obfuscation Archives

AppWizard

August 14, 2026

I tested an Android app that lets anyone fight censorship – and shows your impact in real time

Snowflake Volunteer is a newly launched Android app available on the Google Play Store, created by the Tor Project, that allows users to contribute to internet freedom by transforming their smartphones into proxies for the Tor Network. It is a collaboration between Bloco, the Tor Network, and Guardian Project, building on the original Snowflake initiative from 2019. The app connects users needing access to the Tor Network, particularly in regions with heavy internet restrictions, by simulating user traffic as a video call via WebRTC and using dynamic proxies. Users can customize settings such as enabling/disabling the app, charging preferences, Wi-Fi operation, background operation, and connection limits. The app is open-source and available on both Google Play and F-Droid. Testing indicates that it does not significantly drain battery life, showing only a gradual decline over three hours with multiple connections. The app aims to enhance the robustness of the Snowflake network, making it harder for oppressive regimes to impose restrictions.

Winsage

August 14, 2026

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

CoolClient is a sophisticated backdoor family linked to the HoneyMyte APT group, actively used in cyber-espionage campaigns targeting organizations in Asia and Russia since its initial disclosure in 2022. It has capabilities such as keylogging, clipboard theft, credential harvesting, and system reconnaissance. Investigations in 2023 revealed enhancements, including clipboard theft and HTTP traffic interception. By late 2025 and into 2026, a variant was noted that could deploy a signed kernel-mode driver as a Windows service, improving its stealth and operational capabilities. In a recent campaign targeting Myanmar, the HoneyMyte group used PlugX to deploy CoolClient components. They configured Microsoft Defender to exclude a fake Windows Defender installation directory and a renamed executable, defender.exe, to avoid detection. Persistence was achieved through a scheduled task that executed defender.exe with SYSTEM privileges at startup, which sideloaded the malicious libngs.dll to initiate the CoolClient execution chain. The latest CoolClient variant has a multi-stage execution chain, including: - defender.exe / Sang.exe: Exploited legitimate application for DLL sideloading. - libsrapc.dll: Benign dependency for the Sangfor application. - libngs.dll: First-stage loader that decrypts and loads the next stage. - loadcert.ini: Second-stage DLL implementing core functionalities. - cert.ini: Final-stage implant for command and control communication. - time.ini: Configuration file for CoolClient. The execution begins with the legitimate Sangfor application loading libngs.dll, which uses obfuscation to conceal its operations. The second stage, loadcert.ini, is injected into synchost.exe and performs tasks including persistence and process injection. The kernel-mode driver deployment routine involves decrypting time.ini, verifying privileges, and creating a service to execute the driver, enhancing stealth. The deployed kernel-mode driver, msagent.sys, is digitally signed and helps hide processes, files, and registry objects, making detection more difficult. The latest variant continues to target organizations consistent with previous HoneyMyte activities, with confirmed victims in Myanmar, Mongolia, Pakistan, and Russia, including government entities. The deployment of CoolClient as a secondary backdoor after a PlugX infection indicates a strategic approach to maintain access to compromised systems. The malware is confirmed as a new variant of CoolClient associated with the HoneyMyte threat group, with the kernel-mode driver marking a significant advancement in its capabilities.

AppWizard

August 4, 2026

DoubleVerify finds dozens of Android apps a month showing ads after calls

A recent analysis by DoubleVerify engineers has identified a trend in mobile advertising known as AfterCall ads, where applications display advertisements immediately after a phone call ends. This practice generates hundreds of millions of impressions monthly and raises concerns about user experience and brand integrity. AfterCall applications operate using three components: a misleading permission, a Broadcast Receiver to capture end-of-call events, and an Activity to display ads. The SYSTEMALERTWINDOW permission allows these apps to show content over others, often granted under false pretenses. They utilize Android's telephony system to trigger ads post-call and employ tactics to obscure their presence, such as removing themselves from the recent apps list and using innocuous icons. Detection is challenging due to the lack of shared codebases and the obfuscation techniques used. The scale of the issue is significant, with numerous AfterCall applications identified monthly, negatively impacting user experience and raising concerns for advertisers.

AppWizard

July 29, 2026

Minecraft Java Edition Now Demands 16GB RAM in First Hardware Overhaul in 17 Years

Mojang Studios has updated the system requirements for Minecraft: Java Edition for the first time in 17 years, raising the recommended memory to 16GB of RAM. The new minimum specifications include a 64-bit operating system, a quad-core CPU, a graphics card supporting Vulkan 1.3 API with at least 2GB of VRAM, and 8GB of system RAM for discrete GPUs or 12GB for integrated graphics. For the recommended "Fancy" preset, 16GB of system memory, a current-generation processor, and a graphics card with 6GB or more of VRAM are required. Older hardware may struggle to run the game, leading to low frame rates and visual issues. Mojang is transitioning from OpenGL to Vulkan to enhance game performance and visuals. Players can still use Minecraft: Bedrock Edition for lower system requirements or community optimization mods like Sodium to improve performance on less capable hardware.

AppWizard

July 23, 2026

ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories

GitHub will reject command-line support bundle uploads from outdated versions of GitHub Enterprise Server lacking security patches starting August 18, 2026. The npm package @copilot-mcp/apex has been identified as a post-install dropper that installs a macOS infostealer, phishing for sensitive information and maintaining a connection to an attacker's server. A rogue extension on the Microsoft Visual Studio Code marketplace, "Markdown All Pro," impersonates a legitimate tool and opens a backdoor after installation. A phishing campaign targeting Portuguese users delivers the Lampion banking malware, which has been active since 2019. DoubleVerify reports a rise in "AfterCall" apps that exploit user permissions for ad fraud. The GhostCommit attack method hides malicious instructions within PNG images in pull requests. The U.S. government has updated its advisory on Iranian-affiliated cyber activity targeting operational technology devices. An Android app posing as a civil defense alert system has been found to contain malware for data harvesting. An Iranian threat actor is distributing MarkiRAT malware through fake applications. An analysis of 28 AI-coded applications revealed 434 vulnerabilities, prompting Cisco to introduce Antares to identify vulnerabilities in codebases. A Russian-speaking threat actor is dismantling guardrails on AI models to create offensive tools.

Tech Optimizer

June 6, 2026

Hackers Use Fake Purchase Orders to Deploy JS.MonoGlyphRAT Targeting US Enterprises

Researchers have identified a new malware called JS.MonoGlyphRAT, which disguises itself as business documents to infiltrate corporate networks. It is primarily spread through phishing emails targeting various sectors in the U.S. and has been reported in countries like Germany, Sweden, and Australia. The malware is classified as "Unknown malware" on threat intelligence platforms, making traditional antivirus solutions ineffective. It establishes a persistent presence in the network by executing a JavaScript file and communicating with command-and-control (C2) servers over HTTP. Key indicators of compromise include unusual HTTP traffic, registry changes, and the execution of specific JavaScript files. The malware can download additional payloads and execute commands without leaving traces on disk. Indicators of compromise include specific IP addresses, URLs, file hashes, and registry keys associated with the malware's operation.

Tech Optimizer

June 5, 2026

Microsoft quietly deletes Windows 11 guide that claimed you don’t need third-party antivirus

In April 2026, a blog post from Microsoft's Windows Learning Center claimed that most Windows 11 users could rely solely on Windows Security (Defender) for antivirus protection, citing features like Microsoft Defender Antivirus, SmartScreen, and ransomware mitigation. The blog was later removed without explanation, leading to speculation about its definitive claims. Microsoft stated that Windows Defender was sufficient for typical users with default settings and regular updates, while cautioning against using multiple antivirus engines. Independent testing from AV-Test consistently ranks Microsoft Defender highly, but AV-Comparatives noted limitations in offline protection and the reliance on cloud-based intelligence. The blog's removal was viewed by some as a constructive step towards realistic security guidance. Microsoft continues to provide third-party antivirus vendors with significant access to Windows, and the rise of AI-generated threats is complicating the cybersecurity landscape. Despite the controversies, Microsoft has made significant advancements in Windows Security, making it a viable option for many users.

AppWizard

May 29, 2026

Android App Security Essentials: How to Build Secure Mobile Applications

Mobile applications have transformed business operations and communication, becoming essential in various industries. As reliance on mobile technology increases, organizations face cybersecurity challenges such as malware, unauthorized access, data leaks, and phishing. This has led to a focus on Android app security, with businesses implementing advanced protection strategies. To address cybersecurity threats, modern Android applications require multiple security layers. Secure coding practices minimize vulnerabilities through structured frameworks, automated testing, and regular code reviews. Strong user authentication systems, including multi-factor authentication and biometric verification, protect against unauthorized access. Data encryption secures sensitive information during transmission and storage, helping organizations comply with data protection regulations. Malware attacks are a significant concern, prompting developers to implement anti-malware frameworks and application shielding technologies. To prevent reverse engineering, developers use code obfuscation and tamper detection systems. Managing mobile device permissions securely is crucial to protect sensitive user information. Emerging technologies, such as artificial intelligence, enhance mobile security by improving threat detection and response. DevSecOps integrates security practices into the development lifecycle, allowing for continuous vulnerability identification. Robust endpoint protection solutions monitor devices for malware and unauthorized access, supporting stronger cybersecurity governance across mobile ecosystems.

AppWizard

May 24, 2026

I’ve used the new Google Health app for a week, and I hate it

User feedback on the new Google Health app revealed mixed sentiments: 28% praised it as "gorgeous and so useful," 26% found it visually appealing but cumbersome, 10% appreciated its functionality but disliked the aesthetic, 20% expressed indifference, and 16% had not transitioned from Fitbit. The app's design features lengthy text explanations from the Google Health Coach that overshadow vital statistics, diminishing usability. The Fitness and Sleep tabs also exhibit design flaws, with excessive scrolling and text before essential metrics. Users cannot easily move tiles or customize the home screen, limiting visibility for health data. Suggested improvements include presenting metrics and graphs upfront, allowing tile customization, resizing the home screen tile section, prioritizing workouts in the Fitness tab, and displaying sleep statistics before interpretations in the Sleep tab.

AppWizard

May 20, 2026

Trapdoor Android Ad Fraud Scheme Hit 659 Million Daily Bid Requests Using 455 Apps

Cybersecurity researchers have identified an ad fraud and malvertising operation called Trapdoor, targeting Android users with 455 malicious applications and 183 command-and-control domains. Users often download these disguised apps, which initiate malvertising campaigns and lead to further downloads of malicious applications. At its peak, Trapdoor generated 659 million bid requests daily, with over 24 million downloads of the associated apps, primarily from the United States. The operation exploits install attribution tools to activate malicious activities only for users acquired through fraudulent ad campaigns, while suppressing such behavior for organic downloads. Trapdoor employs advanced evasion techniques, including obfuscation and impersonation of legitimate software, to avoid detection. Google has removed the identified malicious apps from the Play Store in response to the threat.