cryptocurrency Archives

Tech Optimizer

September 1, 2026

Fake Microsoft Security Scan Tells You to Remove Antivirus—Then Scammers Ask for Remote Access

A new web-based scam is using counterfeit Microsoft-branded security scans to deceive users into uninstalling their antivirus software. The scam websites conduct fake inspections, reporting false security failures and claiming third-party antivirus products are unsupported by Windows. They gather browser information to create customized-looking scan reports and aim to mislead victims into a fraudulent refund process. Investigators have identified 11 related scam sites under the name SysScan, which present themselves as legitimate Microsoft security checks. The scam does not involve file downloads but relies on convincing websites, fabricated security scores, and personal information forms. The scan results are hard-coded, and the security score is limited to a range between 13 and 30 out of 100. The scams instruct users to uninstall antivirus software, which is misleading since Windows does not cease support for third-party antivirus solutions. The scam sites request extensive personal information, including names, addresses, phone numbers, and banking details, and redirect victims to a page claiming a refund manager will call shortly. This process allows scammers to gain remote access to victims' computers. Indicators of compromise include specific IP addresses and domains associated with the scam.

Tech Optimizer

August 26, 2026

Catch Of The Week: The ‘Security Scan’ That Wants You Defenseless

Researchers at Malwarebytes have identified a network of deceptive websites posing as a service called “SysScan,” which pretends to conduct Microsoft security checkups. Users encounter these sites through search results, browser hijacking pop-ups, or unsolicited emails. The sites use Microsoft branding and a fake progress bar to create the illusion of a scan, but they only collect harmless data like operating system and location, which are then manipulated into alarming fake alerts. The fabricated security score is predetermined and does not reflect the user's actual security status. The scam misleads users into believing that Windows no longer supports third-party antivirus software, prompting them to uninstall their protections, which increases their vulnerability. Users are then asked to provide personal and banking information through a form that sends data via a Telegram bot. Eleven fraudulent sites have been traced back to a single server. Indicators of the scam include requests to disable antivirus software, installation of remote-access software, and solicitation of sensitive information. Microsoft does not initiate cold calls or scan computers through web pages. If someone has engaged with the scam, they should disconnect from the internet, uninstall any remote-access tools, reinstall antivirus software, and report the incident to authorities.

Tech Optimizer

August 24, 2026

Fake Microsoft security scans trick victims into uninstalling their antivirus

A surge of fraudulent websites claiming to verify antivirus software functionality has emerged, using the name SysScan and misleadingly asserting that Windows no longer supports third-party antivirus solutions. These sites conduct fake security scans, gather personal information, and set up a refund scam. Eleven such websites were found hosted on a single server, executing similar deceptive tactics. They can access basic browser data but cannot conduct genuine security scans. Microsoft continues to support third-party antivirus software, and legitimate refund processes do not require uninstalling security tools. The scams instruct users to remove their antivirus software to facilitate further manipulation and to collect information about the antivirus in use. The customer information forms collect extensive personal data and are designed to send this information to a Telegram bot API. Victims are promised a refund call after submitting their information, which is part of the scam's manipulation. Signs of such scams include claims of deep problems with the computer, consistently negative diagnostic results, requests to uninstall antivirus software, and demands for banking information. If affected, victims should disconnect from the internet, remove remote-access tools, and contact their bank. The hosting IP address for these sites is 157.230.180.90, with multiple associated domains listed.

AppWizard

August 23, 2026

Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices

A new Android malware threat, codenamed Manic, poses significant risks to Ukrainian banks, government services, and messaging applications, with a reach extending to Russian and European financial institutions, global fintech platforms, cryptocurrency services, and military communication channels. Manic combines Android banking malware and mobile spyware, targeting sensitive applications and enabling comprehensive device takeover. It features a novel Wi-Fi mesh technique for data relay through compromised devices and utilizes phishing sites and dropper apps. The malware originated in February 2026, with initial development leading to its first deployment by late May. It monitors 169 package IDs related to banks, payment services, and messaging applications, primarily affecting Ukrainian targets but also impacting applications in Russia and Europe. Manic can infiltrate commercial and military messaging apps, track locations, monitor notifications, and collect files. It exploits Android's accessibility services to capture sensitive data and employs a store-and-forward relay mechanism for data exfiltration through nearby compromised devices. Google has stated that no apps containing this malware are found on Google Play, and Android users are protected by Google Play Protect.

AppWizard

August 22, 2026

Hackers have issued an ultimatum to Rockstar Games and threatened to release GTA 6 on PC worldwide.

The anonymous group CYBERLEEK claims to possess a complete working build of Grand Theft Auto 6 and threatens to release it to millions of PC users unless legal actions against them are stopped. They have distributed backup copies of the game globally, beyond U.S. legal jurisdiction, and have an automated system that could release the game if their communication is disrupted. CYBERLEEK is soliciting cryptocurrency donations and positioning their actions as a protest against the digitalization of the gaming industry. The gaming community is divided on the authenticity of the threat, with some speculating it may be a marketing strategy. Take-Two Interactive and Rockstar Games have not commented and are preparing for the game's release on November 19 for PlayStation 5 and Xbox Series X/S consoles.

AppWizard

August 21, 2026

Cyberleek’s still at it: Another GTA 6 leak shows 2 full minutes of high speed driving, surprisingly few crashes

Cyberleek has released a new gameplay snippet from Grand Theft Auto 6 for the fourth consecutive day. The latest video, titled "hypercar.mp4," features protagonist Jason in a carjacking scene in Vice City. The two-minute clip shows Jason having the option to perform an aggressive extraction of the driver, which may attract attention. It also confirms earlier leaks about visual identification mechanics related to the stolen vehicle and Jason's wanted level. The footage highlights advanced lighting technology, showcasing realistic reflections from the hypercar's headlights. Additionally, the video promotes Cyberleek's cryptocurrency initiative, with a message linking market capitalization to the frequency of leaks. Take-Two has reportedly lost approximately .8 billion in market capitalization this week due to a decline in share price.

AppWizard

August 21, 2026

Who is Cyberleek? What we know about the GTA 6 leaker

On August 18, an entity named "Cyberleek" shared what is believed to be authentic gameplay footage from Grand Theft Auto 6, featuring the protagonist Jason. The footage showcased typical GTA activities and was removed from social media due to copyright claims from Take-Two and Rockstar. Cyberleek's leaks were not from testers but indicated access to a segment of GTA 6. They expressed consumer rights grievances and made three demands: no more digital preorders, no selling DLC already included in base game files, and mandatory offline fallback states for single-player games. Cyberleek is also promoting a cryptocurrency token, $Cyberleek, with a market cap of .1 million, allowing token holders to vote on gameplay clips to release. The timing of the leaks suggests a possible European origin, and investigations link Cyberleek to past posts on a German cybersecurity forum. There are indications that Cyberleek is not affiliated with Rockstar Games, and if identified, they could face significant consequences. Rockstar's official gameplay reveal for GTA 6 is scheduled for August 27.

Tech Optimizer

August 20, 2026

Hackers Are Using a Fake Roblox Cheat To Access Your Webcam and Steal Data

Roblox is facing privacy concerns due to spyware disguised as an "undetected" version of the Xeno Roblox cheat tool. This malware can access screens, record keystrokes, and activate webcams, allowing attackers to execute remote commands. The infection begins when users download a file resembling a legitimate Xeno installation, often shared on platforms like Discord. The malware, previously known as Powercat, has evolved and operates in three stages: 1. The user executes a file named Xeno.exe, which checks for Java and extracts it if necessary. 2. The malware runs a JAR file disguised as decompiler.exe, performing checks to avoid detection. 3. It masquerades as a legitimate Windows DLL file, logging activities and attempting to escalate privileges. If successful, the malware can control the victim's system, access webcams, log keystrokes, and steal sensitive information, including cryptocurrency wallet credentials. To protect against this spyware, users are advised to avoid unofficial cheats, use antivirus software, refrain from clicking unsolicited links, enable two-factor authentication, inspect User Account Control prompts, and consider identity theft protection services.

Winsage

August 17, 2026

⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More

A suspected advanced persistent threat (APT) group linked to China exploited a newly patched vulnerability in VMware vCenter (CVE-2026-59310), which has a critical CVSS score of 9.8, allowing for arbitrary code execution and the deployment of Babuk-derived ransomware. A recently patched vulnerability in Apple macOS (CVE-2026-65400) has been exploited to deploy a cryptocurrency miner, granting unauthorized root access. The Lazarus Group from North Korea exploited a zero-day vulnerability in Microsoft Windows, targeting defense and aerospace sectors. GeoServer patched a critical SQL injection vulnerability that was actively exploited. A new macOS malware, Amnesia Stealer, targets users through ClickFix attacks, stealing data and allowing real-time access to authenticated sessions. A novel attack technique named GhostSplice can manipulate AI coding assistants. Research revealed a method exploiting Chromium's DevTools Protocol for data theft. Noteworthy CVEs this week include CVE-2026-68820, CVE-2026-58231, and multiple others across various platforms. A high-severity command injection flaw in FileRun allows remote code execution. An advanced ClickFix attack has been reported, deploying sophisticated malware. A heap overflow vulnerability in Citrix NetScaler was patched after indications of exploitation. A new malware loader targeting Portuguese-speaking users has been identified. A significant reduction in exposed Automatic Tank Gauge systems has been observed. A phishing campaign targeting Brazil has been detected, and an F.B.I. agent faces charges for unauthorized crypto withdrawals. Authorities in Ukraine dismantled fraudulent call centers, and a North Carolina man was sentenced for cyber extortion. Unauthorized access to sensitive data by the ExfilSquad group has been confirmed. LightSpy activity linked to China has been detected in over 13 countries. A supply chain attack exposed over 2,500 companies, and an Azure exfiltration campaign has exposed millions of enterprise records.

Tech Optimizer

August 11, 2026

Fake popular sites offer a free app, instead take over PCs

A fraudulent website mimicking CNN's homepage is promoting a fake "CNN app" that is not affiliated with CNN. This site, along with others impersonating brands like Avast and Stremio, distributes a legitimate remote management tool called O&O Syspectr, which can grant attackers remote access to victims' computers. The installers for these counterfeit apps share the same account ID, indicating they are linked to the same malicious source. Users are misled into downloading these installers, which appear legitimate but allow unauthorized access to their systems. O&O Software has responded by disabling certain features for free accounts and monitoring for abuse. Users are advised to only download software from official sources and verify installer details before execution.