passwords Archives

Winsage

March 2, 2026

Still on Windows 10? That’s a security risk now

Microsoft Windows 11 Pro is available for .97, reduced from its regular price of 9, until March 8 at 11:59 P.M. Pacific. Windows 11 Pro includes enhanced security features such as TPM 2.0 support, BitLocker device encryption, Smart App Control, and Windows Sandbox. It also offers productivity tools like Hyper-V, Azure AD support, Snap layouts, and AI-assisted Copilot integration. Minimum system requirements for the upgrade include a 1 GHz or faster 64-bit processor, 4GB RAM, 64GB storage, UEFI firmware with Secure Boot, TPM 2.0, and DirectX 12 compatible graphics.

Winsage

March 2, 2026

RAT Malware Via Windows Explorer Puts Crypto at Risk

Cofense Intelligence reported that threat actors are exploiting Windows File Explorer and WebDAV servers to deliver Remote Access Trojans (RATs) to corporate systems, bypassing browser security measures. This method allows attackers to infiltrate machines without using web browsers, taking advantage of File Explorer's ability to connect to remote WebDAV servers. Despite WebDAV being deprecated by Microsoft in November 2023, it is still supported in Windows, creating a vulnerability. The campaigns began in February 2024, with a significant increase in September 2024, and 87% of these campaigns deliver multiple RATs, including XWorm, Async RAT, and DcRAT. Victims typically receive phishing emails disguised as invoices, containing URL or LNK shortcut files that initiate a WebDAV connection. The attacks often utilize Cloudflare Tunnel for hosting malicious WebDAV servers, making the traffic appear legitimate. Notably, 50% of affected campaigns are in German, while 30% are in English. The report emphasizes the risks posed to individuals holding digital assets, as RATs can access sensitive information, including crypto wallet files. Organizations are advised to monitor network traffic for Cloudflare Tunnel instances and educate users about the risks associated with File Explorer's capabilities.

Tech Optimizer

February 27, 2026

Fake Avast Website Steals Users’ Credit Card Information

A phishing scam is targeting French-speaking users in Europe by impersonating Avast antivirus software. Victims are lured to a fraudulent website that mimics Avast's official portal, where they are tricked into providing credit card details due to a fabricated €499.99 charge and promises of a refund. The scam uses realistic branding, dynamic JavaScript for urgency, and live chat features to collect personal information. Users are asked to select refund reasons and submit their personal details, after which they are prompted for credit card information. The scam employs the Luhn algorithm to validate card numbers and displays a fake confirmation message after data submission. Key red flags include dynamic dates, tight deadlines, requests for full card re-entry, and suspicious live chat interactions. Avast has warned users about these scams and encourages reporting to authorities.

Tech Optimizer

February 25, 2026

Effective ways to prevent the download of malicious code

Malware is malicious software designed to disrupt normal system operations, often infiltrating devices through activities like web browsing or opening documents. In 2023, SonicWall Capture Labs reported over 6 billion malware attacks, an 11% increase from the previous year. Common types of malware include viruses, worms, Trojans, spyware, adware, ransomware, fileless malware, and bots. Malware spreads through email attachments, phishing links, compromised websites, fake apps, and removable media. Its effects can include performance issues, data theft, and financial damage. Signs of malware presence include sluggish performance, unexpected crashes, and unauthorized changes. Recommended actions if malware is suspected include disconnecting the device, running a malware scan, and changing passwords. Preventative measures include using security software, practicing safe browsing, keeping software updated, and building security awareness.

Tech Optimizer

February 24, 2026

Hackers Are Using Fake Invitations to Take Over Your PC

Cybercriminals are sending counterfeit email invitations that, when clicked, install a backdoor on the victim's computer, allowing hackers full control. The scam often involves downloading a file named “invites.msi,” which is a Windows Installer package. This file can install ScreenConnect, a legitimate remote support tool that can be exploited by attackers to monitor screens, access files, and deploy additional malware. Many security engines fail to flag this software as malicious, making it difficult to detect. If someone suspects they have fallen victim to this scam, they should disconnect from the internet, check for and uninstall any remote management software, run a comprehensive antivirus scan, change passwords for critical accounts, enable two-factor authentication, inform their IT department if applicable, and consider performing a full Windows reset. The scam originated from a compromised email account, which was used to send the malicious link to contacts. Implementing two-factor authentication and using a password manager can help prevent such incidents. Users should be cautious of any email invitations that require downloading and running installer files.

Tech Optimizer

February 24, 2026

Fake Zoom meeting “update” silently installs surveillance software

A deceptive website, uswebzoomus[.]com/zoom/, poses as a Zoom meeting platform and installs surveillance software on Windows devices without user consent. The software is a covert version of Teramind, a commercial monitoring tool. The site creates a fake Zoom waiting room experience, complete with scripted participants and background audio, to trick users into downloading a malicious file named zoomagentx64s-i(_941afee582cc71135202939296679e229dd7cced) (1).msi. This file is preconfigured to connect to an attacker-controlled Teramind server and operates in stealth mode, leaving minimal traces on the device. The installation process collects information about the device and is designed to evade detection by security tools. If users suspect they have been affected, they are advised not to open the downloaded file, check for its installation, and change passwords from a clean device.

AppWizard

February 21, 2026

Unsecured AI apps are leaking personal data of Android users

Many unregulated or inadequately secured AI applications on platforms like the Google Play store pose significant privacy risks to users. A specific Android application, "Video AI Art Generator & Maker," linked to a data leak, compromised 1.5 million user images, over 385,000 videos, and millions of AI-generated media files due to a misconfiguration in a Google Cloud Storage bucket. Another app, IDMerit, exposed sensitive know-your-customer data from users in 25 countries, including full names, addresses, birthdates, IDs, and contact information, totaling a terabyte of data. Both developers addressed the vulnerabilities after being alerted by researchers. However, cybersecurity experts warn that lax security among AI applications is a widespread issue, with 72 percent of analyzed Google Play apps exhibiting security flaws, including the practice of "hardcoding secrets" in their source code.

Winsage

February 20, 2026

Facebook ads spread fake Windows 11 downloads that steal passwords and crypto wallets

Attackers are using social media advertising, specifically paid Facebook ads, to promote a malware campaign disguised as legitimate Microsoft promotions. They create near-exact replicas of the official Windows 11 download page to lure users into downloading malicious software. The deceptive domains used include ms-25h2-download[.]pro and ms-25h2-update[.]pro. The malware campaign employs geofencing to selectively target victims, redirecting security researchers to benign sites while delivering malware to unsuspecting users. The malicious file, named ms-update32.exe, is hosted on GitHub and mimics the size of a legitimate Windows installer. Once executed, it checks for monitoring tools and, if none are detected, installs an application named "Lunar" that collects sensitive data, including cryptocurrency wallet information. The malware maintains persistence by writing data to the Windows registry and employs various obfuscation techniques to evade detection. The attackers run parallel ad campaigns with different Facebook Pixel IDs to ensure continued operation even if one is suspended. Indicators of compromise include specific file hashes, domains, file system artifacts, and registry keys associated with the malware.

AppWizard

February 19, 2026

PromptSpy Android Malware Abuses Google Gemini to Automate Recent-Apps Persistence

Cybersecurity researchers have identified a new Android malware named PromptSpy that utilizes Google's Gemini AI chatbot to enhance its capabilities and persistence on infected devices. PromptSpy can capture lockscreen data, obstruct uninstallation, gather device information, take screenshots, and record screen activity. It integrates Gemini to analyze the current screen and provide instructions to keep the malware active in the recent apps list. The malware uses a hard-coded AI model and communicates with a command-and-control server via the VNC protocol, allowing remote access to the victim's device. It is financially motivated, targeting users in Argentina, and was developed in a Chinese-speaking environment. PromptSpy is distributed through a dedicated website and is considered an advanced version of a previously unidentified malware called VNCSpy.

Tech Optimizer

February 19, 2026

Avast Antivirus in 2026: Still Worth Paying For on Windows and Mac?

Ransomware is evolving, and many users in the United States continue to invest in Avast Antivirus as of 2026. Avast, now part of Gen Digital, has shifted from a traditional free antivirus to a comprehensive consumer security suite, which includes three tiers: Avast Free Antivirus, Avast Premium Security, and Avast One. The product lineup features a core antivirus engine, ransomware and phishing protection, a firewall, Wi-Fi inspector, built-in VPN, and performance cleanup tools. Avast's core antivirus engine provides real-time file scanning and web/email shields, consistently ranking high in independent lab tests for malware protection. The ransomware shield protects sensitive folders from unauthorized encryption, while the firewall and Wi-Fi inspector are available in paid tiers. The built-in VPN is designed for safer public Wi-Fi use, and performance tools aim to optimize system efficiency. Pricing for Avast products in the US varies, with a free tier supported by upsell prompts for premium features, Premium Security typically offered as an annual subscription, and Avast One marketed as a higher-value bundle. Renewal pricing often increases significantly after the first year, leading to user complaints. Microsoft Defender is now effective enough that many experts believe average users may not need third-party antivirus software, but Avast justifies its subscription by offering stronger web protection, more control over app permissions, and additional non-security features. User feedback highlights strong protection but frequent upsell prompts, performance issues on low-end machines, and concerns over past data collection practices. Avast is seen as valuable for households with mixed tech literacy, remote workers, students on older hardware, and users seeking basic privacy protections.