network traffic Archives

AppWizard

September 8, 2026

Are Free VPNs for Android Actually Worth Using

A free VPN for Android can improve internet privacy, especially on untrusted networks, but it has limitations, such as not guaranteeing complete anonymity or security. The VPN creates an encrypted tunnel between the device and the server, protecting traffic from local monitoring but not ensuring overall security if poorly implemented. Changing your IP address does not guarantee anonymity, as account logins and tracking technologies can still identify users. Free VPNs may be suitable for low-risk tasks, like occasional browsing on public Wi-Fi, but they do not protect against malware or phishing. Providers often rely on alternative revenue sources, such as advertising or data sharing, which necessitates careful examination of their privacy policies. Free VPNs may have limitations like data caps, slower speeds, and fewer server options compared to paid services. Users should evaluate the provider’s background, privacy policy, permissions, and performance before installation. A paid VPN generally offers better reliability, support, and transparency, making it a safer choice for sensitive activities.

Winsage

September 6, 2026

Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

Elastic Security Labs has identified four previously undocumented programs associated with REVSTEALER, a Windows information stealer that persists on infected machines after self-deletion. The programs are ProManager, WinUpdate, SoftManager, and LockAppHost, each with distinct functionalities. ProManager steals wallet files and logs passwords, WinUpdate monitors the clipboard for cryptocurrency addresses, SoftManager acts as a reverse proxy, and LockAppHost executes a cryptocurrency miner after disabling Windows Update and Microsoft Defender. REVSTEALER has been marketed as a commercial infostealer since February 2026, exfiltrating sensitive data such as browser passwords, cookies, and cryptocurrency wallet information. It deletes itself after reporting its activities but leaves the four programs installed for persistence. These programs share build tradecraft with REVSTEALER, including the use of identical packers and runtime function resolutions. REVSTEALER primarily spreads through game-cheat lures and disguises itself as pirated software. It employs evasion techniques to resist analysis, including checking for sandbox environments and using indirect system calls. Users are advised to avoid unofficial software and to follow specific steps if infected, such as re-enabling Windows Update services and changing passwords. Indicators of compromise include SHA-256 hashes for REVSTEALER and its associated programs, as well as domains linked to their command and control servers.

AppWizard

August 26, 2026

Beware of fake Indeed interview apps used to install spyware

Scammers are exploiting the Indeed platform to target job seekers by using counterfeit Android "interview" applications. Users in the UK and Brazil reported being instructed by supposed employers to download fraudulent apps like MyInterview, which compromised their devices. These scammers post fake job listings and prompt applicants to install apps that mimic Indeed's login page and establish a VPN connection. The malicious apps, classified as Trojan.Droppers, can install additional untrusted software and gain control over devices, complicating uninstallation efforts. Indeed confirmed that their interview process does not require downloading any separate app and warned job seekers against such scams. Indicators of compromise include specific MD5 hashes and package names associated with the Trojan droppers and dropped malware payloads.

Winsage

August 24, 2026

You don’t want this Sleepwalker backdoor on your Windows machine

Malware researcher Dominik Reichel has discovered a sophisticated Windows backdoor named Sleepwalker, which remains dormant in memory until activated by a specially crafted network packet. Sleepwalker uses a 23-instruction command language to execute tasks, including running code in memory and exfiltrating data. It activates through a proprietary activation packet that does not contain readable commands. The malware targets a VMware VMCI and disguises itself as Microsoft's dpapi.dll, mimicking its functions while redirecting calls to a non-existent file. Once it confirms its host process as ERAAgent.exe, it enters a dormant state to evade detection. Sleepwalker monitors for a specific pattern known as a magic packet to decrypt and interpret commands. Commands sent to it are encrypted with AES-256-CCM and must be read in a specific order. The backdoor includes functionalities for sending and concealing data, receiving tasks, and executing programs. Reichel has developed a toolkit to decode Sleepwalker’s bytecode and a mitigation guide for affected users. However, there are significant gaps in knowledge regarding the initial access method, victim identification, and the malware's operator.

Winsage

August 22, 2026

Hackers abuse FTP server banners to deliver new Windows malware

Threat actors are exploiting FTP banners to conceal commands for deploying two undocumented remote access trojans (RATs), E4del and PINHOLE. This method was first observed by MalwareHunterTeam in July 2026, using shortcut files (.LNK) and FTP server banners as dead-drop resolvers to retrieve malicious commands. SOCRadar confirmed that this technique has been weaponized since early July 2026 and remains active, with new infrastructure identified as recently as August 2026. The attacks typically start with a ZIP archive leading to an LNK-based infection chain, likely initiated through phishing tactics. E4del is a Node.js-based RAT disguised within a digitally signed Electron application mimicking Discord, capable of executing commands, capturing screenshots, streaming desktops, and downloading additional payloads. It also includes a module for privilege escalation. PINHOLE retrieves its command and control configuration from Pinterest and SurveyMonkey, designed to leave a minimal footprint and employing shellcode fluctuation. It supports 14 commands, including file management and credential theft, but had only recorded 11 execution events at the time of analysis. SOCRadar notes that while using FTP banners is a novel approach, it is less stealthy than traditional web-based dead-drop resolvers. They provide indicators of compromise to help identify malicious infrastructure and infected machines.

AppWizard

August 14, 2026

Threema messenger says DDoS attacks disrupted its service for two days

Threema experienced significant disruptions due to large-scale DDoS attacks, rendering the service inaccessible for several hours on Tuesday and causing intermittent outages on Wednesday morning. The attacks targeted both Threema and its Swiss colocation partner, Nine, with service being unavailable from 7:30 p.m. to 11:30 p.m. CEST on Tuesday. By 12:23 p.m. on Wednesday, normal operations were restored. The security of Threema's systems and user data remained intact despite the service availability issues. The nature of the attacks made mitigation challenging, as attackers modified their methods rapidly. Threema's status page faced issues during the outage, and communication was conducted via email and social media. In response, Threema is implementing specialized upstream DDoS protection and plans to enhance its status page to provide monitoring for future disruptions.

AppWizard

August 6, 2026

Android Apps Share Location Data With Advertisers by Default

A recent investigation by the Electronic Frontier Foundation (EFF) revealed that many Android applications contain third-party code that automatically transmits users' precise location data to external companies, including advertisers and data brokers, once location permission is granted. There are no specific location permissions for Software Development Kits (SDKs) on Android, meaning that granting one app access allows all bundled components to access the same data. Developers may be unaware that their apps are configured to share location histories with external firms, as advertising SDKs often prioritize data collection for revenue generation. The EFF calls for advertising SDKs to stop making personal data sharing the default setting and urges developers to disable unnecessary data collection. Location data can reach data brokers, which may experience breaches, compromising user privacy and security. This situation poses hidden risks for investors in the mobile advertising sector, as legal challenges and reputational damage may arise from regulatory scrutiny of location data practices. The EFF emphasizes that app-level permissions do not provide meaningful consent for third-party data sharing, highlighting the value and risks associated with location data.

AppWizard

August 5, 2026

Developers: Beware of Ad Libraries that Betray Your Users’ Location

Advertising companies provide software development kits (SDKs) for mobile app monetization, which often automatically transmit users' location data to ad systems and location data brokers, raising privacy concerns. Many developers and users may be unaware of this data sharing. When developers allow SDKs to collect location data, it poses risks beyond targeted ads, including potential misuse by agencies like ICE and global surveillance. Location data brokers harvest precise movements of individuals, often without their consent, through mobile applications. Some apps directly collaborate with data brokers, while others leak data through advertising SDKs during real-time bidding (RTB) auctions. An incident in 2025 revealed that many apps unknowingly contributed to a location data broker's database. Developers must understand their SDKs' location-sharing practices to mitigate risks. Advertising SDKs can collect location data automatically once users grant permission, without specific permissions for the SDKs themselves. Precise location data can be collected when apps have location permissions, leading to potential privacy violations. Several SDKs have been identified as collecting location data by default, increasing the risk of unintentional data leaks. The Electronic Frontier Foundation (EFF) found that four advertising SDKs collect users' location data by default when location permissions are granted. InMobi encourages location sharing for higher revenue, while BidMachine updated its documentation after EFF's inquiry, confirming precise location data collection. Verve's SDK also collects location data by default but presents a cautious narrative in its Play Store guidance. Huawei's SDK recommends obtaining location permissions to enhance revenue, with default location sharing occurring if permissions are granted. Location data can be shared without users' knowledge or meaningful consent, complicating informed consent issues. The focus on four SDKs does not imply that others adequately protect location data, as many have faced criticism for similar practices. Studies indicate that SDKs often encourage increased data collection through design and documentation, leading to minimal control for developers over data transmission. The EFF's analysis highlights that advertising SDKs incentivize location data sharing through default settings and unclear documentation. Developers should assess third-party SDKs and disable unnecessary data collection. Regulators must hold developers accountable for unlawful data sharing, while legislators should enact laws to protect location privacy and address online behavioral advertising, which drives data tracking.

AppWizard

August 5, 2026

Why Running Your Own Minecraft Server Is Still Worth It in 2026

In 2026, players have three primary options for hosting Minecraft servers: self-hosting on personal computers, free hosting services, and paid hosting plans. Self-hosting offers complete control but requires maintenance and can lead to performance issues as player numbers grow. Free hosting is suitable for casual play but has limitations like restricted RAM and player slots. Paid hosting provides dedicated resources, DDoS protection, automatic backups, and technical support, making it a reliable choice for larger communities. Owning a server allows for customization of game settings, mods, and player access, enhancing the gaming experience. However, self-hosting can expose users to security risks and requires network configuration. Upgrading to paid hosting is advisable for those needing more resources, reliability, and support.

AppWizard

August 5, 2026

Android Developers Unknowingly Leak User Location Data

Recent research from the Electronic Frontier Foundation (EFF) has revealed that millions of Android users' location data are being inadvertently exposed to advertisers through third-party code libraries. This occurs when seemingly harmless applications, like weather services and fitness trackers, integrate third-party SDKs that collect user location information automatically upon permission approval, often without developers' awareness. Data brokers aggregate this location information to create detailed movement profiles sold to advertisers and government agencies. Despite privacy regulations like GDPR and CCPA, enforcement is inconsistent, and developers may claim ignorance regarding data practices they did not implement. Google has improved Android's privacy controls, but visibility into third-party libraries accessing data remains limited. Developers face challenges in auditing third-party code due to resource constraints, leading to a complex landscape where user information traverses multiple entities without clear accountability. Privacy advocates are calling for new technical standards to require SDKs to disclose their data practices.