malicious activities Archives

Tech Optimizer

September 21, 2026

Thousands of hacked sites trick you into installing malware

More than 5,400 websites across over 2,200 organizations have been compromised to propagate malware, primarily affecting small businesses like clinics and online retailers. The attack mechanism involves malicious code that triggers a deceptive CAPTCHA, instructing users to execute commands that can download malware. Attackers are using the BNB Smart Chain test network to store instructions, making it harder for investigators to shut down operations. A newer variant of the attack uses WebRTC technology to establish encrypted connections for delivering additional malicious code. To protect against these threats, users should avoid pasting commands from websites, be suspicious of unusual CAPTCHA instructions, use strong antivirus protection, keep systems updated, take action if commands are executed, and small business owners should regularly verify their website's integrity.

AppWizard

September 19, 2026

New RatHat Android Malware Uses AI to Steal Banking Logins, PINs and OTP Codes

Security researchers have identified an Android banking Trojan named RatHat, which utilizes artificial intelligence, accessibility features, and Android Debug Bridge (ADB) to steal financial credentials, PINs, and one-time passcodes. Unlike traditional malware, RatHat employs a live AI assistant that interacts with the Android accessibility tree, allowing it to make real-time decisions based on the victim's screen content. The infection typically starts with social-engineering tactics, leading victims to counterfeit download pages where they are tricked into sideloading a malicious APK. Once installed, RatHat prompts users to enable Android Accessibility Service permissions, which it exploits to navigate Developer Options and enable Wireless Debugging. This grants it shell-level ADB access, allowing it to bypass application sandbox restrictions. RatHat deploys two native binaries for executing commands and maintaining a connection to the attacker's infrastructure. It targets banking applications through credential-stealing overlays and can intercept SMS messages for transaction verification codes. Additionally, it can record touch coordinates to reconstruct PINs and unlock patterns. RatHat includes persistence mechanisms to restore itself after removal, and users are advised to perform a factory reset if they suspect compromise. To reduce infection risk, users should avoid sideloading apps from unknown links, deny unnecessary Accessibility Service requests, and refrain from enabling Developer Options or Wireless Debugging for unfamiliar applications.

AppWizard

September 18, 2026

RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall

Cybersecurity experts have identified a new Android malware named RatHat, believed to be operated by Chinese threat actors. RatHat is distributed primarily through smishing and malvertising campaigns, leading users to deceptive download portals. It employs an automated multi-stage infection process and exploits Accessibility features along with a local ADB self-pairing mechanism to escape the Android application sandbox. The malware uses various anti-analysis techniques, including container tampering, manifest bombs, DEX bytecode poisoning, and dual string-encryption. RatHat's architecture consists of a malicious Android application, a Go agent, and an FRP reverse-proxy client, which together enable it to gain critical system permissions and perform various malicious activities such as credential capturing, screen recording, and SMS interception. Even if uninstalled, the malware retains shell access to the device, allowing attackers to reinstall it. RatHat can serialize the device's Accessibility tree to XML and communicate with a Generative AI assistant for tasks like screen coordinate determination and text extraction. The Go Agent, masquerading as a native library, exploits shell access to execute commands and establish a persistent connection to a command-and-control server via the FRP client. The C2 server can issue extensive commands to collect sensitive information, including SMS messages, credentials, files, and keystrokes, and RatHat also features a hardware-level keylogger.

Tech Optimizer

August 18, 2026

The temporary download folder unleashes 35% of infostealers on Windows

Executing files directly from the temporary download folder is the primary gateway for infostealers targeting Windows systems, accounting for approximately 35% of analyzed infections. The second most common entry point is C:WindowsMicrosoft.NETFramework, appearing in 32% of cases and associated with advanced tactics like process injection. The findings are based on a report by Kaspersky, which analyzed five million records from the dark web. Malicious files often disguise themselves as legitimate software, such as fake codecs or program activators. Kaspersky recommends monitoring exposed assets and not disabling antivirus software during installations.

Winsage

August 14, 2026

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

CoolClient is a sophisticated backdoor family linked to the HoneyMyte APT group, actively used in cyber-espionage campaigns targeting organizations in Asia and Russia since its initial disclosure in 2022. It has capabilities such as keylogging, clipboard theft, credential harvesting, and system reconnaissance. Investigations in 2023 revealed enhancements, including clipboard theft and HTTP traffic interception. By late 2025 and into 2026, a variant was noted that could deploy a signed kernel-mode driver as a Windows service, improving its stealth and operational capabilities. In a recent campaign targeting Myanmar, the HoneyMyte group used PlugX to deploy CoolClient components. They configured Microsoft Defender to exclude a fake Windows Defender installation directory and a renamed executable, defender.exe, to avoid detection. Persistence was achieved through a scheduled task that executed defender.exe with SYSTEM privileges at startup, which sideloaded the malicious libngs.dll to initiate the CoolClient execution chain. The latest CoolClient variant has a multi-stage execution chain, including: - defender.exe / Sang.exe: Exploited legitimate application for DLL sideloading. - libsrapc.dll: Benign dependency for the Sangfor application. - libngs.dll: First-stage loader that decrypts and loads the next stage. - loadcert.ini: Second-stage DLL implementing core functionalities. - cert.ini: Final-stage implant for command and control communication. - time.ini: Configuration file for CoolClient. The execution begins with the legitimate Sangfor application loading libngs.dll, which uses obfuscation to conceal its operations. The second stage, loadcert.ini, is injected into synchost.exe and performs tasks including persistence and process injection. The kernel-mode driver deployment routine involves decrypting time.ini, verifying privileges, and creating a service to execute the driver, enhancing stealth. The deployed kernel-mode driver, msagent.sys, is digitally signed and helps hide processes, files, and registry objects, making detection more difficult. The latest variant continues to target organizations consistent with previous HoneyMyte activities, with confirmed victims in Myanmar, Mongolia, Pakistan, and Russia, including government entities. The deployment of CoolClient as a secondary backdoor after a PlugX infection indicates a strategic approach to maintain access to compromised systems. The malware is confirmed as a new variant of CoolClient associated with the HoneyMyte threat group, with the kernel-mode driver marking a significant advancement in its capabilities.

Winsage

August 7, 2026

This ‘classic’ decades-old SQL injection flaw could let hackers take over entire Windows servers, thanks to a nifty database trick

Security researchers from Huntress discovered a sophisticated SQL Injection (SQLi) attack that led to the deployment of a rare toolkit called Khunt. The attackers exploited a public-facing application backed by an Oracle database by failing to validate user input, allowing malicious SQL commands to be executed. The Khunt toolkit enabled activities such as executing operating system commands, stealing credentials, and exfiltrating registry hive data. Experts recommend robust defense mechanisms, including input sanitation, regular security audits, and the implementation of web application firewalls to protect against such attacks.

Tech Optimizer

July 25, 2026

Scrappy RAT Malware Targets Chrome And Edge Users

A new remote access trojan (RAT) named msaRAT has been identified by Cisco Talos, linked to the Chaos ransomware group and built using Rust. It exploits Chrome and Edge browsers to disguise its traffic and evade detection. MsaRAT operates through a headless browser process, enabling remote code execution and facilitating ransomware deployment, data theft, and other malicious activities. It is typically installed via phishing emails or malicious files, making it resistant to standard browser patches. Cisco Talos recommends specific SNORT rules and a ClamAV signature for detection. Indicators of Compromise (IoC) include traffic to the IP address 172.86.126.18 and the domain is-01-ast.ols-img-12.workers.dev. The malware primarily targets large organizations, but individual users may also be at risk.

AppWizard

July 23, 2026

ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories

GitHub will reject command-line support bundle uploads from outdated versions of GitHub Enterprise Server lacking security patches starting August 18, 2026. The npm package @copilot-mcp/apex has been identified as a post-install dropper that installs a macOS infostealer, phishing for sensitive information and maintaining a connection to an attacker's server. A rogue extension on the Microsoft Visual Studio Code marketplace, "Markdown All Pro," impersonates a legitimate tool and opens a backdoor after installation. A phishing campaign targeting Portuguese users delivers the Lampion banking malware, which has been active since 2019. DoubleVerify reports a rise in "AfterCall" apps that exploit user permissions for ad fraud. The GhostCommit attack method hides malicious instructions within PNG images in pull requests. The U.S. government has updated its advisory on Iranian-affiliated cyber activity targeting operational technology devices. An Android app posing as a civil defense alert system has been found to contain malware for data harvesting. An Iranian threat actor is distributing MarkiRAT malware through fake applications. An analysis of 28 AI-coded applications revealed 434 vulnerabilities, prompting Cisco to introduce Antares to identify vulnerabilities in codebases. A Russian-speaking threat actor is dismantling guardrails on AI models to create offensive tools.

Tech Optimizer

July 21, 2026

Advanced Threat Protection: How AI Transforms Enterprise Security

An attacker is testing stolen passwords against a company with inadequate firewall protection, highlighting the flaws in traditional security measures. Modern attacks, including ransomware and phishing, have evolved, necessitating advanced threat protection (ATP) that incorporates artificial intelligence (AI) for improved threat detection and response. AI-driven ATP identifies attacks that conventional tools miss, such as fileless malware and targeted phishing, by learning normal operating patterns and flagging deviations. Traditional security relies on known malware signatures, which are ineffective against zero-day attacks and polymorphic malware that changes its identity. Cloud misconfigurations and hybrid security gaps further complicate security. AI enhances detection by focusing on malicious behaviors rather than just file signatures, allowing for rapid identification of threats. Automated incident response can isolate affected endpoints and terminate malicious processes quickly. Behavioral analytics and threat intelligence integration improve ATP effectiveness by understanding user behavior and recognizing attack patterns. AI-powered ATP significantly reduces breach containment time and false positives, shifting the focus from reactive cleanup to proactive prevention. Best practices for maximizing ATP include integrating it into existing security operations, keeping machine learning models updated, and regularly testing defenses against real-world threats.

Tech Optimizer

July 21, 2026

Advanced Threat Protection: How AI Transforms Enterprise Security

An attacker is testing stolen passwords against a company that incorrectly believes its firewall is sufficient protection. Traditional defenses have become inadequate due to the speed and sophistication of modern attacks, including ransomware groups renting tools and phishing kits being easily accessible. Advanced threat protection (ATP) was designed to address these challenges, especially with the integration of artificial intelligence (AI). AI-powered ATP identifies attacks that conventional tools overlook, such as fileless malware and targeted phishing attempts, by learning the normal behavior of an organization’s environment and flagging anomalies. Traditional security relies on identifying known malware through established fingerprints, which fails against novel threats like zero-day attacks and polymorphic malware. The rise of remote work and cloud services has introduced new risks due to misconfigurations and inconsistent security rules. AI enhances threat detection by focusing on malicious behavior rather than matching files against known threats, allowing for rapid detection and automated incident response. Behavioral analytics establishes a baseline for users and devices, flagging deviations that may indicate insider threats or credential theft. Integrating threat intelligence provides insights into emerging threats and helps prioritize alerts. AI-driven ATP can contain breaches faster, significantly reducing the financial impact and dwell time of attackers. Best practices for maximizing ATP include integrating with security operations, ensuring comprehensive coverage, updating models regularly, conducting real-world testing, securing AI systems, and maintaining human oversight.