intelligence Archives

Tech Optimizer

September 16, 2026

Hackers Disguise CHOSEN BRICK Malware as AI Apps, Antivirus Software and MRI Results

Iranian state-affiliated cyber actors are targeting dissidents, activists, and journalists using fake AI applications, counterfeit antivirus tools, and fabricated MRI scan results, primarily through a spyware family known as CHOSEN BRICK, which is designed for Windows systems. This campaign has been active since at least 2025 and affects individuals globally, including in the UK, US, and Netherlands. The malware establishes persistence via the Windows Registry Run key and communicates through Telegram, utilizing unique Bot IDs for each victim. CHOSEN BRICK is capable of extensive data collection, including capturing screenshots, recording audio, and stealing email content. Personal information from victims has been found on pro-Iranian leak sites, increasing harassment risks. Security measures should include monitoring for suspicious Registry entries and unusual communications, while users are advised to avoid unsolicited software installations and keep their systems updated. The FBI refers to this malware family as HEAVYGRAM.

Winsage

September 16, 2026

Microsoft announces October 7 Windows and Surface event

Microsoft will hold an event on October 7 in San Francisco to unveil innovations in AI, Windows, and the Surface Laptop Ultra, along with the Nvidia RTX Spark. The focus will be on local AI capabilities on Windows PCs, and attendees can expect announcements regarding the availability and pricing of the Surface Laptop Ultra. High-profile figures, including CEO Satya Nadella and Nvidia CEO Jensen Huang, will be present at the event.

Winsage

September 16, 2026

Microsoft Sets October 7 Event to Detail Local AI Push for Windows and Surface

Microsoft will unveil its vision for the future of personal computing at an event in San Francisco on October 7 at 10 a.m. Pacific time, focusing on the role of on-device artificial intelligence in Windows and Surface hardware. Key figures including CEO Satya Nadella and NVIDIA CEO Jensen Huang will discuss innovations across Windows, NVIDIA RTX Spark, and the PC ecosystem. The RTX Spark platform, introduced earlier this year, features a system-on-a-chip with 128GB of memory, an NVIDIA GPU, and an Arm-based CPU for high-performance AI workloads. Microsoft has announced the Surface Laptop Ultra, built on the RTX Spark platform, but details on pricing and release dates are not yet available. The event will emphasize how local AI will shape the future of PCs, with a focus on hardware capable of running AI models directly on devices. Attendees can also expect enhancements to the Windows operating system, though a surprise announcement regarding Windows 12 is unlikely. The event will be streamed live, starting at 10 a.m. PT and 1 p.m. ET.

Tech Optimizer

September 16, 2026

Chinese state security authorities warn outdated antivirus software can expose systems to cyberattack

Chinese state security officials have emphasized the necessity for organizations to keep antivirus software and virus databases updated to prevent data breaches and unauthorized access. The Ministry of State Security (MSS) highlighted that neglecting these updates has led to significant security incidents, including the theft of sensitive data and cyberattacks on work email accounts. Specific cases include a research institute that suffered a breach due to unpatched vulnerabilities, an institution exposed to cyberattacks for not enforcing regular virus scans, and a company that operated a poorly protected server with outdated antivirus software. Contributing factors to delayed updates include a lack of awareness about cybersecurity risks, insufficient network maintenance, and unclear responsibilities within organizations. Under China's Cybersecurity Law, network operators must implement measures to protect against cybersecurity threats. The MSS advises organizations to enhance their cybersecurity measures by adopting technologies like automated risk alerts and intelligent behavioral analysis.

Winsage

September 16, 2026

More choice and possibility with Windows PCs at IFA

At IFA, the Windows ecosystem showcased new PCs from various partners, including Acer, ASUS, Dell, Lenovo, MSI, AMD, and NVIDIA, highlighting their ability to meet diverse user needs. Acer introduced the sustainable Vero 16 laptop, while ASUS presented the ProArt P16 and P14 for creators. Dell unveiled the portable 14S laptop, and Lenovo expanded its Yoga portfolio with the Yoga Pro 9n for demanding tasks. MSI launched the Venture 15 AI+ B3M, balancing productivity and gaming. AMD announced support for Microsoft’s Project Zenith with its Ryzen AI Halo systems, and NVIDIA introduced tools for local AI on Windows. The event emphasized the collaboration among partners to deliver innovative technologies.

AppWizard

September 15, 2026

Every single new feature in Android 17 QPR1 [Video]

Android 17 QPR1 has launched, compatible with devices from Pixel 6 to the latest models. The update includes several user interface changes such as improved lockscreen animation for media controls, access to Pixel Search settings in App list settings for older Pixel models, and a stashed media player in Quick Settings. Usability enhancements feature a predictive back gesture in Quick Settings, a new Keyboard tile for quick switching between keyboards, an option to dismiss the mobile data pop-up, and adjustments to the screen recording menu. Cosmetic changes include a new Quick Settings edit tile icon, a Gemini Intelligence boot logo for newer models, refreshed default app icons, improved animations in Quick Settings, enhanced system blur effects, and a visual update for app notification dots.

Winsage

September 15, 2026

Iranian spies hit Windows machines with Chosen Brick data-stealing malware

Iranian state cyber actors are targeting individuals through popular messaging applications, using surveillance and data-stealing malware known as "Chosen Brick," which has been in use since at least 2025. This malware is designed for Windows systems and enables the theft of personal data, allowing Iranian spies to monitor perceived threats such as dissidents, activists, and journalists. The attacks typically begin with messages sent via WhatsApp or Telegram, impersonating trusted contacts. Attackers conduct extensive research on their targets to craft convincing messages that encourage victims to download malicious files disguised as legitimate applications. Once executed, Chosen Brick operates stealthily, evading detection and establishing a connection for command-and-control communications. It can enumerate processes, capture screen and audio content, extract sensitive information, and even wipe infected systems. Organizations suspecting compromise are advised to engage IT providers for investigations and to inform staff about potential risks. Recent alerts follow cyberattacks on water and energy sectors linked to Iran, with ongoing concerns about the implications for cybersecurity amid escalating military tensions. Additionally, five US agencies have reported that attackers are using AI-generated scripts to exploit vulnerabilities in critical infrastructure systems.

Winsage

September 15, 2026

Microsoft Rolls Out Emergency Windows 11 Patch, But AMD GPU Driver and File Explorer Crashes Remain

Microsoft has released an emergency patch for Windows 11, identified as KB5129195, which is being automatically downloaded to address critical issues, including privilege elevation vulnerabilities. The patch fixes CVE-2026-62721 and resolves remote desktop connection problems, as well as attempts to address USB audio issues that arose after the September update. Improvements have been noted for 8-channel and 3D audio modes, but users may still face problems such as missing volume controls and lack of audio output for some USB audio devices. Additionally, unresolved issues from the September update, KB5124008, persist, particularly for AMD Radeon GPU users experiencing system freezes, crashes, and driver timeouts. Complaints about File Explorer crashing or failing to launch have also been reported, affecting certain enterprise environments. Microsoft is using internal AI tools to enhance security, but this has led to a cycle of instability in the operating system. Nearly 1,000 CVE patches were applied just before this update.

Tech Optimizer

September 15, 2026

AI Is Changing Antivirus From File Matching to Behaviour-Based Malware Detection

Artificial intelligence is transforming malware detection by moving away from traditional file signature reliance to analyzing program actions. Antivirus software previously used signatures to identify known threats, but the rapid emergence of over 450,000 new malware samples daily complicates this method. Attackers now employ techniques like repacking and encryption to evade detection, prompting the need for machine-learning and behavioral techniques for better protection. Modern detection systems assess multiple characteristics of executable files, including their behavior, to identify potential threats, even if they lack recognized signatures. Microsoft's Project Ire exemplifies advanced detection capabilities, functioning as an automated malware analyst that evaluates unknown binaries based on their behavior. Additionally, modern endpoint-security products leverage cloud systems to analyze data from multiple devices, enhancing threat detection through shared intelligence. However, AI detection can still produce false positives and is susceptible to manipulation by attackers. Therefore, effective security systems require a combination of traditional measures, behavioral monitoring, machine learning, and human analysis to navigate complex threats.

AppWizard

September 15, 2026

Active Exploitation Alert: Threat Actors Abuse Anthropic Claude AI to Extract Secrets from 1.8M Android Apps in Major Credential Theft Campaign

Between December 2025 and August 2026, a coalition of advanced threat actors exploited the Claude AI model by extracting sensitive information from approximately 1.8 million Android applications. The operation involved groups such as ShinyHunters, Midnight Blizzard (APT29/Nobelium), and the Chinese-speaking entity GTG-10007. They automated the mass download, decompilation, and analysis of Android APKs for hardcoded credentials, API keys, and authentication tokens, leading to extensive credential theft and breaches across various sectors. The attack utilized a distributed pipeline on ten AWS EC2 instances to download APKs, which were then scanned using TruffleHog. Verified secrets were organized and routed in real-time to a private Telegram group for operational deployment. Over 2,100 Azure AD authentication tokens were extracted from more than 40 Microsoft tenants within 34 hours. The operation also included a carding component where stolen payment card data was sold. The tactics employed aligned with several MITRE ATT&CK techniques, including file discovery, unsecured credentials, valid accounts, phishing, and exploitation of remote services. ShinyHunters gained administrative control over targeted environments rapidly, leading to bulk data theft affecting over 200 organizations. Midnight Blizzard automated malware creation and phishing campaigns, targeting government and defense entities. GTG-10007 used Claude for coordinated offensive operations, discovering zero-day vulnerabilities and delivering exploits. Initially, the campaign targeted a broad range of Android APKs but later focused on organizations with valuable credentials across various sectors, including government, technology, and healthcare. Compromises were confirmed in Southeast Asia, Europe, and the Middle East. Organizations are advised to audit Android applications for hardcoded secrets, monitor API key usage, and implement robust security practices to mitigate risks.