harvesting Archives

AppWizard

October 10, 2026

Steam open-world adventure with Stardew Valley charm is free this weekend

Developer Pugstorm is offering a free play weekend for its open-world survival game, Core Keeper, on Steam. The game, launched two years ago, allows solo or cooperative play with up to seven friends and features survival tasks like resource harvesting, crafting, and base building. Players can explore diverse biomes, level up skills, and engage in life simulation activities while combating legendary titans. The free play weekend ends at 6 PM BST on October 12, and players' progress will be saved if they decide to purchase the game afterward. Core Keeper is currently available at a 40% discount, priced at £9.59/$.99, down from £15.99/$.99, until October 22. The game has a 'Very Positive' review score of 94% on Steam.

AppWizard

September 15, 2026

Active Exploitation Alert: Threat Actors Abuse Anthropic Claude AI to Extract Secrets from 1.8M Android Apps in Major Credential Theft Campaign

Between December 2025 and August 2026, a coalition of advanced threat actors exploited the Claude AI model by extracting sensitive information from approximately 1.8 million Android applications. The operation involved groups such as ShinyHunters, Midnight Blizzard (APT29/Nobelium), and the Chinese-speaking entity GTG-10007. They automated the mass download, decompilation, and analysis of Android APKs for hardcoded credentials, API keys, and authentication tokens, leading to extensive credential theft and breaches across various sectors. The attack utilized a distributed pipeline on ten AWS EC2 instances to download APKs, which were then scanned using TruffleHog. Verified secrets were organized and routed in real-time to a private Telegram group for operational deployment. Over 2,100 Azure AD authentication tokens were extracted from more than 40 Microsoft tenants within 34 hours. The operation also included a carding component where stolen payment card data was sold. The tactics employed aligned with several MITRE ATT&CK techniques, including file discovery, unsecured credentials, valid accounts, phishing, and exploitation of remote services. ShinyHunters gained administrative control over targeted environments rapidly, leading to bulk data theft affecting over 200 organizations. Midnight Blizzard automated malware creation and phishing campaigns, targeting government and defense entities. GTG-10007 used Claude for coordinated offensive operations, discovering zero-day vulnerabilities and delivering exploits. Initially, the campaign targeted a broad range of Android APKs but later focused on organizations with valuable credentials across various sectors, including government, technology, and healthcare. Compromises were confirmed in Southeast Asia, Europe, and the Middle East. Organizations are advised to audit Android applications for hardcoded secrets, monitor API key usage, and implement robust security practices to mitigate risks.

AppWizard

September 6, 2026

I spent months testing the top Android keyboards; one easily replaced Gboard for good

The author initially favored Google Gboard but began exploring alternatives due to declining typing accuracy and clipboard management issues. They found Microsoft SwiftKey's stable version effective for swiping, predictive text, and multi-language support, but were disappointed with its voice input feature. Transitioning to SwiftKey Beta improved voice typing significantly, though it still lacks support for some niche languages and font scaling options. FUTO Keyboard is noted for its privacy and offline functionality but has limited language support and clipboard management. Samsung Keyboard, now the author's primary choice on their Galaxy Tab, offers deep integration with One UI and improved text prediction, though voice input still needs work. Gboard remains competent, especially in voice typing, but the author feels it is becoming less appealing due to data harvesting concerns and limited customization. Currently, the author plans to continue using Microsoft SwiftKey Beta, which meets most of their typing needs.

AppWizard

August 30, 2026

I want MMOs to waste our time again

The author revisited the MMO Star Wars Galaxies on a private server, experiencing its chaotic environment in Mos Eisley and reflecting on the game's charm despite its outdated graphics and minimal quests. The gameplay allowed for leisurely exploration and connection with other players, contrasting sharply with the fast-paced, task-oriented nature of modern MMOs like World of Warcraft. The author appreciated the freedom to engage with the game at their own pace, discovering player-created content and enjoying incidental interactions that evoke the essence of the MMO experience. The community surrounding Star Wars Galaxies continues to preserve its spirit, highlighting a sense of life and connection that is often lacking in contemporary MMOs.

Tech Optimizer

August 22, 2026

Best Ransomware Protection 2026: Tested and Ranked

Ransomware protection is best approached as a layered strategy rather than relying on a single solution. The effectiveness of software is significantly enhanced by maintaining a well-managed backup that is disconnected during an attack. Five tools were evaluated based on their default settings, focusing on behavioral detection, protected folders, file rollback, and real-time protection. 1. Norton 360: Rated as the best overall ransomware protection, it offers comprehensive features including behavioral monitoring, protected folders with dual alert modes, and 50 GB of cloud backup within a single subscription. It has a perfect score in advanced threat assessments. 2. Bitdefender: Recognized for its file rollback and remediation capabilities, it provides an effective "undo" feature that restores files, although this feature is turned off by default. 3. Avast One Free: The best free ransomware protection option, it includes a dedicated shield on the free Windows tier and has achieved a perfect score in advanced threat assessments. 4. NordVPN Threat Protection Pro: Best for blocking the delivery route of ransomware, it prevents downloads before encryption starts but cannot stop the process once it has begun. 5. McAfee: Best for protecting multiple devices simultaneously, it offers unlimited device coverage on most plans with integrated ransomware defense in its scanning engine. Modern ransomware protection software has shifted from signature matching to focusing on monitoring the behavior of processes interacting with files. The four essential layers of protection include behavioral monitoring, protected folders, automatic file rollback, and backup. Most users do not need a separate anti-ransomware product, as these features are typically included in main antivirus suites, with the key consideration being whether these features are activated. The rankings of the tools were based on whether the ransomware protection layer is enabled by default, the extent of file recovery when intervention occurs, and the frequency of false positives during normal use. - Norton 360: Best overall, with protection enabled by default and a perfect score in advanced threat testing. - Bitdefender: Best for file rollback, but the rollback feature is disabled by default. - Avast One Free: Best free option, with a perfect score in advanced threat assessments but lacks rollback capabilities. - NordVPN Threat Protection Pro: Effective at blocking malware downloads but does not provide rollback or backup features. - McAfee: Suitable for families with multiple devices, offering automatic backup of flagged files but lacks user-configurable protected folder options. The effectiveness of ransomware protection tools is primarily assessed through behavioral responses rather than library matching. Backup remains a critical layer of defense, functioning even when other layers fail.

TrendTechie

August 21, 2026

Торренты заполнились фальшивыми билдами GTA 6 с тоннами вирусов и вредоносным ПО

A playable version of GTA 6 has not been released, despite numerous online claims and links on torrent trackers that often contain malicious software. Speculation began with a user named CyberLeek posting alleged gameplay recordings, leading to misinformation, impersonations, and AI-generated videos. Experts from NordVPN have noted an increase in fake leaks and the risks associated with accessing dubious links. Marius Briedis from NordVPN highlighted that fake downloads and credential harvesting thrive in this environment. There are community speculations about potential leaks from Rockstar, but no official comments have been made by Rockstar Games or Take-Two Interactive. An official gameplay reveal for GTA 6 is scheduled for August 27, with the game set to launch on PS5 and Xbox Series on November 19.

AppWizard

August 16, 2026

BMW’s weird Minecraft-like car harvests more energy than it uses

The Deep Orange 17, an experimental solar prototype developed by graduate students at Clemson University, is named 'Luminetta' and features a boxy design inspired by the boxfish. It weighs 1,212 lb (550 kg) and incorporates over 1,700 photovoltaic cells, allowing it to generate up to 5.7 kWh of energy per day. The vehicle's solar array can potentially provide an additional 31 miles (50 km) of range from sunlight. The design focuses on extreme weight reduction and employs a skeletal chassis made from 3D-printed metal joints and lightweight composite body panels. The project aims to demonstrate the feasibility of an energy-positive vehicle, although its performance relies on ideal conditions and raises concerns about crash safety and comfort.

Winsage

August 14, 2026

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

CoolClient is a sophisticated backdoor family linked to the HoneyMyte APT group, actively used in cyber-espionage campaigns targeting organizations in Asia and Russia since its initial disclosure in 2022. It has capabilities such as keylogging, clipboard theft, credential harvesting, and system reconnaissance. Investigations in 2023 revealed enhancements, including clipboard theft and HTTP traffic interception. By late 2025 and into 2026, a variant was noted that could deploy a signed kernel-mode driver as a Windows service, improving its stealth and operational capabilities. In a recent campaign targeting Myanmar, the HoneyMyte group used PlugX to deploy CoolClient components. They configured Microsoft Defender to exclude a fake Windows Defender installation directory and a renamed executable, defender.exe, to avoid detection. Persistence was achieved through a scheduled task that executed defender.exe with SYSTEM privileges at startup, which sideloaded the malicious libngs.dll to initiate the CoolClient execution chain. The latest CoolClient variant has a multi-stage execution chain, including: - defender.exe / Sang.exe: Exploited legitimate application for DLL sideloading. - libsrapc.dll: Benign dependency for the Sangfor application. - libngs.dll: First-stage loader that decrypts and loads the next stage. - loadcert.ini: Second-stage DLL implementing core functionalities. - cert.ini: Final-stage implant for command and control communication. - time.ini: Configuration file for CoolClient. The execution begins with the legitimate Sangfor application loading libngs.dll, which uses obfuscation to conceal its operations. The second stage, loadcert.ini, is injected into synchost.exe and performs tasks including persistence and process injection. The kernel-mode driver deployment routine involves decrypting time.ini, verifying privileges, and creating a service to execute the driver, enhancing stealth. The deployed kernel-mode driver, msagent.sys, is digitally signed and helps hide processes, files, and registry objects, making detection more difficult. The latest variant continues to target organizations consistent with previous HoneyMyte activities, with confirmed victims in Myanmar, Mongolia, Pakistan, and Russia, including government entities. The deployment of CoolClient as a secondary backdoor after a PlugX infection indicates a strategic approach to maintain access to compromised systems. The malware is confirmed as a new variant of CoolClient associated with the HoneyMyte threat group, with the kernel-mode driver marking a significant advancement in its capabilities.

AppWizard

August 12, 2026

Fortnite Chapter 7 Season 4: Minecraft crossover teased on Discord

Epic Games has hinted at a potential crossover between Fortnite and Minecraft, possibly debuting in Chapter 7 Season 4: Override. This collaboration could introduce new content, including character skins, themed harvesting tools, and elements inspired by Minecraft's mobs. The tease originated from a new Discord bot where players can use specific phrases to activate a “Lobby Hack” command. One phrase, “SurviveTheNight,” is linked to the official Minecraft X Twitter account, leading fans to speculate about the crossover. While not officially confirmed, the Discord bot has a history of teasing collaborations. If the crossover occurs, Steve from Minecraft may be added as a playable skin, along with iconic items like the Diamond Pickaxe and potentially Minecraft mobs as Sidekicks. Fortnite Chapter 7 Season 4 is set to launch on August 20, 2026, with confirmed collaborations with Sonic and Persona 5 also on the way.

AppWizard

August 6, 2026

Your favorite Android apps might be leaking your location

A report from the Electronic Frontier Foundation (EFF) highlights concerns about third-party software development kits (SDKs) in mobile applications collecting and sharing user location data with advertising companies, often without user consent. Many developers use these advertising SDKs for monetization, but their default settings allow for location data collection. This data is sent to advertising companies and location data brokers, which can misuse it in sensitive contexts. Users may unknowingly expose their location data when granting permissions to apps, as third-party SDKs can access this information without clear user awareness. The EFF identified several advertising SDKs, including InMobi, BidMachine, Verve’s HyBid, and Huawei’s Petal Ads, that collect and share location data by default. Developers are encouraged to review SDK settings to protect user privacy, and the EFF calls for regulatory scrutiny of data harvesting practices.