commands

Winsage
April 6, 2026
A newly discovered Windows malware called ResokerRAT uses Telegram’s Bot API for its command-and-control operations, allowing it to monitor and manipulate infected systems without a conventional server. It obscures its communications by integrating with legitimate Telegram traffic, complicating detection. Upon execution, it creates a mutex to ensure only one instance runs and checks for debuggers to avoid analysis. It attempts to relaunch with elevated privileges and logs failures to its operator. ResokerRAT terminates known monitoring tools and installs a global keyboard hook to obstruct defensive key combinations. It operates through text-based commands sent via Telegram, allowing it to check processes, take screenshots, and modify system settings to evade detection. Persistence is achieved by adding itself to startup and altering UAC settings. The malware retrieves additional payloads from specified URLs and uses URL-encoded data for communication. Researchers have confirmed its Telegram traffic, and its behavior aligns with various MITRE ATT&CK techniques. Security teams are advised to monitor for unusual Telegram traffic and scrutinize registry keys related to startup and UAC.
AppWizard
April 4, 2026
Using ADB via the command line can be cumbersome, prompting the desire to create a tailored application focused on the APK installation workflow, including wireless debugging pairing, file browsing, and bundle unpacking. A recent poll indicated that 48% of respondents use ADB fairly often, while 35% have used it once or twice. The author, a moderately skilled programmer, explored AI-assisted "vibe coding" to develop an app in Go, chosen for its simplicity and cross-platform capabilities. The project began with outlining its structure and creating a basic ADB wrapper in Go, which evolved into a functional terminal application within three days of part-time effort. The app, a compact 7MB executable, manages ADB sessions, allows pairing with Android devices over USB or Wi-Fi, includes a file explorer, and supports installing and unpacking various app bundles. Despite its usefulness, the author noted a limited understanding of Go due to reliance on AI for problem-solving. The app's source code is available on the Tiny APK Installer GitHub repository.
AppWizard
April 3, 2026
Researchers at McAfee Labs discovered that 50 Android applications on the Google Play Store contain malware known as NoVoice, which can grant full remote access to infected smartphones. These apps have over 2.3 million downloads. The malware can communicate with remote servers, profile devices, and download tailored root exploits, potentially compromising specific hardware and software configurations. However, devices with an Android security patch level of May 2021 or later are not vulnerable to these exploits, as the vulnerabilities were patched by Android between 2016 and 2021. Google Play Protect removes these apps and blocks new installs, and users are advised to keep their devices updated with the latest security patches.
Search