NewApp Digest
search bot

executable

State antivirus revived: "Multiscanner" returns after funding cut
Tech Optimizer
July 15, 2026

State antivirus revived: “Multiscanner” returns after funding cut

The Russian portal "Multiscanner" has resumed its service for scanning files for malicious software without mandatory registration. It allows users to upload files up to 256 MB in over 30 formats, including DOC, DOCX, PDF, PPTX, EXE, and ZIP. The scanning history is saved in the browser but can be deleted for privacy. "Multiscanner" is compatible with popular web browsers like Google Chrome, Yandex Browser, Firefox, Microsoft Edge, and Safari, but is not available on mobile browsers. The portal was originally developed between 2023 and 2024 and is now managed by the National Technology Center for Digital Cryptography, operating in pilot mode.
Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution
Winsage
July 15, 2026

Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution

Cursor, a development tool, has a security vulnerability that allows arbitrary code execution by simply opening a project repository on Windows. This flaw, reported by AI security firm Mindgard, is due to the presence of a file named git.exe in the project root, which Cursor executes automatically without user prompts. Mindgard demonstrated this vulnerability by renaming Windows Calculator to git.exe and placing it in the project root, leading to multiple instances of Calculator launching upon opening the repository. Cursor has not yet released a patch or advisory for this issue, which was first reported on December 15, 2025, and remains in the latest version, 3.11, released on July 10, 2026. Users are advised to implement workarounds, such as using AppLocker or Windows App Control to block executables by name and path. Other vendors, including GitHub and Google, have encountered similar vulnerabilities, but none have released fixes. The issue highlights the risks associated with untrusted search paths in software development.
silver Android smartphone
Winsage
July 13, 2026

A Microsoft engineer revealed Windows 95’s smart way for spotting installers: It just guessed

Developers of Windows 95 faced the challenge of preventing software installers from overwriting existing files with older versions. They implemented a heuristic approach that identified running setup programs by scanning the program's name for specific "magic words." These included "setup," "inst," "imposta," "ayarla," and "felrak." The word "install" was considered redundant since variations like "inst" could also be detected. If a program's name did not contain these magic words, Windows 95 would check the executable path for matches and perform post-installation verification to ensure newer files were not replaced by older versions.
Windows 95 didn’t detect installers, it ‘guessed’ based on the file name, says veteran dev — it simply checked for words like setup, install, inst, or localized equivalents
Winsage
July 12, 2026

Windows 95 didn’t detect installers, it ‘guessed’ based on the file name, says veteran dev — it simply checked for words like setup, install, inst, or localized equivalents

Raymond Chen, a Microsoft engineer, revealed that Windows 95 identified installation programs by analyzing executable filenames against a list of keywords, including "setup," "install," and "inst." The system would then initiate a routine to repair any compromised system files. The list included six terms: setup, install, inst, imposta, ayarla, and felrak. Chen noted redundancy in the list, suggesting "install" was unnecessary since it included "inst." For executables not matching the terms, Windows 95 scanned the executable's path for "Setup." The system maintained backup copies of frequently overwritten files in a hidden directory at C:WindowsSYSBCKUP and would restore correct versions after installers completed. File verification was often postponed until the next system boot, especially for installers that reverted to MS-DOS for file replacements. This file repair mechanism continues to influence modern operating systems, including Windows 11.
silver Android smartphone
Tech Optimizer
July 10, 2026

Hackers Use Fake VLC Executable and Malicious libvlc.dll to Deploy ValleyRAT

Cybercriminals are exploiting the VLC media player to install ValleyRAT, a remote access trojan, by embedding malware in a seemingly harmless file linked in phishing emails. The attack starts with an email that prompts the victim to download a ZIP archive containing a fake VLC executable and a malicious DLL named libvlc.dll. This method uses DLL sideloading to execute the malware under the guise of a legitimate application. Once executed, the malware establishes persistence by creating a registry entry and connects to a remote server to retrieve the final payload. ValleyRAT employs evasion tactics to avoid detection, including assessing system characteristics before executing harmful actions and using a fileless approach to deliver the payload directly into memory. Researchers have identified indicators of compromise, including specific SHA1 hashes and URLs associated with the malicious campaign.
GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware
Tech Optimizer
July 10, 2026

GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware

Microsoft Threat Intelligence has identified the GigaWiper malware, which has been detected in compromised environments since October 2025. This malware has destructive capabilities and comes in two forms: standalone wiper binaries and larger binaries with backdoor functionalities, both developed in Golang. The standalone wiper operates at the physical disk level, overwriting disk content and removing partition references. The backdoor variant includes the same wiper functionality and adds persistence through a registry key and scheduled tasks, along with command and control communication via RabbitMQ and Redis. GigaWiper can execute various commands, including wiping drives, triggering a Blue Screen of Death (BSOD), file encryption that mimics ransomware behavior, and managing system elements. The malware integrates components from multiple malware families, including wipers and ransomware mechanisms, and has been linked to a previous malware known as FlockWiper. To defend against GigaWiper, organizations are advised to implement security measures such as tamper protection, blocking access to known C2 infrastructure, and utilizing endpoint detection and response solutions. Microsoft Defender provides detections for GigaWiper and related malware, and threat intelligence reports are available for customers to stay informed about threats. Indicators of compromise include specific SHA-256 hashes and IP addresses associated with GigaWiper.
Search