NewApp Digest
search bot

disguise

Tor VPN Beta brings isolated app-by-app Tor routing to Android
AppWizard
September 10, 2026

Tor VPN Beta brings isolated app-by-app Tor routing to Android

The Tor Project has launched Tor VPN Beta for Android, allowing mobile applications to route traffic through the Tor network, expanding beyond web browsing. This development was driven by user demand for privacy tools to bypass internet censorship, particularly in restrictive regions. The concept originated in 2021, and after initial testing and user feedback, the beta was announced on September 9. Tor VPN creates a separate Tor circuit for each application, enhancing privacy by complicating activity correlation across apps. Users can select which applications use Tor, and the interface has been improved for easier management. The beta version 1.4.0 includes support for WebTunnel bridges to disguise Tor connections as standard encrypted traffic. Usability testing revealed issues with exit-node selection, leading to a design change that requires users to connect to Tor before choosing an exit. Tor VPN is built on the Arti implementation of the Tor protocol and the Onionmasq networking layer, ensuring stability and component sharing. The software supports reproducible builds and is available via F-Droid and APK downloads. A security review in June 2025 found no major flaws but identified some issues being addressed. Tor VPN is currently in beta and focuses on enhancing circumvention capabilities and usability rather than competing with commercial VPNs on speed. Users in censored areas are advised to configure bridges for access.
ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions
Tech Optimizer
August 31, 2026

ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions

Silver Fox is linked to the distribution of a backdoor malware called ValleyRAT, disguised as the legitimate QN Wallpaper adware application. Once installed, ValleyRAT provides complete control over the compromised machine. The malware uses DLL sideloading to operate under the guise of a legitimate process, bypassing security measures. It disables Windows Defender and adds itself to autorun entries, and can mark its process as critical, causing system crashes if terminated. Kaspersky has identified specific indicators of compromise (IoCs) including hashes, command-and-control servers, and associated domains. In 2026, Kaspersky recorded over 100,000 detections of ValleyRAT affecting more than 1,500 unique users, mainly in China and India.
The temporary download folder unleashes 35% of infostealers on Windows
Tech Optimizer
August 18, 2026

The temporary download folder unleashes 35% of infostealers on Windows

Executing files directly from the temporary download folder is the primary gateway for infostealers targeting Windows systems, accounting for approximately 35% of analyzed infections. The second most common entry point is C:WindowsMicrosoft.NETFramework, appearing in 32% of cases and associated with advanced tactics like process injection. The findings are based on a report by Kaspersky, which analyzed five million records from the dark web. Malicious files often disguise themselves as legitimate software, such as fake codecs or program activators. Kaspersky recommends monitoring exposed assets and not disabling antivirus software during installations.
Hackers use fake Adobe and Zoom updates to load malware onto victim devices — here's what to look out for
Tech Optimizer
August 8, 2026

Hackers use fake Adobe and Zoom updates to load malware onto victim devices — here’s what to look out for

Securonix Threat Research has identified a cyber campaign called SMOKE#SCREEN that uses deceptive tactics to trick users into installing weaponized versions of ScreenConnect, a legitimate remote monitoring software. The attackers disguise their malicious intent with fake update notifications for applications like Zoom and Adobe, as well as counterfeit business documents. This campaign allows attackers to gain persistent remote access to victims' systems, disable security protections, and exploit trusted services like Dropbox and Cloudflare for delivering malicious payloads. Victims have been reported on both Windows and macOS platforms. Businesses are advised to verify updates through official channels and train staff on the risks of unexpected software installations.
Scrappy RAT Malware Targets Chrome And Edge Users
Tech Optimizer
July 25, 2026

Scrappy RAT Malware Targets Chrome And Edge Users

A new remote access trojan (RAT) named msaRAT has been identified by Cisco Talos, linked to the Chaos ransomware group and built using Rust. It exploits Chrome and Edge browsers to disguise its traffic and evade detection. MsaRAT operates through a headless browser process, enabling remote code execution and facilitating ransomware deployment, data theft, and other malicious activities. It is typically installed via phishing emails or malicious files, making it resistant to standard browser patches. Cisco Talos recommends specific SNORT rules and a ClamAV signature for detection. Indicators of Compromise (IoC) include traffic to the IP address 172.86.126.18 and the domain is-01-ast.ols-img-12.workers.dev. The malware primarily targets large organizations, but individual users may also be at risk.
silver Android smartphone
Tech Optimizer
July 10, 2026

Hackers Use Fake VLC Executable and Malicious libvlc.dll to Deploy ValleyRAT

Cybercriminals are exploiting the VLC media player to install ValleyRAT, a remote access trojan, by embedding malware in a seemingly harmless file linked in phishing emails. The attack starts with an email that prompts the victim to download a ZIP archive containing a fake VLC executable and a malicious DLL named libvlc.dll. This method uses DLL sideloading to execute the malware under the guise of a legitimate application. Once executed, the malware establishes persistence by creating a registry entry and connects to a remote server to retrieve the final payload. ValleyRAT employs evasion tactics to avoid detection, including assessing system characteristics before executing harmful actions and using a fileless approach to deliver the payload directly into memory. Researchers have identified indicators of compromise, including specific SHA1 hashes and URLs associated with the malicious campaign.
This month's Humble Choice is worth a look if you like RPGs, Zelda-likes, fast-paced shooters, or violating people's civil rights
AppWizard
July 8, 2026

This month’s Humble Choice is worth a look if you like RPGs, Zelda-likes, fast-paced shooters, or violating people’s civil rights

This month's Humble Choice features a selection of games appealing to fans of classic RPGs, nostalgic adventures, and action-packed shooters. One standout title has received a score of 85%, noted for its platforming time trials and featuring the English voice actor of Spike Spiegel. Another title, Tunic, has an 86% score and is praised for its challenging combat and exploration, reminiscent of classic Zelda games. Sea of Stars is highlighted for its beautiful RPG aesthetics. The offerings are available for approximately £11.50, and users are reminded to cancel their subscriptions after claiming their keys if they choose to do so.
Search