cybersecurity Archives

AppWizard

June 5, 2026

Microsoft 365 Android Apps Let Any App Steal Account Tokens via Leftover Debug Flag

A vulnerability in several Microsoft 365 Android applications, identified as FlagLeft, was caused by a development flag left enabled in production builds, which disabled checks meant to restrict account-token sharing to trusted applications. This flaw affected applications such as Word, PowerPoint, Excel, Microsoft 365 Copilot, Microsoft Loop, and OneNote, allowing unauthorized apps to request and obtain user tokens without permission. Microsoft Teams was unaffected. The vulnerability was demonstrated by Enclave, allowing access to user emails through an unverified app. On May 12, Microsoft issued four CVEs for the affected applications, categorized under improper access control. The patched version of Word for Android is 16.0.19822.20190, and users are advised to update their applications. The patch does not invalidate already compromised tokens, so users should revoke these tokens and sign in again.

Tech Optimizer

June 4, 2026

How We Test Antivirus and Security Software

Most software applications clearly indicate their functionality, but the effectiveness of antivirus utilities is often less tangible. PCMag rigorously evaluates antivirus products through comprehensive tests that validate their claims, including real-world malware samples and various protective measures. Each antivirus tool is assessed based on its on-demand scanner and real-time monitor capabilities. PCMag compiles fresh malware samples annually, analyzing them to ensure they are suitable for testing. The testing process includes evaluating malware-blocking capabilities and web-level protection against known malware-hosting sites. Phishing site detection is also tested using recent URLs, and antispam testing has been simplified due to the effectiveness of email providers. Performance impact tests have been discontinued as modern security suites show improved efficiency. Firewall protection is evaluated through program control, exploit defenses, and overall resilience against malware. Parental control features are tested for effectiveness in content filtering and monitoring. Ransomware protection is assessed by releasing real-world samples in a controlled environment. PCMag monitors independent antivirus lab tests from various organizations, including AV-Test, AV-Comparatives, SE Labs, MRG-Effitas, and AVLab, to inform their reviews. An aggregate testing score is calculated to summarize lab results. Testing methodologies do not include VPN evaluations, which are covered separately.

AppWizard

June 4, 2026

Teens are using $5 WeedHack malware to target Minecraft players

A recent cybersecurity analysis from McAfee Labs has revealed a malware campaign involving WeedHack, which has garnered over 116,000 hits and is accumulating 2,000 to 3,000 malicious hits daily. WeedHack is marketed as malware-as-a-service (MaaS) and is accessible on the internet, allowing individuals with minimal technical skills to use it for harmful activities. A dedicated Telegram channel for WeedHack has over 850 members, many of whom are teenagers and young adults using the malware for cyberbullying. The malware spreads primarily through YouTube videos promoting Minecraft mods, which often conceal the WeedHack malware. Additionally, bad actors use SEO poisoning tactics to elevate fake websites posing as legitimate Minecraft clients. McAfee lists several legitimate clients targeted by WeedHack, including Meteor Client, Radium Client, and Wurst Client. For an additional fee, attackers can access premium features like webcam access, keylogging, and file management. McAfee advises players to be cautious when downloading mods and to seek help from trusted adults if approached by individuals claiming to have compromised their systems.

AppWizard

June 4, 2026

Kremlin’s State-Mandated Max Messenger Removed From Apple Store

On June 3, Russia's Max messenger was removed from the Apple App Store. Max, launched in 2025 by VK, integrates messaging, social media, digital identification, payments, banking, and government services. The reasons for its removal are unclear, and VK plans to seek clarification from Apple. Following the removal, the app stopped sending push notifications. Max is part of the Kremlin's strategy for control over information and is positioned as a "secure" alternative, although it lacks end-to-end encryption. Moscow has previously restricted foreign social media platforms, including banning Facebook and Instagram, and has faced backlash for banning Telegram in 2026. Critics warn that Max may enable the Kremlin to monitor citizen communications, with concerns raised about the security of data shared through the app.

Winsage

June 4, 2026

June 9 Patch Tuesday incoming as Secure Boot deadline looms

Microsoft has announced updates to Secure Boot, enhancing system security by modifying support and registry keys to streamline the boot process. These updates aim to improve the security of Windows devices by ensuring that only trusted software is loaded during startup. Collaborations with Dell and STMicroelectronics are also underway to provide tailored support and integrate advanced security features into chipsets, respectively.

Winsage

June 3, 2026

Windows Netlogon CVE-2026-41089 exploited: Priority patch needed

Microsoft has addressed a critical vulnerability identified as CVE-2026-41089, which could allow unauthorized access to sensitive data. This vulnerability primarily affects specific Microsoft software and has been classified with a high severity rating. If unaddressed, it could lead to data breaches and unauthorized access. Microsoft recommends users apply the latest security patches and updates. The cybersecurity community emphasizes the importance of prioritizing cybersecurity strategies and collaboration among industry stakeholders to mitigate risks associated with such vulnerabilities.

Winsage

June 3, 2026

Unpatched Windows Search URI Vulnerability Lets Attackers Steal NTLMv2 Hashes

Cybersecurity researchers have identified an unpatched vulnerability that could expose NTLMv2 hashes to attackers, linked to the "search:" URI handler. This issue is similar to CVE-2026-33829, which involved a spoofing vulnerability in the Windows Snipping Tool's ms-screensketch: URI handler. The flaw allows attackers to trick users into connecting to their SMB servers, disclosing NTLMv2 hashes for authentication exploitation. The new vulnerability operates using "search:" and "crumb=location:" parameters, resulting in a similar Net-NTLMv2 leak. Microsoft has chosen not to address this issue, stating only vulnerabilities classified as Important or Critical would be fixed. Recommendations to mitigate risks include blocking outbound SMB traffic, enforcing SMB signing, and disabling NTLM authentication where possible.

Tech Optimizer

June 3, 2026

Endpoint Security Statistics By Market Share And Insights (2026)

Endpoints are critical computing devices connected to networks, including personal computers, tablets, smartphones, and smart appliances, and are often targeted in cyberattacks. Robust endpoint security is essential, especially in business environments with sensitive data. Endpoint protection solutions include antivirus software, endpoint detection and response (EDR) systems, and multi-factor authentication. - 81% of businesses have faced malware-related attacks. - 59% of ransomware incidents compromise data stored in public cloud environments. - In 2023, the average cost associated with breach detection and escalation reached USD 1.58 million. - 97% of executives access work accounts via personal devices. - During Q3 2024, malware detections at endpoints surged by 300%. - 13% of employees reported being victims of phishing attacks while working remotely. - 70% of employees using ChatGPT in the workplace do so without informing their employers. - 68% of companies have reported at least one successful endpoint attack that compromised their data or IT infrastructure. - 55% of professionals consider smartphones among the most vulnerable endpoints. - 47% of organizations monitor their networks around the clock. - The global financial impact of cybercrime is projected to exceed .5 trillion annually by 2025. - In 2021, 53% of organizations experienced successful ransomware attacks, marking a 148% increase from 2020. - Paying a ransom can double the total cost of a ransomware incident. - 40% of organizations delay patch rollouts to avoid potential conflicts. - 67% of IT professionals believe that Bring Your Own Device (BYOD) policies have weakened their organization's security posture. - 69% of Chief Information Security Officers (CISOs) expected at least one ransomware attack in 2022. - Only 50% of organizations encrypt sensitive data on their devices. - Organizations with a high number of remote workers face the greatest risks regarding endpoint security threats. - The endpoint security market is anticipated to grow from USD 13.37 billion in 2023 to USD 31.2 billion by 2032, with a compound annual growth rate (CAGR) of 12.1%. - Approximately 70% of companies plan to increase their investment in endpoint security solutions over the next two years. - The average financial impact of a data breach is estimated at around USD 4.88 million. - In 2023, the highest costs related to breaches were linked to detection and escalation, averaging USD 1.58 million. - As of 2024, the United States has the highest average cost of data breaches globally at USD 9.36 million. - A significant breach affecting 50 to 60 million records in 2024 is expected to cost USD 375 million. - Organizations facing compliance challenges typically incur an average breach cost of USD 5.05 million. - 40% of organizations admit to postponing patch implementations to avoid potential conflicts. - 92% of remote employees report using personal smartphones or tablets for work tasks. - 80% of executives are inclined to send work-related messages from personal devices. - 80-90% of successful ransomware attacks originate from unmanaged devices. - 62% of cybersecurity experts cite data loss and leaks as their primary concerns regarding BYOD policies. - 36% of employees using personal devices for work admit to delaying security updates. - 71% of employees store sensitive work passwords on personal phones. - 67% of organizations work with multiple vendors for management and security across various device types. - Only 42% of surveyed companies have a solution to proactively identify sensitive data on employee devices. - 38% of employees state that their employer lacks BYOD policies, or that existing policies are often disregarded. - There was a 300% increase in malware detections at endpoints during Q3 2024. - In 2024, a data breach involving Twilio compromised 33 million phone numbers linked to Authy accounts. - 90% of successful cyberattacks and up to 70% of data breaches originate from endpoint devices. - 54% of security experts reported that over 20% of their total endpoints were unmanaged. - 67% of Managed Service Providers (MSPs) faced AI-driven threats in the past year. - Among HR professionals who offboarded employees in the last year, 71% reported that at least one employee failed to return company-owned devices. - 65% of employees indicated they often bypass organizational security protocols to enhance productivity. - Over 90% of security incidents related to lost or stolen devices lead to unauthorized data breaches. - 13% of employees admit to being victims of phishing attacks while working remotely. - 63% of companies may have former employees retaining access to organizational data. - 62% of employees acknowledged transferring company intellectual property to personal devices. - 59% of stolen company-owned devices contained sensitive information. - Gartner estimates that shadow IT accounts for 30-40% of IT expenditures in large organizations. - 80% of employees engage in shadow IT activities. - 76% of small and medium-sized businesses (SMBs) believe shadow IT poses a security risk. - 58% of SMBs have encountered significant shadow IT initiatives without the knowledge of their official IT departments. - 30% of IT leaders cite information security as the primary challenge to adopting BYOD policies. - The prevalence of shadow IT has surged by 59% due to remote work. - 70% of employees using ChatGPT in the workplace do so without employer knowledge. - 32% of remote and hybrid employees use applications or software not sanctioned by IT. - 59% of organizations have experienced data loss due to cloud-based shadow IT. - ChatGPT is the most frequently used unauthorized application among employees. - By 2027, it is projected that 75% of employees will acquire, modify, or create technology beyond IT's visibility. - The trend of paying ransoms has increased; over 47.8% of companies chose to pay in Q3, rising to 59.6% in Q4. - Tanium raised USD 300 million in Series G funding, resulting in a valuation of USD 9 billion. - Cybereason secured USD 275 million in Series F funding. - SentinelOne acquired Attivo Networks in a transaction valued at USD 616 million.

AppWizard

June 3, 2026

Over 116,000 Mincraft systems infected in WeedHack malware campaign

A malware operation called WeedHack has targeted Minecraft players since January, compromising over 116,000 systems with daily infections between 2,000 and 3,000. It primarily distributes malware through malicious mods, clients, cheats, and utilities promoted on YouTube, utilizing SEO poisoning to reach victims. The campaign features polished YouTube videos with embedded download links and targets keywords related to popular Minecraft clients. WeedHack operates as a malware-as-a-service (MaaS) model, offering a free tier that steals Minecraft session IDs, cookies, and passwords across various platforms, and a premium tier with enhanced capabilities. The operation's Telegram channel has over 800 members, mostly teenagers or young adults. Minecraft players are advised to trust only official sources for mods and verify download links to protect against these threats.

AppWizard

June 3, 2026

Fake ‘Minecraft’ Mods Bring Malware to as Many as 116,000 Players

The "Minecraft" community is facing a cybersecurity threat from a malware operation called WeedHack, which disguises itself as fake mods to lure players into downloading it. This operation, run by a teenager, has affected over 116,000 players and uses social engineering tactics to distribute malicious mods, cheats, and clients. WeedHack spreads through trusted channels, including YouTube, and employs search engine optimization poisoning to mislead users. The malware operates by disseminating malicious Java Archive files that appear legitimate, compromising devices to extract sensitive information such as session IDs, browser cookies, and cryptocurrency wallet data. It can also steal credentials for applications like Discord, Steam, and Telegram, and includes remote control features for surveillance and keylogging. Approximately 2,000 new infections occur daily, primarily affecting users in the United States, Germany, India, the United Kingdom, and Italy. The low cost of access to this malware has led to its use by teenagers for online bullying and harassment.