domains Archives

Winsage

November 25, 2025

JackFix Uses Fake Windows Update Pop-Ups on Adult Sites to Deliver Multiple Stealers

Cybersecurity experts have identified a new campaign that combines ClickFix tactics with counterfeit adult websites to trick users into executing harmful commands under the guise of a "critical" Windows security update. This campaign uses fake adult sites, including clones of popular platforms, as phishing mechanisms, increasing psychological pressure on victims. ClickFix-style attacks have risen significantly, accounting for 47% of all attacks, according to Microsoft data. The campaign features convincing fake Windows update screens that take over the user's screen and instruct them to execute commands that initiate malware infections. The attack begins when users are redirected to a fake adult site, where they encounter an "urgent security update." The counterfeit Windows Update screen is created using HTML and JavaScript, and it attempts to prevent users from escaping the alert. The initial command executed is an MSHTA payload that retrieves a PowerShell script from a remote server, which is designed to deliver multiple payloads, including various types of malware. The downloaded PowerShell script employs obfuscation techniques and seeks to elevate privileges, potentially allowing attackers to deploy remote access trojans (RATs) that connect to command-and-control servers. The campaign has been linked to other malware execution chains that also utilize ClickFix lures. Security researchers recommend enhancing defenses through employee training and disabling the Windows Run box to mitigate risks associated with these attacks.

Winsage

November 25, 2025

ClickFix attack uses fake Windows Update screen to push malware

Recent observations have identified ClickFix attack variants where cybercriminals use deceptive Windows Update animations on full-screen browser pages to hide malicious code within images. Victims are misled into executing harmful commands through specific key sequences that copy and execute commands via JavaScript. Security researchers have documented these attacks since October, noting the use of LummaC2 and Rhadamanthys information stealers. Attackers utilize steganography to embed malware payloads within PNG images, reconstructing and decrypting them in memory using PowerShell and a .NET assembly called the Stego Loader. A dynamic evasion tactic known as ctrampoline complicates detection by initiating calls to numerous empty functions. The shellcode extracted from the encrypted image can execute various file types directly in memory. Following a law enforcement operation on November 13, the Rhadamanthys variant's payload delivery through fake Windows Update domains ceased, although the domains remain active. Researchers recommend disabling the Windows Run box and monitoring suspicious process chains to mitigate risks.

Winsage

November 25, 2025

ClickFix Attack Uses Steganography to Hide Malicious Code in Fake Windows Security Update Screen

A new wave of ClickFix attacks has emerged, using fake Windows Update screens and PNG image steganography to deploy infostealing malware like LummaC2 and Rhadamanthys. The attacks trick users into executing a command by pressing Win+R and pasting a command copied to their clipboard. Attackers have shifted from using “Human Verification” lures to more convincing full-screen fake Windows Update screens. The fake update prompts users to run a command that initiates mshta.exe with a URL containing a hex-encoded IP address, leading to the download of obfuscated PowerShell and .NET loaders. A notable feature of the campaign is the use of a .NET steganographic loader that hides shellcode within the pixel data of a PNG image, which is decrypted and reconstructed in memory. The shellcode is Donut-packed and injected into processes like explorer.exe using standard Windows APIs. Huntress has been monitoring these ClickFix clusters since early October, noting the use of the IP address 141.98.80[.]175 and various paths for the initial mshta.exe stage, with subsequent PowerShell stages hosted on domains linked to the same infrastructure. Despite the disruption of Rhadamanthys’ infrastructure in mid-November, active domains continue to serve the ClickFix lure, although the Rhadamanthys payload appears to be unavailable. To mitigate the attack, disabling the Windows Run box through Group Policy or registry settings is recommended, along with monitoring for suspicious activity involving explorer.exe. User education is critical, emphasizing that legitimate processes will not require pasting commands into the Run prompt. Analysts can check the RunMRU registry key to investigate potential ClickFix abuse.

Winsage

November 25, 2025

New ClickFix attacks use fake Windows Updates to swipe creds

A surge in ClickFix attacks is occurring, where attackers use deceptive Windows update screens to trick users into downloading infostealer malware. This method has become the primary means of initial access for cybercriminals, as reported by Microsoft. State-sponsored actors and organized crime groups are increasingly using this tactic. Huntress security experts have noted a shift from traditional prompts to convincing fake Windows update screens, showcasing the attackers' adaptability. Cyber adversaries are utilizing a steganographic loader to deliver infostealing malware like Rhadamanthys, encoding malicious code within PNG images to evade detection. Between September 29 and October 30, 2025, Huntress investigated 76 incidents linked to this campaign across various regions, with one incident involving the IP address 141.98.80[.]175. Victims typically visit a malicious site that triggers a full-screen blue Windows Update screen, leading them to install a “critical security update” through a series of commands. This process involves executing a command that runs PowerShell code to deploy a steganographic loader, ultimately leading to the installation of Rhadamanthys, which captures login credentials. Comments in the lure site's source code are in Russian, suggesting the attackers' identity remains unknown. As of November 19, multiple domains continue to host the lure page, although the payload is no longer actively hosted. Organizations can defend against these attacks by blocking access to the Windows Run box and educating employees about the ClickFix technique.

AppWizard

November 23, 2025

The League of Legends trading card game is surprisingly good, because it embraces the best trends in card games

Trading Card Games (TCGs) are experiencing a surge in popularity, with titles like Magic: The Gathering achieving success through crossover events. Wizards of the Coast reports financial gains from these initiatives. TCGs face competition from board games, miniatures wargames, roleplaying games, and digital card games. Magic: The Gathering remains dominant, with The Pokémon TCG and Yu-Gi-Oh as its main challengers, though neither poses a significant threat. Riot Games has launched Riftbound: The League of Legends card game, which sold out its first print run and is being resold at inflated prices. Riftbound features a 40-card deck centered around a single Champion and incorporates unique gameplay mechanics. It is designed for both casual and competitive play, with straightforward mechanics and flexible formats. Riot's previous success in tabletop gaming supports their credibility in this venture, and Riftbound may develop a dedicated community even if it doesn't achieve mainstream success.

AppWizard

November 21, 2025

6 Free Android TV Apps You Need To Install Before Google Removes Sideloading

Developers are now required to register their applications before users can sideload them on Android devices, a change aimed at reducing malware risks associated with unverified apps. This policy is particularly significant for Android TV users who often rely on sideloading for niche utilities and unofficial streaming tools. The risk of malware is reportedly 50 times higher when apps are installed from outside the Play Store. Google has promised to create a workflow for experienced users to sideload unverified apps despite the new restrictions. Sideloading allows users to install apps not available on the Play Store, but it comes with increased risks of data-stealing malware. Users can sideload apps by transferring APK files to their devices and adjusting settings to allow installations from unknown sources. SmartTube TV is an unofficial YouTube client that offers an ad-free experience and integrates features like SponsorBlock, but it violates YouTube's Terms of Service. Aptoide TV is a community-driven app marketplace that provides access to apps not available on the Play Store, though caution is advised due to potential malware risks. Leanback Launcher is an open-source launcher that enhances performance and customization options for Android TV. RetroArch allows users to emulate classic gaming consoles and requires legal copies of games. Syncler organizes and streams shows and movies from user-selected providers without hosting content itself. AdAway is an open-source ad blocker that filters ads at the device level using host files. The selection of these apps focuses on enhancing the Android TV experience through performance improvements, user-friendly interfaces, and a range of categories including streaming, gaming, customization, and privacy.

Winsage

November 20, 2025

Evicting Copilot: The Insider’s Guide to Purging AI from Windows 11

Microsoft's Windows 11 has introduced Copilot, an AI assistant aimed at enhancing productivity, but it has faced criticism from users concerned about privacy and resource usage. Copilot offers features like document summarization and image generation, but some users have labeled it an unwelcome presence. During the March 2025 Patch Tuesday, some users experienced Copilot being inadvertently uninstalled. Privacy concerns and performance issues have led many to seek ways to disable or remove Copilot, with methods including hiding the Copilot button, using Group Policy Editor, editing the Windows Registry, and uninstalling the app through Settings or PowerShell commands. In corporate environments, IT administrators can disable Copilot using Intune or Group Policy. Users have reported that Windows updates can reinstall Copilot, prompting them to disable automatic updates or block related domains. Recent user sentiment indicates growing fatigue with AI features, and there is potential for Microsoft to introduce easier opt-out options in future updates.

Tech Optimizer

November 17, 2025

Dragon Breath Uses RONINGLOADER to Disable Security Tools and Deploy Gh0st RAT

The threat actor Dragon Breath, also known as APT-Q-27 and Golden Eye, has been observed using a multi-stage loader called RONINGLOADER to deploy a modified variant of the remote access trojan Gh0st RAT, primarily targeting Chinese-speaking users. The campaign employs trojanized NSIS installers disguised as legitimate applications, such as Google Chrome and Microsoft Teams. The infection chain utilizes various evasion techniques, including a legitimately signed driver, custom Windows Defender Application Control policies, and manipulation of the Microsoft Defender binary. RONINGLOADER's attack chain involves delivering a DLL and an encrypted file labeled "tp.png," which contains shellcode. It attempts to neutralize security products by terminating processes associated with popular antivirus solutions in the region. Specific actions are taken against Qihoo 360 Total Security, including blocking network communication, injecting shellcode into the Volume Shadow Copy service, and restoring firewall settings. For other security processes, RONINGLOADER directly writes a driver to disk to perform process termination. The malware aims to inject a rogue DLL into "regsvr32.exe" to conceal its activities and launch a next-stage payload into high-privilege system processes. The final payload is a modified version of Gh0st RAT, capable of communicating with a remote server, configuring Windows Registry keys, clearing Windows Event logs, and capturing keystrokes and clipboard contents. Additionally, two interconnected malware campaigns identified by Palo Alto Networks Unit 42 employed brand impersonation to deliver Gh0st RAT to Chinese-speaking users. The first campaign, Campaign Trio, occurred between February and March 2025, while the second, Campaign Chorus, detected in May 2025, impersonated over 40 applications. Both campaigns utilized complex infection chains and trojanized installers hosted on domains that circumvented network filters. The second campaign also involved an embedded Visual Basic Script for launching the final payload through DLL side-loading.

AppWizard

November 14, 2025

Android Photo Frame App Infects Devices With Malware, Allows Full Remote Takeover

A recent investigation revealed significant security vulnerabilities in Android-powered digital photo frames, particularly those using the Uhale app (version 4.2.0). These vulnerabilities allow preinstalled applications to autonomously download and execute malware, granting remote attackers complete control of the device without user interaction. The malware is sourced from infrastructure linked to China, with domains like dc168888888.com and webtencent.com distributing malicious content. Many antivirus applications inadequately detect these threats. The Uhale app has high-risk vulnerabilities, including insecure HTTPS trust management and insufficient input validation, enabling remote code execution with root access. Brands associated with Uhale include BIGASUO, Canupdog, Euphro, and others. Exploits can lead to data exfiltration, access to private photos, and further attacks within home and enterprise environments. Technical oversights include outdated Android 6 firmware, disabled SELinux, weak cryptographic protections, and lack of authentication for incoming file transfers. Compromised frames can serve as surveillance tools or points for data exfiltration, posing risks to both home and enterprise networks. Users are advised to disconnect affected frames and monitor for unusual behavior.

AppWizard

November 12, 2025

Google Drive’s new AI audio summaries make PDFs effortless

Google Drive has introduced a feature that allows users to generate audio summaries of lengthy documents, which can be accessed through a new button in the toolbar. These summaries range from two to ten minutes and are designed to capture the essential points of documents, eliminating the need for extensive reading. The feature, called audio overviews, is currently available only in English and is being rolled out to select paid Workspace tiers, including Business Standard, Business Plus, Enterprise Standard, Enterprise Plus, Google One AI Premium, AI Ultra, and AI Ultra for Business. Users can retrieve audio files from an “Audio overviews” folder in their Drive. The rollout will begin with Rapid Release domains, while Scheduled Release domains will start seeing the feature from November 12, 2025, with a potential delay of up to 15 days for full availability.