delivery Archives

Tech Optimizer

September 21, 2026

Thousands of hacked sites trick you into installing malware

More than 5,400 websites across over 2,200 organizations have been compromised to propagate malware, primarily affecting small businesses like clinics and online retailers. The attack mechanism involves malicious code that triggers a deceptive CAPTCHA, instructing users to execute commands that can download malware. Attackers are using the BNB Smart Chain test network to store instructions, making it harder for investigators to shut down operations. A newer variant of the attack uses WebRTC technology to establish encrypted connections for delivering additional malicious code. To protect against these threats, users should avoid pasting commands from websites, be suspicious of unusual CAPTCHA instructions, use strong antivirus protection, keep systems updated, take action if commands are executed, and small business owners should regularly verify their website's integrity.

Tech Optimizer

September 20, 2026

How to Remove a Keylogger: 12 Steps, 60 Min [2026]

A keylogger captures every keystroke made on a device and sends that information to an external source. In 2025, infostealer malware, including keyloggers, resulted in the theft of 642.4 million credentials from 13.2 million infections globally. In Australia, approximately 30,000 banking passwords were compromised between 2021 and 2025 due to this malware. The Australian Cyber Security Centre reported over 42,500 calls related to credential theft in one year, a 16% increase. Four main malware families dominate the landscape, with LummaC2 accounting for nearly 60% of credentials linked to infostealers in 2026. Keyloggers can be detected through signs such as typing lag, unexpected antivirus notifications, new browser extensions, and unexplained spikes in outbound data usage. Detection and removal steps include checking running processes, auditing startup programs, reviewing installed programs, running antivirus scans, and resetting passwords from a clean device. Keyloggers can infiltrate systems via phishing emails, malicious attachments, or compromised software downloads. Mobile devices can also be targeted by keyloggers disguised as legitimate apps.

AppWizard

September 19, 2026

Valve open-sources Lepton, its Android compatibility layer for the Steam Frame

Valve has open-sourced Lepton, an Android compatibility layer for the Steam Frame headset, allowing VR developers to adapt existing Android games for the device. The code is available on Valve's GitLab repository and facilitates the transition without needing to reconstruct games for a different platform. Lepton is designed to create a game-optimized Android environment rather than transforming the Steam Frame into a general Android device. It disables unnecessary Android services to maintain efficiency and integrates with the SteamOS host system, supporting various graphics stacks and Vulkan tools for enhanced VR gaming. Lepton operates without requiring root access, with each process running as a non-root user, and provides developers with tools for debugging and performance profiling. The open-sourced code offers insight into Valve's approach to supporting Android games on SteamOS.

AppWizard

September 19, 2026

Google’s Android Bench 2.0 tests AI agents on week-long app builds

Google has launched Android Bench 2.0, an upgraded benchmark for evaluating AI coding agents, which now includes 30 long-horizon tasks that can take human engineers days or weeks to complete. The best pass rate for these tasks is around 28%, down from approximately 91% in the previous version. The benchmark measures both pass rates and completion rates, acknowledging partial progress rather than just failures. It assesses various challenges, including app creation and feature integration, using a comprehensive scoring methodology that evaluates functionality, regression checks, and visual fidelity. AI models perform better with new code than with modifications to existing systems, facing challenges in runtime validation and cross-platform conversions. The current leaderboard shows OpenAI’s GPT-6 Astra leading with a 28% pass rate, while Gemini 3.8 Flash has an 8% pass rate. Developers using AI agents should be aware that while AI can generate significant portions of applications, further refinements will require human input. The benchmark is available on Google’s Android Bench leaderboard.

AppWizard

September 17, 2026

New Chinese-Made ‘RatHat’ Android Malware Leverages AI to Steal Financial Data

Security researchers at Zimperium have identified a new strain of Android malware called RatHat, which is linked to threat actors from China and is designed to steal sensitive credentials and banking information. RatHat infiltrates devices through phishing sites, malvertising, and SMS phishing (smishing), tricking users into downloading malicious Android package kits (APKs). The malware uses a dropper to activate its payload, which is hidden in encrypted assets, and employs techniques to bypass Android's security measures. RatHat consists of three main components: a malicious Android application, a Go agent (liblocal-service.so), and an FRP client (libmedia_codec.so). The app collects sensitive information such as banking credentials, notifications, 2FA codes, OTP keys, and screen inputs. It features a generative AI user interface-automation engine that communicates in Mandarin and can perform various tasks like determining screen coordinates and issuing navigation commands. The Go agent acts as a command-and-control executor, executing commands to bypass app-level security and manage system-level tasks. The FRP client maintains a secure reverse tunnel to the attacker's server, allowing ongoing remote access to the device. The architecture of RatHat demonstrates the inadequacy of traditional mobile security measures against such advanced threats.

Winsage

September 15, 2026

China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE

A spear-phishing campaign linked to the Chinese threat actor UTA0560 targeted various NGOs on September 1, 2026, exploiting recently patched vulnerabilities in Google Chrome and Microsoft Windows. The campaign utilized a malicious JavaScript backdoor called GRIMWEDGE, which was deployed through a multi-stage exploit chain that involved three vulnerabilities: CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880. The attack began with spear-phishing emails that led recipients to a vulnerable U.S.-based university website, allowing attackers to redirect users to their infrastructure. The exploit chain enabled arbitrary code execution and facilitated the deployment of GRIMWEDGE, which is capable of host reconnaissance, file and process management, command execution, and payload delivery. The initial payload was an executable named "msgbox.exe," which extracted a legitimate Windows binary and a malicious DLL called "wsc.dll." This DLL initiated a sideloading chain and contacted a command-and-control server for further instructions. GRIMWEDGE allows for several commands, including system reconnaissance, directory listing, file deletion, and command execution in a hidden window. It lacks built-in persistence or lateral movement mechanisms but provides a foothold for further exploitation. Concurrently, another Chinese threat actor, JungleBamboo (APT31), used the same exploit chain to deploy a loader named SUPERSTOMP, which installs a credential-stealing Chrome extension called LONGTALE. The simultaneous use of the exploit chain by multiple actors suggests potential sharing or sale of the exploit, raising concerns about patch-gap vulnerabilities that pose risks for exploitation campaigns.

AppWizard

September 15, 2026

Active Exploitation Alert: Threat Actors Abuse Anthropic Claude AI to Extract Secrets from 1.8M Android Apps in Major Credential Theft Campaign

Between December 2025 and August 2026, a coalition of advanced threat actors exploited the Claude AI model by extracting sensitive information from approximately 1.8 million Android applications. The operation involved groups such as ShinyHunters, Midnight Blizzard (APT29/Nobelium), and the Chinese-speaking entity GTG-10007. They automated the mass download, decompilation, and analysis of Android APKs for hardcoded credentials, API keys, and authentication tokens, leading to extensive credential theft and breaches across various sectors. The attack utilized a distributed pipeline on ten AWS EC2 instances to download APKs, which were then scanned using TruffleHog. Verified secrets were organized and routed in real-time to a private Telegram group for operational deployment. Over 2,100 Azure AD authentication tokens were extracted from more than 40 Microsoft tenants within 34 hours. The operation also included a carding component where stolen payment card data was sold. The tactics employed aligned with several MITRE ATT&CK techniques, including file discovery, unsecured credentials, valid accounts, phishing, and exploitation of remote services. ShinyHunters gained administrative control over targeted environments rapidly, leading to bulk data theft affecting over 200 organizations. Midnight Blizzard automated malware creation and phishing campaigns, targeting government and defense entities. GTG-10007 used Claude for coordinated offensive operations, discovering zero-day vulnerabilities and delivering exploits. Initially, the campaign targeted a broad range of Android APKs but later focused on organizations with valuable credentials across various sectors, including government, technology, and healthcare. Compromises were confirmed in Southeast Asia, Europe, and the Middle East. Organizations are advised to audit Android applications for hardcoded secrets, monitor API key usage, and implement robust security practices to mitigate risks.

Tech Optimizer

September 11, 2026

12-Year-Old PostgreSQL Flaw Lets Attackers Execute Code on Database Servers

A PostgreSQL vulnerability identified as CVE-2026-6471, known as PostGREShell, allows attackers with minimal replication access to execute arbitrary code on database servers. This flaw has existed for approximately 12 years and affects non-superuser PostgreSQL accounts with the REPLICATION attribute, commonly used for backup and replication tasks. The vulnerability arises from inadequate restrictions on the library path specified as an output plugin name, enabling an attacker to exploit the logical decoding feature to load a malicious library. Exploitation requires only a PostgreSQL account with REPLICATION privileges, wal_level set to logical, and access to SMB port 445. The flaw was discovered by Cyera Research and dates back to PostgreSQL 9.4's release in 2014. Patches have been released for versions 18.6, 17.11, 16.15, 15.19, and 14.24, and organizations are advised to upgrade to these versions. Database administrators should audit accounts with the REPLICATION attribute and restrict replication connections. Limiting outbound network access and monitoring logical replication activity is also recommended to mitigate risks.

Tech Optimizer

September 11, 2026

Improving Lakebase Postgres compute cache

Lakebase Postgres employs a disaggregated storage model that enhances data management through efficient caching, utilizing an object store like S3 for backups. The caching operates on two layers: within distributed storage for optimizing write and read performance, and on the Postgres compute side for ultra-fast access to frequently accessed pages. Traditional Postgres caching involves shared buffers and the OS page cache, which leads to double buffering and inefficiencies. Lakebase Postgres addresses these issues by implementing a local file cache (LFC) and larger shared buffers, allowing for more effective memory utilization without the drawbacks of the OS page cache. The shared buffers are set to a maximum of 1 GB, while the LFC can utilize up to 75% of DRAM. The introduction of huge pages reduces memory management overhead and improves performance, resulting in significant throughput increases and reduced latency in production environments. Recent enhancements have shown up to 2× throughput improvements and substantial reductions in CPU usage. The focus is now on extending these benefits to autoscaling Postgres computes, with plans to implement dynamic shared buffers and autoscaling huge pages.

Winsage

September 11, 2026

Microsoft Issues New Windows 11 Release Preview Builds

Microsoft has released new builds for Windows 11, versions 24H2 and 25H2, available for download from the Release Preview channel, specifically builds 26100.9539/26200.9539. The rollout is structured into two phases: a gradual rollout, which allows features to reach devices incrementally, and a normal rollout, which releases updates to all eligible devices simultaneously. Enhancements in this update include improvements to File Explorer, Wi-Fi support in the Windows Recovery Environment, support for Emoji 17.0, a new Tips widget, various personalization, Bluetooth, and accessibility improvements, and the ability to remap the Copilot key to Right Ctrl or Context Menu. The last updates for versions 24H2 and 25H2 were released in mid-August, and Microsoft introduced its first 26H2 build to the Release Preview channel two weeks ago. There is speculation about the potential release of Windows 11 version 26H2 in October, possibly coinciding with upcoming Patch Tuesday updates.