file uploads Archives

Winsage

September 24, 2026

Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware

A Chinese threat actor, codenamed UTA0565, has exploited newly disclosed vulnerabilities in Google Chrome (CVE-2026-85046, CVE-2026-87491) and Windows (CVE-2026-85880) through deceptive websites, achieving remote code execution. The attacks were detected on September 3 and 4, 2026, and involved impersonating organizations to mislead victims, particularly targeting Asian government entities with phishing emails related to Hong Kong activist Chow Hang-tung. The phishing messages directed users to fraudulent sites that loaded an HTML element using the BlueMoon exploit kit, which delivered a payload named "chrome_cleanup.exe," associated with the CLEANGULP malware family. This malware allows for command execution, process listing, file uploads and downloads, and uses a hard-coded domain for command-and-control communications. The exploit's widespread use suggests a coordinated effort within the Chinese cyber espionage community, with indications that multiple groups are sharing and weaponizing the exploit.

AppWizard

September 14, 2026

How to Convert a Website or AI-Built Web App into a Play Store-Ready Android App in 2026

Native App AI simplifies the process of converting websites or AI-generated web apps into Android applications ready for the Play Store without needing to rebuild from scratch. It allows users to input a website URL, customize the app's features, and generate APK and AAB files for testing and publishing. The platform supports various features such as push notifications, AdMob monetization, deep linking, and custom branding. It also assists in preparing necessary information for Google Play, ensuring compliance with policies and technical requirements. This service is beneficial for SaaS companies, startups, e-commerce ventures, and creators who have existing web products.

Winsage

August 22, 2026

Hackers abuse FTP server banners to deliver new Windows malware

Threat actors are exploiting FTP banners to conceal commands for deploying two undocumented remote access trojans (RATs), E4del and PINHOLE. This method was first observed by MalwareHunterTeam in July 2026, using shortcut files (.LNK) and FTP server banners as dead-drop resolvers to retrieve malicious commands. SOCRadar confirmed that this technique has been weaponized since early July 2026 and remains active, with new infrastructure identified as recently as August 2026. The attacks typically start with a ZIP archive leading to an LNK-based infection chain, likely initiated through phishing tactics. E4del is a Node.js-based RAT disguised within a digitally signed Electron application mimicking Discord, capable of executing commands, capturing screenshots, streaming desktops, and downloading additional payloads. It also includes a module for privilege escalation. PINHOLE retrieves its command and control configuration from Pinterest and SurveyMonkey, designed to leave a minimal footprint and employing shellcode fluctuation. It supports 14 commands, including file management and credential theft, but had only recorded 11 execution events at the time of analysis. SOCRadar notes that while using FTP banners is a novel approach, it is less stealthy than traditional web-based dead-drop resolvers. They provide indicators of compromise to help identify malicious infrastructure and infected machines.

Tech Optimizer

July 28, 2026

ClamAV Setup: Linux Antivirus in 12 Steps [2026]

Malware can threaten Linux systems, which are often mistakenly believed to be immune to viruses. It can be introduced through email attachments, infected files, or compromised plugins, especially when Linux servers interact with Windows clients or handle internet uploads. ClamAV is an open-source antivirus engine maintained by Cisco Talos, designed for scanning mail traffic and file uploads. As of mid-2026, the stable release is ClamAV 1.5.x, with version 1.5.2 being the latest patch. To deploy ClamAV, users need root or sudo access on a compatible Linux machine, at least 2 vCPUs and 2GB of RAM, 5GB of free disk space, and outbound HTTPS access to ClamAV’s signature mirrors. The installation process involves several steps, including configuring freshclam for automatic updates, validating detection with the EICAR test file, and setting up cron jobs for regular scans. ClamAV can also be integrated with mail servers and a SIEM for enhanced security. Common pitfalls in deployment include skipping the initial freshclam run and using clamscan instead of clamdscan for repeated scans. ClamAV is free for commercial use and can also scan Windows systems, although it does not replace comprehensive endpoint protection solutions.

Winsage

July 15, 2026

LabubaRAT malware infiltrates Windows systems while posing as NVIDIA software

LabubaRAT is a newly identified Rust-based remote access tool (RAT) that disguises itself as NVIDIA software to facilitate operations on Windows systems. It establishes a reusable foothold for hands-on activity and can profile the host system, identify security tools, execute commands, transfer files, capture screenshots, and proxy network traffic. LabubaRAT retrieves its configuration at launch via command-line arguments or environment variables, allowing operators to specify parameters like the command-and-control server and API key at runtime. It maintains local state in a SQLite database and supports communication through HTTPS polling, Microsoft Edge WebView2, and DNS tunneling. The malware includes capabilities for command execution, file handling, and establishing persistence through a Windows Run registry key. The entry point for the attack is an executable named nvidia-sysruntime.exe, which masquerades as NVIDIA’s container runtime toolkit. LabubaRAT conducts thorough profiling of the host, checking for installed browsers and security products, and gathers information on the system's specifications. Blackpoint Cyber has shared indicators of compromise to help detect LabubaRAT activity.

Winsage

June 24, 2026

Windows RAT Uses Encrypted HTTP C2 and Registry Persistence After npm Infection

A malware campaign targets Windows systems through a malicious npm package named postcss-minify-selector-parser, which mimics the legitimate postcss-selector-parser. This counterfeit package installs a Remote Access Trojan (RAT) on developer machines, beginning with a multi-stage attack triggered by the installation of the package. The RAT can steal credentials, execute shell commands, and communicate with a remote attacker. Security researchers at JFrog identified this threat and reported it on June 22, 2026, noting that two additional related packages, postcss-minify-selector and aes-decode-runner-pro, are linked to the same publisher and remain live on the npm registry. The RAT employs encrypted HTTP communication with a command-and-control (C2) server and ensures persistence by creating a registry key under the Windows Run key. It has capabilities for remote shell execution, file uploads and downloads, and can steal saved login data from Google Chrome using Windows decryption APIs. The malware is designed for organized batch exfiltration of stolen data. Indicators of compromise include specific IP addresses, domains, file paths, and SHA-256 hashes associated with the malware components. JFrog advises users to remove the malicious packages, inspect their dependency trees, and treat any stored credentials as compromised.

Winsage

June 16, 2026

China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth

Cybersecurity researchers have identified two new Windows variants of the SprySOCKS backdoor, named WINDRV and WINPLUS, which were previously thought to be exclusive to Linux systems. Both variants feature hard-coded command-and-control configurations and can communicate via TCP, UDP, and WebSocket protocols. They support over 30 commands for operations such as system information collection and file management. WINDRV employs kernel drivers for stealth, obscuring network connections and allowing TCP traffic diversion. SprySOCKS was first documented by Trend Micro in September 2023, linked to the Chinese state-sponsored threat actor Earth Lusca, also known as FishMonger. The Windows variants belong to version 1.8 of SprySOCKS and utilize a kernel driver named RawWNPF for enhanced stealth. The attack chain begins with an initial access method that drops a batch script, leading to the installation of the backdoor. Evidence suggests these variants may have been used in attacks against government organizations in Honduras, Taiwan, Thailand, and Pakistan between 2023 and 2024. The WINPLUS variant was first detected in July 2024 in Pakistan. There are indications of a potential UEFI bootkit involvement exploiting CVE-2023-24932, a vulnerability in the Windows Boot Manager.

AppWizard

June 5, 2026

I found the easiest way to transfer files between Android and Windows

The author initially used Pushbullet for data transfer between their smartphone and Windows PC but switched to a NAS solution, specifically the DiskStation DS1823xs+, for easier file uploads and downloads. They found Syncthing as an alternative for syncing folders but discovered Quick Share as a more efficient option. Quick Share is Google's default method for sharing data between Android devices and is compatible with iPhones, particularly models like the Galaxy S26 and Pixel 10. It requires a 64-bit version of Windows (Windows 10 or 11) and allows for seamless file transfers, including folders, with no connectivity issues reported during a month of use. To use Quick Share, users must download the application on Windows, log in with the same Google account linked to their phone, and select their PC as a target device for file transfers. The process involves selecting files on the phone, choosing Quick Share, and initiating the transfer on the PC.

AppWizard

January 21, 2026

OpenAI enhances safety, rolls out age prediction measures in ChatGPT

OpenAI has introduced "Age Predictions" in ChatGPT for EU users, which assesses account-level factors to estimate a user's age and restrict access to sensitive content for those identified as under 18. The feature uses various indicators, including stated age and usage patterns, to enhance user safety. If a user is mistakenly restricted, they can undergo an age verification process via a service called Persona. OpenAI is also implementing additional parental controls for managing teen accounts, such as setting "quiet hours" and monitoring AI retention of information. Furthermore, OpenAI plans to launch a ChatGPT Go subscription tier in the U.S. with higher usage limits and will introduce advertisements within ChatGPT conversations, ensuring that user conversations are not used for ad targeting.

Winsage

January 20, 2026

Microsoft Edge finally lets you hide the Copilot icon from the browser’s toolbar — Are you clicking “remove”?

Microsoft has released an update for its Edge browser, version 144.0.3719.82, which includes bug fixes, feature enhancements, and improvements. Key fixes include resolving a browser crash during file uploads. New features include: - Default Profile for External Links: Uses the Primary Work Profile for opening external links. - Management Enrollment Token Policy Update: Requires configuration directly from the platform. - Performance Settings Update: Renames efficiency mode to "Energy Saver" and PC gaming feature to "PC Gaming Boost." - Tenant Restrictions v2 (TRv2): Blocks access from unauthorized Microsoft 365 tenants. - Copilot Icon Management: Users can manage the visibility of the Copilot icon in the toolbar. - Contextual Nudges: Provides summaries of open pages from the address bar. - Enhanced Autofill Experience: Prompts users to save addresses intentionally. - Desktop Visual Search: Allows sending images to Bing Visual Search for identification. The update also allows users to hide the Copilot icon and discontinues the Collections feature.