permissions Archives

Tech Optimizer

July 24, 2026

CrashStealer Mac malware steals passwords and wallets

A sophisticated new malware targeting Mac users, named CrashStealer, has been discovered by security researchers at Jamf Threat Labs. It masquerades as Apple's legitimate crash-reporting software and was first identified in May 2026, with active attacks detected by early July. CrashStealer is designed to extract sensitive information, including browser credentials, password manager data, and cryptocurrency wallet information, and can copy the Mac login Keychain. It uses native C++ programming, encrypts collected files, and employs anti-debugging features. The malware is distributed through a disk image labeled "Werkbit Setup," which features a polished installer that bypasses Mac security warnings by using a valid Apple Developer ID and notarization ticket. Once opened, it connects to GitHub for commands and downloads a script that installs a second disk image named CrashReporter.dmg, which mimics an Apple system component. CrashStealer presents a fake password prompt resembling a legitimate macOS request, verifying entered passwords locally. It targets data linked to various browsers and password managers, scanning for approximately 80 cryptocurrency wallet extensions and 14 password managers. Stolen data is stored in hidden folders, encrypted using AES-256-GCM, and packaged into hidden ZIP archives before being uploaded. Warning signs of infection include a website requiring a meeting PIN for download, unexpected password prompts, and unfamiliar apps requesting Full Disk Access. Users are advised to download apps from verified sources, avoid overriding security warnings, pause before entering passwords, review app permissions, install security updates, use antivirus software, and act quickly if they installed Werkbit Setup.

AppWizard

July 24, 2026

I replaced my old Android Auto sideloading method with this, and it’s so much easier

The process of sideloading apps for Android Auto can be complex due to varying permissions by device and app. Users often face issues with platforms like Android Auto Apps Download (AAAD), which may go offline. Some beneficial sideloaded apps include AABrowser for internet browsing and CarStream for watching YouTube. A new sideloading method allows users to bypass AAAD, ensuring app icons appear in the vehicle's infotainment system. This method was effective on a Pixel 10 Pro running Android 17 without being rooted, but results may vary on other devices. To enable this method, users must activate Developer Mode on their Android device and Android Auto. It is important to install apps from reputable sources, such as GitHub, as recent updates to Android Auto may remove sideloaded apps that circumvent restrictions. After enabling the Unknown Sources option in Android Auto's developer settings, users can install apps like AABrowser, which then appears in the Android Auto launcher and the vehicle's infotainment system.

Tech Optimizer

July 24, 2026

Microsoft has ensured that LG monitors no longer prompt users to install McAfee on Windows

Owners of LG monitors have expressed frustration over an automatic prompt that appears when connecting their devices to Windows 11 PCs, encouraging the download of the LG Monitor App Installer, which suggests installing McAfee antivirus software. Microsoft has intervened, with executive vice president Pavan Davuluri confirming on July 22 that they reached out to LG to address the issue. LG has agreed to disable the McAfee pop-up from their app. Users have also raised concerns about the extensive permissions granted to the app, which reportedly accesses "all system resources" and the Internet connection. Similar practices have been observed with other manufacturers, including Alienware and Samsung.

AppWizard

July 24, 2026

Nothing launches Essential Apps for building apps right on your phone

Nothing has launched the Essential Apps application, allowing users to build, preview, and deploy apps directly from their devices. The app is available on the Google Play Store but is being rolled out in stages, initially accessible only to users who have previously used the Builder on the web. Users will receive an error message if they attempt to access the app without permission, and Nothing will notify users via email when access is granted. The company plans to eventually remove the waitlist for broader access. Additionally, Nothing has paused the publishing of new applications on its Playground platform to improve the user experience.

AppWizard

July 24, 2026

How to Use WorldEdit in Minecraft Java and Bedrock

WorldEdit is a tool for Minecraft that has different requirements for Java Edition and Bedrock Edition. Users must select the correct version for their Minecraft edition. For Java Edition, WorldEdit can be downloaded from EngineHub or Modrinth, while Bedrock Edition requires a separate add-on. To install WorldEdit on Java Edition, users need to download the appropriate .jar file and place it in the server's plugins or mods folder, depending on the platform. Command access must be granted based on world or server settings, and users can select blocks for editing using various commands. Basic edits can be made using commands like //set, //replace, and //undo. For Bedrock Edition, users must download the add-on package, enable experimental features, and use semicolon commands for editing. The add-on also includes item shortcuts and management commands for access. The main differences between Java and Bedrock versions include the installation process, permissions, and command prefixes.

AppWizard

July 23, 2026

Active Exploitation Alert: Fake Bahrain Alert App Deploys Advanced Android Surveillance Malware Targeting Gulf Region Users

A cyber-espionage campaign has been identified involving a counterfeit Bahrain Alert Android application designed to surveil individuals in Bahrain and the Gulf region. The app masquerades as an official civil defense tool and employs social engineering tactics to compromise Android devices, extract sensitive data, and maintain remote access. It targets high-value individuals such as activists and journalists, particularly during civil unrest and missile alerts, leveraging trusted government branding to increase infection rates. The malware features a complex, multi-stage architecture with advanced evasion techniques and is distributed through phishing links and malicious websites. It initiates a four-stage infection process, ultimately installing a remote access trojan (RAT) that enables covert surveillance and encrypted communications. The malware can monitor device activity, capture credentials, and intercept communications, while also employing mechanisms to avoid detection and maintain persistence. The campaign primarily targets Bahraini citizens, exploiting fear during crises to encourage app installation. Although there are indications of Russian-speaking developers involved, there is no definitive attribution to a specific nation-state or APT group. Mitigation strategies include monitoring for suspicious app installations, user education on verifying app authenticity, and blocking known malicious domains.

AppWizard

July 23, 2026

ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories

GitHub will reject command-line support bundle uploads from outdated versions of GitHub Enterprise Server lacking security patches starting August 18, 2026. The npm package @copilot-mcp/apex has been identified as a post-install dropper that installs a macOS infostealer, phishing for sensitive information and maintaining a connection to an attacker's server. A rogue extension on the Microsoft Visual Studio Code marketplace, "Markdown All Pro," impersonates a legitimate tool and opens a backdoor after installation. A phishing campaign targeting Portuguese users delivers the Lampion banking malware, which has been active since 2019. DoubleVerify reports a rise in "AfterCall" apps that exploit user permissions for ad fraud. The GhostCommit attack method hides malicious instructions within PNG images in pull requests. The U.S. government has updated its advisory on Iranian-affiliated cyber activity targeting operational technology devices. An Android app posing as a civil defense alert system has been found to contain malware for data harvesting. An Iranian threat actor is distributing MarkiRAT malware through fake applications. An analysis of 28 AI-coded applications revealed 434 vulnerabilities, prompting Cisco to introduce Antares to identify vulnerabilities in codebases. A Russian-speaking threat actor is dismantling guardrails on AI models to create offensive tools.

Tech Optimizer

July 23, 2026

Simplify AI agent orchestration with Lakebase Postgres

The auditing process has traditionally been labor-intensive, requiring extensive document reviews. CLA (CliftonLarsonAllen LLP) partnered with the Databricks Forward Deployed Engineering team to develop a document processing application that reduces extraction time from hours to minutes while maintaining quality. The application is built on the Databricks platform, utilizing technologies like Lakebase Postgres, Databricks Apps, Lakeflow Jobs, MLflow, and Unity Catalog Volumes. The application addresses challenges in document parsing, including unpredictable per-task latency, rate-limit-aware throttling, workload prioritization, cost attribution per task, and real-time progress visibility. It eliminates the need for multiple specialized systems by integrating components such as a web application for user interaction, Lakebase for state management, an orchestrator for task management, and AI agents for document processing. The task queue is supported by two Postgres tables in Lakebase, tracking task status and execution attempts. Concurrency safety is ensured through a locking mechanism, and crash recovery is facilitated by lease-based locking. The orchestrator implements rate-limit-aware throttling and idempotent webhook callbacks to manage task processing effectively. An operator dashboard provides real-time metrics on task status, agent performance, and workload costs, with live updates through Postgres LISTEN/NOTIFY events. Cost attribution is managed at the application level, allowing for detailed monitoring of expenditures. Lakebase enhances the orchestration process with features like autoscaling compute, OAuth-rotated authentication, Unity Catalog integration, and support for branching and snapshots.

Winsage

July 21, 2026

LG admits its monitor app installs bloatware via Windows Update, and Microsoft is letting it happen

A growing number of LG monitor users have reported that connecting their devices to Windows systems results in the automatic installation of the LG Monitor App Installer, which prompts users with a McAfee trial advertisement. YouTuber Gamers Nexus found that connecting an LG UltraGear monitor led to the installation of LG's driver package and the LG Monitor App Installer, with the McAfee pop-up appearing 31 times over 32 boots. This automatic installation is facilitated by device metadata, which Windows uses to download associated applications without user notification. Users must be signed into the Microsoft Store and connected to the internet for this to occur, leading to frustrations about transparency. Reports of unsolicited McAfee pop-ups have been shared on platforms like Reddit, with users confirming the app's installation was logged as part of a Windows Update. LG has acknowledged the inclusion of McAfee in their app updates, promoting a free trial, which has raised privacy concerns. The app's rating on the Microsoft Store has dropped to around 1 out of 5 due to user dissatisfaction. Users can prevent automatic installations by adjusting Group Policy settings, while macOS requires manual approval for third-party applications. Neither Microsoft nor LG has formally addressed the concerns regarding silent installations and McAfee pop-ups.

Winsage

July 21, 2026

LG monitors criticized for silently installing McAfee ads via Windows Update

LG monitors have been reported to automatically install an application promoting paid subscriptions to McAfee antivirus software when connected to Windows PCs. This occurs via the LG Monitor App Installer, which is delivered through Windows Update without user approval. The app installs itself seamlessly upon connection and has been noted to present McAfee promotional offers on 31 out of 32 system boots. It operates with "runFullTrust" permissions, allowing it to launch at startup and display ads after system reboots. Reports of this behavior date back to at least 2024, affecting even older LG monitors. Users can remove the app through Windows Settings and disable startup entries, while Windows Pro and Enterprise users can implement a policy to block automatic downloads of applications linked to device metadata.