PNG Archives

Winsage

June 19, 2026

Microsoft confirms Recycle Bin bug across all versions of Windows

Reports have emerged about complications from the latest Patch Tuesday update, affecting users with issues such as access problems with OneDrive and Dropbox, BitLocker recovery lockouts, and Blue Screen of Death (BSOD) errors. Microsoft has acknowledged a glitch related to the Recycle Bin after the installation of June's Patch Tuesday update (KB5094126), where the confirmation dialog displays the internal file name instead of the actual name when deleting an item. This issue affects various supported Windows client and server versions, including Windows 11 (versions 26H1, 25H2, 24H2, 23H2), Windows 10 (versions 22H2, Enterprise LTSC 2021, Enterprise LTSC 2019, Enterprise LTSB 2016), and Windows Server (2025, 2022, 2019, 2016, 2012 R2, 2012). Microsoft is working on a solution expected in a future update, but it is unclear if it will be part of the next Patch Tuesday or an out-of-band update. Commercial customers can implement a workaround by contacting Microsoft Support for Business.

AppWizard

June 17, 2026

New Rokarolla Android Trojan Targets 217 Banking and Crypto Apps

Zimperium’s zLabs researchers have analyzed a newly identified Android banking trojan named Rokarolla, which targets 217 distinct banking and cryptocurrency applications. It is distributed through malicious websites that impersonate popular platforms like TikTok and Google Chrome, with one identified distribution point being hxxps://infocontablidades[.]it[.]com/. The malware uses a dropper disguised as Google Play Protect to install a second-stage payload and gain Accessibility Services access, allowing it to simulate user interactions and manipulate on-screen elements. Rokarolla downloads counterfeit HTML login pages for targeted applications and overlays them to capture user credentials, including sensitive card information. It can also deploy a fraudulent PIN entry screen, read and send SMS messages, intercept one-time codes from banks, and block incoming calls. The malware rewrites the clipboard, operates a keylogger and screen content logger, and scrapes WhatsApp contact data. It captures screenshots without alerting users and has a resilient command-and-control infrastructure with multiple fallback domains. No product flaws are exploited, and defenses against it include installing apps only from Google Play and being cautious with Accessibility Services. Zimperium’s Mobile Threat Defense and zDefend products can detect Rokarolla, and a list of indicators of compromise is available on their GitHub repository.

AppWizard

June 16, 2026

New Rokarolla Android Malware Steals PINs, SMS Codes, and Crypto Wallet Funds

Security researchers at Zimperium's zLabs have identified a new Android banking trojan named Rokarolla, which can target 217 banking and cryptocurrency applications and execute 137 remote commands. The malware spreads through deceptive websites that impersonate popular apps, installing a dropper that mimics Google Play Protect to gain Accessibility access. It uses overlay techniques to capture sensitive information by displaying counterfeit login pages and can intercept SMS messages, including one-time codes from banks. Rokarolla also features a keylogger, screen logger, and can rewrite clipboard contents to divert cryptocurrency payments. It employs advanced methods for discreet data capture and has multiple fallback command-and-control domains, making it resilient against takedowns. There is no patch available for this malware, and users are advised to install apps only from Google Play and remain cautious of unexpected Accessibility requests. Zimperium's products can detect this malware, and indicators of compromise are available on their GitHub repository.

AppWizard

May 27, 2026

Minecraft 26.2 Pre-Release 1

Today marks the unveiling of the first pre-release for version 26.2. Bug fixes are included to refine the overall experience. The Peer-to-Peer connection feature has been removed due to quality concerns. Known issues include potential crashes on systems lacking Vulkan support, which can be worked around by editing the options.txt file. Changes include updated models and textures for Small Sulfur Cubes, new sounds for Sulfur Cubes, and updates to the Sulfur Caves biome. The continuous Geyser setup now requires a source Lava Block. The friend list button will remain visible even if disabled. Technical changes include updates to the Data Pack version (106.1) and Resource Pack version (88.0). New server properties for chat and command spam thresholds have been added. A new world preset, minecraft:flatalldimensions, has been introduced. Entity textures for Sulfur Cubes have been added, and various bugs have been fixed in this pre-release. Pre-releases are available for Minecraft: Java Edition, and players are advised to back up their data.

AppWizard

April 29, 2026

Minecraft 26.2 Snapshot 5

The 26.2 Snapshot 5 introduces several new features, including an explosive archetype for the Sulfur Cube and the addition of erupting Geysers formed by Potent Sulfur. The new Sulfur Cube archetype, called Explosive, shares properties with the Regular archetype but has higher air drag and can absorb TNT blocks. When primed, absorbed TNT has a fuse time of 6 seconds when ignited by fire or Redstone, and a randomized fuse time between 0.75 and 3 seconds when primed by an explosion. Sulfur Cubes with absorbed TNT cannot be picked up or damaged, and no Small Sulfur Cubes will spawn upon explosion. Potent Sulfur creates Geysers when placed above a Magma block and under water, sending water particles skyward at random intervals. Various adjustments have been made to mob hitboxes, and Hoglins are now classified as hostile and will not spawn on Peaceful difficulty. New sounds for Geyser eruptions have been added, and Touchscreen Mode has been removed. The Data Pack version is now 104.0, and the Resource Pack version is 86.2. New particles related to Geysers have been introduced, and several bugs have been fixed in this update.

AppWizard

April 25, 2026

NoVoice malware hit 2.3 million Android devices through apps Google never should have approved

McAfee researchers discovered a complex Android rootkit campaign, dubbed Operation NoVoice, that infiltrated 50 applications on Google Play, exploiting vulnerabilities in the kernel that had been patched but not uninstalled. The malware was resilient enough to survive factory resets and was concealed within seemingly benign apps, which collectively garnered 2.3 million downloads. The malicious payload was hidden in the com.facebook.utils package and used steganography to embed an encrypted payload within a PNG image. The malware conducted multiple checks to avoid detection and established contact with a command-and-control server, polling for exploit packages every 60 seconds. It utilized 22 distinct exploits, including vulnerabilities that had received patches between 2016 and 2021. The malware disabled SELinux enforcement and installed a persistent rootkit that could survive factory resets. Google confirmed the removal of the infected apps but noted that users who had already downloaded them remained at risk, especially if their devices were running unpatched Android versions. McAfee advised affected users to treat their devices as compromised and consider professional inspection or hardware-level storage wiping for remediation.

AppWizard

April 15, 2026

Minecraft 26.2 Snapshot 3

In version 26.2, a new feature called sulfur spikes has been introduced, which generates naturally in sulfur caves. These spikes can form stalactites when placed on the ceiling and stalagmites when on the floor. They can be combined to create longer formations and will merge if placed adjacent without pressing the shift key. Stalagmites will break if not anchored, and stalactites will fall if unsupported. Thrown tridents can break sulfur spikes. The Potent Sulfur block can no longer be crafted back into sulfur blocks, and several block textures have been updated. The Sulfur Cube can no longer be picked up by boats. Sound effects for Nautilus jets and recoveries have been updated. The Data Pack version is now 102.0, and the Resource Pack version is 86.0. The minecraft:bed block entity has been removed, and entity predicates have been restructured for simplification. New block textures for sulfur spikes have been added. Several bugs have been fixed, including issues with axolotls, emissive textures, client crashes, and leads disappearing from sulfur cubes. Snapshots for Minecraft: Java Edition are available for installation, with a reminder to back up worlds.

Winsage

April 13, 2026

Paint (25H2)

Microsoft has updated Paint significantly with the rollout of Windows 11, enhancing both its user interface and core functionalities. Key updates include the introduction of a Dark mode, an updated Text tool, layer capabilities similar to Photoshop, and support for transparent PNG files. Paint now features AI-driven tools, some of which require a Microsoft account and a Microsoft 365 subscription, while others are accessible on any PC or require a Copilot+ PC. Customization options in Paint are limited; users cannot disable any image creation or editing features but can change the app theme and configure watermark settings for AI-generated content. The toolbar can be set to auto-hide, and users can view their work in full screen by pressing F11. New features include the ability to save projects with multiple layers, a Remove background tool, an Image Creator for generating images from text prompts, and a Generative erase tool for removing objects from images. Copilot+ PCs unlock additional features that operate locally, such as Object select, Sticker generator, Cocreator, and Generative fill, which requires specific hardware capabilities.

Winsage

April 6, 2026

ResokerRAT Hijacks Telegram API to Command Infected Windows PCs

A newly discovered Windows malware called ResokerRAT uses Telegram’s Bot API for its command-and-control operations, allowing it to monitor and manipulate infected systems without a conventional server. It obscures its communications by integrating with legitimate Telegram traffic, complicating detection. Upon execution, it creates a mutex to ensure only one instance runs and checks for debuggers to avoid analysis. It attempts to relaunch with elevated privileges and logs failures to its operator. ResokerRAT terminates known monitoring tools and installs a global keyboard hook to obstruct defensive key combinations. It operates through text-based commands sent via Telegram, allowing it to check processes, take screenshots, and modify system settings to evade detection. Persistence is achieved by adding itself to startup and altering UAC settings. The malware retrieves additional payloads from specified URLs and uses URL-encoded data for communication. Researchers have confirmed its Telegram traffic, and its behavior aligns with various MITRE ATT&CK techniques. Security teams are advised to monitor for unusual Telegram traffic and scrutinize registry keys related to startup and UAC.

AppWizard

April 1, 2026

‘NoVoice’ Android malware on Google Play infected 2.3 million devices

A new Android malware called NoVoice has been found in over 50 applications on Google Play, with more than 2.3 million downloads. The malware targets older Android versions, specifically those patched between 2016 and 2021, and attempts to gain root access by exploiting vulnerabilities. It conceals malicious components within the com.facebook.utils package and uses steganography to hide an encrypted payload within a PNG image file. NoVoice avoids infecting devices in certain regions and has checks to detect emulators and VPNs. Once activated, the malware contacts its command-and-control server to gather device information and polls it every 60 seconds for tailored exploits aimed at rooting the device. It can exploit 22 vulnerabilities, including kernel bugs, and establishes persistence by replacing key system libraries and installing recovery scripts. The malware injects code into applications, particularly targeting WhatsApp to extract sensitive data for session replication, which is then exfiltrated to the C2 server. The malicious apps containing NoVoice have been removed from Google Play, but users who installed them should consider their devices compromised. Upgrading to devices with later security patches is recommended to mitigate the threat.