keywords Archives

Winsage

July 12, 2026

Windows 95 didn’t detect installers, it ‘guessed’ based on the file name, says veteran dev — it simply checked for words like setup, install, inst, or localized equivalents

Raymond Chen, a Microsoft engineer, revealed that Windows 95 identified installation programs by analyzing executable filenames against a list of keywords, including "setup," "install," and "inst." The system would then initiate a routine to repair any compromised system files. The list included six terms: setup, install, inst, imposta, ayarla, and felrak. Chen noted redundancy in the list, suggesting "install" was unnecessary since it included "inst." For executables not matching the terms, Windows 95 scanned the executable's path for "Setup." The system maintained backup copies of frequently overwritten files in a hidden directory at C:WindowsSYSBCKUP and would restore correct versions after installers completed. File verification was often postponed until the next system boot, especially for installers that reverted to MS-DOS for file replacements. This file repair mechanism continues to influence modern operating systems, including Windows 11.

Winsage

July 8, 2026

Windows 95 used a very basic “trick” to detect setup files

Microsoft developed Windows 95 with innovative detection mechanisms to prevent external installers from downgrading essential system components. The team used a heuristics-based approach to identify installer files by analyzing their names for keywords like "setup," "installer," or "inst," and also considered variations in other languages. If these keywords were not present, the system would check the file path for "setup." File checks were delayed until the next start to catch improperly modified files, as some setup programs would exit Windows to run batch files. Additionally, live file checks were conducted for multimedia driver installations via INF files, which was a special exception.

AppWizard

June 24, 2026

Morphe v1.32.0 brings back a heavily missed YouTube feature

Morphe has released its v1.32.0 patch bundle, which includes interface enhancements and bug fixes. Key features include a settings toggle to revert to the previous video action bar layout, restoring the dislike counter on YouTube (as estimates), and the option to hide the “Connect” button. Users can filter comments using a keyword-based comment blocker and open videos in fullscreen mode. The update also enhances the top toolbar with options to hide the Cast and live Chat buttons. Compatibility updates include experimental support for Reddit (version 2026.25.0), YouTube Music (version 9.24.51), and YouTube (version 21.25.523). Bug fixes address issues with link redirects, app crashes in tablet mode, player popup panels, and playback issues in YouTube Music. The update is available through the Morphe Manager application.

Winsage

June 24, 2026

Windows RAT Uses Encrypted HTTP C2 and Registry Persistence After npm Infection

A malware campaign targets Windows systems through a malicious npm package named postcss-minify-selector-parser, which mimics the legitimate postcss-selector-parser. This counterfeit package installs a Remote Access Trojan (RAT) on developer machines, beginning with a multi-stage attack triggered by the installation of the package. The RAT can steal credentials, execute shell commands, and communicate with a remote attacker. Security researchers at JFrog identified this threat and reported it on June 22, 2026, noting that two additional related packages, postcss-minify-selector and aes-decode-runner-pro, are linked to the same publisher and remain live on the npm registry. The RAT employs encrypted HTTP communication with a command-and-control (C2) server and ensures persistence by creating a registry key under the Windows Run key. It has capabilities for remote shell execution, file uploads and downloads, and can steal saved login data from Google Chrome using Windows decryption APIs. The malware is designed for organized batch exfiltration of stolen data. Indicators of compromise include specific IP addresses, domains, file paths, and SHA-256 hashes associated with the malware components. JFrog advises users to remove the malicious packages, inspect their dependency trees, and treat any stored credentials as compromised.

AppWizard

June 3, 2026

Malware campaign targeting Minecraft users infects over 116,000 systems

A recent investigation by McAfee researchers has identified a Malware-as-a-Service (MaaS) operation called WeedHack, which targets Minecraft users. Since its launch in January 2026, WeedHack has compromised over 116,000 systems, with 2,000 to 3,000 new infections daily. The operation uses YouTube and SEO poisoning to distribute malware, promoting Minecraft mods and utilities through videos. WeedHack is accessible for free, with premium features available at low costs. The malware targets Minecraft session IDs, collects system information, and extracts credentials from various platforms. It includes a web-based dashboard for tracking infections and offers tools for injecting malware into legitimate mods. The operation has also been linked to incidents of cyberbullying among its users. McAfee advises caution when engaging with Minecraft-related content on YouTube.

AppWizard

June 3, 2026

Over 116,000 Mincraft systems infected in WeedHack malware campaign

A malware operation called WeedHack has targeted Minecraft players since January, compromising over 116,000 systems with daily infections between 2,000 and 3,000. It primarily distributes malware through malicious mods, clients, cheats, and utilities promoted on YouTube, utilizing SEO poisoning to reach victims. The campaign features polished YouTube videos with embedded download links and targets keywords related to popular Minecraft clients. WeedHack operates as a malware-as-a-service (MaaS) model, offering a free tier that steals Minecraft session IDs, cookies, and passwords across various platforms, and a premium tier with enhanced capabilities. The operation's Telegram channel has over 800 members, mostly teenagers or young adults. Minecraft players are advised to trust only official sources for mods and verify download links to protect against these threats.

AppWizard

May 20, 2026

You can now build Android apps in minutes by describing them to Google AI Studio

Google has introduced AI-powered features in Google AI Studio to simplify Android app development. Users can describe their app ideas in plain language, and the AI translates these into functional Android applications via a web browser. The platform generates the app's framework, user interface, and core functionalities using Kotlin and Jetpack Compose, supporting features like GPS, Bluetooth, and NFC. AI Studio includes an in-browser Android Emulator for building and testing apps, along with Android Debug Bridge integration for direct deployment to devices. Currently, the tools are aimed at personal utilities and lightweight projects, with plans for broader sharing options in the future. The platform can automatically create Play Console records, package Android App Bundles, and upload builds for testing, reducing manual steps. Developers can also export projects as zip files for further work in Android Studio or GitHub. Future expansions will include support for Firebase services. Additionally, Google has introduced the "Ask Play" feature for app discovery, allowing users to search using conversational prompts instead of keywords, and plans to integrate Android applications within Gemini interactions across mobile and web platforms.

AppWizard

May 20, 2026

Google’s new YouTube AI tools could make AI slop impossible to escape

YouTube has introduced the Ask YouTube feature, which supports conversational searches, allowing users to engage in complex queries and refine their searches with follow-up questions. Additionally, Google is launching Gemini Omni, a tool that enables users to remix YouTube Shorts with AI-generated edits while preserving the original video's essence. Omni-generated videos will include digital watermarking, metadata, and links to the original content, and creators can opt out of visual remixing. The rollout of these tools will begin this week, available for free through YouTube Shorts Remix and the Create app.

AppWizard

May 19, 2026

Russia’s State-Mandated Max Messenger Reportedly Hides Powerful Tracking Tools

The state-mandated messenger Max, developed by VK and supported by the Kremlin, is preinstalled on all new smartphones in Russia as of September 1, 2025, and is designed to function during internet blackouts. Following WhatsApp's ban in February 2026, officials have promoted Max as a "sovereign" alternative to Western messaging platforms. A reverse-engineering study revealed numerous surveillance features in Max, including VPN detection that restricts access until VPNs are disabled, real-time monitoring of contact lists, NFC control for manipulating the phone's NFC chip, silent message deletion, IP address tracking, a persistent hardware identifier, the creation of fake chats and reviews, and code injection capabilities. The study also found an on-device machine-learning system that detects keywords from audio input and the ability to record microphone audio during calls without user notification. Additionally, Max monitors access to foreign services and compiles sensitive user information into reports sent to analytics channels. The integration of Max is part of Moscow's broader initiative to consolidate internet traffic through state-controlled platforms, even reaching the International Space Station for communication purposes. Critics view the promotion of Max as part of a strategy to establish a "sovereign" communications system, raising concerns about digital privacy and freedom in Russia.

AppWizard

April 17, 2026

Android officially releases AI development skills, enabling you to build Android apps up to 3 times faster using AI agents.

Google has introduced a suite of AI skills and development tools for Android developers to enhance productivity, allowing them to build applications three times faster using any AI agent. The documentation has been restructured into a format called Agent Skills, providing clear, actionable steps for AI to follow, which eliminates the need for manual input from developers. Google plans to expand its offerings with more official Android skills compatible with community-developed skills. Additionally, a preview of the Android CLI has been released, enabling developers to perform tasks like environment setup and project creation directly from the terminal, significantly improving efficiency. Internal tests show that using the Android CLI with the new skills can reduce AI token usage for project setup by 70% and decrease task completion time to a third of traditional methods. The Android Knowledge Base has also been introduced to keep AI agents updated with current data, enhancing their effectiveness. Developers can transition from the Android CLI to Android Studio for advanced debugging, with new AI-powered project flows integrated into the IDE.