modus operandi Archives

Winsage

September 15, 2026

Iranian spies hit Windows machines with Chosen Brick data-stealing malware

Iranian state cyber actors are targeting individuals through popular messaging applications, using surveillance and data-stealing malware known as "Chosen Brick," which has been in use since at least 2025. This malware is designed for Windows systems and enables the theft of personal data, allowing Iranian spies to monitor perceived threats such as dissidents, activists, and journalists. The attacks typically begin with messages sent via WhatsApp or Telegram, impersonating trusted contacts. Attackers conduct extensive research on their targets to craft convincing messages that encourage victims to download malicious files disguised as legitimate applications. Once executed, Chosen Brick operates stealthily, evading detection and establishing a connection for command-and-control communications. It can enumerate processes, capture screen and audio content, extract sensitive information, and even wipe infected systems. Organizations suspecting compromise are advised to engage IT providers for investigations and to inform staff about potential risks. Recent alerts follow cyberattacks on water and energy sectors linked to Iran, with ongoing concerns about the implications for cybersecurity amid escalating military tensions. Additionally, five US agencies have reported that attackers are using AI-generated scripts to exploit vulnerabilities in critical infrastructure systems.

AppWizard

September 1, 2026

Fake Porn Apps Target Android Users Via Ads On Facebook, Instagram: How To Stay Safe

Cybercriminals are targeting Android users with deceptive advertisements for malicious applications disguised as pornographic content on platforms like Facebook and Instagram. The National Cybercrime Threat Analytics Unit (NCTAU) has reported that these ads lead users to phishing traps or malware downloads that can compromise banking credentials. Malicious applications linked to this threat include “Night Play,” “Reloop,” “Kyss,” “Vimo,” “Rivo,” “Nexo,” and “Vixa.” The scam involves promoting these apps through enticing ads, redirecting users to websites offering pornographic content, and prompting them to download APK files directly from these sites, often using “.live” domains. The initial app may request users to download a second package disguised as an update, which can exploit permissions granted to the first app. This malware can gain extensive control over the device, potentially installing a VPN that routes internet traffic through attackers' servers. To protect against this threat, users should download apps only from trusted sources, avoid installing APK files from ads or suspicious links, refrain from granting Accessibility access to unknown apps, regularly review installed apps, keep Google Play Protect enabled, and monitor bank accounts for unusual activity. If a suspicious app cannot be uninstalled, users can try Safe Mode, remove special permissions, or perform a factory reset as a last resort.

AppWizard

August 31, 2026

Home Ministry alerts about rise in financial frauds through malicious Android apps

The Indian Cyber Crime Coordination Centre (I4C) has reported a rise in financial frauds associated with malicious Android applications disguised as pornography apps. These apps, including names like "Night Play," "Reloop," and "Kyss," are promoted through ads on Facebook and Instagram, leading users to phishing websites where they are encouraged to download APK files from unverified sources. The malicious apps exploit permissions granted by users to take control of devices, potentially facilitating unauthorized financial transactions. Recommendations for safety include only installing apps from reputable sources, avoiding suspicious downloads, and regularly monitoring financial transactions. Instructions for uninstalling these apps involve starting the phone in Safe Mode, uninstalling the suspicious app, and then restarting the device.

Winsage

August 3, 2026

Microsoft warns Windows PC users of Russian hackers on hotel WiFi

Microsoft has issued a warning to Windows PC users about Russian hackers targeting individuals using hotel WiFi networks. The campaign, named CaptiveCrunch and attributed to the Storm-2945 group, focuses on corporate travelers and employs tactics like credential theft and malware distribution through compromised guest networks. Microsoft has been monitoring this activity since May, noting its impact on hospitality networks utilizing captive portals. Hackers have been redirecting users to counterfeit sign-in pages to steal credentials without phishing emails. The threat may also extend to Android devices, with hackers using deceptive techniques to manipulate users into downloading malicious APK files. The hackers employ fake verification checks and sign-in prompts, sometimes misleading users into Microsoft's legitimate authentication process to gain access to accounts. Microsoft has identified a specific remote-access trojan named CornFlake, which can record keystrokes, steal credentials, and capture screenshots. Recommendations for travelers include using mobile hotspots, avoiding updates through captive portals, strengthening authentication methods, and blocking unnecessary device-code authentication.

Tech Optimizer

July 7, 2026

7 Habits That Are More Important Than Using Antivirus on Your Phone

Antivirus software was once standard on personal computers, but modern smartphones have evolved with enhanced security measures from Apple and Google, making them less vulnerable to traditional malware. Smartphones isolate applications, allowing them only to access user-permitted information, and if a malicious app infiltrates, it faces significant challenges due to built-in defenses. Apple requires thorough vetting of apps through the App Store, which enhances security but limits antivirus capabilities. Android allows sideloading apps from outside the Google Play Store, which introduces risks but also includes built-in security features like Google Play Protect and regular updates. Despite these advancements, smartphones can still be compromised, and cybercriminals increasingly target user accounts through phishing tactics rather than malware. Security experts recommend focusing on phishing awareness, strong passwords, and two-factor authentication. For enhanced security, users should keep devices updated, download apps from official sources, review app permissions, use strong passwords, utilize a password manager, enable two-factor authentication, and be cautious with unexpected communications. While most users may not need antivirus apps, those who frequently sideload or download from unfamiliar sites may benefit from additional security tools.

AppWizard

May 11, 2026

Google warns 7 million Android users to delete these 28 fake apps

28 Android applications were removed from the Google Play Store after being identified as scams by security researchers at ESET. These apps, part of a campaign called “CallPhantom,” falsely claimed to provide access to private call logs, SMS records, and WhatsApp activity. They attracted millions of downloads despite lacking legitimacy, offering fabricated data such as fake phone numbers and bogus call durations. Some apps charged users for “detailed reports” that either never arrived or contained nonsensical information. The apps did not steal phone data or install malware but instead promised illicit access and generated fictitious data. The primary targets of this scam were users in India and the Asia-Pacific region.

AppWizard

May 8, 2026

Android alert: 7 million users downloaded ‘stalking’ apps that were actually scams

Security researchers at ESET uncovered a scam involving 28 applications named "CallPhantom," which collectively amassed over 7.3 million downloads on the Google Play Store. These apps promised access to call histories, SMS records, and WhatsApp call logs for any phone number, raising privacy concerns. They requested intrusive permissions from users' devices, leading to potential privacy violations. Payment structures varied, with some using Google Play's billing system and others circumventing it through third-party methods. ESET reported the apps to Google in December 2025, resulting in their removal from the Play Store. A recent search confirmed that these apps are no longer available.

AppWizard

March 21, 2026

FBI, CISA issue PSA on Russian intelligence campaign to target messaging apps

The FBI and CISA issued a joint public service announcement about Russian hackers targeting commercial messaging applications like Signal and WhatsApp. The hackers use social engineering tactics to deceive users into giving up account access, including impersonating support personnel and prompting users to click on malicious links or provide sensitive information. Although the hackers have not yet bypassed the apps' end-to-end encryption, compromised accounts can lead to serious consequences, such as reading messages and launching further phishing attacks. The agencies recommend that users enhance their cybersecurity measures to protect against these threats. This campaign is part of a broader trend to undermine the security of messaging apps, with previous warnings about spyware and attempts to infiltrate Signal users, especially in conflict zones.

AppWizard

March 19, 2026

RUSSIA Mammut virus hits Russia’s patriotic messaging app

A virus known as Mamont is targeting users of the messaging platform Max, which has 100 million registered profiles. Mamont infiltrates online banking applications and spreads primarily through family and parental chat groups, allowing cybercriminals to steal payment information. The virus often begins with a deceptive message prompting users to click, leading to the silent download of a Trojan that siphons off data. Despite claims from the Max press service that the virus's spread is exaggerated, concerns remain about the security of user data, particularly given that all communications on Max are monitored by the state. Many users resort to using a second device, referred to as Maxofon, to comply with the platform's requirements while keeping their primary device for other applications.

Winsage

March 6, 2026

Chinese hackers hide malware in Windows and Google Drive to hit targets

Chinese state-sponsored threat actors, specifically a group known as Silver Dragon, have been conducting espionage operations across Southeast Asia and Europe since at least mid-2024. They have targeted government entities in countries such as Russia, Poland, Hungary, Italy, Japan, Myanmar, and Malaysia. Silver Dragon is believed to be affiliated with APT41 and primarily uses phishing emails to initiate attacks, often containing weaponized documents or links. They employ a custom backdoor called GearDoor, which utilizes Google Drive for command-and-control operations, allowing them to exfiltrate stolen intelligence. The group also hijacks legitimate Windows services to load malicious code and uses tools like SSHcmd and Cobalt Strike for post-exploitation activities. Their tactics involve blending malicious activities with normal system operations, making detection difficult and increasing their dwell time within targeted networks.