lock screen Archives

AppWizard

September 18, 2026

RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall

Cybersecurity experts have identified a new Android malware named RatHat, believed to be operated by Chinese threat actors. RatHat is distributed primarily through smishing and malvertising campaigns, leading users to deceptive download portals. It employs an automated multi-stage infection process and exploits Accessibility features along with a local ADB self-pairing mechanism to escape the Android application sandbox. The malware uses various anti-analysis techniques, including container tampering, manifest bombs, DEX bytecode poisoning, and dual string-encryption. RatHat's architecture consists of a malicious Android application, a Go agent, and an FRP reverse-proxy client, which together enable it to gain critical system permissions and perform various malicious activities such as credential capturing, screen recording, and SMS interception. Even if uninstalled, the malware retains shell access to the device, allowing attackers to reinstall it. RatHat can serialize the device's Accessibility tree to XML and communicate with a Generative AI assistant for tasks like screen coordinate determination and text extraction. The Go Agent, masquerading as a native library, exploits shell access to execute commands and establish a persistent connection to a command-and-control server via the FRP client. The C2 server can issue extensive commands to collect sensitive information, including SMS messages, credentials, files, and keystrokes, and RatHat also features a hardware-level keylogger.

AppWizard

September 12, 2026

New Android Ransomware Records Screens, Steals OTPs and Secretly Takes Photos of Victims

A newly identified malware threat in the Android ecosystem, named Mantax Otax, combines ransomware with espionage capabilities. It targets users who install applications from untrustworthy sources, often through messaging apps or phishing attempts. The malware is linked to Indonesian cybercriminals and can steal sensitive information such as SMS one-time passwords, chat histories, and lock-screen PINs, facilitating account takeovers. Mantax Otax requests device-administrator rights and seeks access to SMS messages, contacts, and media files. It encrypts files on devices running Android 9 and earlier using AES encryption and demands a ransom for recovery. Although the impact is reduced on Android 10 and later due to Scoped Storage, the malware still poses significant surveillance risks. The malware collects extensive sensitive data, including contacts, call logs, and location data, and targets multi-factor authentication codes. It uses a deceptive system-lock overlay to capture PINs and has introduced features like WebSocket communications and disruptive pop-ups in its second iteration. Users are advised to be cautious when installing applications, avoid unsolicited APKs, and reject permissions that do not align with an app's purpose. In case of suspicious activity, users should disconnect from networks and seek help before entering sensitive information. Organizations should monitor for signs of this malware on managed devices.

AppWizard

September 10, 2026

New Android Feature Lets You Securely Switch Password Managers

Google has introduced a new system-level feature for Android that simplifies the transfer of passwords and passkeys between password managers. This feature allows users to transfer credentials with a few taps, eliminating the need for file downloads and reducing the risk of data exposure. Previously, migrating credentials involved exporting sensitive information into unencrypted CSV files, which posed security risks. The new mechanism operates at the operating system level, enabling direct communication between applications. Users can initiate transfers by selecting the option to import credentials from another provider, after which Android identifies existing password manager apps. The process requires user authentication and ensures that sensitive information is not stored in an unencrypted format. The feature supports several password management platforms, including Google Password Manager, 1Password, Bitwarden, and Dashlane.

AppWizard

September 10, 2026

Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks

The Gigabud banking trojan installs a secondary Android application called Vwork, which creates a work profile on compromised devices to evade detection from banking app security measures. This work profile separates its contents from the personal space of the device, allowing fraudulent transactions without triggering alerts. Group-IB confirmed this operational chain in Indonesia, where Gigabud has been active since 2022 and is linked to the GoldFactory group, which uses deceptive tactics to distribute the trojan. Vwork simplifies the creation of a work profile and communicates with an external server for authorization before cloning apps. The report indicates that Vwork has been detected in various countries, while approximately 1,469 devices and 1,281 logins were compromised in Indonesia, leading to estimated losses of around ,000,000. Users can check for a work profile in their phone's settings and are advised to download apps only from official stores and to deny unnecessary Accessibility access.

AppWizard

September 9, 2026

Gigabud Uses Android App Cloning to Evade Fraud Detection

The Gigabud Android banking trojan can clone banking applications into a separate Android work profile, allowing fraudsters to bypass malware alerts during transactions. Research by Group-IB, released on September 9, indicates that Gigabud is used with Vwork, a modified app for cloning, attributed to the GoldFactory group. The infection has been confirmed in Indonesia but targets 11 countries, including Brazil, Colombia, Egypt, Mexico, Thailand, and Turkiye. Vwork uses Android's Work Profile feature to isolate cloned apps, making them less detectable. This allows operators to install malware, clone banking apps, and execute transactions without raising alarms. During fraud, fake login screens capture credentials, and an invisible overlay collects lock screen codes. From February to July 2026, 1,469 devices were compromised in Indonesia, with financial losses nearing 0,939. Gigabud spreads through phishing and social media, requesting permissions to control devices. Group-IB identified six behavioral signals for banks to monitor as indicators of high-risk sessions. Recommendations include device binding and downloading apps only from official stores.

AppWizard

September 9, 2026

Gemini’s Daily Brief drops its subscription fee

Google's Gemini's Daily Brief feature is now available to free users in the United States, removing the previous paid subscription requirement. The Daily Brief compiles information from Gmail, Google Calendar, and other connected applications, along with insights from past interactions, to create a personalized morning summary. Users need to have Personal Intelligence, Memory, and Google Workspace integration activated to fully utilize the feature. The rollout is gradual, and currently limited to U.S. users. Daily Brief allows users to manage tasks, initiate chats, and receive updates via Gemini Live. Future developments may include audio Daily Briefs and integration into the Android lock screen.

Winsage

September 8, 2026

Microsoft Releases September 2026 Patch Tuesday Updates

Microsoft released its September 2026 Patch Tuesday updates for Windows 11, focusing on versions 26H1 and 25H2/24H2. Key features include: - Taskbar customization for versions 25H2 and 24H2, allowing users to choose the taskbar's location and size. - Faster Windows Search with options to hide web and Microsoft Store suggestions. - Touch scrolling support in the "Recommended" section of File Explorer. - Start Menu customization options for size and visibility of sections. - Stability improvements for Microsoft Teams and Outlook on Arm64 PCs. For version 26H1, updates include: - Improved app search and Settings relevance in Windows Search. - Voice Isolation technology in Voice Access. - Updated taskbar notification badges and Weather widget display on the Lock Screen. - New gesture controls for Precision Touchpads. - Enhanced Sign-in Security supporting peripheral fingerprint sensors. - Optimized Windows Update progression calculations and clean-up logic. - Power settings allowing users to set energy saver activation thresholds. Microsoft is using AI to identify vulnerabilities, with 997 Common Vulnerabilities and Exposures reported, including one actively exploited vulnerability (CVE-2026-81963). Windows 11 version 26H2 has been made available to Insiders, with a public rollout expected next month.

Winsage

September 7, 2026

‘We’ve made significant gains on things like boot time’: Microsoft promises a free speed boost is coming to Windows 11 soon

Microsoft is working to improve the performance of Windows 11, specifically focusing on boot times and overall responsiveness. At IFA 2026, Mark Linton, Vice President of Windows & Devices, announced that significant gains have been made in startup speeds and Windows Hello responsiveness. Although these enhancements are still in development and not yet publicly tested, they are expected to allow users to reach the lock screen almost instantaneously. Microsoft aims to ensure that Windows 11 runs smoothly on devices with 8GB of RAM, emphasizing ongoing improvements to performance fundamentals.

Winsage

September 7, 2026

Windows 11 hack unlocks animated profile pictures Microsoft has been hiding from you

Windows 11 typically converts profile pictures into static, resized versions for display on the Start menu, Settings page, or lock screen. A registry tweak allows users to link these entries to the original image file, enabling animated profile pictures. This method supports transparent PNGs and animated GIFs, although Microsoft does not officially support animated account pictures. Windows generates resized copies of the profile picture and stores their paths in the registry. Users can automate the process using a PowerShell tool from GitHub or manually edit the registry with elevated permissions. Users must ensure the GIF is stored in a permanent location, as moving or deleting it will break the profile picture. The workaround modifies local account settings, not Microsoft account avatars, and users with sync enabled should be cautious.

Winsage

September 7, 2026

Microsoft confirms Windows 11 upgrade for faster boot and 8GB RAM PCs, but shares no numbers

Microsoft announced at the IFA 2026 conference that Windows 11 will boot faster and improve performance on PCs with 8GB of RAM. The upcoming major update will enhance features like Windows Hello and include a movable taskbar, a resizable Start menu, and the option to remove Bing from Windows Search. The September 2026 Patch Tuesday update is expected to roll out these improvements. Mark Linton, Corporate Vice President of Windows & Devices at Microsoft, emphasized the company's goal of optimizing Windows 11 for 8GB RAM PCs due to rising memory costs. While 16GB of RAM has been historically recommended for optimal performance, Microsoft's focus on improving efficiency for 8GB systems aims to make technology more accessible.