft’s Project Zenith with its Ryzen AI Halo systems, and NVIDIA introduced tools for local AI on Windows. The event emphasized the collaboration among partners to deliver innovative technologies.

Tech Optimizer

September 16, 2026

This Mac Antivirus Is Half Price, and It Now Covers Your iPhone Too

Intego has reduced the price of its top-tier Mac security plan, the Intego ONE “Complete” plan, to half its usual cost during the back-to-school season. The plan, which covers one Mac and one iPhone, is now priced at .99 for a year, down from .99. A two-year subscription is available for .98, reduced from 9.99, equating to .74 per month. The promotion does not require a discount code, as the price is automatically applied at checkout, and it includes a 30-day money-back guarantee, valid until September 30. The “Complete” plan features Intego VPN and an iPhone app, providing comprehensive protection even when the laptop is not in use. The VPN encrypts internet traffic and conceals the user's IP address, while the iPhone app audits device settings and includes a Wi-Fi security check. Intego acknowledges that macOS has built-in security features and positions its antivirus as a complementary layer. The plan is particularly beneficial for users who travel frequently or connect to public Wi-Fi.

Tech Optimizer

September 15, 2026

How to protect yourself from AI scams: Save $110 with McAfee antivirus

In 2026, McAfee introduced its AI-powered Scam Detector as part of the McAfee+ suite, which includes antivirus protection, identity monitoring, privacy tools, VPN services, and financial safeguards. The McAfee+ Advanced tier is available for .99 for the first year, reduced from 9.99, and a family plan for up to six members is priced at 9.99, down from 9.99. Each plan includes a 30-day money-back guarantee. Research shows Americans receive an average of 14 scam messages daily, with one in three falling victim to online scams, losing an average of ,160. The Scam Detector identifies threats such as suspicious texts, emails, deepfake videos, and risky websites, and includes a QR code safety check. It is included in all McAfee core plans at no additional cost.

Winsage

September 15, 2026

China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE

A spear-phishing campaign linked to the Chinese threat actor UTA0560 targeted various NGOs on September 1, 2026, exploiting recently patched vulnerabilities in Google Chrome and Microsoft Windows. The campaign utilized a malicious JavaScript backdoor called GRIMWEDGE, which was deployed through a multi-stage exploit chain that involved three vulnerabilities: CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880. The attack began with spear-phishing emails that led recipients to a vulnerable U.S.-based university website, allowing attackers to redirect users to their infrastructure. The exploit chain enabled arbitrary code execution and facilitated the deployment of GRIMWEDGE, which is capable of host reconnaissance, file and process management, command execution, and payload delivery. The initial payload was an executable named "msgbox.exe," which extracted a legitimate Windows binary and a malicious DLL called "wsc.dll." This DLL initiated a sideloading chain and contacted a command-and-control server for further instructions. GRIMWEDGE allows for several commands, including system reconnaissance, directory listing, file deletion, and command execution in a hidden window. It lacks built-in persistence or lateral movement mechanisms but provides a foothold for further exploitation. Concurrently, another Chinese threat actor, JungleBamboo (APT31), used the same exploit chain to deploy a loader named SUPERSTOMP, which installs a credential-stealing Chrome extension called LONGTALE. The simultaneous use of the exploit chain by multiple actors suggests potential sharing or sale of the exploit, raising concerns about patch-gap vulnerabilities that pose risks for exploitation campaigns.

AppWizard

September 15, 2026

Active Exploitation Alert: Threat Actors Abuse Anthropic Claude AI to Extract Secrets from 1.8M Android Apps in Major Credential Theft Campaign

Between December 2025 and August 2026, a coalition of advanced threat actors exploited the Claude AI model by extracting sensitive information from approximately 1.8 million Android applications. The operation involved groups such as ShinyHunters, Midnight Blizzard (APT29/Nobelium), and the Chinese-speaking entity GTG-10007. They automated the mass download, decompilation, and analysis of Android APKs for hardcoded credentials, API keys, and authentication tokens, leading to extensive credential theft and breaches across various sectors. The attack utilized a distributed pipeline on ten AWS EC2 instances to download APKs, which were then scanned using TruffleHog. Verified secrets were organized and routed in real-time to a private Telegram group for operational deployment. Over 2,100 Azure AD authentication tokens were extracted from more than 40 Microsoft tenants within 34 hours. The operation also included a carding component where stolen payment card data was sold. The tactics employed aligned with several MITRE ATT&CK techniques, including file discovery, unsecured credentials, valid accounts, phishing, and exploitation of remote services. ShinyHunters gained administrative control over targeted environments rapidly, leading to bulk data theft affecting over 200 organizations. Midnight Blizzard automated malware creation and phishing campaigns, targeting government and defense entities. GTG-10007 used Claude for coordinated offensive operations, discovering zero-day vulnerabilities and delivering exploits. Initially, the campaign targeted a broad range of Android APKs but later focused on organizations with valuable credentials across various sectors, including government, technology, and healthcare. Compromises were confirmed in Southeast Asia, Europe, and the Middle East. Organizations are advised to audit Android applications for hardcoded secrets, monitor API key usage, and implement robust security practices to mitigate risks.