Phishing

Winsage
May 10, 2025
Threat actors are exploiting Windows Remote Management (WinRM) to navigate through Active Directory environments stealthily, allowing them to bypass detection systems, escalate privileges, and deploy malicious payloads. WinRM operates on HTTP port 5985 and HTTPS port 5986, enabling remote command execution and management tasks. Attackers can gain access through compromised credentials and use WinRM-enabled PowerShell commands for reconnaissance, deploying payloads while evading detection. The attack chain includes initial access, reconnaissance, payload deployment, persistence, and lateral movement, often utilizing techniques that obfuscate malicious activities. Detecting such attacks is challenging due to the use of built-in Windows functionalities and encrypted channels. Recommended mitigation strategies include monitoring for unusual activity, restricting WinRM access, enforcing credential hygiene, and implementing advanced monitoring solutions.
Tech Optimizer
May 9, 2025
Antivirus software collects various types of data to protect systems, including system details (operating system version, RAM, CPU type, computer name), network data (local and external IP addresses, DNS server, network name), user data (Windows username, time zone, language, general location), browsing history (if web protection features are enabled), and file-related information (file names, locations, hashes, and sometimes entire files). The AV-Comparatives report indicates that while some antivirus companies manage data responsibly (e.g., F-Secure, G Data, K7), others (e.g., Norton, Panda, McAfee) have been criticized for poor practices. Data sharing can enhance malware detection but poses privacy risks, as seen in AVG's past actions of selling user browsing history. Users can limit data collection by adjusting settings, reviewing installation agreements, avoiding free antivirus software, choosing privacy-conscious vendors (like F-Secure, ESET, G Data), and reading privacy policies. Despite concerns about data collection, antivirus software is essential for protection against cyber threats, and selecting a transparent provider can help safeguard privacy.
Tech Optimizer
May 8, 2025
Cyberattacks are increasingly common due to psychological warfare among global powers. Macs are vulnerable to these attacks, necessitating effective antivirus solutions. Intego is the only antivirus software developed specifically for macOS, offering two packages: Mac Internet Security and Mac Premium Bundle. The Mac Internet Security suite includes real-time antivirus protection, a customizable firewall, and anti-phishing features, priced at .99 for one Mac or .99 for three Macs during the first year. The Mac Premium Bundle adds features like system cleanup, parental management, and automated backups, starting at .99 for one Mac or .99 for three Macs in the first year. Intego is designed specifically for Apple computers, providing lightweight, effective protection with minimal impact on system performance. It has a perfect malware detection score and offers a 30-day money-back guarantee. Users can also add a VPN subscription as Intego is associated with CyberGhost and ExpressVPN.
Winsage
May 6, 2025
AI has evolved into a transformative force for organizations, increasing the demand for secure and high-performance AI-ready Windows 11 PCs. Microsoft has introduced Copilot+ PCs, including the new 12-inch Surface Pro and 13-inch Surface Laptop, both powered by the Snapdragon X Plus processor with an integrated neural processing unit (NPU) capable of 45 trillion operations per second. The 13-inch Surface Laptop offers up to 23 hours of video playback and 16 hours of web browsing, with performance enhancements of up to 50% faster speeds and double the battery life compared to its predecessor. It features an AI-enhanced 1080p front camera for video conferencing and a durable design. The 12-inch Surface Pro is the thinnest and lightest Copilot+ PC, providing 50% faster performance and up to 16 hours of local video playback. Both devices are designed as Secured-core PCs with advanced security features, including Windows Hello for Business and biometric authentication options. They support enhanced productivity through AI features in Windows 11 and Microsoft 365 Copilot, enabling faster file searches and improved team efficiency. Microsoft emphasizes sustainability with the use of recycled materials and energy-efficient designs. The new devices will be available starting July 22 in select markets.
Winsage
May 4, 2025
Microsoft has warned about the increasing use of PDF attachments in cyberattacks, particularly during the U.S. tax season. Attackers have been using PDFs with embedded links that redirect users to counterfeit pages, such as a fake DocuSign site. TrustWave SpiderLabs has identified a new campaign involving a fake payment SWIFT copy that leads to a malicious PDF containing obfuscated JavaScript, which downloads a script that conceals the RemcosRAT payload using steganography. This technique involves hiding links within images, making them difficult to detect. The latest attacks begin with phishing emails containing malicious PDFs that direct victims to harmful webpages, facilitating the delivery of RemcosRAT, a trojan that allows remote control of compromised systems. Users are advised to be cautious of emails labeled “SWIFT Copy” and to delete suspicious emails immediately.
Search