obfuscation Archives

AppWizard

August 4, 2026

DoubleVerify finds dozens of Android apps a month showing ads after calls

A recent analysis by DoubleVerify engineers has identified a trend in mobile advertising known as AfterCall ads, where applications display advertisements immediately after a phone call ends. This practice generates hundreds of millions of impressions monthly and raises concerns about user experience and brand integrity. AfterCall applications operate using three components: a misleading permission, a Broadcast Receiver to capture end-of-call events, and an Activity to display ads. The SYSTEMALERTWINDOW permission allows these apps to show content over others, often granted under false pretenses. They utilize Android's telephony system to trigger ads post-call and employ tactics to obscure their presence, such as removing themselves from the recent apps list and using innocuous icons. Detection is challenging due to the lack of shared codebases and the obfuscation techniques used. The scale of the issue is significant, with numerous AfterCall applications identified monthly, negatively impacting user experience and raising concerns for advertisers.

AppWizard

July 29, 2026

Minecraft Java Edition Now Demands 16GB RAM in First Hardware Overhaul in 17 Years

Mojang Studios has updated the system requirements for Minecraft: Java Edition for the first time in 17 years, raising the recommended memory to 16GB of RAM. The new minimum specifications include a 64-bit operating system, a quad-core CPU, a graphics card supporting Vulkan 1.3 API with at least 2GB of VRAM, and 8GB of system RAM for discrete GPUs or 12GB for integrated graphics. For the recommended "Fancy" preset, 16GB of system memory, a current-generation processor, and a graphics card with 6GB or more of VRAM are required. Older hardware may struggle to run the game, leading to low frame rates and visual issues. Mojang is transitioning from OpenGL to Vulkan to enhance game performance and visuals. Players can still use Minecraft: Bedrock Edition for lower system requirements or community optimization mods like Sodium to improve performance on less capable hardware.

AppWizard

July 23, 2026

ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories

GitHub will reject command-line support bundle uploads from outdated versions of GitHub Enterprise Server lacking security patches starting August 18, 2026. The npm package @copilot-mcp/apex has been identified as a post-install dropper that installs a macOS infostealer, phishing for sensitive information and maintaining a connection to an attacker's server. A rogue extension on the Microsoft Visual Studio Code marketplace, "Markdown All Pro," impersonates a legitimate tool and opens a backdoor after installation. A phishing campaign targeting Portuguese users delivers the Lampion banking malware, which has been active since 2019. DoubleVerify reports a rise in "AfterCall" apps that exploit user permissions for ad fraud. The GhostCommit attack method hides malicious instructions within PNG images in pull requests. The U.S. government has updated its advisory on Iranian-affiliated cyber activity targeting operational technology devices. An Android app posing as a civil defense alert system has been found to contain malware for data harvesting. An Iranian threat actor is distributing MarkiRAT malware through fake applications. An analysis of 28 AI-coded applications revealed 434 vulnerabilities, prompting Cisco to introduce Antares to identify vulnerabilities in codebases. A Russian-speaking threat actor is dismantling guardrails on AI models to create offensive tools.

Tech Optimizer

June 6, 2026

Hackers Use Fake Purchase Orders to Deploy JS.MonoGlyphRAT Targeting US Enterprises

Researchers have identified a new malware called JS.MonoGlyphRAT, which disguises itself as business documents to infiltrate corporate networks. It is primarily spread through phishing emails targeting various sectors in the U.S. and has been reported in countries like Germany, Sweden, and Australia. The malware is classified as "Unknown malware" on threat intelligence platforms, making traditional antivirus solutions ineffective. It establishes a persistent presence in the network by executing a JavaScript file and communicating with command-and-control (C2) servers over HTTP. Key indicators of compromise include unusual HTTP traffic, registry changes, and the execution of specific JavaScript files. The malware can download additional payloads and execute commands without leaving traces on disk. Indicators of compromise include specific IP addresses, URLs, file hashes, and registry keys associated with the malware's operation.

Tech Optimizer

June 5, 2026

Microsoft quietly deletes Windows 11 guide that claimed you don’t need third-party antivirus

In April 2026, a blog post from Microsoft's Windows Learning Center claimed that most Windows 11 users could rely solely on Windows Security (Defender) for antivirus protection, citing features like Microsoft Defender Antivirus, SmartScreen, and ransomware mitigation. The blog was later removed without explanation, leading to speculation about its definitive claims. Microsoft stated that Windows Defender was sufficient for typical users with default settings and regular updates, while cautioning against using multiple antivirus engines. Independent testing from AV-Test consistently ranks Microsoft Defender highly, but AV-Comparatives noted limitations in offline protection and the reliance on cloud-based intelligence. The blog's removal was viewed by some as a constructive step towards realistic security guidance. Microsoft continues to provide third-party antivirus vendors with significant access to Windows, and the rise of AI-generated threats is complicating the cybersecurity landscape. Despite the controversies, Microsoft has made significant advancements in Windows Security, making it a viable option for many users.

AppWizard

May 29, 2026

Android App Security Essentials: How to Build Secure Mobile Applications

Mobile applications have transformed business operations and communication, becoming essential in various industries. As reliance on mobile technology increases, organizations face cybersecurity challenges such as malware, unauthorized access, data leaks, and phishing. This has led to a focus on Android app security, with businesses implementing advanced protection strategies. To address cybersecurity threats, modern Android applications require multiple security layers. Secure coding practices minimize vulnerabilities through structured frameworks, automated testing, and regular code reviews. Strong user authentication systems, including multi-factor authentication and biometric verification, protect against unauthorized access. Data encryption secures sensitive information during transmission and storage, helping organizations comply with data protection regulations. Malware attacks are a significant concern, prompting developers to implement anti-malware frameworks and application shielding technologies. To prevent reverse engineering, developers use code obfuscation and tamper detection systems. Managing mobile device permissions securely is crucial to protect sensitive user information. Emerging technologies, such as artificial intelligence, enhance mobile security by improving threat detection and response. DevSecOps integrates security practices into the development lifecycle, allowing for continuous vulnerability identification. Robust endpoint protection solutions monitor devices for malware and unauthorized access, supporting stronger cybersecurity governance across mobile ecosystems.

AppWizard

May 24, 2026

I’ve used the new Google Health app for a week, and I hate it

User feedback on the new Google Health app revealed mixed sentiments: 28% praised it as "gorgeous and so useful," 26% found it visually appealing but cumbersome, 10% appreciated its functionality but disliked the aesthetic, 20% expressed indifference, and 16% had not transitioned from Fitbit. The app's design features lengthy text explanations from the Google Health Coach that overshadow vital statistics, diminishing usability. The Fitness and Sleep tabs also exhibit design flaws, with excessive scrolling and text before essential metrics. Users cannot easily move tiles or customize the home screen, limiting visibility for health data. Suggested improvements include presenting metrics and graphs upfront, allowing tile customization, resizing the home screen tile section, prioritizing workouts in the Fitness tab, and displaying sleep statistics before interpretations in the Sleep tab.

AppWizard

May 20, 2026

Trapdoor Android Ad Fraud Scheme Hit 659 Million Daily Bid Requests Using 455 Apps

Cybersecurity researchers have identified an ad fraud and malvertising operation called Trapdoor, targeting Android users with 455 malicious applications and 183 command-and-control domains. Users often download these disguised apps, which initiate malvertising campaigns and lead to further downloads of malicious applications. At its peak, Trapdoor generated 659 million bid requests daily, with over 24 million downloads of the associated apps, primarily from the United States. The operation exploits install attribution tools to activate malicious activities only for users acquired through fraudulent ad campaigns, while suppressing such behavior for organic downloads. Trapdoor employs advanced evasion techniques, including obfuscation and impersonation of legitimate software, to avoid detection. Google has removed the identified malicious apps from the Play Store in response to the threat.

Tech Optimizer

April 16, 2026

MiningDropper Android Malware Exploits Lumolight App

Researchers at Cyble Research and Intelligence Labs (CRIL) have discovered an Android malware framework called MiningDropper, which is being used in various campaigns to distribute malicious payloads such as cryptocurrency miners, infostealers, Remote Access Trojans (RATs), and banking malware. Over 1,500 MiningDropper samples were detected in one month, with many showing minimal antivirus detection. MiningDropper operates as a multi-stage delivery framework that employs techniques like XOR-based obfuscation and AES encryption to evade detection. A recent variant uses a trojanized version of the Lumolight application as the initial infection vector, often spread through phishing links and fraudulent websites. The malware executes a series of stages, starting with decrypting an embedded asset and loading additional payloads, including a counterfeit Google Play update interface to deceive users. Two main campaign clusters have been identified: an infostealer campaign targeting Indian users by impersonating trusted entities, and a global campaign distributing the BTMOB RAT, which enables credential theft and device takeover. The final payload capabilities include extracting sensitive data, enabling full device compromise, facilitating financial fraud, and unauthorized cryptocurrency mining. MiningDropper's modularity allows it to adapt and scale across various campaigns while maintaining low detection rates.

AppWizard

April 14, 2026

Mirax RAT Targets Android Devices Through Meta Apps

Mirax is a remote access Trojan (RAT) targeting Android devices in Spanish-speaking countries, identified by Outpost24's KrakenLabs in early March. It propagates fraudulent advertisements on Meta-owned applications, allowing cybercriminals to gain initial access. Mirax can interact with compromised devices in real time, converting them into residential proxy nodes through ads on platforms like Facebook and Instagram. It uses SOCKS5 protocol and Yamux multiplexing to establish proxy channels and uncover victims' IP addresses. The malware captures keystrokes, steals sensitive data, executes commands, and monitors user activity. It employs overlay pages to steal credentials and orchestrates distribution through Meta ads and GitHub for malicious APK files. Users are tricked into enabling installations from "unknown sources," and the malware disguises itself behind video playback features. Additionally, a threat actor has been offering Mirax as a malware-as-a-service (MaaS) on illicit forums, with subscription prices starting at ,500 for three months. This service is described as highly controlled and exclusive, primarily targeting Russian-speaking actors in underground communities.