keystroke Archives

Tech Optimizer

August 20, 2026

Hackers Are Using a Fake Roblox Cheat To Access Your Webcam and Steal Data

Roblox is facing privacy concerns due to spyware disguised as an "undetected" version of the Xeno Roblox cheat tool. This malware can access screens, record keystrokes, and activate webcams, allowing attackers to execute remote commands. The infection begins when users download a file resembling a legitimate Xeno installation, often shared on platforms like Discord. The malware, previously known as Powercat, has evolved and operates in three stages: 1. The user executes a file named Xeno.exe, which checks for Java and extracts it if necessary. 2. The malware runs a JAR file disguised as decompiler.exe, performing checks to avoid detection. 3. It masquerades as a legitimate Windows DLL file, logging activities and attempting to escalate privileges. If successful, the malware can control the victim's system, access webcams, log keystrokes, and steal sensitive information, including cryptocurrency wallet credentials. To protect against this spyware, users are advised to avoid unofficial cheats, use antivirus software, refrain from clicking unsolicited links, enable two-factor authentication, inspect User Account Control prompts, and consider identity theft protection services.

Winsage

August 5, 2026

I played DOOM inside MS Paint on Windows 11 by hijacking the clipboard, and it’s shockingly good

Mark Russinovich, the Chief Technology Officer of Microsoft Azure, has created a project called DoomPaint, which allows the classic game DOOM to be displayed within Microsoft Paint. The game operates through the ViZDoom engine, rendering frames headlessly and transferring them to Paint via the Windows clipboard. DoomPaint features full keyboard controls, sound effects, and a MIDI soundtrack, maintaining a frame rate of around 35 FPS. To run DoomPaint, users need to download the project from GitHub, ensure Python is installed, extract the folder, and run a batch file, which sets up a virtual environment and opens Microsoft Paint for gameplay. The default controls include movement with W/S or arrow keys, turning with A/D or arrow keys, strafing with Q/E, firing with Ctrl/F, and other functions assigned to different keys. The project uses the shareware DOOM1.WAD for the initial episode and additional maps from Freedoom due to licensing restrictions. DoomPaint differs from previous attempts to integrate DOOM into Paint by using Paint’s canvas as the sole display for the game. The clipboard race condition was addressed by allowing the application to own the clipboard as a reference-counted OLE data object. Sound effects come from ViZDoom through OpenAL, and music is played using a separate module that loops through the Windows MIDI sequencer. Russinovich utilized Claude Fable 5 for this project, demonstrating how AI tools can enhance software development.

Winsage

July 31, 2026

I used Everything, Windows Search, and File Pilot to find lost files fast, and there’s one clear winner

Many users struggle with disorganized files, and Windows 11's built-in search tool is often slow and unreliable, yielding poor results. Testing showed that it struggles to find files in subfolders, even with enhanced indexing enabled. In contrast, File Pilot offers faster search functionality, filtering results to the current folder and allowing expansion to subfolders with a keystroke, though it lacks wildcard search capabilities. Everything is highlighted as the best option, known for its rapid indexing and customizable search criteria, making it superior to both Windows Search and File Pilot.

Tech Optimizer

June 23, 2026

Meta pauses controversial employee-tracking program after security review

Meta has suspended its employee-tracking program after an internal security review revealed excessive accessibility to sensitive data collected from staff laptops. The program, part of the Model Capability Initiative (MCI), aimed to gather detailed information on employee interactions with work devices, including mouse movements, click locations, keystrokes, and screen content. Concerns arose regarding the privacy and security of the collected data, which included AI prompts, transcriptions, private conversations, and performance-related information. The initiative faced backlash, particularly after an engineer criticized "laptop surveillance," leading to a petition for its termination. The monitoring software was deployed on US workers’ laptops without an opt-out option, capturing comprehensive behavioral datasets. The situation highlighted significant legal and regulatory challenges, as well as the risks associated with managing sensitive data. Access controls, data minimization, and retention policies are critical to mitigate potential breaches.

Winsage

June 17, 2026

Windows SprySOCKS Malware: Advanced Kernel-Level Rootkit Targets Government Organizations via Supply Chain Vulnerabilities

The Windows variant of SprySOCKS malware, developed by the Chinese threat group Earth Lusca, targets government entities globally and features advanced capabilities such as rootkit-level stealth and extensive command-and-control (C2) functionalities. It operates on Windows systems, utilizing two main variants: WINDRV, which includes kernel drivers for stealth operations, and WINPLUS, a streamlined backdoor. The malware can communicate over TCP, UDP, and WebSocket, offering over 30 C2 commands for various operations, including system information gathering and keystroke logging. WINDRV loads a driver named ‘RawWNPF’ into memory using another signed kernel driver, allowing it to conceal processes and achieve persistence. The malware's design incorporates open-source elements and exploits vulnerabilities in the software supply chain, notably using a leaked certificate for driver signing. To combat SprySOCKS, organizations are advised to implement advanced endpoint detection and response (EDR) solutions, maintain regular patching, and manage supply chain risks vigilantly. The malware's adaptability and reliance on legitimate certificates complicate detection efforts, necessitating continuous refinement of security practices.

AppWizard

June 3, 2026

Malware campaign targeting Minecraft users infects over 116,000 systems

A recent investigation by McAfee researchers has identified a Malware-as-a-Service (MaaS) operation called WeedHack, which targets Minecraft users. Since its launch in January 2026, WeedHack has compromised over 116,000 systems, with 2,000 to 3,000 new infections daily. The operation uses YouTube and SEO poisoning to distribute malware, promoting Minecraft mods and utilities through videos. WeedHack is accessible for free, with premium features available at low costs. The malware targets Minecraft session IDs, collects system information, and extracts credentials from various platforms. It includes a web-based dashboard for tracking infections and offers tools for injecting malware into legitimate mods. The operation has also been linked to incidents of cyberbullying among its users. McAfee advises caution when engaging with Minecraft-related content on YouTube.

BetaBeacon

May 5, 2026

ScarCruft Hacks Gaming Platform to Deploy BirdCall Malware on Android and Windows

ScarCruft compromised a video game platform in a supply chain attack, trojanizing its components with a backdoor called BirdCall to target ethnic Koreans residing in China. The attack enabled the threat actors to target both Windows and Android devices, turning it into a multi-platform threat. The campaign targeted sqgame[.]net, a gaming platform used by ethnic Koreans in China, known as a transit point for North Korean defectors. BirdCall has features like screenshot capture, keystroke logging, and data gathering, and relies on legitimate cloud services for command-and-control. The Android variant collects various data and has seen active development.

AppWizard

April 17, 2026

New RecruitRat, SaferRat, Astrinox, Massiv Android Malware Found Targeting 800 Apps

Cybersecurity researchers from Zimperium zLabs have identified four families of Android malware—RecruitRat, SaferRat, Astrinox, and Massiv—targeting banking and cryptocurrency applications. These malware families can extract sensitive information from over 800 applications. They primarily use phishing and smishing to lure users into downloading malicious software. Phishing involves creating fake websites resembling legitimate login pages, while smishing uses urgent text messages with links to download harmful payloads. RecruitRat targets job seekers with fake employment websites, and SaferRat promises free access to premium video services. Astrinox mimics a business tool and has been linked to a fraudulent Apple App Store page, while Massiv's distribution methods remain unclear. Once installed, these malware applications initiate Overlay attacks, displaying counterfeit screens to capture user credentials. They also use a "blindfold" technique to obscure their activities by overlaying static images on the user's screen. The malware can intercept security codes, capture one-time passwords, and employ keylogging techniques. RecruitRat has a library of over 700 counterfeit login pages that activate with targeted apps. Researchers recommend avoiding links in urgent messages and downloading apps only from official sources.

Winsage

April 8, 2026

I might have a reason to press my Copilot key as this absurd Windows 11 app adds some comic relief: “I can’t stop laughing”

Microsoft has announced plans for new Windows PCs that will include a dedicated Copilot key, marking a significant change to the Windows keyboard in 30 years. The option to remap this key in Windows 11 has been temporarily suspended to prevent bugs. The developer community has created a utility called NoCopilotKey to revert the key to its original function as the right-side CTRL key. Additionally, an app called TypeFart produces humorous sounds with keystrokes but does not allow users to assign unique sounds to specific keys. Microsoft has clarified that outdated language in Copilot's terms of use, which suggested it was for entertainment purposes only, will be updated to reflect its current capabilities. The company is also working on improvements for Windows 11, including the return of the movable Taskbar and better integration of Copilot.

Winsage

March 16, 2026

Microsoft has lost the plot: 5 Windows “features” nobody asked for

Windows 11 has faced criticism for design choices that prioritize corporate interests over user experience, including aggressive monetization strategies and privacy concerns. The Recall app was designed to take frequent screenshots of the desktop but functioned like a keylogger, leading to privacy issues. Initially set to be enabled by default on new Copilot+ PCs, backlash prompted Microsoft to make it an opt-in feature during setup, allowing users to uninstall it. Microsoft also introduced biometric encryption and moved screenshot processing to secure enclaves for data protection. The Start Menu has shifted to include third-party advertisements in the "Recommended" section, turning it into a platform for promotions rather than a personal navigation tool. Microsoft replaced the right Control or Menu key with a dedicated Copilot key, disrupting standard keyboard layouts and complicating workflows for users. Setting up a new PC now requires an active internet connection and a Microsoft account, making it difficult to operate without relinquishing digital identity. This change illustrates a shift towards subscription revenue and data collection. Windows 11 often ignores users' default browser choices, defaulting to Microsoft Edge and Bing for web searches initiated from the taskbar, reflecting a trend of prioritizing Microsoft's ecosystem over user autonomy. These developments indicate a strategy by Microsoft to erode user control, suggesting users are becoming products rather than customers as the company focuses on data collection and subscription services.