overlays Archives

AppWizard

September 23, 2026

RatHat Android Malware Uses AI to Target Banking Credentials in Real Time

A newly identified strain of Android malware, RatHat, utilizes generative AI to manipulate infected devices in real time. It is linked to threat actors believed to be operating out of China. RatHat serializes the device’s live Accessibility tree into XML format and communicates with a generative AI assistant to return screen coordinates, identify text, and issue navigation commands. The malware employs WebView-based HTML overlays to capture login credentials from banking and cryptocurrency applications and can infiltrate payment apps like WeChat and Alipay to extract PINs. It also features an SMS receiver and notification listener to intercept OTPs and 2FA codes. RatHat is disseminated through smishing, malvertising campaigns, and misleading third-party forums. It employs anti-analysis techniques such as container tampering, manifest bombing, DEX bytecode poisoning, string encryption, and anti-debugging. Once installed, it gains Accessibility access, activates Developer Options, and enables Wireless Debugging, allowing it to connect to the device's local ADB service and launch control agents with shell-level privileges. The malware captures raw touch coordinates to reconstruct PINs and unlock patterns, bypassing screenshot protections. It also includes persistence mechanisms that prevent uninstallation by presenting a fake Google Play failure overlay and automatically reinstalling itself if removed.

AppWizard

September 22, 2026

RatHat is a new Android malware that records your screen touches to steal passwords

Cybersecurity researchers at Zimperium have identified a new strain of malware called RatHat, targeting Android devices and linked to threat actors from China. RatHat uses generative AI to maintain persistence and control over infected devices. The malware is typically spread through social engineering, tricking users into downloading counterfeit applications that appear legitimate. Once installed, RatHat requests accessibility permissions, activates Wireless Debugging, and can capture text messages, create overlays, and steal passwords and multi-factor authentication codes. Its AI capabilities allow it to navigate the device interface in real-time, making detection by security software more difficult. To protect against RatHat, users should avoid downloading apps from untrustworthy sources, and removal requires a factory reset of the device.

AppWizard

September 19, 2026

New RatHat Android Malware Uses AI to Steal Banking Logins, PINs and OTP Codes

Security researchers have identified an Android banking Trojan named RatHat, which utilizes artificial intelligence, accessibility features, and Android Debug Bridge (ADB) to steal financial credentials, PINs, and one-time passcodes. Unlike traditional malware, RatHat employs a live AI assistant that interacts with the Android accessibility tree, allowing it to make real-time decisions based on the victim's screen content. The infection typically starts with social-engineering tactics, leading victims to counterfeit download pages where they are tricked into sideloading a malicious APK. Once installed, RatHat prompts users to enable Android Accessibility Service permissions, which it exploits to navigate Developer Options and enable Wireless Debugging. This grants it shell-level ADB access, allowing it to bypass application sandbox restrictions. RatHat deploys two native binaries for executing commands and maintaining a connection to the attacker's infrastructure. It targets banking applications through credential-stealing overlays and can intercept SMS messages for transaction verification codes. Additionally, it can record touch coordinates to reconstruct PINs and unlock patterns. RatHat includes persistence mechanisms to restore itself after removal, and users are advised to perform a factory reset if they suspect compromise. To reduce infection risk, users should avoid sideloading apps from unknown links, deny unnecessary Accessibility Service requests, and refrain from enabling Developer Options or Wireless Debugging for unfamiliar applications.

Winsage

September 17, 2026

Microsoft Azure CTO used AI to port 20-year-old Windows tool to macOS in two days: “I was flabbergasted”

Mark Russinovich, the Chief Technology Officer of Microsoft Azure, transitioned ZoomIt, a Windows tool for screen zooming, recording, and annotation, to macOS using artificial intelligence. Originally developed to aid in teaching Windows Internals, ZoomIt has been enhanced over the years with features like screen recording and webcam overlays. Despite initial reluctance due to time constraints, Russinovich utilized AI to create a functional macOS version in just two days, significantly faster than anticipated. The AI model leveraged the original Windows code, allowing for a high-fidelity clone of ZoomIt that includes essential features. ZoomIt for macOS is now available as a free and open-source tool, requiring macOS 14 Sonoma or newer, and can be installed via Homebrew or from Microsoft’s GitHub repository. Users can access its functionalities through keyboard shortcuts and a menu bar icon.

AppWizard

September 12, 2026

New Android Ransomware Records Screens, Steals OTPs and Secretly Takes Photos of Victims

A newly identified malware threat in the Android ecosystem, named Mantax Otax, combines ransomware with espionage capabilities. It targets users who install applications from untrustworthy sources, often through messaging apps or phishing attempts. The malware is linked to Indonesian cybercriminals and can steal sensitive information such as SMS one-time passwords, chat histories, and lock-screen PINs, facilitating account takeovers. Mantax Otax requests device-administrator rights and seeks access to SMS messages, contacts, and media files. It encrypts files on devices running Android 9 and earlier using AES encryption and demands a ransom for recovery. Although the impact is reduced on Android 10 and later due to Scoped Storage, the malware still poses significant surveillance risks. The malware collects extensive sensitive data, including contacts, call logs, and location data, and targets multi-factor authentication codes. It uses a deceptive system-lock overlay to capture PINs and has introduced features like WebSocket communications and disruptive pop-ups in its second iteration. Users are advised to be cautious when installing applications, avoid unsolicited APKs, and reject permissions that do not align with an app's purpose. In case of suspicious activity, users should disconnect from networks and seek help before entering sensitive information. Organizations should monitor for signs of this malware on managed devices.

AppWizard

September 10, 2026

Steam’s latest beta brings ‘Big Art’ to Big Picture Mode and Steam Deck, and customizable screensavers too

The latest beta release of the Steam client includes several enhancements, particularly the new "Big Art Mode," which changes the home screen to display large artwork from games against a simplified backdrop. This mode reduces the size of the carousel for recently played games, creating a more spacious layout. The update also introduces a screensaver feature with options for a game art slideshow or a retro bouncing logo, along with the ability to load custom screensavers. Additional improvements include enhanced startup performance, bug fixes, improved game recording stability, in-game overlay fixes, better Steam Input performance, Linux support enhancements, and adjustments to Remote Play, such as removing the PIN requirement for app downloads. Users can access the beta through the Steam settings menu.

AppWizard

September 10, 2026

Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks

The Gigabud banking trojan installs a secondary Android application called Vwork, which creates a work profile on compromised devices to evade detection from banking app security measures. This work profile separates its contents from the personal space of the device, allowing fraudulent transactions without triggering alerts. Group-IB confirmed this operational chain in Indonesia, where Gigabud has been active since 2022 and is linked to the GoldFactory group, which uses deceptive tactics to distribute the trojan. Vwork simplifies the creation of a work profile and communicates with an external server for authorization before cloning apps. The report indicates that Vwork has been detected in various countries, while approximately 1,469 devices and 1,281 logins were compromised in Indonesia, leading to estimated losses of around ,000,000. Users can check for a work profile in their phone's settings and are advised to download apps only from official stores and to deny unnecessary Accessibility access.

AppWizard

September 10, 2026

Fix: Embark Game Boot Fatal Error (Detected Software) ARC Raiders

ARC Raiders players may face issues launching the game due to the Embark Game Boot halting unexpectedly because of a fatal error. Two main error messages can occur: "Detected Software," indicating that the anti-cheat system has identified a disallowed process, and "Failed to install EasyAntiCheat," which suggests that the EAC service or driver could not be initialized. The first error can be triggered by an AutoHotkey-based utility, while the second may arise from a locked EAC file, another anti-cheat process, or an incomplete installation of the service. If players reach the menu but experience crashes, they should consult the ARC Raiders crashing and freezing guide for troubleshooting steps related to the Embark Game Boot or Easy Anti-Cheat. Specific error messages and their solutions include: - "Detected Software or Cheat Software Detected": Close the named process. - "Failed to install EasyAntiCheat or EAC is not installed": Run EAC uninstall and install scripts. - "Error 30005 or CreateFile failed with 32": Restart Windows to unlock the EAC file. - "Maximum simultaneous game instances reached": Close other games and anti-cheat processes. - "An ARAV code names AutoHotkey, an auto-clicker, Cheat Engine, a VM, or another tool": Stop the named program. - "An ARAV code ending in 005, 006, or 007": Verify the game installation in Steam. To resolve issues: 1. Check and close the program named by Embark Game Boot. 2. Repair Easy Anti-Cheat from the ARC Raiders Installer Folder. 3. Verify the ARC Raiders installation in Steam. 4. Reinstall ARC Raiders if previous steps fail, and provide detailed error information to Embark Support if issues persist. Players should ensure that any flagged processes are closed before attempting to launch the game or reinstall it.

AppWizard

August 23, 2026

Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices

A new Android malware threat, codenamed Manic, poses significant risks to Ukrainian banks, government services, and messaging applications, with a reach extending to Russian and European financial institutions, global fintech platforms, cryptocurrency services, and military communication channels. Manic combines Android banking malware and mobile spyware, targeting sensitive applications and enabling comprehensive device takeover. It features a novel Wi-Fi mesh technique for data relay through compromised devices and utilizes phishing sites and dropper apps. The malware originated in February 2026, with initial development leading to its first deployment by late May. It monitors 169 package IDs related to banks, payment services, and messaging applications, primarily affecting Ukrainian targets but also impacting applications in Russia and Europe. Manic can infiltrate commercial and military messaging apps, track locations, monitor notifications, and collect files. It exploits Android's accessibility services to capture sensitive data and employs a store-and-forward relay mechanism for data exfiltration through nearby compromised devices. Google has stated that no apps containing this malware are found on Google Play, and Android users are protected by Google Play Protect.

Winsage

August 10, 2026

Windows 11’s built-in weather app hogs more than 1.2 gigabytes of RAM just to tell the forecast — memory-sucking web wrapper filled with ads masquerades as an actual application

Microsoft is addressing issues related to user dissatisfaction with its Windows operating system, which has faced criticism for lack of optimization, excessive bloat, and intrusive advertisements. The built-in weather application, MSN Weather, exemplifies these problems, consuming up to 1.2GB of RAM while idling and displaying ads despite being part of a paid OS. In contrast, Apple's macOS weather app uses about 250MB of memory and operates ad-free. MSN Weather functions as a web wrapper, utilizing eight Chromium-based subprocesses, which raises concerns about its efficiency. Microsoft plans to update all native Windows applications to the Win32 standard for better optimization, but it is unclear if this will also apply to MSN-branded services like MSN Weather. Users have shown a preference for mobile devices over the weather widget introduced in Windows 11.