commands Archives

Winsage

August 27, 2026

Windows malware numbers look awful next to macOS. I’m still not worried

Windows holds a 71 percent share of the desktop market, with over 1.6 billion active Windows PCs globally. In contrast, macOS accounts for just over seven percent of the market, rising to nearly 20 percent when combined with OS X. Windows users face a variety of threats, including trojans and riskware, and in 2025, Windows users encountered seven times more malware than macOS users. Surfshark's data indicates that macOS users are increasingly targeted by phishing attacks, which pose significant financial and personal risks.

AppWizard

August 26, 2026

Multilogin releases open-source agent so AI can run social accounts on real Android cloud phones

Multilogin has launched an open-source AI agent for social media management on authentic Android devices in the cloud. This tool enables automation of workflows on platforms like TikTok, Instagram, Facebook, and X. The AI agent connects to a Multilogin Android cloud phone, allowing it to view screens, execute taps, type commands, and save results. It integrates with multiple AI agents capable of running shell commands and interpreting visual inputs. Each cloud phone functions as an independent Android device with unique parameters and persistent app data, connected via ADB. The tool monitors the cloud phone's readiness, activates ADB, interprets screenshots, and executes tasks while logging activities. It is designed for marketers, agencies, creators, and teams, providing setup instructions and compatibility with AI tools like ChatGPT/Codex and Claude Code. The project is available on GitHub, and Multilogin offers a free plan with paid options starting at [openai_gpt model="gpt-4o-mini" prompt="Summarize the content and extract only the fact described in the text bellow. The summary shall NOT include a title, introduction and conclusion. Text: Multilogin has unveiled an innovative open-source AI agent designed to empower social media management on authentic Android devices hosted in the cloud. This groundbreaking tool bridges the gap between AI capabilities and mobile app functionalities, allowing users to automate workflows across popular platforms such as TikTok, Instagram, Facebook, and X. How the Tool Functions The newly developed AI agent connects seamlessly to a Multilogin Android cloud phone, providing it with the ability to view screens, execute taps, type commands, and complete various tasks while saving the results. This integration works harmoniously with multiple AI agents, including Claude Code, Cursor, and OpenClaw, all of which can run shell commands and interpret visual inputs from screenshots. As many social media operations increasingly shift to mobile applications, the limitations of browser-based tools become apparent. While browser profiles serve their purpose for web-based tasks, they fall short when it comes to executing native Android applications. Multilogin's cloud phones offer a distinct advantage by providing an authentic Android environment, facilitating direct interaction with mobile apps. Each cloud phone operates as an independent Android device in the cloud, complete with unique device parameters, installed applications, and persistent app data. The AI agent connects to the cloud phone via ADB (Android Debug Bridge), a standard interface used by developers for device management. Operational Efficiency and Flexibility The process begins with the selection of an Android cloud phone, which the tool monitors until it is fully operational. Once ready, the AI agent activates ADB, allowing it to interpret screenshots, determine subsequent actions, and execute tasks such as tapping or typing. Upon completion of a task or in the event of an error, the tool halts the cloud phone and logs the activity, ensuring that resources are not wasted during the development and testing of AI-assisted mobile workflows. This project is compatible with any AI agent capable of executing shell commands and processing visual inputs, making it versatile for various applications. Gleb K., the UI team lead at Multilogin, emphasizes the importance of this development: “AI agents are becoming useful for real operational work, but many important workflows still happen inside mobile apps. We built this open-source project to give everyone a simple and controlled way to connect AI agents to Android cloud phones.” Target Audience and Accessibility The cloud phone agent is tailored for marketers, agencies, creators, and teams seeking an AI assistant to streamline routine tasks within Android applications. Users need not start from scratch; the project provides clear setup instructions and is compatible with widely-used AI tools such as ChatGPT/Codex, Claude Code, OpenClaw, and Cursor. Once connected, the AI agent can efficiently manage tasks on the cloud phone, with the Multilogin Support team readily available for assistance. As with any automation tool, users are encouraged to adhere to the guidelines set by the applications they utilize. The Multilogin cloud phone agent is accessible on GitHub: GitHub Repository. For further information about Android cloud phones from Multilogin, visit Multilogin's Website. The Need for Android Cloud Phones in Social Media Workflows As marketing teams increasingly adopt AI-driven workflows, the necessity for reliable and scalable environments becomes paramount. Real Android devices provide AI agents with the authentic conditions that mimic human usage, allowing accounts to behave naturally and accumulate history over time—an aspect that emulators and browser profiles simply cannot replicate. About Multilogin Multilogin is a comprehensive platform offering cloud phones and browser profiles tailored for marketers, agencies, creators, and AI workflow builders. It enables teams to manage distinct browser and mobile workflows from a unified dashboard. Multilogin offers a Free plan with no credit card requirement, while paid plans commence at .08 per month when billed annually, inclusive of monthly proxy traffic and mobile minutes based on the selected plan. Established in 2015, Multilogin operates from the UAE and adheres to GDPR compliance. Media Contact: Teona B. Media Specialist Multilogin Email: marketing@multilogin.com For additional visuals accompanying this announcement, please visit the following links: Visual 1 Visual 2" max_tokens="3500" temperature="0.3" top_p="1.0" best_of="1" presence_penalty="0.1" frequency_penalty="frequency_penalty"].08 per month.

Winsage

August 24, 2026

You don’t want this Sleepwalker backdoor on your Windows machine

Malware researcher Dominik Reichel has discovered a sophisticated Windows backdoor named Sleepwalker, which remains dormant in memory until activated by a specially crafted network packet. Sleepwalker uses a 23-instruction command language to execute tasks, including running code in memory and exfiltrating data. It activates through a proprietary activation packet that does not contain readable commands. The malware targets a VMware VMCI and disguises itself as Microsoft's dpapi.dll, mimicking its functions while redirecting calls to a non-existent file. Once it confirms its host process as ERAAgent.exe, it enters a dormant state to evade detection. Sleepwalker monitors for a specific pattern known as a magic packet to decrypt and interpret commands. Commands sent to it are encrypted with AES-256-CCM and must be read in a specific order. The backdoor includes functionalities for sending and concealing data, receiving tasks, and executing programs. Reichel has developed a toolkit to decode Sleepwalker’s bytecode and a mitigation guide for affected users. However, there are significant gaps in knowledge regarding the initial access method, victim identification, and the malware's operator.

Winsage

August 23, 2026

“Sort of a feature,” Microsoft on why Ctrl+C fails on Windows 11 due to a design choice

Microsoft's clipboard history service operates asynchronously, which can cause issues when executing multiple copy commands quickly. This design choice can lead to scenarios where the clipboard is locked by another program, preventing new content from being copied. Common culprits include the Remote Desktop clipboard redirector and various background utilities like Intel Arc Control and HP Smart. The clipboard may fail to register rapid Ctrl+C presses, often only storing the last copied item due to the way the Clipboard history service notifies programs of changes. Developers can manage clipboard changes more effectively by using the Clipboard.HistoryChanged event from the WinRT clipboard API. Additionally, some applications may experience delayed rendering, leading to outdated or empty clipboard history. These clipboard issues have been present in earlier versions of Windows as well.

AppWizard

August 23, 2026

Red Dead Redemption 2 gets new lease of life with Mafia inspired expansion

Rockstar Games is not currently pursuing a new-gen update for Red Dead Redemption 2, leaving fans uncertain about the game's future. Meanwhile, a mod called 'Mafia 1899' has been created by NexusMods user M8Tmods, which enhances the game with new features and activities inspired by the Mafia franchise. This mod includes 13 mission types, such as protection rackets, wagon robberies, and assassinations, with several missions directly inspired by Mafia 1: Definitive Edition. Notable missions include the 'Police Files Heist,' 'Booze Wagon Heist,' 'Church of Holy Heist,' and 'Warehouse Heist.' The mod has received positive feedback from the community, with players expressing excitement and nostalgia for the new content. It integrates with the existing storylines of Arthur and John, and some players have suggested developing it into a standalone mode.

Winsage

August 23, 2026

I think Microsoft is finally fixing the customization problems that held Windows 11 back

Windows 11 is evolving into a more user-centric operating system, with recent updates enhancing customization options like moving and resizing the Taskbar and improving Start menu control. This change is part of Microsoft's Windows K2 initiative, which aims to boost performance and user experience. Initially, Windows 11's design aimed for simplicity but reduced user choices, leading to frustration. The context menu was simplified but became cluttered again, prompting updates that allow users to customize its organization. Microsoft recognizes that users have varied preferences for interacting with the OS, and the flexibility in Taskbar positioning enhances satisfaction. While the updates are positive, there is criticism that Microsoft should not be overly praised for restoring previously removed features. The goal is to maintain a modern interface while enhancing user experience without sacrificing functionality. Recent changes reflect an understanding that the issues with Windows 11 arose from removing options rather than having too many choices, guiding future updates to balance user-friendliness with customization.

Winsage

August 22, 2026

Hackers abuse FTP server banners to deliver new Windows malware

Threat actors are exploiting FTP banners to conceal commands for deploying two undocumented remote access trojans (RATs), E4del and PINHOLE. This method was first observed by MalwareHunterTeam in July 2026, using shortcut files (.LNK) and FTP server banners as dead-drop resolvers to retrieve malicious commands. SOCRadar confirmed that this technique has been weaponized since early July 2026 and remains active, with new infrastructure identified as recently as August 2026. The attacks typically start with a ZIP archive leading to an LNK-based infection chain, likely initiated through phishing tactics. E4del is a Node.js-based RAT disguised within a digitally signed Electron application mimicking Discord, capable of executing commands, capturing screenshots, streaming desktops, and downloading additional payloads. It also includes a module for privilege escalation. PINHOLE retrieves its command and control configuration from Pinterest and SurveyMonkey, designed to leave a minimal footprint and employing shellcode fluctuation. It supports 14 commands, including file management and credential theft, but had only recorded 11 execution events at the time of analysis. SOCRadar notes that while using FTP banners is a novel approach, it is less stealthy than traditional web-based dead-drop resolvers. They provide indicators of compromise to help identify malicious infrastructure and infected machines.

Winsage

August 22, 2026

Someone discovered that Windows 11 nukes your GPU drivers if you leave your laptop in eco mode

A user on the Zephyrus G14 subreddit discovered that using the eco power mode on Windows 11 for 15 consecutive days leads to the automatic deletion of GPU drivers. The eco mode power-gates the discrete GPU off the PCIe bus, causing Windows to treat it as disconnected. After 15 days of inactivity, Windows performs a cleanup and removes the GPU driver package. When switching back to standard power mode, the GPU is identified as a "Basic Display Adapter." Users can check if their GPU drivers have been removed using specific command prompt commands. To prevent driver cleanup, users can either switch to a non-eco power plan occasionally or modify the registry to set Autorun (DWORD) = 0.

Winsage

August 22, 2026

Researchers find way to weaponize Windows Defender’s own driver

Check Point Research revealed a technique that uses the boot-time remediation driver BTR.sys, part of Windows Defender, to execute kernel-level operations on Windows systems from Windows 7 to Windows 11 25H2. This method does not exploit software vulnerabilities but leverages BTR.sys, which is designed to remove locked malware components. Researchers reverse-engineered its undocumented protocol, leading to the creation of a proof-of-concept tool, BTR_CLI, that can install the driver as a service without standard management protocols. Once operational, BTR.sys can delete or move files, modify registry entries, and remove security binaries, including parts of Defender, during a specific period when the file system is writable. To exploit this technique, an attacker needs administrator privileges, specifically SeLoadDriverPrivilege. Although Microsoft does not consider this a critical issue due to the requirement of pre-existing administrative access, it highlights a significant potential vulnerability. There have been no documented real-world attacks using this technique.

AppWizard

August 21, 2026

New Android Malware Spotted Infecting Cars Via Software Updates

A new strain of Android malware has emerged, targeting automotive head units responsible for infotainment, connectivity, and navigation in vehicles. Discovered by Kaspersky in June, this is the first documented instance of malware affecting car head units, specifically within the firmware updaters of Android-based software developed by DoFun, a Hong Kong company. The malware, disguised as an application called JarService, infiltrates devices without user awareness. It is delivered through a legitimate system application called TWCore, which collects analytics and updates software. The malware aims to convert the head unit into a botnet, equipped with commands to download and execute code and display advertisements, potentially for online ad fraud. Kaspersky notified DoFun, which addressed the vulnerabilities, and noted similarities between this malware and a previous threat called BadBox, which affected various Android devices.