NewApp Digest
search bot

PowerShell command

New ClickFix campaign can deploy powerful multi-stage malware directly through Windows Terminal and PowerShell
Winsage
September 1, 2026

New ClickFix campaign can deploy powerful multi-stage malware directly through Windows Terminal and PowerShell

Security researchers at Microsoft have identified a campaign named "TerminalFix" that exploits compromised websites to trick users into installing a backdoor. Users visiting these sites encounter a deceptive overlay prompting them to complete a fake Cloudflare CAPTCHA, which requires executing a malicious PowerShell command. This leads victims to inadvertently sideload dynamic link libraries (DLLs) and deploy a Python implant that creates encrypted reverse tunnels, allowing attackers to access internal networks.
Spent Two Weeks in Eco Mode? Windows Might Have Quietly Purged Your Nvidia Driver
Winsage
August 25, 2026

Spent Two Weeks in Eco Mode? Windows Might Have Quietly Purged Your Nvidia Driver

An Asus ROG Zephyrus G14 owner experienced the disappearance of their RTX GPU due to the Windows maintenance task pnpclean.dll, which removed the Nvidia driver package after the GPU had been in Eco mode for approximately 15 days. Eco mode disconnects the discrete GPU from the PCIe bus, causing Windows to register it as missing hardware. The pnpclean.dll routine removes drivers for devices absent beyond a timeout, which is reportedly 30 days by default but observed at 15 days in this case. Switching back to Normal or Hybrid mode makes the GPU reappear, but it is recognized only via the Microsoft Basic Display Adapter, requiring a full Nvidia driver reinstall. To check if a system was affected, users can run a specific PowerShell command. A registry fix involves setting the DWORD Autorun from 1 to 0 to prevent automatic cleanup. This issue is considered rare, requiring extended use of Eco mode, and while no hardware is harmed, the silent removal of the GPU driver raises concerns about automated OS processes. Neither Microsoft nor Asus has publicly addressed the issue as of late August 2026.
Grep this: Microsoft grafts (most) Linux commands onto Windows
Winsage
June 3, 2026

Grep this: Microsoft grafts (most) Linux commands onto Windows

Microsoft has integrated over 75 Unix commands into Windows CMD and PowerShell through the introduction of coreutils, a multi-call binary file created in Rust. This includes commands like cat, ls, grep, and head, enhancing the command experience across various platforms. Grep is now available natively on Windows, allowing users to search through large files efficiently. Coreutils aims to provide memory safety and cross-platform compatibility, and can be downloaded via CMD WinGet. While some Linux commands overlap with existing Windows commands, coreutils simplifies the transition for users moving from Linux to Windows. Additionally, Microsoft is focusing on AI technologies and has introduced tools like OpenClaw and Microsoft Execution Containers to enhance developer capabilities.
How to Disable Windows Defender in Windows 11 (GUI, PowerShell, CMD & Group Policy)
Winsage
May 30, 2026

How to Disable Windows Defender in Windows 11 (GUI, PowerShell, CMD & Group Policy)

Disabling Windows Defender is common among users setting up virtual machines or optimizing build processes, but it can be frustrating due to Windows 11's resistance to such actions. Many guides suggest using outdated registry keys, which are often reverted by updates, leading to repeated attempts to disable the protections. Users may disable Defender for several reasons, including performance issues with virtual machines, conflicts with Android emulators, hindrances in development environments, troubleshooting disk performance, and security testing in isolated labs. However, disabling antivirus software increases exposure to threats. Microsoft Defender includes components such as Antivirus, Real-Time Protection, Cloud-Delivered Protection, Tamper Protection, and Defender for Endpoint. Tamper Protection is a significant barrier to disabling Defender, as it prevents unauthorized changes to security settings. Key considerations before disabling Defender include the need for administrator rights, the effect of Tamper Protection, potential resets from Windows Updates, temporary toggles for Real-Time Protection, and the option to install third-party antivirus software, which places Defender in passive mode. Methods to disable Defender include using the Windows Security GUI, PowerShell commands, Command Prompt, or Group Policy (available only for certain editions). Disabling Tamper Protection requires accessing the GUI or being managed by an organization. To check if Defender is disabled, users can use PowerShell to review specific fields. Common reasons for Defender reactivating include enabled Tamper Protection, system reboots, Windows Updates, lack of third-party antivirus, and security policy refreshes. Installing a legitimate third-party antivirus is often the best way to maintain a consistent state. Instead of disabling Defender, users can add exclusions for specific folders related to virtual machines or development tools, allowing them to maintain protection while avoiding conflicts. Troubleshooting common problems includes ensuring elevated sessions for PowerShell, checking Tamper Protection status, and understanding the limitations of the Group Policy editor based on the Windows edition. Disabling Defender may be appropriate in specific scenarios, but for regular use, especially on machines handling sensitive tasks, the risks generally outweigh the benefits. Using exclusions is recommended for performance improvements without compromising security.
LofyStealer Uses Node.js Loader Against Minecraft Gamers
AppWizard
April 30, 2026

LofyStealer Uses Node.js Loader Against Minecraft Gamers

Cybersecurity threat hunters have discovered an active infostealer campaign targeting the gaming community, involving malware called LofyStealer (or GrabBot) that disguises itself as a Minecraft hack named “Slinky.” The attackers use the official game icon to trick young gamers into executing the malware. The Brazilian cybercrime group LofyGang has enhanced its technical capabilities, utilizing a sophisticated two-stage modular architecture. The initial stage features a 53.5 MB loader file named load.exe, which is a Node.js runtime environment that obscures malicious signatures. The loader connects to the attacker’s server and decrypts a 1.4 MB C++ payload, chromelevator.exe, which targets eight web browsers to extract sensitive information like cookies and passwords. The stolen data is compressed, encrypted, and sent to the attacker’s server. LofyGang has evolved into a Malware-as-a-Service platform, offering a web panel for operators to monitor victims and generate custom executables. The campaign highlights the increasing threats to the gaming community, with advanced evasion techniques being employed by cybercriminals. Security professionals are advised to monitor network traffic and conduct audits for suspicious activities.
Minecraft Players Targeted by LofyStealer Using Node.js Loader and In-Memory Browser Injection
AppWizard
April 30, 2026

Minecraft Players Targeted by LofyStealer Using Node.js Loader and In-Memory Browser Injection

A new infostealer malware called LofyStealer is targeting the gaming community, particularly Minecraft players, by disguising itself as a cheat tool named “Slinky.” It employs a two-stage attack to extract sensitive information from eight major web browsers, including Chrome and Firefox, while evading detection by security software. The malware siphons off cookies, saved passwords, payment card information, and session tokens. Researchers at Zenox.ai identified LofyStealer, linking it to the Brazilian cybercrime group LofyGang, which has been active since October 2022. The malware uses social engineering tactics to appear legitimate and operates as a Malware-as-a-Service platform, offering both Free and Premium tiers to buyers. Its technical sophistication is evident in its method of in-memory browser injection, which allows it to bypass security defenses. The stolen data is compressed and sent to a command-and-control server. Users are advised to avoid downloading unofficial game mods and enable multi-factor authentication to reduce the risk of credential theft. Security teams should monitor for specific behavioral indicators related to the malware's operations.
Search