operators Archives

AppWizard

July 1, 2026

Kalshi Challenges Illinois Sports Betting Tax as Prediction Market Jurisdiction Fight Escalates

Kalshi has filed a federal lawsuit against the state of Illinois, challenging a law that imposes taxes and licensing requirements on sports-related trades in prediction markets. The lawsuit questions whether contracts traded on Kalshi's federally regulated exchange are classified as sports bets under state laws or as financial derivatives overseen by the Commodity Futures Trading Commission (CFTC). Illinois law categorizes prediction market operators as sports wagering businesses, imposing a 1.75% tax on the first five million sports wagers annually, increasing to 3.5% for wagers above that threshold, along with a costly licensing requirement. Kalshi argues that these state requirements are preempted by federal law and contends that its offerings are financial instruments, not traditional wagers. The dispute reflects a broader conflict between federal and state regulators regarding jurisdiction over prediction markets, with the CFTC previously filing a lawsuit against Illinois over similar regulatory issues. The outcome of this legal battle could have implications for the regulation of prediction contracts related to various events beyond sports.

Winsage

June 27, 2026

New Millenium RAT version infects 62,000 Windows systems worldwide

A significant evolution of the Millenium remote access trojan (RAT) has impacted over 62,000 Windows devices across more than 160 countries. The latest version, 4.*, marks a departure from previous .NET-based versions and is attributed to a threat cluster known as Y2K Operators, with the creator identified as “ShinyEnigma.” There are 62,289 infected endpoints, with 39,730 infections occurring in the first quarter of 2026. The RAT is marketed as malware-as-a-service (MaaS) and promoted through underground forums and platforms like GitHub, with accessible pricing. Millenium RAT 4 is developed in native C++ and uses the Telegram Bot API for command-and-control communications. Its capabilities include stealing browser data, collecting system information, logging keystrokes, capturing screenshots and audio, accessing Telegram and Discord data, downloading additional payloads, and executing Windows or PowerShell commands. The malware ensures persistence by replicating itself in the %APPDATA% directory and creating an autorun registry entry. The malware is distributed through social engineering tactics such as cracked software, cryptocurrency utilities, hacking toolkits, OSINT tools, exploit builders, and Roblox-related cheats. Some campaigns have trojanized malware builders, infecting cybercriminals. One campaign used PDF-themed lures with a malicious Windows shortcut to download the RAT while displaying a legitimate document. Payloads often use filenames associated with Windows components or security software to blend into infected systems. Group-IB recommends avoiding untrusted executables, applying security updates, enabling multi-factor authentication, and monitoring for unusual autorun registry entries.

BetaBeacon

June 25, 2026

Google Play Store Fees Will be Lowered Thanks to Epic Games Lawsuit, Settlement

Google Play Store fees are getting lower starting on June 30, with the service fee starting at 10% on the first million in annual earnings. Developers using Google Play's billing system will pay an additional 5% billing fee. The changes are a result of Epic Games' lawsuit against Google, which required the company to make structural changes to its Play Store operations. Apple also made changes to its App Store policies following a lawsuit from Epic.

Tech Optimizer

June 22, 2026

The database that refused to die: How Postgres survived its own creators

Postgres, originally developed by Michael Stonebraker in the early 1980s, is an open-source database system that evolved from Ingres. It was designed to handle complex data types and introduced user-defined data types, operators, and functions, leading to the support for abstract data types (ADTs). The initial commercialization of Postgres occurred through a startup named Illustra, later acquired by Informix. In 1995, graduate students Andrew Yu and Jolly Chen revived Postgres, transitioning it from QUEL to SQL, resulting in Postgre95, which evolved into PostgreSQL. Today, Postgres is one of the most popular database systems globally, known for its extensibility and high code quality. However, it currently lacks features like file-level encryption (TDE), which are standard in commercial systems, relying instead on the operating system for encryption. Efforts to implement TDE have faced challenges due to the complexity of required code changes.

Tech Optimizer

June 19, 2026

Looking Ahead to Postgres 19

Postgres has introduced new functionalities, including UPDATE and DELETE FOR PORTION OF, enhancing temporal use cases. The expansion of RANDOM() temporal functions is attributed to Paul Ramsey and Greg Sabino Mullane. Version 19 includes performance improvements in the planner and executor components, with contributions from Tom Lane. Key enhancements include refinements in anti-joins and semi-joins, constant folding optimizations, incremental sorting with append paths, enhanced aggregate processing prior to joins, improved join selectivity computation, and more comprehensive function statistics. These changes allow Postgres to better understand query structures, reducing unnecessary processing. The visibility of memoization in EXPLAIN has improved, sort performance has benefited from radix sort, and foreign key constraint checks have become faster. The COPY FROM command can now utilize SIMD instructions. Postgres 19 offers a range of improvements for application developers, operators, performance enthusiasts, and those building on Postgres, including enhanced graph queries, refined SQL syntax, improved window functions, better upsert behavior, REPACK CONCURRENTLY, advancements in autovacuum, improved monitoring capabilities, and new hooks. The release is still in beta, providing an opportunity for testing applications, migration, extensions, execution plans, and maintenance workflows.

Tech Optimizer

June 18, 2026

Announcing Lakebase Search: agent-native retrieval built into Lakebase Postgres

Lakebase Search is a hybrid vector and full-text retrieval system integrated into Lakebase, now in beta on AWS and Azure. It utilizes two Postgres extensions: lakebase_vector and lakebase_text, allowing agents to operate on a single data backend. Agents manage four times more databases than human users and require real-time access to indexed data. The system features a tiered architecture that stores cold data in cost-effective object storage while keeping active data in local NVMe, significantly reducing costs. The lakebase_vector extension offers 32x compression for vectors, allowing a billion vectors to fit into under 10GB of RAM. The lakebase_text extension provides BM25 relevance ranking without high RAM usage. Benchmarking shows that Lakebase Search can efficiently handle large-scale workloads, achieving high recall and low latency with reduced resource requirements compared to traditional architectures. The system allows for continuous search experimentation and dedicated retrieval engines for each agent, enhancing operational efficiency and scalability.

Winsage

June 17, 2026

Windows SprySOCKS Malware: Advanced Kernel-Level Rootkit Targets Government Organizations via Supply Chain Vulnerabilities

The Windows variant of SprySOCKS malware, developed by the Chinese threat group Earth Lusca, targets government entities globally and features advanced capabilities such as rootkit-level stealth and extensive command-and-control (C2) functionalities. It operates on Windows systems, utilizing two main variants: WINDRV, which includes kernel drivers for stealth operations, and WINPLUS, a streamlined backdoor. The malware can communicate over TCP, UDP, and WebSocket, offering over 30 C2 commands for various operations, including system information gathering and keystroke logging. WINDRV loads a driver named ‘RawWNPF’ into memory using another signed kernel driver, allowing it to conceal processes and achieve persistence. The malware's design incorporates open-source elements and exploits vulnerabilities in the software supply chain, notably using a leaked certificate for driver signing. To combat SprySOCKS, organizations are advised to implement advanced endpoint detection and response (EDR) solutions, maintain regular patching, and manage supply chain risks vigilantly. The malware's adaptability and reliance on legitimate certificates complicate detection efforts, necessitating continuous refinement of security practices.

AppWizard

June 16, 2026

New Rokarolla Android malware targets 217 banking, crypto apps

A new Android banking trojan named Rokarolla targets 217 banking and cryptocurrency applications and features 137 commands for malicious activities. It is distributed via deceptive websites posing as legitimate application sources and impersonates Google Play Protect to lure users into installing infected apps. Once installed, it seeks Accessibility service permissions and access to notifications, SMS, and calls. Rokarolla communicates with a command-and-control server, sending device profiles to generate unique identifiers for victims. Its primary goal is to steal financial information by using deceptive login overlays to capture sensitive data and maintain control over the device. The malware employs evasion tactics such as disabling Google Play Protect, hiding its icon, silencing notifications, and keeping the screen awake. It can steal SMS messages, extract contacts, capture keystrokes, record screen content, manipulate clipboard contents, block calls, and take screenshots. Zimperium confirms that Rokarolla is not found on Google Play, and users are advised to avoid downloading APK files from untrusted sources and to be cautious with Accessibility permissions.

AppWizard

June 16, 2026

New Rokarolla Android Malware Steals PINs, SMS Codes, and Crypto Wallet Funds

Security researchers at Zimperium's zLabs have identified a new Android banking trojan named Rokarolla, which can target 217 banking and cryptocurrency applications and execute 137 remote commands. The malware spreads through deceptive websites that impersonate popular apps, installing a dropper that mimics Google Play Protect to gain Accessibility access. It uses overlay techniques to capture sensitive information by displaying counterfeit login pages and can intercept SMS messages, including one-time codes from banks. Rokarolla also features a keylogger, screen logger, and can rewrite clipboard contents to divert cryptocurrency payments. It employs advanced methods for discreet data capture and has multiple fallback command-and-control domains, making it resilient against takedowns. There is no patch available for this malware, and users are advised to install apps only from Google Play and remain cautious of unexpected Accessibility requests. Zimperium's products can detect this malware, and indicators of compromise are available on their GitHub repository.

Winsage

June 16, 2026

China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth

Cybersecurity researchers have identified two new Windows variants of the SprySOCKS backdoor, named WINDRV and WINPLUS, which were previously thought to be exclusive to Linux systems. Both variants feature hard-coded command-and-control configurations and can communicate via TCP, UDP, and WebSocket protocols. They support over 30 commands for operations such as system information collection and file management. WINDRV employs kernel drivers for stealth, obscuring network connections and allowing TCP traffic diversion. SprySOCKS was first documented by Trend Micro in September 2023, linked to the Chinese state-sponsored threat actor Earth Lusca, also known as FishMonger. The Windows variants belong to version 1.8 of SprySOCKS and utilize a kernel driver named RawWNPF for enhanced stealth. The attack chain begins with an initial access method that drops a batch script, leading to the installation of the backdoor. Evidence suggests these variants may have been used in attacks against government organizations in Honduras, Taiwan, Thailand, and Pakistan between 2023 and 2024. The WINPLUS variant was first detected in July 2024 in Pakistan. There are indications of a potential UEFI bootkit involvement exploiting CVE-2023-24932, a vulnerability in the Windows Boot Manager.