NewApp Digest
search bot

cybercriminals

Mirax RAT Targets Android Devices Through Meta Apps
AppWizard
April 14, 2026

Mirax RAT Targets Android Devices Through Meta Apps

Mirax is a remote access Trojan (RAT) targeting Android devices in Spanish-speaking countries, identified by Outpost24's KrakenLabs in early March. It propagates fraudulent advertisements on Meta-owned applications, allowing cybercriminals to gain initial access. Mirax can interact with compromised devices in real time, converting them into residential proxy nodes through ads on platforms like Facebook and Instagram. It uses SOCKS5 protocol and Yamux multiplexing to establish proxy channels and uncover victims' IP addresses. The malware captures keystrokes, steals sensitive data, executes commands, and monitors user activity. It employs overlay pages to steal credentials and orchestrates distribution through Meta ads and GitHub for malicious APK files. Users are tricked into enabling installations from "unknown sources," and the malware disguises itself behind video playback features. Additionally, a threat actor has been offering Mirax as a malware-as-a-service (MaaS) on illicit forums, with subscription prices starting at ,500 for three months. This service is described as highly controlled and exclusive, primarily targeting Russian-speaking actors in underground communities.
This fake Windows 11 24H2 update looks perfect, until it avoids antivirus and steals your passwords
Winsage
April 14, 2026

This fake Windows 11 24H2 update looks perfect, until it avoids antivirus and steals your passwords

Cybercriminals are using sophisticated tactics to deceive users, particularly with a counterfeit website posing as a legitimate Windows 11 update. This site operates under the domain microsoft-update[.]support and is designed to trick individuals into downloading malware that compromises sensitive information. The site is written in French and mimics a genuine cumulative update for Windows 11, version 24H2, featuring a convincing KB article number and a blue download button. The malware is packaged as a Windows update using the WiX Toolset 4.0.0.5512 and is labeled "WindowsUpdate 1.0.0.msi," with properties that suggest it is from Microsoft. At the time of analysis, VirusTotal showed no detections for the malware, which conceals its harmful code within an Electron shell, making it difficult to identify. Users are advised to download updates directly through the Windows Settings app or from Microsoft's official support hub.
Fake Claude site installs malware that gives attackers access to your computer
Tech Optimizer
April 13, 2026

Fake Claude site installs malware that gives attackers access to your computer

Claude, an AI tool developed by Anthropic, receives nearly 290 million web visits monthly and has become a target for cybercriminals. A fake website has been found that impersonates Claude, distributing a trojanized installer named Claude-Pro-windows-x64.zip. This installer, while appearing legitimate, deploys PlugX malware, granting attackers remote access to users' systems. The fraudulent site mimics the official download page and uses passive DNS records linked to commercial bulk-email platforms, indicating active maintenance by the operators. The ZIP file contains an MSI installer that incorrectly spells "Claude" as "Cluade" and creates a desktop shortcut that launches a VBScript dropper. This script runs the legitimate claude.exe while executing malicious activities in the background, including copying files to the Windows Startup folder to ensure persistence after reboot. The attack utilizes a DLL sideloading technique recognized by MITRE as T1574.002, where a legitimate G DATA antivirus updater is exploited with a malicious DLL. Within 22 seconds of execution, the malware establishes a connection to an IP address associated with Alibaba Cloud, indicating control over the compromised system. The dropper script also employs anti-forensic measures to delete itself and the VBScript after deployment. Indicators of compromise include the filenames Claude-Pro-windows-x64.zip, NOVUpdate.exe, avk.dll, and NOVUpdate.exe.dat, along with the network indicator 8.217.190.58:443 (TCP) as the command and control destination. Users are advised to download Claude only from the official site and to remain vigilant against potential compromises.
AI malware threatens Windows 11 security. Traditional antivirus can't keep up
Tech Optimizer
April 8, 2026

AI malware threatens Windows 11 security. Traditional antivirus can’t keep up

AI-powered fileless malware poses a significant challenge to Windows 11 security, as traditional antivirus solutions struggle to detect these advanced threats. This type of malware operates without traditional files and can execute malicious actions directly in memory, bypassing conventional detection methods. Vulnerabilities in applications like Excel and Outlook have been exploited, allowing harmful code execution through simple actions like opening a preview pane. The integration of AI features, such as Microsoft's Copilot, has also created new risks, leading to potential data leaks. To combat these threats, a multi-layered security approach that includes behavioral analysis and real-time monitoring is essential. Upgrading from Windows 11 Home to Windows 11 Pro provides additional security features to enhance defenses against malware.
Scammers Want Our Data, Yet CNET Finds Many of Us Aren't Protecting Our Devices
Tech Optimizer
April 6, 2026

Scammers Want Our Data, Yet CNET Finds Many of Us Aren’t Protecting Our Devices

- 78% of US adults currently own a personal laptop, with HP (32%) and Apple (26%) being the most popular brands. - 54% of laptop owners have encountered potential malware on their devices in the past year. - 88% of those who reported seeing potential malware took action, while 12% did not respond. - 68% of proactive laptop owners either deleted the suspicious file or closed the website or pop-up. - 37% of laptop owners received phishing emails in the past year. - Many modern devices come equipped with built-in antivirus solutions, such as Microsoft Defender for Windows 11 and XProtect for Mac users. - 60% of users who acted upon encountering potential malware manually deleted files or closed suspicious websites, while 35% initiated antivirus scans. - Antivirus software alone cannot safeguard against data breaches or identity theft; a comprehensive cybersecurity strategy involves various tools and practices. - Recommended tools for online security include Bitdefender for antivirus, Aura for identity theft protection, Bitwarden for password management, and ExpressVPN for VPN services.
Best antivirus for Windows 11: Guide to choosing the right software
Tech Optimizer
April 4, 2026

Best antivirus for Windows 11: Guide to choosing the right software

Windows 11 provides a more secure environment than previous versions, but recovery remains a concern for users. Built-in protections are limited against threats like phishing and ransomware. The need for antivirus solutions has evolved to include comprehensive protection and recovery options. Basic threat prevention is often insufficient for home users and remote workers, who risk losing important files. Microsoft Defender offers a solid foundation, but products like Acronis True Image combine anti-malware capabilities with backup and recovery features. Antivirus software is essential for Windows 11 users, protecting against various malicious software. Modern antivirus programs offer real-time protection, web protection, and identity theft protection. Users must consider free versus paid solutions, as premium options typically provide advanced features. Top antivirus picks for Windows 11 in 2026 include Acronis True Image, Bitdefender Total Security, McAfee Total Protection, Norton 360 Deluxe, and Microsoft Defender Antivirus. Acronis True Image stands out for its dual functionality of prevention and recovery, utilizing AI-driven analysis to monitor unauthorized changes. Backup-focused alternatives like EaseUS Todo Backup Home and Macrium Reflect Home specialize in recovery but lack comprehensive antivirus protection. The choice between paid and free antivirus depends on whether Microsoft Defender meets users' needs. Paid suites generally offer deeper protection and advanced features. The best antivirus should provide robust protection while minimizing system impact, tailored to users' specific needs for prevention or recovery.
'This rootkit is highly persistent; a standard factory reset will not remove it': "NoVoice" Android malware on Google Play infects 50 apps across 2.3 million devices, here's what we know
AppWizard
April 2, 2026

‘This rootkit is highly persistent; a standard factory reset will not remove it’: “NoVoice” Android malware on Google Play infects 50 apps across 2.3 million devices, here’s what we know

Researchers at McAfee have identified a malware strain named NoVoice that has infiltrated over 50 applications on the Google Play Store, leading to more than 2.3 million downloads. NoVoice exploits vulnerabilities in older Android kernels and GPU architectures, remaining active even after factory resets. It can inject malicious code into applications like WhatsApp, allowing it to hijack user sessions and spy on private conversations. Google has removed the affected applications, but the malware continues to pose a threat to already compromised devices.
Search