Google Chrome Archives

Winsage

June 24, 2026

Windows RAT Uses Encrypted HTTP C2 and Registry Persistence After npm Infection

A malware campaign targets Windows systems through a malicious npm package named postcss-minify-selector-parser, which mimics the legitimate postcss-selector-parser. This counterfeit package installs a Remote Access Trojan (RAT) on developer machines, beginning with a multi-stage attack triggered by the installation of the package. The RAT can steal credentials, execute shell commands, and communicate with a remote attacker. Security researchers at JFrog identified this threat and reported it on June 22, 2026, noting that two additional related packages, postcss-minify-selector and aes-decode-runner-pro, are linked to the same publisher and remain live on the npm registry. The RAT employs encrypted HTTP communication with a command-and-control (C2) server and ensures persistence by creating a registry key under the Windows Run key. It has capabilities for remote shell execution, file uploads and downloads, and can steal saved login data from Google Chrome using Windows decryption APIs. The malware is designed for organized batch exfiltration of stolen data. Indicators of compromise include specific IP addresses, domains, file paths, and SHA-256 hashes associated with the malware components. JFrog advises users to remove the malicious packages, inspect their dependency trees, and treat any stored credentials as compromised.

Tech Optimizer

June 22, 2026

I Turned Off All Antivirus Protection for a Week. Here’s What I Learned

The author conducted an experiment by disabling both Bitdefender and Windows Security for a week to rely solely on personal cybersecurity instincts. They took precautions by using a secondary device and backing up important data. Throughout the week, the author experienced heightened awareness while navigating online tasks, encountered a phishing email, and adapted to a more deliberate browsing rhythm. Key takeaways included exercising caution, verifying sources, being aware of URLs, and keeping software updated. The experiment highlighted the importance of both good habits and antivirus software in maintaining cybersecurity. The author concluded that while personal vigilance is crucial, antivirus software is essential for those lacking strong instincts.

AppWizard

June 19, 2026

Rokarolla trojan uses screen overlays to hijack Android financial apps

A new banking trojan for Android, named Rokarolla, targets 217 applications, including banking and cryptocurrency platforms, to steal credentials and sensitive financial data. It operates via a command and control (C2) server and bypasses the Google Play Store by using phishing websites that mimic legitimate download portals. Users are tricked into downloading a dropper that installs the malware, which disguises itself as the Google Play Protect security tool to gain access to Android Accessibility Services. Rokarolla employs dynamic screen overlays to capture user input in targeted financial applications and can also impersonate the device's lock screen. Additionally, it uses a pseudo-VNC system to intermittently capture screenshots for data extraction and can modify clipboard contents to manipulate cryptocurrency transactions by replacing copied addresses with those controlled by attackers.

Winsage

June 18, 2026

Microsoft kills mandatory MSA Edge sign‑in after years of complaints, and Google login support will arrive in July

Users will soon be able to sign into Microsoft Edge using a Google account, according to a new entry in Microsoft's roadmap (ID 565860). This change eliminates the requirement for a Microsoft account, increasing accessibility. Additionally, Microsoft Edge will adopt a two-week release cycle for major updates, similar to Google Chrome, to enhance innovation and competitiveness.

AppWizard

June 17, 2026

New Rokarolla Android Trojan Targets 217 Banking and Crypto Apps

Zimperium’s zLabs researchers have analyzed a newly identified Android banking trojan named Rokarolla, which targets 217 distinct banking and cryptocurrency applications. It is distributed through malicious websites that impersonate popular platforms like TikTok and Google Chrome, with one identified distribution point being hxxps://infocontablidades[.]it[.]com/. The malware uses a dropper disguised as Google Play Protect to install a second-stage payload and gain Accessibility Services access, allowing it to simulate user interactions and manipulate on-screen elements. Rokarolla downloads counterfeit HTML login pages for targeted applications and overlays them to capture user credentials, including sensitive card information. It can also deploy a fraudulent PIN entry screen, read and send SMS messages, intercept one-time codes from banks, and block incoming calls. The malware rewrites the clipboard, operates a keylogger and screen content logger, and scrapes WhatsApp contact data. It captures screenshots without alerting users and has a resilient command-and-control infrastructure with multiple fallback domains. No product flaws are exploited, and defenses against it include installing apps only from Google Play and being cautious with Accessibility Services. Zimperium’s Mobile Threat Defense and zDefend products can detect Rokarolla, and a list of indicators of compromise is available on their GitHub repository.

AppWizard

June 16, 2026

New Rokarolla Android malware targets 217 banking, crypto apps

A new Android banking trojan named Rokarolla targets 217 banking and cryptocurrency applications and features 137 commands for malicious activities. It is distributed via deceptive websites posing as legitimate application sources and impersonates Google Play Protect to lure users into installing infected apps. Once installed, it seeks Accessibility service permissions and access to notifications, SMS, and calls. Rokarolla communicates with a command-and-control server, sending device profiles to generate unique identifiers for victims. Its primary goal is to steal financial information by using deceptive login overlays to capture sensitive data and maintain control over the device. The malware employs evasion tactics such as disabling Google Play Protect, hiding its icon, silencing notifications, and keeping the screen awake. It can steal SMS messages, extract contacts, capture keystrokes, record screen content, manipulate clipboard contents, block calls, and take screenshots. Zimperium confirms that Rokarolla is not found on Google Play, and users are advised to avoid downloading APK files from untrusted sources and to be cautious with Accessibility permissions.

Winsage

June 16, 2026

Munch Museum Windows display gives visitors something to scream about

At the Munch Museum in Oslo, Edvard Munch's painting "The Scream" is displayed alongside a Microsoft account recovery screen, creating an ironic contrast between art and technology. The museum rotates three versions of "The Scream" to prevent deterioration, and the painting continues to resonate with modern audiences as it symbolizes anxiety in today's technology-driven world. The frustrations of dealing with digital barriers, such as forgotten passwords, evoke emotions similar to those depicted in "The Scream."

Winsage

June 11, 2026

Major Microsoft Edge versions will now ship every two weeks: Microsoft confirms plans to ship new Edge features and changes twice a month

Microsoft has announced a new release schedule for its Edge web browser, transitioning to a two-week release cycle from the previous monthly schedule. This change aims to provide users with a more consistent flow of updates, delivering approximately half the amount of new content with each release. The updates will be smaller and more manageable, enhancing user experience and security.

AppWizard

June 6, 2026

Google Chrome tests another massive change to Search that puts AI in front

Google is testing a change to Chrome's Search experience that would prioritize AI Mode over traditional search engines. This experiment, conducted within Chrome Canary, introduces a feature labeled "Fulfill Searchbox queries in AI Mode." Recently, Google announced a significant update to its Search capabilities with Gemini 3.5 Flash, which allows users to interact with search queries in a more conversational manner and accommodates various input types, including images and videos. The rollout of "Search Profiles" enables users to discover content aligned with their interests. Testers can toggle the AI Mode feature, but there are concerns about the accuracy and comprehensiveness of AI-driven search results.

AppWizard

June 5, 2026

Chrome is faster than ever thanks to a massive under-the-hood overhaul

Google Chrome has achieved scores of 61 in Speedometer 3.1 and 469 in JetStream 3, marking a 10% increase in JetStream and a 5% boost in Speedometer compared to the previous year. These benchmarks were measured on a MacBook Pro with macOS 26.0.1 and the Apple M5 chip. Enhancements in Chrome's performance are largely due to improvements in the V8 JavaScript engine, which included optimizations for asynchronous tasks, string comparison, and data sorting. The Chrome team has improved code optimization decision-making and made advancements in BigInt handling and memory allocation for security. Additionally, Chrome has upgraded WebAssembly performance, optimizing internal data management and compiler times. The rendering engine, Blink, has been tuned for better code translation into visual pages, and page loading has been improved through SIMD processing and optimizations in typography and graphics handling.