Firefox Archives

Tech Optimizer

July 24, 2026

CrashStealer Mac malware steals passwords and wallets

A sophisticated new malware targeting Mac users, named CrashStealer, has been discovered by security researchers at Jamf Threat Labs. It masquerades as Apple's legitimate crash-reporting software and was first identified in May 2026, with active attacks detected by early July. CrashStealer is designed to extract sensitive information, including browser credentials, password manager data, and cryptocurrency wallet information, and can copy the Mac login Keychain. It uses native C++ programming, encrypts collected files, and employs anti-debugging features. The malware is distributed through a disk image labeled "Werkbit Setup," which features a polished installer that bypasses Mac security warnings by using a valid Apple Developer ID and notarization ticket. Once opened, it connects to GitHub for commands and downloads a script that installs a second disk image named CrashReporter.dmg, which mimics an Apple system component. CrashStealer presents a fake password prompt resembling a legitimate macOS request, verifying entered passwords locally. It targets data linked to various browsers and password managers, scanning for approximately 80 cryptocurrency wallet extensions and 14 password managers. Stolen data is stored in hidden folders, encrypted using AES-256-GCM, and packaged into hidden ZIP archives before being uploaded. Warning signs of infection include a website requiring a meeting PIN for download, unexpected password prompts, and unfamiliar apps requesting Full Disk Access. Users are advised to download apps from verified sources, avoid overriding security warnings, pause before entering passwords, review app permissions, install security updates, use antivirus software, and act quickly if they installed Werkbit Setup.

Winsage

July 16, 2026

Firefox vs Edge: fresh shots fired in browser wars as Mozilla report accuses Microsoft of using ‘harmful design’ to undermine choice in Windows 11

Mozilla's report raises concerns about Microsoft's practices regarding browser choice in Windows 11, alleging that Microsoft uses harmful design tactics to promote its Edge browser. Key strategies identified include trick wording, obstruction, visual interference, preselection, nagging, and forced action, affecting users at various stages of their experience. For example, users trying to download Chrome encounter pop-up banners encouraging them to use Edge, which is also pre-pinned to the Windows taskbar. Migration from Windows 10 to Windows 11 resets Edge as the default browser, ignoring user preferences. The report also highlights that Microsoft's AI, Copilot, opens links in Edge instead of the user's default browser, and minor consent requests may compromise user privacy by funneling data into Microsoft's advertising systems. Users in Germany face fewer issues due to stricter regulations. The report indicates that while Microsoft's promotion of Edge hasn't significantly impacted Chrome's dominance, it may have affected smaller competitors like Firefox. Mozilla calls for Microsoft to change its approach and urges regulators to take action to ensure fair competition in the browser market.

Winsage

July 15, 2026

LabubaRAT malware infiltrates Windows systems while posing as NVIDIA software

LabubaRAT is a newly identified Rust-based remote access tool (RAT) that disguises itself as NVIDIA software to facilitate operations on Windows systems. It establishes a reusable foothold for hands-on activity and can profile the host system, identify security tools, execute commands, transfer files, capture screenshots, and proxy network traffic. LabubaRAT retrieves its configuration at launch via command-line arguments or environment variables, allowing operators to specify parameters like the command-and-control server and API key at runtime. It maintains local state in a SQLite database and supports communication through HTTPS polling, Microsoft Edge WebView2, and DNS tunneling. The malware includes capabilities for command execution, file handling, and establishing persistence through a Windows Run registry key. The entry point for the attack is an executable named nvidia-sysruntime.exe, which masquerades as NVIDIA’s container runtime toolkit. LabubaRAT conducts thorough profiling of the host, checking for installed browsers and security products, and gathers information on the system's specifications. Blackpoint Cyber has shared indicators of compromise to help detect LabubaRAT activity.

Winsage

July 15, 2026

Dark patterns in Windows are steering users to Edge: Mozilla-commissioned report

A report by Mozilla, titled "Over The Edge 2.0," reveals that Microsoft is using various tactics to promote its Edge browser, including misleading banners on Bing and pre-pinning Edge on the Windows taskbar. The report indicates that Microsoft hinders users' ability to download or set alternative browsers as default. It also notes that Microsoft's AI tool, Copilot, fails to recognize the default browser when opening links, and data-sharing settings are preselected to ON in regions like the US and India. Despite these efforts, Edge's market share has declined from 13 percent in June 2025 to just over 10 percent, while Mozilla's Firefox has increased from 5.84 percent to 6.44 percent. The Browser Choice Alliance and other browser developers have criticized Microsoft's practices, calling for fair competition.

Tech Optimizer

July 15, 2026

State antivirus revived: “Multiscanner” returns after funding cut

The Russian portal "Multiscanner" has resumed its service for scanning files for malicious software without mandatory registration. It allows users to upload files up to 256 MB in over 30 formats, including DOC, DOCX, PDF, PPTX, EXE, and ZIP. The scanning history is saved in the browser but can be deleted for privacy. "Multiscanner" is compatible with popular web browsers like Google Chrome, Yandex Browser, Firefox, Microsoft Edge, and Safari, but is not available on mobile browsers. The portal was originally developed between 2023 and 2024 and is now managed by the National Technology Center for Digital Cryptography, operating in pilot mode.

Winsage

July 11, 2026

Windows 11 Has a Hidden Tracker – Here’s How to Limit It

Peter Stokes allegedly used sophisticated methods to obscure his identity during a breach at a luxury retailer, but the FBI uncovered his identity through a Global Device Identifier (GDID) linked to his Windows installation. GDID is a persistent device-level identifier that uniquely identifies a Windows installation and remains unchanged through operating system updates, only resetting upon complete reinstallation. Users cannot disable GDID, and attempts to remove it may disrupt Windows activation. To minimize data associated with GDID, users can opt for a local account, limit diagnostic telemetry, disable Activity history, and be cautious during reinstallation. VPNs do not prevent Microsoft from logging GDID, IP addresses, and URLs, making them ineffective for privacy on Windows. GDID has been described as a covert tracking beacon, and security experts advise against using Windows for sensitive tasks, suggesting alternatives like Linux.

Winsage

July 10, 2026

Windows 11 Has a Hidden Tracker – Here’s How to Limit It

Peter Stokes is involved in a breach with a luxury retailer, using tactics like VPNs and rotating IP addresses to hide his digital activity. The FBI discovered a Global Device Identifier (GDID) linked to his Windows installation, which is a persistent device-level identifier that uniquely identifies Windows installations. GDID remains unchanged through operating system updates but resets with a full reinstallation. Disabling GDID is not possible, as attempts to do so would disrupt Windows activation. Users can minimize data linked to GDID by using a local account, reducing diagnostic telemetry, disabling Activity history, and carefully managing reinstalls. VPNs do not prevent Microsoft from logging GDID, IP address, and URL data. Privacy researchers view GDID as a covert tracking mechanism, and Windows lacks user-facing options to reset this identifier, unlike Apple and Google.

Tech Optimizer

July 7, 2026

Avast Premium Security from Gen Digital – multi-device protection tuned for US households

Avast Premium Security is a multi-device security suite developed by Gen Digital, designed for U.S. households and small offices. It includes antivirus, ransomware protection, firewall, and web shield features. The product offers plans for one device, up to ten devices, or unlimited devices, with pricing around .99 per year for a single device and .99 for up to ten devices. It is compatible with Windows PCs, Macs, Android phones and tablets, and iOS devices. Key features include real-time malware scanning, advanced ransomware shields, phishing site detection, and a configurable firewall. The software operates quietly in the system tray and provides notifications when threats are detected. Avast Premium Security is positioned in a competitive market alongside brands like Norton, McAfee, Trend Micro, and Kaspersky, and is part of Gen Digital's strategy for recurring subscription revenue. The product is available for purchase online and targets U.S. households and small offices seeking comprehensive protection.

AppWizard

July 5, 2026

I switched to an open-source notes app for 2 weeks, and I wish I had done it sooner

The author initially used Simplenote and Obsidian for note-taking but sought a replacement for Simplenote due to its restrictive simplicity. They discovered Notesnook, which became their preferred app due to its end-to-end encryption, generous free plan, and offline functionality. Notesnook supports rich-media attachments, offers organizational features like notebooks and sub-notebooks, and provides superior text formatting options compared to Simplenote. However, the author noted some drawbacks, including slower speed, lack of full Markdown support without a paid plan, local revision history that doesn't sync across devices, and missing collaboration features. Despite these drawbacks, the author appreciates Notesnook's versatility but continues to use Obsidian for its strengths in managing databases and knowledge bases.

AppWizard

July 4, 2026

This gorgeous Android launcher is basically dead — and it’s all Google’s fault

Stario Launcher, launched in 2024, is an aesthetically pleasing Android launcher that combines speed and functionality, featuring custom animations, widgets, and automatic app categorization. Its design is influenced by Google’s Material Expressive language, with a minimalist interface that emphasizes essential widgets. The launcher includes a search function similar to Pixel Launcher, supports alternative search engines, and has a dedicated Briefing page for personalized news feeds. It also offers a widget page for customization and a Low Spec mode for older devices. However, the developer plans to cease updates due to Google's tightening policies on third-party apps, which will complicate the installation of non-verified apps starting in September 2026. This situation reflects broader concerns about the future of third-party applications in the Android ecosystem.