NewApp Digest
search bot

fake

Russian Groups Target Signal Messenger in Spy Campaign
AppWizard
February 20, 2025

Russian Groups Target Signal Messenger in Spy Campaign

Multiple Russian threat groups are targeting the Signal Messenger application, focusing on individuals likely to engage in sensitive military and governmental communications during the conflict in Ukraine. Researchers from Google's Threat Intelligence Group have identified these attacks as primarily aimed at individuals of interest to Russian intelligence services. The two main cyber-espionage groups involved are UNC5792 (tracked by Ukraine's CERT as UAC-0195) and UNC4221 (UAC-0185). Their goal is to deceive victims into linking their Signal accounts to devices controlled by the attackers, granting access to incoming messages. UNC5792 uses invitations that resemble legitimate Signal group invites with malicious QR codes, while UNC4221 employs a phishing kit that mimics Ukraine's Kropyva app and includes harmful QR codes on fake sites. Other Russian and Belarusian groups, including Sandworm (APT44) and Turla, are also targeting Signal Messenger in various ways, such as stealing messages from databases or local storage. Additionally, Belarus-linked group UNC1151 uses the Robocopy tool to duplicate Signal messages for future theft. The increased activity against Signal reflects a broader interest in secure messaging apps used by individuals in espionage and intelligence roles. These apps' strong security features make them attractive to at-risk individuals and communities but also high-value targets for adversaries. Russian groups are also targeting Telegram and WhatsApp, with a recent report detailing attacks by the Russian group Star Blizzard on WhatsApp accounts of government officials and diplomats.
Mac users beware: AI-powered malware threats are on the rise
Tech Optimizer
February 17, 2025

Mac users beware: AI-powered malware threats are on the rise

Apple devices, particularly Macs, are facing an increase in cyberattacks, with a new wave of sophisticated malware targeting sensitive data. The emergence of Atomic Stealer (AMOS) in mid-2023 marked a shift from less harmful adware to more serious threats, with AMOS being marketed as a user-friendly service. By mid-2024, Poseidon became the leading Mac information stealer, responsible for 70% of infections and capable of draining various cryptocurrency wallets and capturing sensitive credentials. Cybercriminals are also using malvertising to lure users into downloading disguised malware. Android users are experiencing an even more severe situation, with a significant rise in phishing attacks. In 2024, researchers identified 22,800 malicious apps designed for phishing, along with thousands capable of reading one-time passwords (OTPs). These apps often mimic legitimate software and can easily infiltrate app stores, including Google Play. While Google Play Protect offers some malware protection, it is not entirely effective. To protect against malware threats, it is recommended to use strong antivirus software, be cautious with downloads and links, keep software updated, use strong and unique passwords, and enable two-factor authentication (2FA) for critical accounts.
XELERA Ransomware Attacking Job Seekers With Weaponized Word Documents
Tech Optimizer
February 14, 2025

XELERA Ransomware Attacking Job Seekers With Weaponized Word Documents

Job seekers are targeted by a ransomware campaign called "XELERA," which uses counterfeit job offers from the Food Corporation of India (FCI) to lure victims. The campaign begins with spear phishing emails containing a malicious Word document named “FCEI-job-notification.doc.” This document hides an OLE object that extracts a compressed PyInstaller executable called “jobnotification2025.exe,” which is designed to evade antivirus detection. The malware's structure includes a core script (mainscript.pyc) and supporting libraries for system monitoring and network operations. A Discord bot serves as a Command-and-Control server, allowing remote command execution, including privilege escalation, system control, credential theft, and visual disruption. The final stage of the attack involves deploying the XELERA ransomware, which demands a ransom in Litecoin and includes functions to terminate Windows Explorer and download a tool for MBR corruption.
silver Android smartphone
Winsage
February 11, 2025

Microsoft’s fake “Uninstall Microsoft Edge” guide is gone—but it’s still misleading

Microsoft has updated its "How to Uninstall Microsoft Edge" page, redirecting users to a general guide about the browser instead of providing uninstallation instructions. The new page, titled "Get to Know Microsoft Edge," highlights the browser's features and includes a download link for Edge, which is unhelpful for users seeking to remove it. The previous guide had made claims about Edge's performance compared to Chrome but has shifted to a promotional tone without mentioning "Uninstall." Users looking for straightforward uninstallation steps are still met with a promotional narrative, although alternative resources exist for clear guidance on the uninstallation process.
Microsoft is pulling a bait-and-switch by offering a fake "Uninstall Microsoft Edge" page
Winsage
February 9, 2025

Microsoft is pulling a bait-and-switch by offering a fake “Uninstall Microsoft Edge” page

A search for "How to uninstall Microsoft Edge" leads to an official Microsoft webpage that does not provide uninstallation steps but instead promotes the benefits of Edge. Both Bing and Google searches direct users to the same page, which discusses Edge's advantages and features but lacks actual instructions for uninstallation. Alternative guides exist that offer practical steps for removing Edge without promotional content.
New Scareware Attack Targeting Mobile Users to Deploy Malicious Antivirus Apps
Tech Optimizer
February 7, 2025

New Scareware Attack Targeting Mobile Users to Deploy Malicious Antivirus Apps

A recent increase in scareware attacks is targeting mobile users, aiming to trick them into downloading malicious antivirus applications. These attacks use alarming notifications to exploit users' fears about device security. Analysts from Kaspersky Lab note that scareware often employs social engineering techniques to create urgency and fear, masquerading as legitimate software. Victims may encounter a range of consequences, from ineffective programs to dangerous malware that can encrypt data or steal financial information. Scareware messages typically warn users of detected viruses and the risks of not acting quickly. Malicious applications often use JavaScript or HTML to generate fake alerts. Users are advised to install authentic antivirus software from reputable sources, keep their devices updated, and be cautious with unexpected pop-ups.
Everything you need to know about the Surfshark One VPN bundle for Apple
Tech Optimizer
February 5, 2025

Everything you need to know about the Surfshark One VPN bundle for Apple

Surfshark One is a comprehensive online privacy solution for Mac users that includes a VPN, antivirus protection, and a leak notification tool. It has been recognized as the top VPN for iPhone in 2025 by AppleInsider. The service offers a 24-month prepayment option at a cost of .69 per month, with an additional three months free, totaling for 27 months. Surfshark VPN provides privacy protection across unlimited devices, includes features like CleanWeb, cookie pop-up blocker, customizable browsing controls, Kill Switch, and Dynamic MultiHop for enhanced encryption. Surfshark Antivirus offers scheduled scans, webcam protection, and regular updates every three hours. Surfshark Search is a private search engine with zero logs, no ads, and no tracking. Surfshark Alert monitors personal data for breaches and provides notifications. The Alternative ID feature generates fake identities for online use to protect users' real information. The entire Surfshark One bundle is available for when prepaid for 24 months.
Remove These 12 Android Apps Now—They’re Secretly Capturing Your Conversations
AppWizard
February 4, 2025

Remove These 12 Android Apps Now—They’re Secretly Capturing Your Conversations

Some Android applications are covertly monitoring conversations and collecting personal data without user consent. Cybersecurity firm ESET identified six malicious apps on Google Play and another six on third-party app stores that disguise themselves as legitimate messaging platforms. These apps harvest data such as text messages, call logs, and recorded conversations. Hackers also employ tactics like creating fake romantic connections to persuade victims to download infected apps, such as those containing the VajraSpy Trojan, which records conversations and accesses personal files. Three groups of dangerous apps include: 1. Messaging apps disguised as secure platforms (e.g., Hello Chat, MeetMe, Chit Chat) that steal contact information and SMS messages. 2. Apps exploiting accessibility features (e.g., Wave Chat) that can intercept messages and record phone calls. 3. A fake news app that seeks access to personal data without messaging capabilities. A list of malicious apps includes: Rafaqat, Privee Talk, MeetMe, Let’s Chat, Quick Chat, Chit Chat, YohooTalk, TikTalk, Hello Chat, Nidus, GlowChat, and Wave Chat. Six of these apps were downloaded over 1,400 times each before being removed from Google Play. To protect privacy, users are advised to uninstall suspicious apps, change passwords, enable two-factor authentication, run security scans, and stay informed about cybersecurity threats.
Search