network traffic Archives

Winsage

October 21, 2026

Windows AI agent security: how isolation works

Microsoft's AI agent security is structured around three execution boundaries: local process isolation, session isolation, and cloud-based Windows 365 for Agents. The introduction of Microsoft Execution Containers (MXC) on June 2, 2026, enhances local isolation through two methods: process isolation, which restricts an agent's access to specific files and networks, and session isolation, which separates an agent from the user's interactive environment. The MXC framework includes policies for filesystem access, network traffic, and user-interface controls, with an audit mode that disables sandbox security for analysis purposes. The choice between local isolation and Windows 365 for Agents depends on the agent's execution environment, with local isolation providing limited access and Windows 365 offering a completely separate cloud environment. MXC is in early preview, while Windows 365 for Agents is generally available.

AppWizard

October 11, 2026

Android Malware Caught by Teaching AI to Read Apps as Pictures

A research team from Turkey, led by Erdal Başaran and Ömer Okucu of Ağrı İbrahim Çeçen University, along with Yusuf Alaca from Hitit University, has developed an innovative detection framework for Android malware that utilizes a visual approach. This framework transforms key features of Android applications into images, allowing a Vision Transformer to differentiate between benign software and malware. The researchers created two types of images from static and dynamic analysis features: a conventional 2D grayscale image and a QR code image. Separate Vision Transformer models were trained on each image type, and spatial pooling features were extracted from deeper layers to create a comprehensive representation of application behavior. To refine the fused feature vector, Recursive Feature Elimination (RFE) was employed, enhancing classification clarity and reducing computational load. The final classification utilized a majority-voting ensemble strategy, achieving a detection accuracy of 98.72 percent, surpassing standalone models. The study demonstrates that the multimodal system outperforms individual grayscale or QR code pathways. The dataset used is publicly available, promoting reproducibility. The framework's reliance on static and dynamic analysis features allows it to adapt to new threats, and the novel QR code representation offers distinctive visual signatures of malicious behavior. However, challenges remain regarding feature extraction quality and computational demands.

BetaBeacon

September 29, 2026

Proton finds Russian and Chinese trackers in popular Android games

A study by Proton found tracker code associated with companies in China and Russia in many of the most downloaded free Android games in the US and Europe.

AppWizard

September 24, 2026

Russia’s state-backed messaging app Max can secretly change how it surveils individual users, researchers at InterSecLab find

The Max messenger, developed by VK, has significant user tracking capabilities. A report from InterSecLab revealed that: - Max's features can vary for individual users without app updates. - It lacks end-to-end encryption, allowing VK access to messages, even in "secret chats." - Each account can be configured to perform specific actions, such as decrypting messages on VK's servers and blocking messages if a VPN is detected. - Upon launching, Max reports the user’s network environment to VK, including their public IP address and mobile carrier. - The app uploads users’ entire address books unencrypted to VK's servers, accessing contacts of non-registered individuals. - A phone number query can reveal extensive user information without notification. - Max stops functioning if it detects a VPN, requiring users to disable it to send messages, although workarounds exist. - New users receive a curated list of recommended channels, primarily featuring state media and pro-government figures.

Tech Optimizer

September 20, 2026

How to Remove a Keylogger: 12 Steps, 60 Min [2026]

A keylogger captures every keystroke made on a device and sends that information to an external source. In 2025, infostealer malware, including keyloggers, resulted in the theft of 642.4 million credentials from 13.2 million infections globally. In Australia, approximately 30,000 banking passwords were compromised between 2021 and 2025 due to this malware. The Australian Cyber Security Centre reported over 42,500 calls related to credential theft in one year, a 16% increase. Four main malware families dominate the landscape, with LummaC2 accounting for nearly 60% of credentials linked to infostealers in 2026. Keyloggers can be detected through signs such as typing lag, unexpected antivirus notifications, new browser extensions, and unexplained spikes in outbound data usage. Detection and removal steps include checking running processes, auditing startup programs, reviewing installed programs, running antivirus scans, and resetting passwords from a clean device. Keyloggers can infiltrate systems via phishing emails, malicious attachments, or compromised software downloads. Mobile devices can also be targeted by keyloggers disguised as legitimate apps.

AppWizard

September 14, 2026

One Click, Full Phone Access: Malicious Android Apps Raise Financial Fraud Risk

Malicious Android applications are being promoted through social media advertisements, particularly on platforms like Instagram and Facebook, posing significant risks to users. The Indian Cyber Crime Coordination Centre (I4C) has warned about deceptive apps advertised under names such as Night Play, Reloop, Kyss, Vimo, Rivo, Nezo, and Vixa, which often redirect users to pornographic websites to download APK files. These applications can exploit sensitive device permissions, leading to malware infections, unauthorized financial transactions, and various forms of cyber fraud. Users may be tricked into granting accessibility permissions that allow the malware to operate in the background and potentially install a VPN, rerouting internet traffic through servers controlled by attackers. Cybersecurity experts advise users to verify the legitimacy of applications before installation and to be cautious of permissions requested by unknown apps.

AppWizard

September 8, 2026

Are Free VPNs for Android Actually Worth Using

A free VPN for Android can improve internet privacy, especially on untrusted networks, but it has limitations, such as not guaranteeing complete anonymity or security. The VPN creates an encrypted tunnel between the device and the server, protecting traffic from local monitoring but not ensuring overall security if poorly implemented. Changing your IP address does not guarantee anonymity, as account logins and tracking technologies can still identify users. Free VPNs may be suitable for low-risk tasks, like occasional browsing on public Wi-Fi, but they do not protect against malware or phishing. Providers often rely on alternative revenue sources, such as advertising or data sharing, which necessitates careful examination of their privacy policies. Free VPNs may have limitations like data caps, slower speeds, and fewer server options compared to paid services. Users should evaluate the provider’s background, privacy policy, permissions, and performance before installation. A paid VPN generally offers better reliability, support, and transparency, making it a safer choice for sensitive activities.

Winsage

September 6, 2026

Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

Elastic Security Labs has identified four previously undocumented programs associated with REVSTEALER, a Windows information stealer that persists on infected machines after self-deletion. The programs are ProManager, WinUpdate, SoftManager, and LockAppHost, each with distinct functionalities. ProManager steals wallet files and logs passwords, WinUpdate monitors the clipboard for cryptocurrency addresses, SoftManager acts as a reverse proxy, and LockAppHost executes a cryptocurrency miner after disabling Windows Update and Microsoft Defender. REVSTEALER has been marketed as a commercial infostealer since February 2026, exfiltrating sensitive data such as browser passwords, cookies, and cryptocurrency wallet information. It deletes itself after reporting its activities but leaves the four programs installed for persistence. These programs share build tradecraft with REVSTEALER, including the use of identical packers and runtime function resolutions. REVSTEALER primarily spreads through game-cheat lures and disguises itself as pirated software. It employs evasion techniques to resist analysis, including checking for sandbox environments and using indirect system calls. Users are advised to avoid unofficial software and to follow specific steps if infected, such as re-enabling Windows Update services and changing passwords. Indicators of compromise include SHA-256 hashes for REVSTEALER and its associated programs, as well as domains linked to their command and control servers.

AppWizard

August 26, 2026

Beware of fake Indeed interview apps used to install spyware

Scammers are exploiting the Indeed platform to target job seekers by using counterfeit Android "interview" applications. Users in the UK and Brazil reported being instructed by supposed employers to download fraudulent apps like MyInterview, which compromised their devices. These scammers post fake job listings and prompt applicants to install apps that mimic Indeed's login page and establish a VPN connection. The malicious apps, classified as Trojan.Droppers, can install additional untrusted software and gain control over devices, complicating uninstallation efforts. Indeed confirmed that their interview process does not require downloading any separate app and warned job seekers against such scams. Indicators of compromise include specific MD5 hashes and package names associated with the Trojan droppers and dropped malware payloads.

Winsage

August 24, 2026

You don’t want this Sleepwalker backdoor on your Windows machine

Malware researcher Dominik Reichel has discovered a sophisticated Windows backdoor named Sleepwalker, which remains dormant in memory until activated by a specially crafted network packet. Sleepwalker uses a 23-instruction command language to execute tasks, including running code in memory and exfiltrating data. It activates through a proprietary activation packet that does not contain readable commands. The malware targets a VMware VMCI and disguises itself as Microsoft's dpapi.dll, mimicking its functions while redirecting calls to a non-existent file. Once it confirms its host process as ERAAgent.exe, it enters a dormant state to evade detection. Sleepwalker monitors for a specific pattern known as a magic packet to decrypt and interpret commands. Commands sent to it are encrypted with AES-256-CCM and must be read in a specific order. The backdoor includes functionalities for sending and concealing data, receiving tasks, and executing programs. Reichel has developed a toolkit to decode Sleepwalker’s bytecode and a mitigation guide for affected users. However, there are significant gaps in knowledge regarding the initial access method, victim identification, and the malware's operator.