pasting Archives

Winsage

November 28, 2025

3 Windows frustrations Microsoft PowerToys finally fixed for me

Windows 11 has a sleek interface but comes with some quirks. Integrating Microsoft PowerToys can alleviate minor irritations and improve productivity. FancyZones allows users to create custom layouts for window management, enabling better organization of the desktop. PowerToys Peek lets users preview file contents in File Explorer using the shortcut Ctrl + Space, reducing the need to open multiple files. Advanced Paste enables pasting text as plain text or Markdown, helping maintain consistent formatting and eliminating issues with unwanted formatting from web content. PowerToys may not be necessary for users with basic computing needs, as the built-in features of Windows 11 might suffice. However, for daily users, the tools provided by PowerToys can enhance workflow and efficiency by addressing small annoyances that accumulate during multitasking.

Winsage

November 25, 2025

Attackers are Using Fake Windows Updates in ClickFix Scams

Threat actors have adapted the ClickFix attack model, using a fraudulent Windows Update screen to disguise malicious code. This screen mimics the legitimate Windows Update interface and prompts users to execute harmful commands. The execution of these commands leads to the installation of LummaC2 and Rhadamanthys info-stealing malware. A report from ESET noted a 500% increase in ClickFix attacks, which now account for nearly 8% of all blocked attacks in early 2025. Huntress researchers tracked ClickFix lures that used steganography to deliver LummaC2 and Rhadamanthys malware, concealing malicious software within image files. The attacks involve a full-screen display that instructs users not to turn off their computers, ultimately prompting them to paste a malicious command. The execution process includes using mshta.exe and PowerShell to load and inject malicious assemblies. European law enforcement recently dismantled infrastructure used by threat actors, but Rhadamanthys is no longer distributed through the fraudulent Windows Update campaign. The use of steganography helps these payloads evade detection while relying on victims to manually execute commands.

Winsage

November 25, 2025

ClickFix Attack Uses Steganography to Hide Malicious Code in Fake Windows Security Update Screen

A new wave of ClickFix attacks has emerged, using fake Windows Update screens and PNG image steganography to deploy infostealing malware like LummaC2 and Rhadamanthys. The attacks trick users into executing a command by pressing Win+R and pasting a command copied to their clipboard. Attackers have shifted from using “Human Verification” lures to more convincing full-screen fake Windows Update screens. The fake update prompts users to run a command that initiates mshta.exe with a URL containing a hex-encoded IP address, leading to the download of obfuscated PowerShell and .NET loaders. A notable feature of the campaign is the use of a .NET steganographic loader that hides shellcode within the pixel data of a PNG image, which is decrypted and reconstructed in memory. The shellcode is Donut-packed and injected into processes like explorer.exe using standard Windows APIs. Huntress has been monitoring these ClickFix clusters since early October, noting the use of the IP address 141.98.80[.]175 and various paths for the initial mshta.exe stage, with subsequent PowerShell stages hosted on domains linked to the same infrastructure. Despite the disruption of Rhadamanthys’ infrastructure in mid-November, active domains continue to serve the ClickFix lure, although the Rhadamanthys payload appears to be unavailable. To mitigate the attack, disabling the Windows Run box through Group Policy or registry settings is recommended, along with monitoring for suspicious activity involving explorer.exe. User education is critical, emphasizing that legitimate processes will not require pasting commands into the Run prompt. Analysts can check the RunMRU registry key to investigate potential ClickFix abuse.

Winsage

November 25, 2025

New ClickFix attacks use fake Windows Updates to swipe creds

A surge in ClickFix attacks is occurring, where attackers use deceptive Windows update screens to trick users into downloading infostealer malware. This method has become the primary means of initial access for cybercriminals, as reported by Microsoft. State-sponsored actors and organized crime groups are increasingly using this tactic. Huntress security experts have noted a shift from traditional prompts to convincing fake Windows update screens, showcasing the attackers' adaptability. Cyber adversaries are utilizing a steganographic loader to deliver infostealing malware like Rhadamanthys, encoding malicious code within PNG images to evade detection. Between September 29 and October 30, 2025, Huntress investigated 76 incidents linked to this campaign across various regions, with one incident involving the IP address 141.98.80[.]175. Victims typically visit a malicious site that triggers a full-screen blue Windows Update screen, leading them to install a “critical security update” through a series of commands. This process involves executing a command that runs PowerShell code to deploy a steganographic loader, ultimately leading to the installation of Rhadamanthys, which captures login credentials. Comments in the lure site's source code are in Russian, suggesting the attackers' identity remains unknown. As of November 19, multiple domains continue to host the lure page, although the payload is no longer actively hosted. Organizations can defend against these attacks by blocking access to the Windows Run box and educating employees about the ClickFix technique.

AppWizard

November 20, 2025

All active Where Winds Meet codes and how to redeem them

Players of Where Winds Meet can enhance their gaming experience by using active codes to unlock free currency and rewards, such as Echo Jade and Coins. Currently active codes include: - WWMGO1114: 100 x Echo Jade, 1 x Resonating Melody - WWM251115: 10 x Echo Jade, 5,000 Coins, 1 x Goose God Player Nameplate - WWMGLtiktok: 10 x Echo Jade, 10,000 Coins - WWMGLyoutube: 20 x Echo Jade, 5,000 Coins, 2 x Inner Way Note: Chest To redeem codes, players must complete the tutorial and engage in battle with the Void King. The redemption process involves selecting the cog icon, navigating to the "other" menu, and entering the code in the "Exchange Code" box. Rewards will be sent to the player's mailbox.

Winsage

November 8, 2025

Windows 11’s Phone Link is about to lose a handy feature

Microsoft is removing the Photos tab from the Phone Link app and redirecting users to access their photos through File Explorer in Windows 11. The File Explorer version offers better features, including multi-select, copy-paste, drag-and-drop, and video access. Users are being notified of this change and will need to enable mobile device access in File Explorer settings. The Phone Link app will be reduced from four tabs to three as a result of this transition. Users must enable the "Show mobile device in File Explorer" toggle in settings to ensure their Android phone appears in File Explorer.

Tech Optimizer

October 20, 2025

TikTok Videos Spread ClickFix Malware, Stealing User Credentials

Cybercriminals are increasingly using TikTok to spread malware through seemingly harmless videos that promise free software activations for applications like Windows, Spotify, or Netflix. These videos employ a technique called ClickFix, which tricks users into executing harmful PowerShell commands that install infostealers, compromising sensitive information such as login credentials and financial data. The malware can self-compile on the victim's device, making it harder to detect. Reports indicate a shift in these tactics from platforms like YouTube and Meta to TikTok, with over 30,000 websites compromised in related DNS malware campaigns. Artificial intelligence is also being used to create deceptive videos that resemble legitimate content, complicating the identification of malicious material. Android users face similar threats from apps impersonating popular services, such as WhatsApp or TikTok. Experts recommend enabling two-factor authentication, using reputable antivirus software, avoiding unverified commands, and adjusting privacy settings on TikTok to mitigate these risks.

Winsage

October 15, 2025

12 features coming during first half of October on Windows 11 Insiders

Microsoft is enhancing Windows 11 in October 2025 through the Windows Insider Program, releasing several notable features and improvements. Key updates include: 1. An updated Settings app with improved AI agent integration, featuring a "Recommended settings" card and enhanced search results. 2. The Drag Tray now supports dragging and dropping multiple files. 3. Administrator Protection is accessible again in the Windows Security app. 4. The "Run" command dialog box is being updated for dark mode support. 5. Click to Do feature enhancements allow for more precise object selection within images. 6. Windows Hello now supports external fingerprint sensors. 7. Users can configure the user folder name during the Out-of-box Experience (OOBE) using Command Prompt. 8. File Explorer receives dark mode improvements across various dialogs. 9. A redesigned Start menu in the Canary Channel combines "All," "Pinned," and "Recommended" sections into a scrollable interface. 10. A new setting allows users to adjust the position of on-screen hardware indicators. 11. Updates to keyboard shortcuts facilitate the insertion of En dashes and Em dashes. 12. The Windows Share interface now includes an option for pinning favorite apps.

AppWizard

September 29, 2025

Chrome glitch breaks autofill on Android apps like Bitwarden, fix incoming

Users of Chrome and Brave on Android are experiencing issues with the autofill functionality, where tapping the username field does not prompt the password manager as expected. This problem stems from changes in the Chromium engine, which now requires a single autofill provider, causing disruptions for users of multiple password managers like 1Password and Dashlane. Google is aware of the issue and is working on a fix for Chrome version 141, which will be rolled out gradually. In the meantime, users can enable a flag in Chrome settings to potentially restore autofill functionality and follow troubleshooting steps provided by Bitwarden, such as ensuring the app is updated and re-enabling autofill services.

Tech Optimizer

September 25, 2025

Building a Video Game Recommender System with FastAPI, PostgreSQL, and Render: Part 2

The project involves deploying a board game recommendation system using FastAPI and PostgreSQL on Render. Key tasks include configuring a PostgreSQL database on Render, populating it with data, Dockerizing the FastAPI application, and deploying it as a Render Web Application. The PostgreSQL database is created on Render with the name “fastapi-database” using the free tier. The database connection is tested using the External Database URL, and tables are populated using a script. The FastAPI application is containerized with Docker, which involves creating a Dockerfile that specifies the base image, working directory, dependencies, and commands to run the application. The Docker image is built, tagged, and pushed to DockerHub. The image is then pulled into Render, where a personal access token is created for secure access. Environmental variables are configured for the FastAPI application, and upon successful deployment, the application can be accessed via a provided link, with Swagger documentation available for testing database connections. The project repository is available on GitHub, along with additional resources for FastAPI and Docker.