monitor Archives

Winsage

September 10, 2026

CVE-2026-85880 and CVE-2026-81963: Microsoft Patches Two Actively Exploited Windows Zero-Days

Microsoft's Patch Tuesday on September 8, 2026, addressed two critical Windows privilege escalation vulnerabilities: CVE-2026-85880 and CVE-2026-81963, both with a CVSS score of 7.8. CVE-2026-85880 is a heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC), allowing attackers with low-privilege local access to escalate privileges to SYSTEM. CVE-2026-81963 involves improper link resolution in the Windows Update Stack, enabling similar privilege escalation. Both vulnerabilities require no user interaction and have been actively exploited prior to the patch release. CISA added them to its Known Exploited Vulnerabilities catalog on September 8, 2026, with a remediation deadline of September 22 for U.S. federal agencies. CVE-2026-85880 affects various Windows 10 and Server versions but excludes Windows 11 and Windows Server 2025. CVE-2026-81963 impacts newer Windows platforms, including Windows 11 and Windows Server 2025. Microsoft released security updates for both vulnerabilities on September 8, 2026, and organizations are advised to prioritize these updates. Security teams should monitor for signs of privilege escalation and unusual SYSTEM-level activities related to these vulnerabilities.

AppWizard

September 10, 2026

How to Delete Your Digital Footprint From the Internet: A Complete Guide

Android privacy tools allow users to control camera access, microphone use, location permissions, and app activity, but they only protect information managed on the device or connected services. A digital footprint extends beyond the device, with personal information remaining accessible through search results, social media profiles, and data broker listings even after permissions are changed. To manage this footprint, users should identify publicly visible information, review old accounts, and delete unnecessary records. Simply deleting an Android app does not erase the associated account, which may retain personal data. Users should actively close unused online accounts to maintain digital hygiene. Data brokers publish personal information that cannot be removed through Android privacy settings, requiring users to follow an opt-out process to remove their data. While Android privacy settings are important, they do not eliminate external records. Data breaches require vigilance, including changing compromised credentials and monitoring for suspicious activity. Removing the source of information is more effective than just eliminating search results, and legal rights may exist in some regions for personal data removal. Completely erasing a digital footprint is rarely feasible due to public records and the persistence of past posts. The goal should be to minimize irrelevant content while retaining useful accounts. Users should begin by deleting information they control, then address data brokers and public profiles.

BetaBeacon

September 9, 2026

Android Studio vs Genymotion vs BlueStacks 5 [2026]

Android Studio Emulator is the official Android SDK tooling maintained by Google for app developers to test code against specific Android API levels, screen densities, and hardware profiles.

Winsage

September 9, 2026

Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week

Recent investigations have identified the BlueMoon exploit kit, used by espionage-driven threat activity clusters, particularly linked to APT31, a China-aligned state-sponsored group, since August 28, 2026. BlueMoon exploits three vulnerabilities: CVE-2026-85046 (a type confusion vulnerability in Google Chrome's V8 engine), an unassigned V8 sandbox escape, and CVE-2026-85880 (a heap-based buffer overflow in Windows ALPC). Google and Microsoft have released patches for these vulnerabilities, which were exploited as "patch-gap" zero-days. The attack vectors typically begin with phishing emails that lead victims to malicious URLs, triggering the vulnerabilities for code execution and privilege escalation. Variants of BlueMoon have been detected, featuring modifications for specific campaigns. Notable attack chains include: - APT31 targeting NGOs and mining firms in the U.S. with a malicious browser add-on called GemStone. - UNK_LateNight targeting U.S. aerospace companies, deploying BlueMoon alongside the ShadowPad backdoor. - UNK_DoubleCheck targeting a Vietnamese manufacturer, using DLL sideloading to execute a Rust binary. - UNK_QuietRacket targeting government and financial organizations in Indonesia and Singapore, modifying BlueMoon to execute a .NET assembly. CISA added the Chrome flaw to its Known Exploited Vulnerabilities catalog on September 4, 2026, requiring federal agencies to apply patches by September 18, 2026. Indicators of compromise include specific process trees, files, folders, scheduled tasks, mutexes, and registry keys. Proofpoint has released detection rules to help organizations identify and mitigate these threats.

AppWizard

September 9, 2026

Attorney General Tong Announces Investigation Into “Predator’s Paradise” Kik Messenger App

Attorney General William Tong has launched an investigation into MediaLab.AI Inc., the parent company of the messaging app Kik, following allegations of inadequate age verification and content moderation practices. Kik has been criticized for its reputation as a platform for sexual abuse, exploitation, and bullying, particularly among minors, with over one-third of American teens reportedly using the app. A 2025 report ranked Kik as the second worst app for extreme sexual content and the third worst for severe bullying, and the app has been included on the National Center on Child Exploitation's "Dirty Dozen" list. Despite claims of restricting new users to those aged 18 and older as of September 2023, evidence suggests that Kik continued to market to younger audiences, and the app maintained a "Teen" rating until early 2025. The Attorney General's office issued a notice of violation to MediaLab in July 2025 for deficiencies in Kik’s privacy practices and has issued a civil investigative demand for further records related to data processing and content moderation. This investigation is part of a broader effort to protect children from online threats in Connecticut.

AppWizard

September 9, 2026

Gigabud Uses Android App Cloning to Evade Fraud Detection

The Gigabud Android banking trojan can clone banking applications into a separate Android work profile, allowing fraudsters to bypass malware alerts during transactions. Research by Group-IB, released on September 9, indicates that Gigabud is used with Vwork, a modified app for cloning, attributed to the GoldFactory group. The infection has been confirmed in Indonesia but targets 11 countries, including Brazil, Colombia, Egypt, Mexico, Thailand, and Turkiye. Vwork uses Android's Work Profile feature to isolate cloned apps, making them less detectable. This allows operators to install malware, clone banking apps, and execute transactions without raising alarms. During fraud, fake login screens capture credentials, and an invisible overlay collects lock screen codes. From February to July 2026, 1,469 devices were compromised in Indonesia, with financial losses nearing 0,939. Gigabud spreads through phishing and social media, requesting permissions to control devices. Group-IB identified six behavioral signals for banks to monitor as indicators of high-risk sessions. Recommendations include device binding and downloading apps only from official stores.

Winsage

September 9, 2026

Announcing new builds for 8 September 2026

New Insider Preview builds for Windows 11 are being released for the Beta and Experimental channels, featuring enhancements aimed at improving user experience. 1. Cross-device resume improvements: Users can now continue browsing on their PC from where they left off on their phone, with options to open the webpage in the PC's default browser or install the phone's browser if not already present. 2. Narrator: The Narrator feature has been upgraded to include math reading and navigation support, enhancing accessibility for users who are blind or have low vision, especially in STEM fields. 3. Magnifier: The Magnifier tool now allows each display to maintain its own zoom level, enabling users to set different zoom percentages for multiple screens, improving comfort and clarity when working across different resolutions.

AppWizard

September 8, 2026

‘Predator’s paradise’: Connecticut AG investigates popular messaging app

Connecticut Attorney General William Tong has launched an investigation into the messaging platform Kik over concerns about its effectiveness in protecting children from online exploitation. The inquiry centers on allegations of inadequate age verification measures, which expose younger users to potential dangers. Kik lacks parental controls, prompting Tong to compare it unfavorably to other platforms, and he described it as a "predator's paradise." The National Center on Sexual Exploitation has also raised alarms about Kik being a tool for grooming children and distributing explicit content. Local residents shared experiences of minimal restrictions on the app, and while Kik claims to be intended for adults only, Tong criticized its age-verification processes as ineffective. He has advised parents to monitor their children's online activities and consider removing Kik from their devices.

AppWizard

September 8, 2026

Connecticut attorney general calls Kik messenger app a ‘predator’s paradise’

Connecticut's Attorney General, William Tong, is investigating MediaLab.AI Inc.'s messaging app, Kik, due to concerns about inadequate age assurance practices and content moderation. Child safety advocates have criticized Kik as a “predator’s paradise.” Tong described Kik as a platform with significant issues related to sexual abuse, exploitation, and bullying, lacking meaningful age verification and protections for users. The app has over one-third of American teens using it, down from 40 percent in 2016. MediaLab has only partially responded to inquiries about privacy and safety. Tong's office has issued a civil investigative demand for information on MediaLab’s data processing, content moderation, and age assurance practices to assess compliance with the Connecticut Data Privacy Act and the Connecticut Unfair Trade Practices Act.

Tech Optimizer

September 8, 2026

Microsoft Confirms False “Defender Antivirus Turned Off” Alerts Spreading Across Windows Devices

Microsoft has acknowledged a software bug causing persistent Windows Security pop-ups that incorrectly indicate antivirus protection is disabled. These notifications began appearing after the latest Microsoft Defender Antivirus updates, but the antivirus is functioning correctly. The issue affects various versions of Windows and Windows Server with the latest Defender updates. Microsoft has committed to resolving the issue in a future update, though no timeline has been provided. Users are advised to verify the status of their antivirus through the Windows Security app and disregard the notifications until a fix is released.