commands Archives

Winsage

July 15, 2026

LabubaRAT malware infiltrates Windows systems while posing as NVIDIA software

LabubaRAT is a newly identified Rust-based remote access tool (RAT) that disguises itself as NVIDIA software to facilitate operations on Windows systems. It establishes a reusable foothold for hands-on activity and can profile the host system, identify security tools, execute commands, transfer files, capture screenshots, and proxy network traffic. LabubaRAT retrieves its configuration at launch via command-line arguments or environment variables, allowing operators to specify parameters like the command-and-control server and API key at runtime. It maintains local state in a SQLite database and supports communication through HTTPS polling, Microsoft Edge WebView2, and DNS tunneling. The malware includes capabilities for command execution, file handling, and establishing persistence through a Windows Run registry key. The entry point for the attack is an executable named nvidia-sysruntime.exe, which masquerades as NVIDIA’s container runtime toolkit. LabubaRAT conducts thorough profiling of the host, checking for installed browsers and security products, and gathers information on the system's specifications. Blackpoint Cyber has shared indicators of compromise to help detect LabubaRAT activity.

Winsage

July 15, 2026

Here’s how to update every app on your Windows PC with a single command

Updating Windows applications is important for accessing the latest features and protecting against vulnerabilities. Many users neglect this due to forgetfulness or the time-consuming nature of the process. The Microsoft Store and Windows Update usually provide updates for native Windows applications, but a unified method for updating all programs is lacking. Windows includes a command called winget (Windows Package Manager) that allows users to update all applications simultaneously via the command line. The command to update all apps is:


winget upgrade --all

This command updates both traditional installers and Microsoft Store apps. Users can also update individual apps by specifying the app ID, for example:


winget upgrade "Chrome"

To view all applications managed by winget, the command is:


winget list

To skip confirmation prompts during updates, users can use:


winget upgrade --all --accept-source-agreements --accept-package-agreements

For complete automation, users can create a task in Task Scheduler to run at startup with the following setup: 1. Open Task Scheduler and create a basic task named "Winget Auto Update." 2. Set the trigger to run when the computer starts. 3. Choose to start a program, entering PLACEHOLDER216a2cf34dab649d in Program/script and PLACEHOLDERbe861b18048fd836 in Add arguments. 4. Set the task to run with the highest privileges and add a 1-minute delay to ensure network connectivity. While winget does not cover every Windows application, it effectively manages most mainstream applications.

AppWizard

July 15, 2026

Magic Pointer app teardown uncovers how this Googlebook tool actually works

Google is set to launch Googlebooks, featuring an AI-powered Magic Pointer cursor that enhances user interaction by allowing users to point at their screens to communicate with Gemini, Google's AI system. The Magic Pointer app will not yet be operational on existing Android devices but will allow users to set the Google app as the default assist app and use a keyboard shortcut (Meta + g) for activation. The app will include gesture control for activation through a cursor wiggle, with sensitivity settings to prevent accidental activations. Magic Pointer will analyze user interactions to categorize intent into four core capabilities: Understand, Transform, Ideate, and Execute. It will generate up to three relevant suggestion chips based on user input, ensuring suggestions are contextually specific and framed from the user's perspective. For example, if a user inputs an image of a long email thread, the suggestions might include "Summarize key decisions," "Draft a reply," and "Suggest next steps." The output will consist solely of these suggestion chips without additional text or formatting.

BetaBeacon

July 13, 2026

The best Nintendo 3DS emulator on Android finally supports multiplayer games

The Azahar release brings changes to the Android app, including the Vulkan graphics renderer being forcefully enabled on devices using ANGLE for OpenGL rendering. This change is important for upcoming Android 17 devices that will switch to Vulkan-based rendering for most apps. Additionally, the update includes a combo button shortcut, improvements for dual-screen devices, tweaks for frame generation software, and GPU-related changes to improve accuracy.

AppWizard

July 12, 2026

I wish someone told me about these 5 Android Auto settings before I bought my new car

A 2003 PT Cruiser was replaced by a 2022 Hyundai Tucson after a transmission failure. The Hyundai Tucson features modern technology, including Android Auto. Key settings in Android Auto can enhance the user experience: 1. Taskbar Widgets: Enable taskbar widgets in the Android Auto settings to display miniature widgets for multitasking. 2. Launcher Customization: Rearrange the app drawer and hide infrequently used apps for a more organized interface. 3. Change Home Screen Layout: Adjust the layout to place the media app closer to the driver for easier access. 4. Play Media by Default: Disable the automatic playback of the last played media upon startup for more control over audio selection. 5. Gemini Actions: Create multi-step commands for tasks like navigation and media playback with a single command to streamline the driving routine.

AppWizard

July 10, 2026

ASUS Republic of Gamers Announces Raikiri II Pro PC Game Controller

ASUS Republic of Gamers has launched the ROG Raikiri II Pro PC gaming controller, featuring an 8K polling rate for high responsiveness. It includes customizable hot-swappable TMR joystick modules with two actuation force options (120gf and 50gf), four removable rear buttons, and two extra claw bumpers that can be remapped. A full-color panel allows for on-the-fly adjustments, and ASUS Gear Link software offers detailed customization, including Turbo mode for rapid auto-repeat. The controller boasts up to 79 hours of battery life on a single charge using 2.4 GHz wireless. It comes with premium accessories, including a protective charging case, charging stand, rear button cover plates, a module removal tool, TMR modules, and detachable joystick caps.

Tech Optimizer

July 10, 2026

Hackers Use Fake VLC Executable and Malicious libvlc.dll to Deploy ValleyRAT

Cybercriminals are exploiting the VLC media player to install ValleyRAT, a remote access trojan, by embedding malware in a seemingly harmless file linked in phishing emails. The attack starts with an email that prompts the victim to download a ZIP archive containing a fake VLC executable and a malicious DLL named libvlc.dll. This method uses DLL sideloading to execute the malware under the guise of a legitimate application. Once executed, the malware establishes persistence by creating a registry entry and connects to a remote server to retrieve the final payload. ValleyRAT employs evasion tactics to avoid detection, including assessing system characteristics before executing harmful actions and using a fileless approach to deliver the payload directly into memory. Researchers have identified indicators of compromise, including specific SHA1 hashes and URLs associated with the malicious campaign.

Tech Optimizer

July 10, 2026

Your Antivirus Has A Blind Spot, And Advanced Persistent Threats (APTs) Know Where It Is

Advanced Persistent Threats (APTs) are a type of cyber threat characterized by long-term infiltration aimed at stealing sensitive data or surveilling communications, often orchestrated by well-funded groups. Unlike traditional malware, which seeks immediate disruption, APTs employ a methodical approach, spending weeks mapping out networks and identifying valuable credentials. Traditional antivirus solutions often fail to detect APTs because they rely on signature-based detection, which is ineffective against custom malware. APTs frequently use legitimate tools already present on systems, making detection challenging, and some forms of APTs operate directly from memory without writing to disk, evading traditional scans. To combat APTs, a multifaceted strategy is recommended, including behavioral detection, network monitoring for unusual patterns, and a mindset of skepticism towards all network activities.

Tech Optimizer

July 10, 2026

GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware

Microsoft Threat Intelligence has identified the GigaWiper malware, which has been detected in compromised environments since October 2025. This malware has destructive capabilities and comes in two forms: standalone wiper binaries and larger binaries with backdoor functionalities, both developed in Golang. The standalone wiper operates at the physical disk level, overwriting disk content and removing partition references. The backdoor variant includes the same wiper functionality and adds persistence through a registry key and scheduled tasks, along with command and control communication via RabbitMQ and Redis. GigaWiper can execute various commands, including wiping drives, triggering a Blue Screen of Death (BSOD), file encryption that mimics ransomware behavior, and managing system elements. The malware integrates components from multiple malware families, including wipers and ransomware mechanisms, and has been linked to a previous malware known as FlockWiper. To defend against GigaWiper, organizations are advised to implement security measures such as tamper protection, blocking access to known C2 infrastructure, and utilizing endpoint detection and response solutions. Microsoft Defender provides detections for GigaWiper and related malware, and threat intelligence reports are available for customers to stay informed about threats. Indicators of compromise include specific SHA-256 hashes and IP addresses associated with GigaWiper.

Winsage

July 10, 2026

Microsoft Warns of GigaWiper Backdoor Built to Destroy Windows PCs

Microsoft has unveiled a destructive Windows backdoor named GigaWiper, which allows operators remote control over compromised systems to execute irreversible damage. GigaWiper originated from cyberattacks in October 2025 and is a composite of code from at least three malware families. It maintains its presence through a scheduled task disguised as “OneDrive Update,” executing at startup and every minute. GigaWiper can obliterate partition information, overwrite physical drives, and restart systems. It also mimics ransomware by encrypting files with the .candy extension, using randomly generated keys that are not stored, making recovery impossible. The malware has connections to the Crucio ransomware and resembles FlockWiper, with rewritten code in Go. GigaWiper features 20 command codes for various functions, including executing PowerShell instructions, managing processes, capturing screenshots, and remote access similar to VNC. It can remain on a system for surveillance until its destructive functions are activated. Microsoft Defender includes detection capabilities for GigaWiper, and users are advised to enable tamper protection and monitor for suspicious activities.