counterfeit Archives

Winsage

August 14, 2026

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

CoolClient is a sophisticated backdoor family linked to the HoneyMyte APT group, actively used in cyber-espionage campaigns targeting organizations in Asia and Russia since its initial disclosure in 2022. It has capabilities such as keylogging, clipboard theft, credential harvesting, and system reconnaissance. Investigations in 2023 revealed enhancements, including clipboard theft and HTTP traffic interception. By late 2025 and into 2026, a variant was noted that could deploy a signed kernel-mode driver as a Windows service, improving its stealth and operational capabilities. In a recent campaign targeting Myanmar, the HoneyMyte group used PlugX to deploy CoolClient components. They configured Microsoft Defender to exclude a fake Windows Defender installation directory and a renamed executable, defender.exe, to avoid detection. Persistence was achieved through a scheduled task that executed defender.exe with SYSTEM privileges at startup, which sideloaded the malicious libngs.dll to initiate the CoolClient execution chain. The latest CoolClient variant has a multi-stage execution chain, including: - defender.exe / Sang.exe: Exploited legitimate application for DLL sideloading. - libsrapc.dll: Benign dependency for the Sangfor application. - libngs.dll: First-stage loader that decrypts and loads the next stage. - loadcert.ini: Second-stage DLL implementing core functionalities. - cert.ini: Final-stage implant for command and control communication. - time.ini: Configuration file for CoolClient. The execution begins with the legitimate Sangfor application loading libngs.dll, which uses obfuscation to conceal its operations. The second stage, loadcert.ini, is injected into synchost.exe and performs tasks including persistence and process injection. The kernel-mode driver deployment routine involves decrypting time.ini, verifying privileges, and creating a service to execute the driver, enhancing stealth. The deployed kernel-mode driver, msagent.sys, is digitally signed and helps hide processes, files, and registry objects, making detection more difficult. The latest variant continues to target organizations consistent with previous HoneyMyte activities, with confirmed victims in Myanmar, Mongolia, Pakistan, and Russia, including government entities. The deployment of CoolClient as a secondary backdoor after a PlugX infection indicates a strategic approach to maintain access to compromised systems. The malware is confirmed as a new variant of CoolClient associated with the HoneyMyte threat group, with the kernel-mode driver marking a significant advancement in its capabilities.

Tech Optimizer

August 11, 2026

Fake popular sites offer a free app, instead take over PCs

A fraudulent website mimicking CNN's homepage is promoting a fake "CNN app" that is not affiliated with CNN. This site, along with others impersonating brands like Avast and Stremio, distributes a legitimate remote management tool called O&O Syspectr, which can grant attackers remote access to victims' computers. The installers for these counterfeit apps share the same account ID, indicating they are linked to the same malicious source. Users are misled into downloading these installers, which appear legitimate but allow unauthorized access to their systems. O&O Software has responded by disabling certain features for free accounts and monitoring for abuse. Users are advised to only download software from official sources and verify installer details before execution.

Tech Optimizer

August 8, 2026

Hackers use fake Adobe and Zoom updates to load malware onto victim devices — here’s what to look out for

Securonix Threat Research has identified a cyber campaign called SMOKE#SCREEN that uses deceptive tactics to trick users into installing weaponized versions of ScreenConnect, a legitimate remote monitoring software. The attackers disguise their malicious intent with fake update notifications for applications like Zoom and Adobe, as well as counterfeit business documents. This campaign allows attackers to gain persistent remote access to victims' systems, disable security protections, and exploit trusted services like Dropbox and Cloudflare for delivering malicious payloads. Victims have been reported on both Windows and macOS platforms. Businesses are advised to verify updates through official channels and train staff on the risks of unexpected software installations.

BetaBeacon

August 8, 2026

Mastering Sideloading: Safe APK Installation on Android

People reach outside the Play Store to download APKs for emulators, early builds of apps, region-locked releases, modded versions of apps, and apps like betting and casino apps that are restricted by Google's store policies. Google has found that there is over 50 times more malware coming from internet-sideloaded sources than from apps on Google Play. Starting in September 2026, Google will require every developer to verify their identity for apps installed on certified Android devices, including sideloaded apps. To sideload without getting burned, users should pull APKs from reputable sources, match permissions to the job, keep Play Protect switched on, and revoke the "install unknown apps" permission after installation.

Tech Optimizer

August 7, 2026

Bitdefender partners Digimune to sell consumer security

Bitdefender has partnered with Digimune Australia to allow Digimune to distribute Bitdefender's consumer cybersecurity products in Australia. This partnership aims to improve access to cybersecurity solutions amid rising threats like scams and ransomware. The products available through Digimune include Bitdefender Antivirus Plus, Bitdefender Total Security, Bitdefender Premium, Bitdefender Mobile Security, and Bitdefender Premium VPN, which support various platforms such as Windows, macOS, iOS, and Android. The collaboration focuses on household consumers, providing local support and simplifying the purchasing process for multi-device subscriptions. The partnership also addresses the growing competition in the Australian consumer security sector and aims to meet the demands for protection against various digital threats.

Winsage

August 3, 2026

Microsoft warns Windows PC users of Russian hackers on hotel WiFi

Microsoft has issued a warning to Windows PC users about Russian hackers targeting individuals using hotel WiFi networks. The campaign, named CaptiveCrunch and attributed to the Storm-2945 group, focuses on corporate travelers and employs tactics like credential theft and malware distribution through compromised guest networks. Microsoft has been monitoring this activity since May, noting its impact on hospitality networks utilizing captive portals. Hackers have been redirecting users to counterfeit sign-in pages to steal credentials without phishing emails. The threat may also extend to Android devices, with hackers using deceptive techniques to manipulate users into downloading malicious APK files. The hackers employ fake verification checks and sign-in prompts, sometimes misleading users into Microsoft's legitimate authentication process to gain access to accounts. Microsoft has identified a specific remote-access trojan named CornFlake, which can record keystrokes, steal credentials, and capture screenshots. Recommendations for travelers include using mobile hotspots, avoiding updates through captive portals, strengthening authentication methods, and blocking unnecessary device-code authentication.

AppWizard

August 1, 2026

Third-party app stores are about to take over Google Play. Here’s how to prepare

Alternative third-party app stores are becoming more prominent on Android, with major companies developing their own storefronts to bypass Google. These stores will be accessible for download directly from the Google Play Store in the U.S. for the first time. This shift is driven by developers' dissatisfaction with the "app tax" imposed by Google and Apple, along with international regulatory efforts like Europe’s Digital Markets Act, which require tech giants to open their platforms to competition. While this change offers more choices for users, it also raises security concerns as the Google Play Store's protective measures may be weakened, leading to potential risks from counterfeit app stores. Additionally, the rise of third-party stores may complicate subscription management and billing, as each store will likely implement its own payment system. This fragmentation could increase the risk of data breaches and complicate user experience. The future may see a competitive landscape similar to streaming services, potentially driving Google to improve its offerings.

Winsage

August 1, 2026

Microsoft Issues Hotel Wi-Fi Warning For Windows PC Users

Microsoft has issued a warning to organizations regarding the risks associated with public and hospitality network infrastructures, citing a new hacking threat from Russian cyber actors targeting travelers for malware distribution and credential theft. This warning follows the identification of a global campaign named CaptiveCrunch, linked to Storm-2945, which has been targeting corporate travelers since early May by exploiting compromised guest networks. Attackers are manipulating hospitality networks to facilitate credential theft and malware delivery, using tactics such as redirecting network traffic to counterfeit sign-in pages. The campaign affects both Windows and Android devices and employs techniques that include presenting fake verification checks and software updates. Some victims have been misled into participating in Microsoft’s legitimate device-code authentication process, allowing attackers to gain access to accounts without stealing passwords. Microsoft advises travelers to treat guest networks as untrusted and recommends using mobile hotspots, avoiding updates through captive portals, and enhancing security measures. Malicious tools identified include the Windows remote-access trojan (RAT) named CornFlake, which can steal credentials, record keystrokes, and hijack audio and video capabilities.

Winsage

July 30, 2026

Malwarebytes for Windows, now available on the Microsoft Store

The Microsoft Store now offers Malwarebytes for Windows, providing a convenient and reliable way for users to download the full version of the software without limitations. This version includes all features, such as real-time protection and seamless integration with Windows. Users can install it by searching for Malwarebytes in the Microsoft Store and clicking "Get." The listing also provides app information and screenshots. Existing users of Malwarebytes from the official website do not need to reinstall or make changes to their current setup.

Winsage

July 29, 2026

Microsoft will make it harder to illegally activate Windows and close a popular piracy loophole

Microsoft is requiring the use of TPM 2.0 security modules for Key Management Service (KMS) activation servers to combat unlicensed software and corporate piracy. KMS, used by organizations for mass activation of devices, has been targeted by hackers who create counterfeit servers. The new protocol mandates that KMS hosts validate their hardware credentials through the TPM 2.0 chip before activating client devices. This initiative will mainly affect illegal infrastructures in the corporate sector, while legitimate PC users will not be impacted. Starting in August 2026, Windows Server 2025 will introduce hardware readiness alerts to help system administrators prepare for these changes. TPM 2.0 has been required for Windows 11 since 2021, and its application is being expanded to address vulnerabilities in volume licensing.