indicators Archives

Tech Optimizer

August 31, 2026

ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions

Silver Fox is linked to the distribution of a backdoor malware called ValleyRAT, disguised as the legitimate QN Wallpaper adware application. Once installed, ValleyRAT provides complete control over the compromised machine. The malware uses DLL sideloading to operate under the guise of a legitimate process, bypassing security measures. It disables Windows Defender and adds itself to autorun entries, and can mark its process as critical, causing system crashes if terminated. Kaspersky has identified specific indicators of compromise (IoCs) including hashes, command-and-control servers, and associated domains. In 2026, Kaspersky recorded over 100,000 detections of ValleyRAT affecting more than 1,500 unique users, mainly in China and India.

Tech Optimizer

August 27, 2026

Scammers Impersonate Microsoft to Push Fake Security Scans and Refund Fraud

A network of fraudulent websites, branded as SysScan, has been discovered, which falsely claims to evaluate antivirus software effectiveness through deceptive security scans. These sites manipulate users into uninstalling legitimate antivirus products and disclosing sensitive personal and banking information. Eleven distinct domains associated with SysScan have been identified, all hosted on a single server. The fraudulent scans generate misleading results based on static findings rather than actual system assessments, and users are coerced into believing their computers are at risk. The scams misrepresent normal browser behaviors as security threats and instruct victims to uninstall their antivirus software, compromising their defenses. The operation targets both individual and business users, collecting extensive personal information and utilizing remote-access tools. The data submitted is sent to Telegram via its bot API. Users are advised to disconnect from the internet and secure their devices if they suspect they have been compromised. Indicators of compromise include specific IP addresses and domains associated with the scam.

Tech Optimizer

August 26, 2026

Catch Of The Week: The ‘Security Scan’ That Wants You Defenseless

Researchers at Malwarebytes have identified a network of deceptive websites posing as a service called “SysScan,” which pretends to conduct Microsoft security checkups. Users encounter these sites through search results, browser hijacking pop-ups, or unsolicited emails. The sites use Microsoft branding and a fake progress bar to create the illusion of a scan, but they only collect harmless data like operating system and location, which are then manipulated into alarming fake alerts. The fabricated security score is predetermined and does not reflect the user's actual security status. The scam misleads users into believing that Windows no longer supports third-party antivirus software, prompting them to uninstall their protections, which increases their vulnerability. Users are then asked to provide personal and banking information through a form that sends data via a Telegram bot. Eleven fraudulent sites have been traced back to a single server. Indicators of the scam include requests to disable antivirus software, installation of remote-access software, and solicitation of sensitive information. Microsoft does not initiate cold calls or scan computers through web pages. If someone has engaged with the scam, they should disconnect from the internet, uninstall any remote-access tools, reinstall antivirus software, and report the incident to authorities.

AppWizard

August 26, 2026

Beware of fake Indeed interview apps used to install spyware

Scammers are exploiting the Indeed platform to target job seekers by using counterfeit Android "interview" applications. Users in the UK and Brazil reported being instructed by supposed employers to download fraudulent apps like MyInterview, which compromised their devices. These scammers post fake job listings and prompt applicants to install apps that mimic Indeed's login page and establish a VPN connection. The malicious apps, classified as Trojan.Droppers, can install additional untrusted software and gain control over devices, complicating uninstallation efforts. Indeed confirmed that their interview process does not require downloading any separate app and warned job seekers against such scams. Indicators of compromise include specific MD5 hashes and package names associated with the Trojan droppers and dropped malware payloads.

Tech Optimizer

August 24, 2026

Fake Microsoft security scans trick victims into uninstalling their antivirus

A surge of fraudulent websites claiming to verify antivirus software functionality has emerged, using the name SysScan and misleadingly asserting that Windows no longer supports third-party antivirus solutions. These sites conduct fake security scans, gather personal information, and set up a refund scam. Eleven such websites were found hosted on a single server, executing similar deceptive tactics. They can access basic browser data but cannot conduct genuine security scans. Microsoft continues to support third-party antivirus software, and legitimate refund processes do not require uninstalling security tools. The scams instruct users to remove their antivirus software to facilitate further manipulation and to collect information about the antivirus in use. The customer information forms collect extensive personal data and are designed to send this information to a Telegram bot API. Victims are promised a refund call after submitting their information, which is part of the scam's manipulation. Signs of such scams include claims of deep problems with the computer, consistently negative diagnostic results, requests to uninstall antivirus software, and demands for banking information. If affected, victims should disconnect from the internet, remove remote-access tools, and contact their bank. The hosting IP address for these sites is 157.230.180.90, with multiple associated domains listed.

Winsage

August 22, 2026

Hackers abuse FTP server banners to deliver new Windows malware

Threat actors are exploiting FTP banners to conceal commands for deploying two undocumented remote access trojans (RATs), E4del and PINHOLE. This method was first observed by MalwareHunterTeam in July 2026, using shortcut files (.LNK) and FTP server banners as dead-drop resolvers to retrieve malicious commands. SOCRadar confirmed that this technique has been weaponized since early July 2026 and remains active, with new infrastructure identified as recently as August 2026. The attacks typically start with a ZIP archive leading to an LNK-based infection chain, likely initiated through phishing tactics. E4del is a Node.js-based RAT disguised within a digitally signed Electron application mimicking Discord, capable of executing commands, capturing screenshots, streaming desktops, and downloading additional payloads. It also includes a module for privilege escalation. PINHOLE retrieves its command and control configuration from Pinterest and SurveyMonkey, designed to leave a minimal footprint and employing shellcode fluctuation. It supports 14 commands, including file management and credential theft, but had only recorded 11 execution events at the time of analysis. SOCRadar notes that while using FTP banners is a novel approach, it is less stealthy than traditional web-based dead-drop resolvers. They provide indicators of compromise to help identify malicious infrastructure and infected machines.

AppWizard

August 22, 2026

Star Wars Zero Company And Galactic Racer Clashed, Lucasfilm Could Have Prevented It

Two Star Wars titles, Star Wars Zero Company and Galactic Racer, are set to launch within months of each other, marking the first time in 15 years that games from different developers will share a release year. The simultaneous lifting of embargoes for both games occurred just an hour apart, creating a clash that disadvantaged the team behind Galactic Racer. The two titles are developed by independent studios Fuse Games/Secret Mode and Bit Reactor/EA, respectively, with Lucasfilm Games overseeing the process. The marketing strategies for the games have differed, with Zero Company announced at last year's Celebration and Galactic Racer unveiled in December. Star Wars Zero Company is set to launch on August 27th, while Galactic Racer will follow on October 6th. Pre-orders are available for both titles.

AppWizard

August 18, 2026

Is Vinted down? Users report issues with app and login

Users have been experiencing login issues with the Vinted app since approximately 3 PM, with reports indicating that 67% of the problems are related to the app itself and 26% specifically to login difficulties. The disruptions have been widespread across the UK, particularly in cities like London, Birmingham, and Leeds. Downdetector reported that a significant number of users were unable to access their profiles, sales, and orders, with many expressing their frustrations on social media. Vinted confirmed that they experienced a temporary technical issue that has since been resolved.

AppWizard

August 18, 2026

Is Lloyds Bank down? Customers complain about app issues

Users of Lloyds Bank's app and online banking services experienced significant difficulties starting around 11 AM, with reports indicating problems since 6:36 AM EDT. Complaints came from various locations across the UK, particularly in major cities like London, Birmingham, and Leeds. Approximately 70% of issues were related to the app, 13% involved login difficulties, and 10% pertained to online banking functionalities. Lloyds Bank acknowledged the technical difficulties and advised users to log in again or try later. Users of Halifax and Bank of Scotland also reported similar issues. Downdetector is a platform that monitors and reports service disruptions, and it confirmed that Lloyds Bank's app is now functioning as intended.

Winsage

August 15, 2026

Windows 11 is dangerously close to letting you move the taskbar

Windows 11 users can now reposition the taskbar to the top or either side of the screen in the latest Insider Preview builds. This feature is currently available to Windows Insiders in the Release Preview Channel, with a broader rollout expected with the September Patch Tuesday update. Additional enhancements include a more customizable Start menu, improved Windows Search, and a faster File Explorer. Users can choose between small or large Start menu sizes, recent items are highlighted, and search functionality has been refined for better clarity. File Explorer now launches more quickly and supports touch scrolling. Updated progress indicators and enhanced security features for administrators are also included in the updates.