Iran Archives

AppWizard

September 19, 2026

Russia’s national messenger app Max found to contain backdoor capable of secret screen captures

Researchers have found that Max, a messaging app mandated by the Russian government, can secretly capture screenshots, access sensitive information, impersonate users, and inject code into other applications. Developed by VK, the app integrates messaging, banking, and government services. Since September 1 of last year, it has been preinstalled on new smartphones, following the blocking of WhatsApp and Telegram. Despite its reach, it is not widely used in political circles, with insiders indicating that compliance with its use is performative.

Winsage

September 15, 2026

Iranian spies hit Windows machines with Chosen Brick data-stealing malware

Iranian state cyber actors are targeting individuals through popular messaging applications, using surveillance and data-stealing malware known as "Chosen Brick," which has been in use since at least 2025. This malware is designed for Windows systems and enables the theft of personal data, allowing Iranian spies to monitor perceived threats such as dissidents, activists, and journalists. The attacks typically begin with messages sent via WhatsApp or Telegram, impersonating trusted contacts. Attackers conduct extensive research on their targets to craft convincing messages that encourage victims to download malicious files disguised as legitimate applications. Once executed, Chosen Brick operates stealthily, evading detection and establishing a connection for command-and-control communications. It can enumerate processes, capture screen and audio content, extract sensitive information, and even wipe infected systems. Organizations suspecting compromise are advised to engage IT providers for investigations and to inform staff about potential risks. Recent alerts follow cyberattacks on water and energy sectors linked to Iran, with ongoing concerns about the implications for cybersecurity amid escalating military tensions. Additionally, five US agencies have reported that attackers are using AI-generated scripts to exploit vulnerabilities in critical infrastructure systems.

Tech Optimizer

September 6, 2026

“Iran unveils second homegrown antivirus to counter malware and cyberattacks”

Iran has introduced its second domestically developed antivirus software, Ayyza, which utilizes artificial intelligence and machine learning to detect known and unknown cyber threats. The antivirus is designed to protect against malware, viruses, Trojans, ransomware, and advanced persistent threats (APTs). Ayyza's detection engine is developed in-house and operates at the Windows kernel level to enhance detection accuracy and speed while minimizing hardware resource consumption. It can receive updates offline or via Iran’s National Information Network. Ayyza's machine-learning capabilities allow it to identify emerging threats, including previously unknown malware and zero-day vulnerabilities. The company has also created complementary security tools, such as privileged access management (PAM) systems and data leakage prevention tools, to enhance overall cybersecurity. The company's products are currently used in various Iranian infrastructures, including banking, financial, and governmental systems.

AppWizard

August 11, 2026

Meet Snowflake Volunteer: Tor’s Android app that lets you help people bypass censorship

The Tor Project has launched the Snowflake Volunteer app, an Android application developed in collaboration with Bloco, aimed at helping users in restricted regions bypass internet censorship. This app enhances the existing Snowflake capabilities, allowing users to share their internet connections through volunteer-operated proxies to access the Tor network. In June, the number of unique proxy IP addresses used daily increased from approximately 1,300 to 1,700, marking a 29% rise. The Tor Browser operates as a free, privacy-focused network, routing traffic through volunteer-run secure computers. The Snowflake Volunteer app employs "domain fronting" to connect users to various proxies and is designed for those with limited technical skills, simplifying the process of becoming a proxy. Users can download the app from F-Droid or Google Play, run it in the background, and set usage restrictions. While Tor generally advises against using VPNs, some experts recommend them for users in highly censored regions, though this approach has its own challenges.

AppWizard

August 7, 2026

The offline messaging apps challenging internet shutdowns

Governments are finding it harder to suppress protests through internet shutdowns due to the use of offline messaging applications. Bitchat, an app launched in 2025 by Jack Dorsey, allows devices to communicate via Bluetooth without internet access and gained popularity during recent student protests in New Delhi amid an internet blackout. The Indian government attempted to block access to Bitchat's source code on GitHub, marking a notable first instance of trying to geoblock an open-source repository. On July 26, Bitchat had 430,000 daily active users in India, with 74% of global downloads occurring in the country from July 20 to July 26. The app has been used in various protests globally, including those in Hong Kong, Myanmar, Nepal, Uganda, Madagascar, and Iran. On July 23, the Indian government ordered GitHub to disable access to three Bitchat repositories in India quickly. Jack Dorsey expressed concerns about the Indian government's stance on Bitchat, while digital rights advocates criticized the government's actions as unnecessary. The repositories remained accessible in India and were mirrored on decentralized platforms, complicating removal efforts. India's government has increasingly scrutinized communication platforms based on their design, imposing restrictions on apps like Telegram and WhatsApp.

AppWizard

August 4, 2026

Google is introducing mandatory identity verification for Android app developers

Google will require mandatory identity verification for all developers creating applications for the Android platform, affecting those from countries under U.S. sanctions, such as Russia, Iran, Cuba, and North Korea, who will be excluded from the verification system and may not distribute their apps internationally. The new regulations apply to developers of apps for Android 7 and later versions.

AppWizard

July 23, 2026

ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories

GitHub will reject command-line support bundle uploads from outdated versions of GitHub Enterprise Server lacking security patches starting August 18, 2026. The npm package @copilot-mcp/apex has been identified as a post-install dropper that installs a macOS infostealer, phishing for sensitive information and maintaining a connection to an attacker's server. A rogue extension on the Microsoft Visual Studio Code marketplace, "Markdown All Pro," impersonates a legitimate tool and opens a backdoor after installation. A phishing campaign targeting Portuguese users delivers the Lampion banking malware, which has been active since 2019. DoubleVerify reports a rise in "AfterCall" apps that exploit user permissions for ad fraud. The GhostCommit attack method hides malicious instructions within PNG images in pull requests. The U.S. government has updated its advisory on Iranian-affiliated cyber activity targeting operational technology devices. An Android app posing as a civil defense alert system has been found to contain malware for data harvesting. An Iranian threat actor is distributing MarkiRAT malware through fake applications. An analysis of 28 AI-coded applications revealed 434 vulnerabilities, prompting Cisco to introduce Antares to identify vulnerabilities in codebases. A Russian-speaking threat actor is dismantling guardrails on AI models to create offensive tools.

AppWizard

April 30, 2026

Meta loses 20 million users across WhatsApp, Facebook, Instagram and Messenger: Here’s what the company is blaming for this drop

Meta has reported a loss of approximately 20 million daily active users across its applications this quarter, attributing the decline to ongoing internet disruptions in Iran and restrictions on WhatsApp in Russia. The company plans to spend between billion and billion this year to support AI initiatives, which is an increase from earlier projections. Meta is also facing legal challenges regarding youth safety, warning of potential material losses due to ongoing lawsuits. To manage its finances while investing in AI, Meta is reducing its workforce by laying off about 8,000 employees and canceling plans to fill 6,000 open roles.

AppWizard

April 8, 2026

Apple pulls Jack Dorsey’s messaging app from the Chinese App Store

Apple has removed the messaging app Bitchat from the Chinese App Store at the request of the Cyberspace Administration of China (CAC), which cited regulatory concerns. Bitchat, originally launched as Bitchat Mesh and developed by Jack Dorsey, allows anonymous, peer-to-peer communication using Bluetooth-based mesh networking, without relying on internet-connected servers. The app gained popularity in regions with internet shutdowns and social media restrictions. The CAC has alleged that Bitchat violated regulations requiring security assessments for apps that can influence public opinion or mobilize users. Dorsey confirmed the removal on X but has not disclosed any plans for Bitchat's return to the App Store.

Winsage

April 7, 2026

What is the Microsoft Windows game that Iran is ‘using’ to tease Donald Trump

The United States and Iran are engaging in digital tensions, with Iranian embassies using social media for pointed critiques of President Trump. A notable instance occurred when the Iranian consulate in Mazar-i-Sharif shared a satirical video combining gameplay from the 90s game Minesweeper with a map of the Strait of Hormuz, humorously highlighting Trump's navigation efforts. The video features animated explosions and sarcastic text, emphasizing the risks associated with US navigation in the strategically important waterway. Iran has stated it deployed mines in the Strait of Hormuz to control maritime traffic, and the use of Minesweeper in this context serves to illustrate the dangers of navigating these waters.