NewApp Digest
search bot

digital signature

Android 17 Beta 4 arrives with post-quantum cryptography and new memory limits
AppWizard
April 18, 2026

Android 17 Beta 4 arrives with post-quantum cryptography and new memory limits

On April 16, Google released Android 17 Beta 4, concluding its beta phase and focusing on app compatibility and platform stability. Developers must finalize updates for Android 17 to avoid delays when the stable version is released. Key behavioral changes for apps targeting Android 17 include: - Large-screen resizability restrictions, preventing apps from opting out of maintaining orientation, resizability, and aspect ratio constraints. - Expanded restrictions on dynamic code loading, requiring native files loaded via System.load() to be read-only. - Certificate Transparency is enabled by default. - Local network access is restricted by default, with a new ACCESSLOCALNETWORK permission for persistent access. - Stricter rules on background audio interactions, including playback and volume change APIs. Android 17 introduces per-app memory limits based on device RAM to target memory leaks and anomalies, with minimal impact expected on app sessions. Developers can check for memory limit impacts via ApplicationExitInfo and utilize profiling tools in Android Studio Panda. An on-device anomaly detection service monitors resource-intensive behaviors and provides profiling artifacts. Additionally, the Android Keystore now supports ML-DSA for quantum-safe signatures, allowing developers to generate keys and create signatures within secure hardware.
Microsoft adds Windows protections for malicious Remote Desktop files
Winsage
April 15, 2026

Microsoft adds Windows protections for malicious Remote Desktop files

Microsoft has introduced new security measures for Windows 10 and Windows 11 to protect against phishing attacks that exploit Remote Desktop Protocol (RDP) connection files. These updates, part of the April 2026 cumulative updates (KB5082200, KB5083769, and KB5082052), include a one-time educational prompt for users upon first opening an RDP file, requiring acknowledgment of the associated risks. Subsequent attempts to open RDP files will display a security dialog with information about the file's publisher, the remote system address, and local resource redirections, with options disabled by default. If an RDP file is unsigned, a warning will indicate an "Unknown remote connection." These protections apply only to connections initiated through RDP files, not through the Windows Remote Desktop client, and can be temporarily disabled via the Windows Registry.
Kazakhstan Considers National Messaging App Aitu for Insurance Companies - The Times Of Central Asia
AppWizard
April 10, 2026

Kazakhstan Considers National Messaging App Aitu for Insurance Companies – The Times Of Central Asia

Kazakhstan’s Agency for Regulation and Development of the Financial Market is considering the domestic messaging platform Aitu for communication between insurance companies, non-bank financial institutions, and their clients. The regulator has encouraged market participants to assess Aitu as a communication tool aimed at enhancing personal data protection. Concerns have been raised about Aitu’s user base, functionality, integration costs, and the absence of clear regulatory guidelines for handling personal and financial data. The adoption of Aitu is not mandatory but is seen as a potential secure communication channel. Aitu’s infrastructure supports high data protection due to localized servers in Kazakhstan, which reduces risks of cross-border data issues. The platform features end-to-end encryption and biometric identification through Aitu Passport, aiming to enhance user verification and minimize phishing and identity theft risks. The agency noted that open APIs and business dashboards could allow financial institutions to integrate with Aitu cost-effectively. Additionally, government agencies and quasi-state companies have been encouraged to use Aitu for official communications.
What Is Conhost.exe?
Winsage
March 31, 2026

What Is Conhost.exe?

Conhost.exe, or Console Window Host, is a legitimate Windows system process responsible for managing the display and behavior of console windows such as Command Prompt and PowerShell. It facilitates text rendering and manages input/output interactions with the graphical user interface. Each time a console application is launched, a new instance of conhost.exe is created, and multiple instances can appear in Task Manager based on active console applications. To verify the authenticity of conhost.exe, it should run from C:WindowsSystem32 or C:WindowsSysWOW64, have a valid Microsoft Windows Publisher digital signature, and not make outbound network connections. High CPU usage or unusual behavior may indicate malware masquerading as conhost.exe. Troubleshooting steps for issues related to conhost.exe include running a malware scan, checking for Windows updates, updating device drivers, and using the System File Checker. Disabling conhost.exe is not advisable as it is essential for the functioning of console applications.
How AI And Hacking Professionalism Are Overwhelming Endpoint Security
Tech Optimizer
March 19, 2026

How AI And Hacking Professionalism Are Overwhelming Endpoint Security

The digital landscape is transforming due to the professionalization of cybercrime, which is now a significant part of organized crime, second only to drug trafficking. Malware includes various types such as viruses, browser hijackers, password stealers, Trojans, botnet malware, and ransomware. Traditional antivirus solutions rely on signature-based detection, heuristic analysis, and behavior monitoring, but these methods can lead to false positives and negatives. The evolution of cybersecurity has seen the rise of "Ransomware-as-a-Service" (RaaS) and the use of polymorphic malware that changes its signature, making traditional defenses ineffective. Hackers are also using AI and machine learning to evade behavioral monitoring. New defense strategies include Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR), which focus on monitoring for breaches rather than preventing them. Leading vendors in this space include CrowdStrike, SentinelOne, Microsoft, and Palo Alto Networks. The zero trust security framework treats all access attempts as potentially hostile and emphasizes the integration of various security technologies. Emerging startups like FinalAV Security are developing zero trust solutions for consumers and small businesses, focusing on prevention rather than detection.
eScan Antivirus Update Servers Compromised to Deliver Multi-Stage Malware
Tech Optimizer
February 11, 2026

eScan Antivirus Update Servers Compromised to Deliver Multi-Stage Malware

MicroWorld Technologies confirmed a breach of its eScan antivirus update infrastructure, allowing attackers to deliver a malicious downloader to enterprise and consumer systems. Unauthorized access was detected, leading to the isolation of affected update servers for over eight hours. A patch was released to revert the changes made by the malicious update, and impacted organizations were advised to contact MicroWorld for assistance. The attack occurred on January 20, 2026, when a compromised update was distributed within a two-hour window. The malicious payload, introduced through a rogue "Reload.exe" file, hindered eScan's functionality, blocked updates, and contacted an external server for additional payloads. This rogue executable was signed with a fake digital signature and employed techniques to evade detection. It also included an AMSI bypass capability and assessed whether to deliver further payloads based on the presence of security solutions. The malicious "CONSCTLX.exe" altered the last update time of eScan to create a false sense of normalcy. The attack primarily targeted machines in India, Bangladesh, Sri Lanka, and the Philippines, highlighting the rarity and seriousness of supply chain attacks through antivirus products.
PDFSIDER Malware Actively Used by Threat Actors to Bypass Antivirus and EDR Defenses
Tech Optimizer
January 19, 2026

PDFSIDER Malware Actively Used by Threat Actors to Bypass Antivirus and EDR Defenses

PDFSIDER is a sophisticated backdoor malware that bypasses modern endpoint detection and response systems. It is distributed through targeted spear-phishing campaigns that exploit vulnerabilities in legitimate PDF software. The malware is delivered via spear-phishing emails containing ZIP archives with a trojanized executable disguised as the PDF24 App. When executed, it uses DLL side-loading to load a malicious DLL (cryptbase.dll) alongside the legitimate PDF24.exe, allowing attackers to execute code without detection. PDFSIDER establishes encrypted command-and-control channels using the Botan 3.0.0 cryptographic library with AES-256 in GCM mode and operates mainly in memory to minimize detectable artifacts. It collects system information and executes commands through hidden cmd.exe processes. The malware employs advanced techniques to evade detection in sandbox and virtual machine environments, including checks for available RAM and debugger presence. Indicators of compromise include the malicious file cryptbase.dll and various clean files associated with the legitimate PDF24 application. Organizations are advised to enforce strict controls on executable files, provide user awareness training, and monitor DNS queries and encrypted traffic to detect PDFSIDER communications. The malware's behavior aligns with tactics used in state-sponsored espionage rather than financially motivated cybercrime.
Popular YouTube app for Android TV ‘SmartTube’ compromised with malware
AppWizard
December 1, 2025

Popular YouTube app for Android TV ‘SmartTube’ compromised with malware

The developer of SmartTube, an ad-free YouTube client for Android TV, confirmed a security breach involving the app's signing key, which allowed malicious actors to inject harmful code into app updates. The breach was disclosed by Yuriy Yuliskov, the maintainer, who advised users to avoid reinstalling the old app and instead wait for a newly signed version. A reverse-engineering analysis of the infected APKs revealed that they were gathering sensitive information and transmitting it to a remote server. Versions 28.56 to 30.52 were particularly affected, and Google Play Protect began disabling installations of SmartTube. In response, Yuliskov wiped his hard drive and released a new version, 30.56, with a different signing key and app ID. Transparency concerns remain, and the developer plans to disclose details about the breach and measures to prevent future incidents. Users have requested additional security assurances, including hashes of clean builds.
SmartTube app was infected by malware, here's what happened
AppWizard
December 1, 2025

SmartTube app was infected by malware, here’s what happened

Google Play Protect disabled the SmartTube app on Android TV, labeling it as potentially harmful due to a compromised digital signature. The developer, Yuliskov, confirmed that the signature breach allowed for the creation of counterfeit app versions that could carry malware. A user discovered that SmartTube version 30.51 contained a hidden library that collected device-specific information and transmitted it to external servers, raising concerns about botnet activity. Certain versions of SmartTube, specifically 30.43 and 30.47, were confirmed to have been compromised due to malware on the developer's computer. Users were advised to uninstall infected versions, including 28.56, 28.58, 28.66, 28.75, 28.78, 29.13, 29.37, 29.62, 29.63, 29.85, 30.27, 30.32, 30.38, 30.40, 30.43, 30.44, 30.45, and 30.51, and to download the newly released safe version from trusted sources. Yuliskov assured users that the compromised computer has been cleaned and that new releases are secure.
Search