inspection Archives

Winsage

June 25, 2026

Introduction to COM usage by Windows threats

Component Object Model (COM) is a technology in Windows that enables object activation, inter-process communication, and automation across different programming languages. Malware exploits COM interfaces for activities such as lateral movement, execution, downloading, exfiltration, persistence, evasion, system discovery, and automation of Windows and Office functionalities. Reverse engineering COM-heavy binaries involves navigating GUIDs and indirect vtable calls to understand malware mechanics. Research at the AVAR 2025 conference and CARO 2026 workshop discusses methodologies for analyzing COM binaries and case studies of malware families that utilize COM. COM is an application binary interface (ABI) model that allows software components to be reused and enables interaction between different programming languages through interfaces defined at the binary level. Distributed COM (DCOM) allows clients to activate COM objects on remote systems. COM classes are identified by unique class identifiers (CLSIDs), and interfaces by interface identifiers (IIDs). The Windows registry stores COM registration data, with classes and interfaces located under specific keys. Malware often acts as a COM client, utilizing the COM runtime to instantiate classes and request interfaces. ProgIDs provide human-readable registry entries for COM classes. The CoCreateInstance function helps create class objects by resolving CLSID registrations. All COM interfaces derive from IUnknown, which manages object lifetimes and interface querying. COM has its own security model, and identifying classes and interfaces used by malware is crucial for threat researchers. Tools like ComView and OleView.NET assist in inspecting COM registrations. The analysis workflow includes identifying activation API calls, extracting CLSID and IID values, consulting registry definitions, and mapping vtable calls. Qakbot, a banking trojan, exemplifies the use of COM in malware, with its architecture enabling malicious activities like credential theft. Dynamic analysis tools can log COM-related calls in real-time to trace execution flow. Notable malware families that utilize COM include Gh0stRAT, which uses Task Scheduler COM interfaces, and the Attor platform, which employs BITS for file transfers. WarmCookie demonstrates the use of COM for persistence through Task Scheduler. Understanding COM's role in malware is essential for cybersecurity professionals.

Winsage

June 24, 2026

Windows RAT Uses Encrypted HTTP C2 and Registry Persistence After npm Infection

A malware campaign targets Windows systems through a malicious npm package named postcss-minify-selector-parser, which mimics the legitimate postcss-selector-parser. This counterfeit package installs a Remote Access Trojan (RAT) on developer machines, beginning with a multi-stage attack triggered by the installation of the package. The RAT can steal credentials, execute shell commands, and communicate with a remote attacker. Security researchers at JFrog identified this threat and reported it on June 22, 2026, noting that two additional related packages, postcss-minify-selector and aes-decode-runner-pro, are linked to the same publisher and remain live on the npm registry. The RAT employs encrypted HTTP communication with a command-and-control (C2) server and ensures persistence by creating a registry key under the Windows Run key. It has capabilities for remote shell execution, file uploads and downloads, and can steal saved login data from Google Chrome using Windows decryption APIs. The malware is designed for organized batch exfiltration of stolen data. Indicators of compromise include specific IP addresses, domains, file paths, and SHA-256 hashes associated with the malware components. JFrog advises users to remove the malicious packages, inspect their dependency trees, and treat any stored credentials as compromised.

Winsage

June 14, 2026

When Windows 7 Arrived in Japan, It Came Printed on Toilet Paper

On October 22, 2009, Japan launched Windows 7, accompanied by a unique promotional item: a roll of toilet paper featuring Windows 7 branding and details about its enhancements. This marketing strategy was similar to the previous promotion for Windows Vista Service Pack 1. The toilet paper included messages about Windows 7's speed, security, and compatibility improvements, with sections detailing faster startup times, enhanced memory management, a streamlined user interface, and security features like the Action Center and BitLocker To Go. Networking capabilities were improved with HomeGroup, and Windows Media Center expanded its functionality. The design of the promotional toilet paper allowed users to revisit key points easily, and some versions mimicked Windows software boxes. This initiative was driven by local retailers, reflecting Japan's trend of quirky promotions in the electronics retail sector.

Tech Optimizer

June 2, 2026

How to set up instant antivirus protection for the whole family

An antivirus program protects personal computers from malware that can steal information or disrupt operations. Antivirus vendors offer family bundles at discounted rates, allowing multiple devices to be protected under a single subscription, which can lead to significant cost savings. To set up family antivirus protection, one should choose an appropriate antivirus app based on cost, compatibility, user experience, and features. Many providers offer family plans that cover multiple devices, such as Webroot Essentials, which offers a plan for five devices at a reduced price. After selecting an app, users can opt for a free trial to assess its features before subscribing. The setup process begins with the administrator's personal device, from which family members can be invited to join the subscription. The administrator can also configure settings for connected devices, including screen time limits and web filters. Antivirus software works by scanning files against a database of malware signatures and using techniques like behavioral analysis, sandboxing, real-time web protection, and external device scans to detect threats. No single antivirus tool is the best for everyone; the choice depends on individual needs. Webroot Essentials is highlighted for its comprehensive protection, covering five devices with features like active scanning and real-time web filtering. Best practices for using antivirus tools include running only one antivirus program, enabling automatic updates, and activating real-time protection to ensure optimal security.

AppWizard

May 19, 2026

Russia’s State-Mandated Max Messenger Reportedly Hides Powerful Tracking Tools

The state-mandated messenger Max, developed by VK and supported by the Kremlin, is preinstalled on all new smartphones in Russia as of September 1, 2025, and is designed to function during internet blackouts. Following WhatsApp's ban in February 2026, officials have promoted Max as a "sovereign" alternative to Western messaging platforms. A reverse-engineering study revealed numerous surveillance features in Max, including VPN detection that restricts access until VPNs are disabled, real-time monitoring of contact lists, NFC control for manipulating the phone's NFC chip, silent message deletion, IP address tracking, a persistent hardware identifier, the creation of fake chats and reviews, and code injection capabilities. The study also found an on-device machine-learning system that detects keywords from audio input and the ability to record microphone audio during calls without user notification. Additionally, Max monitors access to foreign services and compiles sensitive user information into reports sent to analytics channels. The integration of Max is part of Moscow's broader initiative to consolidate internet traffic through state-controlled platforms, even reaching the International Space Station for communication purposes. Critics view the promotion of Max as part of a strategy to establish a "sovereign" communications system, raising concerns about digital privacy and freedom in Russia.

AppWizard

May 13, 2026

There’s a free life-size Minecraft map of the biggest suspension bridge in Japan, and it lets you live a day in the life of a bridge maintenance guy

The Honshu-Shikoku Bridge Expressway Company (HSBE) has launched a Minecraft world featuring a replica of Japan’s Akashi Kaikyo Bridge, the second longest suspension bridge in the world, created using approximately 530,000 blocks. This initiative serves as an educational tool for players to explore bridge infrastructure management through four stages: bridge girder, main tower, inspection walkway, and deck. Players can engage in tasks such as photographing abnormalities, clearing debris, and inspecting for deterioration using vehicles. The HSBE has made the map available for free download.

AppWizard

April 28, 2026

Don’t fall for the Verizon ‘loyalty’ scam that’s putting $1,500 iPads in the mail

A sophisticated scam targeting Verizon customers has emerged, exploiting the My Verizon app to send fraudulent push notifications. A Reddit user, ApprehensivePace2969, experienced this scam when they received a call from someone impersonating a Verizon representative, claiming they qualified for a 65% discount and a free iPad. The legitimacy of the offer was reinforced by a push notification from the app. The victim received a 256GB iPad Pro, valued at ,500, and was charged a shipping fee, which was promised to be refunded upon activation. However, they later received calls from another supposed Verizon representative, instructing them to return the iPad or face a full charge. Red flags included a return shipping label not from Verizon's official center and an unrelated New York address. The victim took the iPad to a real Verizon store, contacted the fraud department, and successfully returned the device, avoiding financial loss.

AppWizard

April 25, 2026

NoVoice malware hit 2.3 million Android devices through apps Google never should have approved

McAfee researchers discovered a complex Android rootkit campaign, dubbed Operation NoVoice, that infiltrated 50 applications on Google Play, exploiting vulnerabilities in the kernel that had been patched but not uninstalled. The malware was resilient enough to survive factory resets and was concealed within seemingly benign apps, which collectively garnered 2.3 million downloads. The malicious payload was hidden in the com.facebook.utils package and used steganography to embed an encrypted payload within a PNG image. The malware conducted multiple checks to avoid detection and established contact with a command-and-control server, polling for exploit packages every 60 seconds. It utilized 22 distinct exploits, including vulnerabilities that had received patches between 2016 and 2021. The malware disabled SELinux enforcement and installed a persistent rootkit that could survive factory resets. Google confirmed the removal of the infected apps but noted that users who had already downloaded them remained at risk, especially if their devices were running unpatched Android versions. McAfee advised affected users to treat their devices as compromised and consider professional inspection or hardware-level storage wiping for remediation.

AppWizard

April 16, 2026

How to make gunpowder in Windrose

To create gunpowder in Windrose, you need 10 units of sulfur and 20 units of ash, which must be combined at a Millstone. You cannot craft gunpowder until you complete the main quest "Revenge is Best Served Cold." Sulfur can only be mined with an Iron Pickaxe, which requires significant game progression. Before crafting gunpowder, you must complete the quests "Rescuing the Crew" and "I Need a Bigger Boat," defeat Thomas Richards, travel to the Foothills to mine Foothills Iron Ore for ingots, discover corn in the Foothills to unlock the Millstone recipe, and craft an Iron Pickaxe. Sulfur can be found in the Coastal Jungle and Foothills biomes, while ash can be obtained from burning wood at the Charcoal Kiln or grinding charcoal at the Millstone.

Tech Optimizer

April 11, 2026

Database Branching in Postgres: Git-Style Workflows with Databricks Lakebase

Database branching is a modern approach that addresses the limitations of traditional database management in development workflows. Unlike conventional database copies, which require significant time and resources to duplicate data and schema, database branching allows for the creation of isolated environments that share the same underlying storage. This method utilizes a copy-on-write mechanism, enabling branches to be created in seconds regardless of database size, with storage costs tied only to the changes made. Key features of database branching include: - Branch creation time: Seconds, constant regardless of database size. - Storage cost: Proportional to changes only, not the total data size. - Isolation: Each branch has its own Postgres connection string and compute endpoint. - Automatic scaling: Idle branches can scale compute to zero, incurring costs only when active. The architecture supporting this approach separates compute from storage, allowing multiple branches to reference the same data without conflict. This design facilitates time travel capabilities, enabling branches to be created from any point in the past for instant recovery and inspection. Database branching unlocks new workflows, such as: - One branch per developer, providing isolated environments for each engineer. - One branch per pull request, automating branch creation and deletion tied to PRs. - One branch per test run, provisioning fresh databases for each CI pipeline execution. - Instant recovery from any point in time within a designated restore window. - Ephemeral environments for AI agents, allowing programmatic database provisioning. Databricks Lakebase offers this database branching capability, transforming the database from a bottleneck into a streamlined component of the development process.