NewApp Digest
search bot

Operation

Hackers Used Hugging Face to Distribute Android Banking Trojans
Tech Optimizer
February 11, 2026

Hackers Used Hugging Face to Distribute Android Banking Trojans

Cybersecurity researchers have identified a malware campaign that exploited Hugging Face's AI infrastructure to distribute Android banking trojans. The attackers used a deceptive app called TrustBastion, which tricked users into installing what appeared to be legitimate security software. Upon installation, the app redirected users to an encrypted endpoint that linked to Hugging Face repositories, allowing the malware to evade traditional security measures. The campaign generated new malware variants every 15 minutes, resulting in over 6,000 commits in about 29 days. It infected thousands of victims globally, particularly in regions with high smartphone banking usage but lower mobile security awareness. The operation is believed to be linked to an established cybercriminal group. Security experts warn that this incident highlights vulnerabilities in trusted platforms and calls for improved security measures, including behavioral analysis systems and verification of application authenticity. The incident has also sparked discussions about the need for enhanced security protocols for AI platforms.
Microsoft tightens Windows security with app transparency and user consent
Winsage
February 11, 2026

Microsoft tightens Windows security with app transparency and user consent

Microsoft is enhancing the security of its Windows operating system through two initiatives: User Transparency and Consent, and Windows Baseline Security Mode. The User Transparency and Consent initiative will notify users when applications request access to sensitive resources and log every permission granted, allowing users to review and modify their choices. Applications and AI agents will adhere to higher transparency standards. Windows Baseline Security Mode will enable runtime integrity safeguards by default, allowing only properly signed applications, services, and drivers to run. Users and IT administrators can approve exceptions for specific applications. These updates are part of Microsoft’s Secure Future Initiative, which aims to help organizations prevent, manage, and recover from security incidents. The rollout will occur in phases, with collaboration from developers, enterprises, and partners to ensure a smooth transition.
Researchers Use Windows Minifilter Drivers to Detect Ransomware in Real Time
Tech Optimizer
February 10, 2026

Researchers Use Windows Minifilter Drivers to Detect Ransomware in Real Time

A security researcher has developed a proof-of-concept tool called Sanctum, available on GitHub, aimed at combating ransomware within the Windows operating system. Sanctum utilizes a Windows feature known as a "filter driver" to monitor file operations at a strategic chokepoint between applications and the hard drive. It employs two primary callbacks: IRPMJCREATE, which detects rapid file write or delete requests indicative of ransomware activity, and IRPMJSET_INFORMATION, which identifies changes in file metadata, such as renaming with malicious extensions. Upon detecting suspicious activity, Sanctum blocks the action and identifies the source of the threat, logging events for security teams. Future enhancements may include real-time encryption detection and the ability to freeze malicious threads. This kernel-level approach offers greater visibility and speed compared to traditional antivirus solutions.
4 Free Android Launchers That Users Swear By
AppWizard
February 1, 2026

4 Free Android Launchers That Users Swear By

Square Home offers grid-based menus for mobile customization, allowing users to organize essential apps and widgets conveniently. It enables quick transitions between apps like WhatsApp and social networks without scrolling through screens. Total Launcher provides extensive customization options, allowing users to reposition icons and widgets, modify fonts, and create unique interfaces, though it has a steeper learning curve. It includes a backup tool for saving and sharing custom setups. Kvaesitso focuses on search functionality, enabling users to access apps via a global search feature, streamlining interactions, and is available as an open-source project on GitHub. Niagara Launcher features a minimalist interface designed for one-handed operation, with an alphabetical scroll bar for easy app access and organization.
Google takes down an invisible network that was secretly using your phone's internet
AppWizard
January 31, 2026

Google takes down an invisible network that was secretly using your phone’s internet

Google has dismantled the IPIDEA residential proxy network, which had exploited millions of devices for cybercrime. This operation resulted in the liberation of approximately nine million Android devices and the removal of hundreds of compromised applications. IPIDEA's infrastructure was integrated into various software development kits (SDKs), allowing it to covertly enlist devices into its proxy pool. Google updated its Play Protect system to identify and eliminate affected applications and collaborated with partners to disrupt the network's underlying systems. The efforts led to a significant decrease in hijacked devices available for exploitation.
Microsoft Adds Centralized RDP Shortpath Control via GPO and Intune
Winsage
January 30, 2026

Microsoft Adds Centralized RDP Shortpath Control via GPO and Intune

Microsoft has enhanced the management of Remote Desktop Protocol (RDP) Shortpath, now available through Group Policy Objects (GPO) and Microsoft Intune, allowing IT teams to implement centralized control over RDP Shortpath behavior across Azure Virtual Desktop (AVD) session hosts and Windows 365 Cloud PCs. RDP Shortpath improves performance and reliability by establishing a direct, UDP-based network connection, reducing latency and enhancing responsiveness for audio and video applications. Prior to this update, managing RDP Shortpath was fragmented, requiring manual adjustments on individual session hosts, which complicated consistent networking behavior. The new centralized configuration allows administrators to enforce Shortpath settings uniformly, reducing administrative overhead and ensuring consistent performance and security controls. Administrators can manage RDP Shortpath settings centrally, control all Shortpath modes, and ensure compatibility with AVD host pool settings. Effective operation of RDP Shortpath requires appropriate network conditions, and policy changes necessitate a restart of session hosts or Cloud PCs.
Centre cracks down on Android scam; blocks fraud app, Telegram channels, warns users
AppWizard
January 30, 2026

Centre cracks down on Android scam; blocks fraud app, Telegram channels, warns users

The Indian government has taken action against the Wingo app, a cyber fraud network that sent fraudulent SMS messages from users' devices without consent. The app's digital infrastructure has been blocked, and four associated Telegram channels with 153,000 users have been shut down. Over 53 related videos have been removed from YouTube. The Wingo app lured users with promises of quick financial gains, encouraging them to deposit funds for minor tasks or investments, but then either shut down or blocked accounts after receiving money. Payments were made through UPI or personal wallets, complicating traceability. Users were asked for access to personal data and provided with fake customer care numbers. Android users are advised to avoid apps promising guaranteed profits, verify app legitimacy, and refrain from granting unnecessary permissions. The government recommends uninstalling suspicious apps and reporting them, as well as contacting the cybercrime helpline at 1930 for assistance.
When Digital Guardians Turn Rogue: Inside the Avast Antivirus Supply Chain Attack That Exposed Millions
Tech Optimizer
January 30, 2026

When Digital Guardians Turn Rogue: Inside the Avast Antivirus Supply Chain Attack That Exposed Millions

Avast's automatic update system was compromised, allowing malicious code to be distributed through its official channels, affecting potentially millions of users. This breach is characterized as a sophisticated supply chain attack, which exploited the software update mechanism, making it difficult to detect as the malware appeared legitimate. Security analysts noted a 300% increase in supply chain attacks over the past three years, with this incident highlighting vulnerabilities in security solutions. Avast has initiated an incident response, revoked compromised digital certificates, and is collaborating with cybersecurity firms to address the breach. European regulators have begun inquiries into Avast's data protection measures, and legal experts anticipate class-action lawsuits from affected users. The incident underscores a trend of attackers targeting security infrastructure itself, prompting calls for improved software distribution security and industry-wide standards.
Chrome will borrow Gemini's cross-app powers in upcoming agentic upgrade
AppWizard
January 28, 2026

Chrome will borrow Gemini’s cross-app powers in upcoming agentic upgrade

Google Chrome is set to introduce a significant upgrade with a feature called Gemini, which will enhance user experience through "Personal Intelligence." This feature will allow users to access information from various Google apps directly within the browser and perform tasks autonomously, such as clicking links and typing. Personal Intelligence has already been rolled out in mobile applications and will be integrated into Chrome to provide tailored responses by synthesizing context from multiple Google apps. Users will be able to draft emails in Gmail using information from web pages without switching windows. Personal Intelligence will be an opt-in feature, allowing users to control their data connections. The enhancements will initially be available on desktop versions of Chrome, with previews for Google AI Pro and Ultra users in the U.S. expected in the coming months.
Search