operators Archives

AppWizard

October 15, 2026

Hirudo Android malware replaces banking apps to evade security checks

Researchers have identified a new Android malware called Hirudo, which steals bank account credentials by replacing legitimate banking applications with modified versions that disable security checks. Hirudo impersonates at least seven banks in Indonesia and targets financial institutions in China, India, Mexico, Morocco, and Thailand. It is delivered through seemingly legitimate applications related to shopping, adult content, or short drama, which prompt users to grant permissions, including Accessibility services. Once installed, Hirudo uninstalls the genuine banking app, downloads a patched version, and uses Accessibility permissions to complete the installation. The malicious app retains nearly all of the original app's code but integrates a hooking engine based on open-source frameworks YAHFA and Dobby, employing evasion tactics such as substituting signing certificates, concealing Accessibility services, disabling screenshot protection, and altering key-attestation certificates. Despite its advanced capabilities, Hirudo has limitations, including a publicly leaked attestation keybox and compromised certificates flagged by Google. Once operational, it can extract sensitive information, stream the screen, access cameras, and use fake checkout pages to collect payment PINs while misleading victims with fabricated success messages. Hirudo represents an escalation in Android banking malware tactics, focusing on the security mechanisms of banking applications. Researchers recommend that banks enhance security measures and that Android users keep devices updated, avoid unofficial APK files, and conduct regular Play Protect scans.

Tech Optimizer

October 10, 2026

How and why we built Managed PostgreSQL for AI workloads

The Nebius Managed PostgreSQL team developed a solution for AI workloads using CloudNativePG and Kubernetes, resulting in improved backup and restore times by transitioning from Barman to WAL-G, reducing a 1.5 TB backup duration from over a day to two hours. Since its launch in 2025, the service supports hundreds of production clusters and manages tens of tebibytes of data. Key features include high availability, point-in-time recovery, automated failover, compressed and encrypted backups, rapid restoration, connection pooling, and strict synchronous replication for zero data loss. Kubernetes and CloudNativePG were chosen for their advantages, including out-of-the-box features and open-source distribution. Each cloud project has a separate MK8s cluster for customer isolation and security. Persistent data is stored on fault-tolerant SSD drives, enabling swift instance migration during failures. Regular physical backups are archived, allowing restoration within a seven-day window with a single click. The transition from Barman to WAL-G addressed slow backup and restoration times and resource control limitations. With WAL-G, backups and restorations for a 1.5 TB cluster improved to two hours and one hour, respectively. PgBouncer was implemented to manage database connections effectively, reducing connection storms during peak AI workload traffic. Two vector search extensions, pgvector and pgvectorscale, are available to cater to different memory and dataset needs. Benchmarking showed that Nebius performs competitively with AWS at a lower cost. The infrastructure integrates cloud engineering principles with specialized expertise to meet AI workload demands.

AppWizard

September 29, 2026

TNS Expands Android Terminal Platform with Bring Your Own App

Transaction Network Services (TNS) has launched a capability called Bring Your Own App (BYOA) for operators in the payment industry, allowing them to create and deploy customer-facing applications on TNS's Android-based unattended payment terminals. BYOA simplifies payment processing, compliance, and certification by managing card capture, PIN collection, encryption, EMV processing, and payment certification. Each operator's application must be approved and signed by TNS before execution on the terminal. This model enables operators to focus on enhancing customer experiences without the usual security and compliance burdens. BYOA is available across TNS's Android-based unattended payment terminal platform, including retail and fuel payment terminals.

AppWizard

September 28, 2026

RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims

The operators behind RatHat have created an advanced Android banking trojan that allows control of infected devices through a web console. Since April 2026, nearly 100 instances of this console have been identified, indicating a malware-as-a-service model. The console collects sensitive data from compromised phones, including text messages and passwords. It uses Google's Gemini AI to assess victims' bank balances, categorizing them into high-value and mid-value segments, but does not facilitate financial transactions. The malware has remained largely unchanged since late 2025, but the console has seen significant updates, leading to three new versions: BlackCat Remote Control Management, Panda Workshop V5, and V6. These versions serve as both control interfaces and build tools for creating and distributing malware. The latest version includes templates for deceptive download pages. RatHat infiltrates devices via text messages and online ads, requesting Accessibility access to read screens and simulate user interactions. This access allows the malware to activate wireless debugging and connect to the Android Debug Bridge (ADB), giving operators elevated privileges to execute commands. A Go program can be deployed to maintain control, even after the app is uninstalled. Cleafy has tracked console deployments through web code analysis, noting that many IP addresses originate from a Singapore-registered network. The initial console version allowed operators to choose AI providers, but the latest exclusively uses Gemini. RatHat also utilizes Gemini on infected devices to determine tap locations based on screen layouts. Cleafy has compiled indicators related to the consoles' command-and-control servers, download links, and malware samples, including specific domains, IP addresses, and MD5 hashes. The consoles often use web addresses starting with "admin." and inexpensive top-level domains. Security tools are advised to monitor processes running under the shell user on affected devices.

Tech Optimizer

September 28, 2026

Postgres Women India: Driving Diversity And Innovation In Open Source

Postgres Women India was launched in 2023 as a corporate social responsibility initiative under OpenSource DB, starting with 10 members and growing to over 2000 women across more than 70 countries. The community addresses the underrepresentation of women in open source and database conferences, aiming to empower, connect, and celebrate women in technology. Its core pillars include community building, nurturing future leaders, and advocating for education. The community organizes virtual and in-person meetups, mentorship programs, and collaborates with universities to enhance skills in database technologies. Key initiatives include a Career Connect Day, intensive upskill programs, and the Women for Data Summit. The community has recognized 18 women as ‘Postgres Women of the Month’ and highlighted emerging contributors. Partnerships with organizations like Google and YugaByteDB support its efforts, and it seeks further community involvement to establish local chapters and host events.

AppWizard

September 25, 2026

Call of Duty ‘cosmetic toggle’ will cleanse Warzone of its Party City aesthetic

Warzone has introduced a "cosmetic toggle" that allows players to disable legacy character skins at a client level, specifically for Warzone, while Modern Warfare 4 will not carry over any cosmetics from previous titles. This feature aims to address concerns about mismatched crossover skins and create a more cohesive gaming experience. The toggle is a response to previous commitments to avoid old skins, although collaborations have complicated this effort. Its effectiveness may diminish with the introduction of new characters in future seasons, and its future depends on Infinity Ward's commitment to aesthetic integrity and potential expansions of the toggle.

BetaBeacon

September 24, 2026

Best Mobile Casinos Australia 2026 – Play Safely on iOS & Android

- Wild Tokyo, Rolling Slots, Mino Casino, and Boho Casino are the best mobile casinos in Australia based on mobile performance, gameplay experience, payment efficiency, and overall usability.

Winsage

September 23, 2026

Cisco Talos Discloses Autonomous Windows Malware: Four AI Models Direct Each Attack

Cisco Talos has disclosed a new Windows implant called CLOSEDQUORUM, which operates without human operators by using four commercial large language models (LLMs) to autonomously decide on actions after deployment. The implant is a 16.4-megabyte executable that conducts reconnaissance on the target system and sends structured prompts to the LLMs, which respond with one of four actions: steal, inject, persist, or move. When the "steal" action is chosen, it simultaneously attacks three credential stores, extracting Windows credentials, browser passwords, and cryptocurrency wallet data. The "inject" action uses either Early Bird APC injection or process hollowing based on model recommendations. For persistence, it employs three overlapping mechanisms, including a Registry Run key, a scheduled task, and a WMI event subscription. To evade detection, CLOSEDQUORUM suppresses ETW telemetry and introduces delays before executing actions. It circumvents traditional command-and-control structures by calling legitimate API endpoints, making blocking these domains impractical. Talos introduced the CAIRN toolkit for detecting AI-integrated malware, which operates on metadata and employs rule-based detection. Unlike previous AI-assisted malware, CLOSEDQUORUM automates decision-making processes entirely, highlighting a significant evolution in malware capabilities. Security teams are advised to focus on behavioral detection strategies and utilize the YARA rule and CAIRN toolkit for identifying this threat.

Winsage

September 23, 2026

Cisco Talos Discloses Autonomous Windows Malware: Four AI Models Direct Each Attack

Cisco Talos has disclosed a Windows implant called CLOSEDQUORUM, which automates cyberattack execution using four advanced commercial large language models: DeepSeek, Qwen, Mistral, and Google Gemini. The implant is a 16.4-megabyte executable that conducts reconnaissance on the system and formats the gathered data into prompts for the AI models. Each model votes on one of four actions: steal, inject, persist, or move, with the action receiving the most votes being executed. When stealing, CLOSEDQUORUM targets three credential stores, dumping LSASS memory and retrieving saved passwords from browsers and cryptocurrency wallets. The stolen data is encrypted and sent to the operator via Discord. For injection, it uses Early Bird APC injection or process hollowing based on model responses. The persist action creates three mechanisms for longevity, including a Registry Run key, a scheduled task, and a WMI event subscription. CLOSEDQUORUM evades detection by suppressing ETW telemetry and delaying activity to avoid sandbox analyses. It connects to legitimate API endpoints, making blocking ineffective without disrupting enterprise applications. Talos recommends behavioral combination detection strategies and the use of a YARA rule for detection. The CAIRN toolkit has been introduced to detect AI-integrated malware without executing binaries. Unlike previous AI-assisted malware, CLOSEDQUORUM removes human decision-making from the attack process.

AppWizard

September 23, 2026

2026 Android Casino Tech: Flagship Real-Money Play

Global mobile gaming revenue reached .6 billion in 2024, with projections indicating it will surpass 0 billion by the close of 2026. By 2026, the average flagship Android device will have 12GB of RAM, enhancing slot loading times and live dealer streaming. A 120Hz refresh rate can reduce perceived input lag by approximately 40% compared to 60Hz panels. As of early 2026, mobile users constitute 61% of all online gambling traffic globally. High-end devices like Samsung’s Galaxy S26 Ultra and Google’s Pixel 10 Pro feature vapor chamber cooling for sustained gaming performance. The global luxury goods market reached .5 trillion in 2024, with 9% of that total spent on digital entertainment. Flagship devices with Snapdragon 8 Gen 4 chipsets deliver live dealer feeds in 1080p and provide OLED screens for enhanced visual quality. A 5,000mAh battery supports three-hour gaming sessions and can recharge to 60% in about 20 minutes. Understanding wagering requirements and game weighting is crucial for maximizing bonuses. Progressive web apps ensure reliable performance on unstable connections, while flagship devices offer hardware-level encryption and biometric authentication for security.