healthcare Archives

AppWizard

September 15, 2026

Active Exploitation Alert: Threat Actors Abuse Anthropic Claude AI to Extract Secrets from 1.8M Android Apps in Major Credential Theft Campaign

Between December 2025 and August 2026, a coalition of advanced threat actors exploited the Claude AI model by extracting sensitive information from approximately 1.8 million Android applications. The operation involved groups such as ShinyHunters, Midnight Blizzard (APT29/Nobelium), and the Chinese-speaking entity GTG-10007. They automated the mass download, decompilation, and analysis of Android APKs for hardcoded credentials, API keys, and authentication tokens, leading to extensive credential theft and breaches across various sectors. The attack utilized a distributed pipeline on ten AWS EC2 instances to download APKs, which were then scanned using TruffleHog. Verified secrets were organized and routed in real-time to a private Telegram group for operational deployment. Over 2,100 Azure AD authentication tokens were extracted from more than 40 Microsoft tenants within 34 hours. The operation also included a carding component where stolen payment card data was sold. The tactics employed aligned with several MITRE ATT&CK techniques, including file discovery, unsecured credentials, valid accounts, phishing, and exploitation of remote services. ShinyHunters gained administrative control over targeted environments rapidly, leading to bulk data theft affecting over 200 organizations. Midnight Blizzard automated malware creation and phishing campaigns, targeting government and defense entities. GTG-10007 used Claude for coordinated offensive operations, discovering zero-day vulnerabilities and delivering exploits. Initially, the campaign targeted a broad range of Android APKs but later focused on organizations with valuable credentials across various sectors, including government, technology, and healthcare. Compromises were confirmed in Southeast Asia, Europe, and the Middle East. Organizations are advised to audit Android applications for hardcoded secrets, monitor API key usage, and implement robust security practices to mitigate risks.

AppWizard

September 11, 2026

NetScaler vulnerability exploited, AdaptHealth suffers breach, new Android malware

The Cybersecurity and Infrastructure Security Agency (CISA) warned of a critical vulnerability in NetScaler, identified as CVE-2026-19490, with a CVSS score of 9.3, which has been exploited and affects all NetScaler ADC and Gateway appliances. Citrix has patched this vulnerability as of August 19. AdaptHealth reported a data breach affecting over 4.1 million individuals, compromising personal, health, and insurance information, but not Social Security numbers or financial data. A new strain of Android malware, MantaxOtax, attributed to Indonesian threat actors, combines ransomware and spyware, stealing sensitive information and affecting older Android versions. The Gigabud banking trojan has evolved to evade detection by installing a secondary app that hides the malicious application. CISA acting director Nick Andersen emphasized the need for swift adaptation to cybersecurity threats and highlighted staffing improvements within CISA. Russian e-commerce giant Wildberries experienced disruptions from a DDoS attack affecting payments to sellers, following claims of a cyber operation by Ukraine's military intelligence. McKesson faced a cyberattack exposing sensitive data of 6.4 million individuals, with the ShinyHunters group releasing this data after a failed extortion attempt. IDScan confirmed a data breach affecting 150 million individuals, resulting in the theft of personally identifiable information and government-issued documents.

Winsage

September 2, 2026

Fake Software Installers Disable Windows Update and Weaken Microsoft Defender

An active malware campaign is using counterfeit software-download websites to distribute malicious installers, primarily targeting users seeking popular software. This campaign has significantly affected China-based operations of multinational corporations and Chinese-speaking users. The malware, once executed, can establish persistence, undermine security measures, and communicate with attacker-controlled infrastructure. Victims span various sectors, including healthcare, manufacturing, gaming, technology, logistics, government, and education. Microsoft associates this campaign with a Chinese threat cluster called Silver Fox, known for using spoofed vendor download pages to spread Gh0st RAT and ValleyRAT. The malicious websites are hosted on .com.cn and .hl.cn domains, featuring Chinese-language content. The downloaded files are dynamically generated, and upon execution, they deploy a wrapper installer that initiates the malware payload. The malware achieves persistence through scheduled tasks and interferes with Windows Update services. The campaign establishes command-and-control communication over non-standard ports, with two identified domains linked to the activity. Microsoft Defender has detected the threat and initiated containment procedures. Kaspersky reported a related malicious installer exploiting a legitimate adware application to execute a backdoor, which captures keystrokes and clipboard contents. ValleyRAT, a sophisticated implant, can collect system information, reboot the computer, capture screenshots, and transmit logs. The attackers are motivated by cyber espionage and financial gain, targeting organizations globally. A subgroup within GoldenEyeDog, known as CuboidalCanine, has also been linked to the use of ValleyRAT, particularly in the gambling industry. In June 2026, Chinese authorities addressed cybercrime cases involving a new variant of the Silver Fox trojan.

Winsage

September 2, 2026

Fake Microsoft Edge, Kaspersky and Razer Installers Used to Compromise Windows Systems

An ongoing malware campaign is targeting Windows devices through counterfeit download pages for well-known software brands like Microsoft Edge, Kaspersky, and Razer. The campaign affects various sectors, including healthcare, manufacturing, gaming, technology, logistics, government, and education. It utilizes high-fidelity fraudulent websites that closely mimic legitimate vendors, with observed lure domains such as app-microsoft-edge[.]com[.]cn and kaspersky-lab[.]hl[.]cn. Attackers employ evasion tactics like server-side payload regeneration and create multiple copies of the same archive in quick succession. Victims are lured into downloading ZIP files that contain a bundled wrapper installer, which activates a stage-one executable in randomized directories. The malware often masquerades as legitimate software, with some payloads impersonating known applications. Persistence is achieved through scheduled tasks with unusual names, and the malware employs various evasion techniques, including deleting shadow copies and altering file permissions. Microsoft Defender has identified activity across multiple stages of the attack, including delivery, execution, and command-and-control communications. To mitigate risks, organizations are advised to block downloads from unofficial sources, enforce Tamper Protection, and implement Attack Surface Reduction rules. Indicators of compromise (IOCs) include specific lure domains and URLs associated with the campaign.

Winsage

August 11, 2026

5 years later, Windows 10 refuses to die, and Microsoft just can’t push holdouts to Windows 11

Windows 11 was released in 2021, but Windows 10 remains a significant presence, with approximately 17% market share among enterprise PCs as of 2026. Lansweeper reports that Windows 10 has lost users, dropping from nearly 50% in early 2025 to around 40% by October 2025, and settling at 16.9% a year later. Key sectors using Windows 10 include healthcare (23%), consumer retail (22.7%), small and medium businesses (21.4%), manufacturing (18%), and enterprises (16.6%). Windows 10 has 1,903 active CVEs compared to 652 on Windows 11, indicating a 2.9 times higher vulnerability. About 14% of Windows 10 users receive Extended Security Updates, leaving 2% on unsupported versions. HP reports that 30% of its installed base still uses Windows 10, reflecting a core group resistant to upgrading. Microsoft states that Windows is active on 1.6 billion PCs globally, with a noted 7% decrease in Windows OEM revenue attributed to lower PC demand and the end-of-support effects for Windows 10.

Winsage

August 10, 2026

Which Windows 11 Update Is Causing Problems in 2026? – TheZeroNet

KB5094126, released in June 2026, is causing significant issues for Windows 11 users, including BSODs, boot failures, BitLocker lockouts, and problems launching Office applications. This update has particularly affected HP enterprise hardware, leading to BitLocker recovery loops and black screens. The issues stem from disk space limitations related to Secure Boot certificate handling and restricted EFI partition space. Affected users are advised to locate their BitLocker recovery keys and consider workarounds, such as launching Office applications directly. Windows 10 users are also experiencing similar problems due to the related update KB5094127. Microsoft is expected to release fixes in subsequent updates, including KB5101650 in July 2026.

Winsage

August 6, 2026

Windows 10 LTSC 2021 has five months before security updates cost extra

Microsoft has announced that support for Windows 10 Enterprise LTSC 2021 will end on January 12, 2027, coinciding with the release of a final security update. Organizations can enroll in the Extended Security Updates (ESU) program to maintain security updates beyond this date, which will cost per device in Year 1, with prices doubling each subsequent year until the program ends on January 8, 2030. ESU sales will start on September 1, 2026, and licenses are cumulative. The ESU program does not cover Windows 10 IoT Enterprise LTSC, which is supported until January 13, 2032. Organizations using Microsoft’s cloud-based update services can receive a 25 percent discount on the Year 1 price. As of July, 16.9 percent of monitored devices were still running Windows 10, with migration to Windows 11 stalling due to compatibility issues and hardware requirements.

Tech Optimizer

August 5, 2026

Timescale Details PostgreSQL’s Growing Adoption Across Industries in 2024

Timescale has released its State of PostgreSQL 2024 Report, highlighting PostgreSQL's growing role as the preferred database for AI applications. Key findings from a survey of 688 developers indicate that 78.6% prefer PostgreSQL for its ability to manage diverse data types, including vectors. There has been a 65% increase in PostgreSQL usage compared to the previous year, with 55.3% of developers now using AI tools, reflecting a 55% year-over-year growth. Additionally, 60% of developers use PostgreSQL for both personal and professional projects, a 20% increase from last year. PostgreSQL is recognized for its stability, extensibility, and developer-friendly nature, making it a strong alternative to specialized databases. Developers cite data integration flexibility (78.6%) and ease of use (56%) as key reasons for their preference. PostgreSQL's capabilities have led to its adoption across various industries, including finance, healthcare, and IoT, due to its proficiency in handling transactional and analytical workloads. Timescale is enhancing PostgreSQL's AI capabilities with innovations like pgai and pgvectorscale.

Tech Optimizer

August 5, 2026

Google Cloud explains SQL Server to PostgreSQL migration

Google Cloud has introduced its Database Migration Service, which focuses on converting SQL Server stored procedures with multiple result sets into PostgreSQL code. The service uses an automated decision-making process to determine if a SQL Server procedure should be translated into a PostgreSQL stored procedure or function, based on the number of result sets and the presence of a scalar return value. Procedures with a single result set or scalar return value are converted into PostgreSQL stored procedures, while those with multiple result sets are transformed into functions returning a SETOF refcursor. In a healthcare reporting example, a master procedure retrieves patient details and may return multiple result sets along with a status integer. The PostgreSQL translation involves simpler child procedures as standard procedures and more complex routines as functions that open cursors sequentially. Scalar return values are handled by placing them in a dedicated cursor at the end of execution, changing how applications interact with the outputs. Testing of these translated objects must occur within an explicit transaction block due to PostgreSQL cursor lifecycle constraints. The user executes the function to generate cursor references and fetches data sequentially. Google Cloud's internal analysis classifies stored procedures by scanning for direct result sets and considers conditional logic and loops that may complicate result set counts. A directed graph of procedure calls is constructed to determine the result set classification. Database migrations often face challenges due to legacy application logic, especially with stored procedures designed to minimize database round trips. Successful code conversion is only part of the task, as teams must also adjust test harnesses and application data access layers for PostgreSQL's cursor management. Google Cloud's service categorizes SQL Server procedures into three types: no result sets, a single result set, or multiple/dynamic result sets.

AppWizard

August 2, 2026

Brand new $10 PC bundle gives you over 100 games to play

PC gamers can purchase a bundle for a low price featuring over 100 games, created by indie developers as part of the Game Industry Hardship Fund on the Itch platform. This initiative, led by Necrosoft Games, aims to support laid-off developers in the gaming industry. The bundle includes 127 games from various indie studios, such as A Short Hike and Neurocracy. The fund seeks to raise 0,000 and will remain active until August 13, 2026, providing financial assistance to developers affected by layoffs. The fund is managed by United Videogame Workers and is available only to developers in the U.S. and Canada. The bundle can be downloaded exclusively from Itch.