detection Archives

Winsage

July 25, 2026

Microsoft finally found a Windows ad it doesn’t like

Users of LG monitors have reported frustration over unsolicited McAfee pop-up ads that automatically appear during the Windows Update process. This issue arises from the installation of the "LG Monitor App Installer," which includes promotional software alongside the standard monitor driver. Reports indicate that this software installs without user consent, even when only a video cable is connected. Following an investigation by Gamers Nexus, Microsoft announced that LG has agreed to disable the McAfee pop-up, although the LG Monitor App Installer will still be automatically downloaded via Windows Update.

AppWizard

July 24, 2026

Fitbit Air’s newest update brings nothing new except invisible bug fixes

Google has begun rolling out firmware version 253.2 for the Fitbit Air, focusing on reliability and minor bug fixes without introducing new features. This is the second firmware release for the device, following an update last month. The update will be gradually available over the next few days. Users must ensure their Fitbit Air is charged or connected to its charger with at least 50% battery life and maintain a Bluetooth connection with a phone or tablet that has the latest version of the Google Health app for installation. Google recommends updating during the day or evening to avoid inaccuracies in daily step counts. The installation process takes about 10 minutes and involves using the Google Health app to initiate the update.

Tech Optimizer

July 24, 2026

CrashStealer Mac malware steals passwords and wallets

A sophisticated new malware targeting Mac users, named CrashStealer, has been discovered by security researchers at Jamf Threat Labs. It masquerades as Apple's legitimate crash-reporting software and was first identified in May 2026, with active attacks detected by early July. CrashStealer is designed to extract sensitive information, including browser credentials, password manager data, and cryptocurrency wallet information, and can copy the Mac login Keychain. It uses native C++ programming, encrypts collected files, and employs anti-debugging features. The malware is distributed through a disk image labeled "Werkbit Setup," which features a polished installer that bypasses Mac security warnings by using a valid Apple Developer ID and notarization ticket. Once opened, it connects to GitHub for commands and downloads a script that installs a second disk image named CrashReporter.dmg, which mimics an Apple system component. CrashStealer presents a fake password prompt resembling a legitimate macOS request, verifying entered passwords locally. It targets data linked to various browsers and password managers, scanning for approximately 80 cryptocurrency wallet extensions and 14 password managers. Stolen data is stored in hidden folders, encrypted using AES-256-GCM, and packaged into hidden ZIP archives before being uploaded. Warning signs of infection include a website requiring a meeting PIN for download, unexpected password prompts, and unfamiliar apps requesting Full Disk Access. Users are advised to download apps from verified sources, avoid overriding security warnings, pause before entering passwords, review app permissions, install security updates, use antivirus software, and act quickly if they installed Werkbit Setup.

AppWizard

July 24, 2026

Ultrahuman’s new ‘Emerald’ update is a massive overhaul of how the app works

Ultrahuman has released the "Emerald" update for its companion app, featuring a new design and enhanced user experience for Ultrahuman Ring PRO and other devices. The update introduces the "UltraSphere," a decision-making engine that provides personalized "Next Best Actions" based on factors like location, weather, and circadian rhythms. It utilizes health metrics such as heart rate variability, skin temperature, and movement patterns, and can incorporate blood glucose levels for users with Ultrahuman M1 or M2 Live devices. The update also includes new tabs for health insights, such as the "Sleep Screener," which consolidates sleep data, and the "Longevity Tab," which aggregates health markers related to lifespan. The "Windows" feature offers insights into time-sensitive data. Workout tracking has been improved with better automatic detection and heart rate algorithms, increasing VO2 Max accuracy by 21%. Users can connect third-party devices for seamless workout tracking. All health data processing now occurs on-device, allowing access to insights without network connectivity. The Emerald update is being rolled out globally and is available on the Google Play Store and Apple App Store.

TrendTechie

July 24, 2026

BitTorrent исполнилось 25 лет. Как программа одного человека изменила интернет и поставила Голливуд в тупик

On July 2, 2001, Bram Cohen announced the operational status of his program, BitTorrent, on a mailing list for peer-to-peer network developers. BitTorrent revolutionized file sharing by segmenting files into smaller pieces, allowing users to download from multiple sources simultaneously and share already downloaded data, which improved download speeds as file popularity increased. Unlike earlier peer-to-peer networks, BitTorrent did not have a built-in catalog, relying on external websites for users to locate torrents. The first major torrent catalog, Suprnova, emerged in 2002, followed by The Pirate Bay in 2003, making the protocol widely accessible. By 2004, BitTorrent accounted for nearly a third of all internet traffic. In 2004, Cohen founded BitTorrent Inc., which acquired the client µTorrent in 2006. The company launched the BitTorrent Entertainment Network in 2007, but it closed in 2008 due to competition from free pirated content. BitTorrent Inc. later explored various technologies but struggled to establish a sustainable business model. The protocol evolved with decentralization features like the distributed hash table (DHT) and magnet links. In 2018, BitTorrent was acquired by the blockchain project TRON for an estimated 0 million. BitTorrent Inc. claims around 54 million active users per month, with additional users on independent clients. Despite a decline in torrent traffic from its peak, the network has been experiencing growth, attributed to rising streaming costs and fragmented content availability.

Tech Optimizer

July 23, 2026

Optimizing PostgreSQL on Azure directly in Visual Studio Code

Poor database performance can lead to missed SLAs, delayed releases, customer dissatisfaction, and lost revenue. Microsoft has enhanced PostgreSQL on Azure, transforming it into a fully managed platform that meets enterprise demands. Azure Database for PostgreSQL and the new Azure HorizonDB offer significant performance improvements, with HorizonDB being three times faster than self-managed PostgreSQL. The PostgreSQL extension for Visual Studio Code integrates performance management into development workflows, providing tools for managing PostgreSQL throughout its lifecycle. Key features include a server metrics dashboard that displays performance indicators, Azure Advisor recommendations for actionable insights, improved query plan visualization, and AI-assisted query analysis. The extension also enhances schema design and query formulation experiences, ensuring secure and governed interactions with PostgreSQL. Azure HorizonDB is in public preview, designed for AI-native workloads. These advancements aim to reduce friction, enhance clarity, and enable faster actions for enterprise teams managing PostgreSQL at scale.

AppWizard

July 23, 2026

Active Exploitation Alert: Fake Bahrain Alert App Deploys Advanced Android Surveillance Malware Targeting Gulf Region Users

A cyber-espionage campaign has been identified involving a counterfeit Bahrain Alert Android application designed to surveil individuals in Bahrain and the Gulf region. The app masquerades as an official civil defense tool and employs social engineering tactics to compromise Android devices, extract sensitive data, and maintain remote access. It targets high-value individuals such as activists and journalists, particularly during civil unrest and missile alerts, leveraging trusted government branding to increase infection rates. The malware features a complex, multi-stage architecture with advanced evasion techniques and is distributed through phishing links and malicious websites. It initiates a four-stage infection process, ultimately installing a remote access trojan (RAT) that enables covert surveillance and encrypted communications. The malware can monitor device activity, capture credentials, and intercept communications, while also employing mechanisms to avoid detection and maintain persistence. The campaign primarily targets Bahraini citizens, exploiting fear during crises to encourage app installation. Although there are indications of Russian-speaking developers involved, there is no definitive attribution to a specific nation-state or APT group. Mitigation strategies include monitoring for suspicious app installations, user education on verifying app authenticity, and blocking known malicious domains.

AppWizard

July 23, 2026

ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories

GitHub will reject command-line support bundle uploads from outdated versions of GitHub Enterprise Server lacking security patches starting August 18, 2026. The npm package @copilot-mcp/apex has been identified as a post-install dropper that installs a macOS infostealer, phishing for sensitive information and maintaining a connection to an attacker's server. A rogue extension on the Microsoft Visual Studio Code marketplace, "Markdown All Pro," impersonates a legitimate tool and opens a backdoor after installation. A phishing campaign targeting Portuguese users delivers the Lampion banking malware, which has been active since 2019. DoubleVerify reports a rise in "AfterCall" apps that exploit user permissions for ad fraud. The GhostCommit attack method hides malicious instructions within PNG images in pull requests. The U.S. government has updated its advisory on Iranian-affiliated cyber activity targeting operational technology devices. An Android app posing as a civil defense alert system has been found to contain malware for data harvesting. An Iranian threat actor is distributing MarkiRAT malware through fake applications. An analysis of 28 AI-coded applications revealed 434 vulnerabilities, prompting Cisco to introduce Antares to identify vulnerabilities in codebases. A Russian-speaking threat actor is dismantling guardrails on AI models to create offensive tools.

Tech Optimizer

July 21, 2026

Advanced Threat Protection: How AI Transforms Enterprise Security

An attacker is testing stolen passwords against a company with inadequate firewall protection, highlighting the flaws in traditional security measures. Modern attacks, including ransomware and phishing, have evolved, necessitating advanced threat protection (ATP) that incorporates artificial intelligence (AI) for improved threat detection and response. AI-driven ATP identifies attacks that conventional tools miss, such as fileless malware and targeted phishing, by learning normal operating patterns and flagging deviations. Traditional security relies on known malware signatures, which are ineffective against zero-day attacks and polymorphic malware that changes its identity. Cloud misconfigurations and hybrid security gaps further complicate security. AI enhances detection by focusing on malicious behaviors rather than just file signatures, allowing for rapid identification of threats. Automated incident response can isolate affected endpoints and terminate malicious processes quickly. Behavioral analytics and threat intelligence integration improve ATP effectiveness by understanding user behavior and recognizing attack patterns. AI-powered ATP significantly reduces breach containment time and false positives, shifting the focus from reactive cleanup to proactive prevention. Best practices for maximizing ATP include integrating it into existing security operations, keeping machine learning models updated, and regularly testing defenses against real-world threats.

Tech Optimizer

July 21, 2026

Advanced Threat Protection: How AI Transforms Enterprise Security

An attacker is testing stolen passwords against a company that incorrectly believes its firewall is sufficient protection. Traditional defenses have become inadequate due to the speed and sophistication of modern attacks, including ransomware groups renting tools and phishing kits being easily accessible. Advanced threat protection (ATP) was designed to address these challenges, especially with the integration of artificial intelligence (AI). AI-powered ATP identifies attacks that conventional tools overlook, such as fileless malware and targeted phishing attempts, by learning the normal behavior of an organization’s environment and flagging anomalies. Traditional security relies on identifying known malware through established fingerprints, which fails against novel threats like zero-day attacks and polymorphic malware. The rise of remote work and cloud services has introduced new risks due to misconfigurations and inconsistent security rules. AI enhances threat detection by focusing on malicious behavior rather than matching files against known threats, allowing for rapid detection and automated incident response. Behavioral analytics establishes a baseline for users and devices, flagging deviations that may indicate insider threats or credential theft. Integrating threat intelligence provides insights into emerging threats and helps prioritize alerts. AI-driven ATP can contain breaches faster, significantly reducing the financial impact and dwell time of attackers. Best practices for maximizing ATP include integrating with security operations, ensuring comprehensive coverage, updating models regularly, conducting real-world testing, securing AI systems, and maintaining human oversight.