NewApp Digest
search bot

persistence

AI-Powered Endpoint Detection and Response: Why Modern Cybersecurity Depends on EDR
Tech Optimizer
May 13, 2026

AI-Powered Endpoint Detection and Response: Why Modern Cybersecurity Depends on EDR

Every device connected to a corporate network, including laptops, desktops, servers, and mobile phones, can be a potential gateway for cyberattacks. AI-powered Endpoint Detection and Response (EDR) solutions are essential in modern cybersecurity strategies, utilizing behavioral analysis, real-time monitoring, and machine learning to detect, investigate, and respond to advanced threats. Traditional antivirus software, which relies on known malicious signatures, is becoming ineffective against modern attackers who use fileless attacks and custom-built malware. EDR continuously monitors endpoint activity, capturing behavioral data to identify anomalies consistent with attacks. It provides forensic capabilities to help security teams understand how breaches occur. EDR is a critical component of a multi-layered security architecture, complementing other security measures like firewalls and patch management. When choosing an EDR solution, organizations should consider real-time detection, automated response capabilities, integration with existing security tools, and ease of investigation.
Minecraft Java Edition will finally let you party up with your pals, without the need for mods
AppWizard
May 13, 2026

Minecraft Java Edition will finally let you party up with your pals, without the need for mods

The Java Edition of Minecraft is introducing new social features, including a friends list system and peer-to-peer connectivity, directly into the game. The Minecraft 26.2 Snapshot 7 update allows players to open private worlds to friends through a 'Multiplayer Options' menu, enabling invitations and access requests. The friends list can be accessed from the title screen and pause menu. These features are exclusive to the Java Edition, and while they may reduce the need for the Essential Mod, some players may continue to use it due to the early stages of the new connectivity features. Access to these updates is currently limited to the Minecraft Snapshot preview system.
silver Android smartphone
AppWizard
May 11, 2026

New TrickMo Variant: Device Take Over malware targeting Banking, Fintech, Wallet & Auth apps

Modern Android banking malware is evolving with architectural enhancements for increased stealth, resilience, and operational flexibility. In early 2026, a new variant of the TrickMo Android banking trojan was identified, actively targeting banking and wallet users in France, Italy, and Austria. This variant has replaced its predecessor in ongoing campaigns and has transitioned its command-and-control traffic to The Open Network (TON). Key features of the new TrickMo variant include: - The primary command-and-control channel now operates over TON, utilizing .adnl endpoints through an embedded local TON proxy. - It employs a runtime-loaded APK (dex.module) with enhanced functionalities, including reconnaissance, SSH tunneling, and SOCKS5 proxying, allowing infected devices to act as network pivots. - TrickMo is classified as Device Take Over (DTO) malware, targeting banking, fintech, wallet, and authenticator applications on Android devices. - Operators gain control over infected devices through accessibility-service permissions, enabling capabilities such as credential phishing, keylogging, screen recording, remote control, and SMS interception. The new variant features a modular architecture with a host APK functioning as a launcher and persistence layer, while offensive capabilities are delivered through the dynamically loaded dex.module. Significant enhancements include network reconnaissance commands (curl, dnslookup, ping, telnet, traceroute) and socket-level tunneling via an embedded SSH client. Indicators of compromise include specific SHA-256 hashes and package names associated with TrickMo dropper applications and host applications. The malware retains unused permissions for NFC capabilities, suggesting a strategic approach to device filtering.
What Is Endpoint Detection and Response?
Tech Optimizer
May 7, 2026

What Is Endpoint Detection and Response?

Traditional endpoint security measures, such as antivirus software and firewalls, are increasingly ineffective against sophisticated cyberattacks, which can bypass these defenses. Endpoint Detection and Response (EDR) is a solution that emphasizes rapid detection and containment of threats, continuously monitoring endpoint activity and identifying suspicious behavior in real time. EDR platforms gather data from all connected endpoints and utilize AI-driven analytics to detect both known and unknown threats. In 2024, over 97 billion exploitation attempts were recorded, underscoring the need for robust endpoint protection. EDR tools operate in four stages: detection, containment, investigation, and elimination of threats. They collect telemetry data from endpoints to establish a baseline of normal activity, enabling the identification of anomalies that may indicate a threat. EDR can automatically isolate affected endpoints, terminate malicious processes, and execute remediation actions. EDR employs two methods for threat detection: comparing endpoint activity against indicators of compromise for known threats and using behavioral detection models for unknown threats. The system can generate reports on threat activity and response effectiveness, aiding compliance and operational decision-making. The telemetry data collected is stored in a centralized repository, supporting threat-hunting initiatives. Organizations that deployed EDR in 2024 experienced an average breach cost that was significantly lower than those that did not. EDR minimizes security blind spots, reduces the attack surface by identifying vulnerabilities, speeds up investigations and responses, blocks new threats through behavioral analysis, and strengthens other security measures when integrated with existing tools. Challenges in EDR implementation include alert fatigue, integration complexity, resource constraints, and limited scope. When choosing an EDR solution, organizations should prioritize features such as real-time threat detection, automated response capabilities, behavioral analysis, offline protection, low performance impact, and integration with existing tools. EDR functions effectively as part of a layered security strategy, complementing other tools like Endpoint Protection Platforms (EPP) and Extended Detection and Response (XDR). EDR focuses on endpoint activity, while EPP serves as a first line of defense against common threats, and XDR broadens the scope to include network traffic and cloud workloads. VPNs encrypt network traffic, providing an additional layer of protection for data in transit.
Widespread controversy surrounds "Messenger"... What is the truth behind the suspension and what will happen to your messages?
AppWizard
April 25, 2026

Widespread controversy surrounds “Messenger”… What is the truth behind the suspension and what will happen to your messages?

Reports from Washington, DC, have raised concerns among Messenger app users regarding the future of the app and user data. Clarifications indicate that there is no complete shutdown planned for the app, but potential updates or modifications to services and features may occur. The parent company routinely implements updates, which may include removing outdated features or integrating services into other applications. User conversations are not being abruptly deleted; they remain securely stored in line with the company's storage policies, and users can access their data as long as their accounts are active. Experts advise users to stay informed through official updates and to be cautious of rumors on social media regarding privacy and data security.
NoVoice malware hit 2.3 million Android devices through apps Google never should have approved
AppWizard
April 25, 2026

NoVoice malware hit 2.3 million Android devices through apps Google never should have approved

McAfee researchers discovered a complex Android rootkit campaign, dubbed Operation NoVoice, that infiltrated 50 applications on Google Play, exploiting vulnerabilities in the kernel that had been patched but not uninstalled. The malware was resilient enough to survive factory resets and was concealed within seemingly benign apps, which collectively garnered 2.3 million downloads. The malicious payload was hidden in the com.facebook.utils package and used steganography to embed an encrypted payload within a PNG image. The malware conducted multiple checks to avoid detection and established contact with a command-and-control server, polling for exploit packages every 60 seconds. It utilized 22 distinct exploits, including vulnerabilities that had received patches between 2016 and 2021. The malware disabled SELinux enforcement and installed a persistent rootkit that could survive factory resets. Google confirmed the removal of the infected apps but noted that users who had already downloaded them remained at risk, especially if their devices were running unpatched Android versions. McAfee advised affected users to treat their devices as compromised and consider professional inspection or hardware-level storage wiping for remediation.
Search