NewApp Digest
search bot

PowerShell

LofyStealer Uses Node.js Loader Against Minecraft Gamers
AppWizard
April 30, 2026

LofyStealer Uses Node.js Loader Against Minecraft Gamers

Cybersecurity threat hunters have discovered an active infostealer campaign targeting the gaming community, involving malware called LofyStealer (or GrabBot) that disguises itself as a Minecraft hack named “Slinky.” The attackers use the official game icon to trick young gamers into executing the malware. The Brazilian cybercrime group LofyGang has enhanced its technical capabilities, utilizing a sophisticated two-stage modular architecture. The initial stage features a 53.5 MB loader file named load.exe, which is a Node.js runtime environment that obscures malicious signatures. The loader connects to the attacker’s server and decrypts a 1.4 MB C++ payload, chromelevator.exe, which targets eight web browsers to extract sensitive information like cookies and passwords. The stolen data is compressed, encrypted, and sent to the attacker’s server. LofyGang has evolved into a Malware-as-a-Service platform, offering a web panel for operators to monitor victims and generate custom executables. The campaign highlights the increasing threats to the gaming community, with advanced evasion techniques being employed by cybercriminals. Security professionals are advised to monitor network traffic and conduct audits for suspicious activities.
Minecraft Players Targeted by LofyStealer Using Node.js Loader and In-Memory Browser Injection
AppWizard
April 30, 2026

Minecraft Players Targeted by LofyStealer Using Node.js Loader and In-Memory Browser Injection

A new infostealer malware called LofyStealer is targeting the gaming community, particularly Minecraft players, by disguising itself as a cheat tool named “Slinky.” It employs a two-stage attack to extract sensitive information from eight major web browsers, including Chrome and Firefox, while evading detection by security software. The malware siphons off cookies, saved passwords, payment card information, and session tokens. Researchers at Zenox.ai identified LofyStealer, linking it to the Brazilian cybercrime group LofyGang, which has been active since October 2022. The malware uses social engineering tactics to appear legitimate and operates as a Malware-as-a-Service platform, offering both Free and Premium tiers to buyers. Its technical sophistication is evident in its method of in-memory browser injection, which allows it to bypass security defenses. The stolen data is compressed and sent to a command-and-control server. Users are advised to avoid downloading unofficial game mods and enable multi-factor authentication to reduce the risk of credential theft. Security teams should monitor for specific behavioral indicators related to the malware's operations.
I investigated Windows 11's massive 5GB monthly .msu updates. AI is only part of the problem.
Winsage
April 28, 2026

I investigated Windows 11’s massive 5GB monthly .msu updates. AI is only part of the problem.

Windows 11 updates have significantly increased in size, with monthly cumulative updates often exceeding 4GB and some approaching 5GB. One update can expand to nearly 9GB when extracted. Microsoft has shifted to delivering Latest Cumulative Updates (LCUs), which include all previous fixes, leading to larger update sizes over time. The introduction of Checkpoint Cumulative Updates aims to reduce this growth by establishing periodic baselines, but the effectiveness has been mixed. The May 2025 cumulative update saw a size increase from approximately 6.5GB to nearly 9GB, with new MSIX files related to semantic search and on-device AI contributing to this growth. Windows Update uses applicability logic to minimize download sizes for users, but enterprises must download full packages, resulting in increased storage costs. The average yearly storage cost for enterprises rose from about 11 GB in 2024 to 52 GB by 2026. Users can check their actual download sizes through the Windows Update settings and Event Viewer logs.
Microsoft Releases Enterprise Policy Option to Disable Windows 11 Copilot
Winsage
April 28, 2026

Microsoft Releases Enterprise Policy Option to Disable Windows 11 Copilot

Microsoft has introduced a new enterprise policy setting that allows IT administrators to silently uninstall the Microsoft Copilot app from managed Windows 11 devices. The RemoveMicrosoftCopilotApp policy became available after the April 2026 Patch Tuesday security updates and is compatible with enterprise management solutions like Microsoft Intune and System Center Configuration Manager (SCCM). Administrators can find the policy in the Group Policy Editor under User Configuration > Administrative Templates > Windows AI > Remove Microsoft Copilot App. It specifically targets Windows 11 Pro, Enterprise, and Education SKUs, excluding Home edition users. The uninstallation process is triggered when three conditions are met: Microsoft 365 Copilot is installed on the device, it was provisioned (not user-installed), and it has not been launched by the user in the last 28 days. The policy was initially available for Windows Insiders in January 2026 and became generally accessible afterward. However, future updates or user reinstalls from the Microsoft Store may reintroduce the Copilot app, necessitating ongoing policy enforcement for permanent removal. Organizations seeking broader exclusion may need to use PowerShell scripts or additional MDM configurations.
Fix: You'll need a new app to open this windowsdefender link
Tech Optimizer
April 26, 2026

Fix: You’ll need a new app to open this windowsdefender link

The message “You’ll need a new app to open this windowsdefender link” indicates issues with the Windows operating system when the Windows Security app fails to launch via the windowsdefender protocol. This can prevent users from accessing the security dashboard, despite Microsoft Defender continuing to operate in the background. Common scenarios leading to this error include clicking on Virus & Threat Protection, trying to open Windows Security from the Start menu, interacting with a Defender notification, or following the uninstallation of third-party antivirus software. Root causes may include corrupted Windows Security app registration, damaged system files, third-party antivirus interference, misconfiguration of the Security Center service, or malware interference. To resolve the issue, users can verify that required services are running, repair system files using SFC and DISM, re-register the Windows Security app, check for third-party antivirus conflicts, and perform a repair installation of Windows. Specific steps include checking the status of the Security Center and Microsoft Defender Antivirus Service, executing repair commands in CMD, re-registering the Windows Security app using PowerShell, uninstalling third-party antivirus software, and performing an in-place upgrade if necessary.
Fileless Malware and Email Authentication Gaps
Tech Optimizer
April 24, 2026

Fileless Malware and Email Authentication Gaps

Fileless malware operates stealthily within networks, utilizing legitimate system tools like PowerShell and Windows Management Instrumentation (WMI) to execute malicious code in memory without leaving traces on disk. Traditional antivirus solutions struggle to detect these threats due to their reliance on file signatures. The primary vector for fileless malware is email, where attackers use spoofed messages to trick users into activating malicious scripts. Misconfigurations in Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) records create vulnerabilities that attackers exploit to deliver spoofed emails. Traditional endpoint protection mechanisms are inadequate against fileless attacks, necessitating a shift towards behavioral analysis for detection. Organizations must assess their preparedness by ensuring proper email authentication configurations and enhancing endpoint security capabilities. Integration among security teams and updated employee security awareness programs are also essential. Sendmarc helps organizations mitigate vulnerabilities by providing visibility into SPF, DKIM, and DMARC configurations and enforcing DMARC to block unauthenticated messages.
Microsoft Changes Windows Security After 15 Years—Update By ‘End Of April’
Winsage
April 22, 2026

Microsoft Changes Windows Security After 15 Years—Update By ‘End Of April’

Microsoft is set to expire the Secure Boot authentication certificates that protect Windows PCs from threats upon each restart, with this initiative beginning in April 2023. The update will install new certificates and confirm if user action is necessary, with all devices expected to have the update by the end of April 2026. Users can check their Secure Boot status in Windows Security, where a badge system indicates the status. If the certificates expire, users may be at risk of boot-level malware. Microsoft is enhancing visibility of Secure Boot certificate status to aid user awareness. Users should check their PC by the end of the month to ensure it is updated.
silver Android smartphone
Tech Optimizer
April 22, 2026

New STX RAT Uses Hidden Remote Desktop and Infostealer Features to Evade Detection

A newly identified remote access trojan, STX RAT, emerged in 2026, integrating hidden remote desktop access with credential theft features. The name "STX" comes from the Start of Text magic byte x02, which it appends to communications with its command-and-control (C2) server. Initial sightings were reported in late February 2026, when it was delivered via a browser-downloaded VBScript file to a financial organization. By early March, Malwarebytes noted a campaign distributing STX RAT through compromised FileZilla installers. Researchers from eSentire’s Threat Response Unit analyzed the malware, which includes extensive anti-analysis measures and employs techniques like AMSI-ghosting. Once operational, STX RAT connects to a C2 server at 95.216.51.236, transmitting system information securely. It targets saved credentials from applications like FileZilla and includes a Hidden Virtual Network Computing (HVNC) module, allowing attackers to control a victim's machine without detection. Security teams are advised to block the C2 IP and implement detection rules to mitigate the threat.
silver Android smartphone
Winsage
April 22, 2026

Microsoft Changes Windows Security After 15 Years—Update By ‘End Of April’

Microsoft is updating the Secure Boot certificates for Windows PCs, which have been in place since 2011. This update will begin with the April security patch rollout and is expected to be fully deployed across PCs by the end of April 2026. Users can check the status of the Secure Boot update by navigating to Windows Security > Device security > Secure Boot, where a color-coded badge will indicate the current status. The update will install new certificates and confirm if user action is necessary. If the badge is red, immediate attention is required. Microsoft is enhancing the visibility of the Secure Boot certificate status within Windows Security to aid users in verifying the update. The certificates will not expire for several more weeks, so users should check their systems by the end of the month.
Search