NewApp Digest
search bot

fake

North Korea Buried Four-Stage Malware in Flag Images: Zero Antivirus Detections
Tech Optimizer
July 18, 2026

North Korea Buried Four-Stage Malware in Flag Images: Zero Antivirus Detections

North Korea's Contagious Interview hackers have been using a deceptive strategy to target developers by posing as recruiters and embedding malware in SVG files. Elastic Security Labs discovered that the attackers hid malicious payloads within HTML comment blocks of these files, allowing the malware to evade antivirus detection. At the time of the findings, no antivirus engines flagged the compromised repositories, which included trojanized GitHub repositories disguised as coding challenges. The malware executed automatically at server startup and deployed four modules: a browser credential and cryptocurrency wallet stealer, a file stealer, a remote access Trojan, and a clipboard monitor. The campaign, tracked as REF9403, is part of the ongoing Contagious Interview operation attributed to North Korea's Lazarus Group, which aims to generate revenue through cryptocurrency theft. Developers are advised to audit any projects run from unsolicited sources and to monitor specific domains associated with the attack.
AI hacks apps in five minutes: fake builds can flood messengers
AppWizard
July 14, 2026

AI hacks apps in five minutes: fake builds can flood messengers

Recent findings from a study by Positive Technologies indicate that AI is increasingly being used by hackers to modify mobile applications, with a success rate of over 60% for embedding unauthorized code without disrupting functionality. The study analyzed 90 Android applications, finding closed commercial models had an 84% success rate, while open-source applications had a 61% success rate. Modifications were completed in as little as 5 minutes and 38 seconds to up to 9 minutes and 9 seconds, with costs ranging from 0.88 to 40.89 rubles per modification. Messaging platforms and third-party sites are particularly at risk, especially for users seeking unofficial app versions. Developers are advised to improve security against code modification and unauthorized clones.
silver Android smartphone
Tech Optimizer
July 10, 2026

Hackers Use Fake VLC Executable and Malicious libvlc.dll to Deploy ValleyRAT

Cybercriminals are exploiting the VLC media player to install ValleyRAT, a remote access trojan, by embedding malware in a seemingly harmless file linked in phishing emails. The attack starts with an email that prompts the victim to download a ZIP archive containing a fake VLC executable and a malicious DLL named libvlc.dll. This method uses DLL sideloading to execute the malware under the guise of a legitimate application. Once executed, the malware establishes persistence by creating a registry entry and connects to a remote server to retrieve the final payload. ValleyRAT employs evasion tactics to avoid detection, including assessing system characteristics before executing harmful actions and using a fileless approach to deliver the payload directly into memory. Researchers have identified indicators of compromise, including specific SHA1 hashes and URLs associated with the malicious campaign.
Search