prompts Archives

AppWizard

September 28, 2026

RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims

The operators behind RatHat have created an advanced Android banking trojan that allows control of infected devices through a web console. Since April 2026, nearly 100 instances of this console have been identified, indicating a malware-as-a-service model. The console collects sensitive data from compromised phones, including text messages and passwords. It uses Google's Gemini AI to assess victims' bank balances, categorizing them into high-value and mid-value segments, but does not facilitate financial transactions. The malware has remained largely unchanged since late 2025, but the console has seen significant updates, leading to three new versions: BlackCat Remote Control Management, Panda Workshop V5, and V6. These versions serve as both control interfaces and build tools for creating and distributing malware. The latest version includes templates for deceptive download pages. RatHat infiltrates devices via text messages and online ads, requesting Accessibility access to read screens and simulate user interactions. This access allows the malware to activate wireless debugging and connect to the Android Debug Bridge (ADB), giving operators elevated privileges to execute commands. A Go program can be deployed to maintain control, even after the app is uninstalled. Cleafy has tracked console deployments through web code analysis, noting that many IP addresses originate from a Singapore-registered network. The initial console version allowed operators to choose AI providers, but the latest exclusively uses Gemini. RatHat also utilizes Gemini on infected devices to determine tap locations based on screen layouts. Cleafy has compiled indicators related to the consoles' command-and-control servers, download links, and malware samples, including specific domains, IP addresses, and MD5 hashes. The consoles often use web addresses starting with "admin." and inexpensive top-level domains. Security tools are advised to monitor processes running under the shell user on affected devices.

AppWizard

September 28, 2026

I turned off these 8 Google Messages features, and the app is so much better now

Google Messages has evolved to include features such as read receipts, Gemini integration, typing indicators, and chat bubbles. Some users find these enhancements beneficial, while others view them as intrusive. The author disabled several features for a more streamlined experience, leading to less clutter and fewer distractions. The features disabled include: 1. Gemini Button: A floating icon for AI-assisted messaging, which can be disabled in Message settings. 2. Profile Sharing: Allows visibility of name and photo to contacts, with customizable privacy settings available. 3. Outgoing Message Sounds: Can be turned off to create a quieter messaging environment. 4. Floating Chat Heads (Bubbles): Can be disabled to avoid distractions and protect sensitive information. 5. Follow-Up Reminders: Prompts to respond to message threads, which can be turned off in Message settings. 6. Read Receipts and Typing Indicators: Create pressure to respond quickly and can be disabled in Message settings. 7. Sensitive Content Warnings: Can misidentify benign images and can be turned off for a smoother experience. 8. Smart Reply and Suggested Actions: Offers quick responses that may not fit all conversations and can be disabled. These adjustments have improved the author's messaging experience, allowing for more personal and less stressful interactions.

AppWizard

September 26, 2026

[Minecraft] Su Has a Talent For Getting Kidnapped

YouTube has introduced a passive sign-in feature that allows users to browse the platform without full authentication, enhancing user experience by simplifying access to content. This update is expected to increase viewer engagement and retention for content creators, potentially leading to greater monetization opportunities and audience growth. The new interface prompts users to log in only when necessary, aligning with current trends in user experience design.

AppWizard

September 25, 2026

F-Droid gets its biggest update in a decade with new UI and smoother app installs

F-Droid is a community-driven repository for free and open source Android applications, recently undergoing a transformation with the release of F-Droid 2.0. The new client is redesigned using Kotlin Compose, enhancing responsiveness and introducing optional Material theming for a visually appealing interface. The update simplifies app discovery and installation, now offering a vast library of thousands of open source applications. F-Droid prioritizes user autonomy without tracking behavior for ads. It features extensive categories for specialized needs and improved search functionality that returns results based on app names and descriptions. Installation has been streamlined using Google’s pre-approval API, allowing users to confirm installations through a simplified pop-up, improving the user experience despite requiring one additional click compared to the Play Store.

BetaBeacon

September 24, 2026

Move over, Claude and ChatGPT: This Android brand’s open-source AI model builds 3D games on demand

Xiaomi has open-sourced its omnimodal AI model, MiMo-V2.6 Pro, which can generate interactive 3D worlds from text or visual prompts. The model is claimed to be the most capable open-weight model on the Artificial Analysis Intelligence Index benchmark.

Winsage

September 23, 2026

Cisco Talos Discloses Autonomous Windows Malware: Four AI Models Direct Each Attack

Cisco Talos has disclosed a new Windows implant called CLOSEDQUORUM, which operates without human operators by using four commercial large language models (LLMs) to autonomously decide on actions after deployment. The implant is a 16.4-megabyte executable that conducts reconnaissance on the target system and sends structured prompts to the LLMs, which respond with one of four actions: steal, inject, persist, or move. When the "steal" action is chosen, it simultaneously attacks three credential stores, extracting Windows credentials, browser passwords, and cryptocurrency wallet data. The "inject" action uses either Early Bird APC injection or process hollowing based on model recommendations. For persistence, it employs three overlapping mechanisms, including a Registry Run key, a scheduled task, and a WMI event subscription. To evade detection, CLOSEDQUORUM suppresses ETW telemetry and introduces delays before executing actions. It circumvents traditional command-and-control structures by calling legitimate API endpoints, making blocking these domains impractical. Talos introduced the CAIRN toolkit for detecting AI-integrated malware, which operates on metadata and employs rule-based detection. Unlike previous AI-assisted malware, CLOSEDQUORUM automates decision-making processes entirely, highlighting a significant evolution in malware capabilities. Security teams are advised to focus on behavioral detection strategies and utilize the YARA rule and CAIRN toolkit for identifying this threat.

Winsage

September 23, 2026

Cisco Talos Discloses Autonomous Windows Malware: Four AI Models Direct Each Attack

Cisco Talos has disclosed a Windows implant called CLOSEDQUORUM, which automates cyberattack execution using four advanced commercial large language models: DeepSeek, Qwen, Mistral, and Google Gemini. The implant is a 16.4-megabyte executable that conducts reconnaissance on the system and formats the gathered data into prompts for the AI models. Each model votes on one of four actions: steal, inject, persist, or move, with the action receiving the most votes being executed. When stealing, CLOSEDQUORUM targets three credential stores, dumping LSASS memory and retrieving saved passwords from browsers and cryptocurrency wallets. The stolen data is encrypted and sent to the operator via Discord. For injection, it uses Early Bird APC injection or process hollowing based on model responses. The persist action creates three mechanisms for longevity, including a Registry Run key, a scheduled task, and a WMI event subscription. CLOSEDQUORUM evades detection by suppressing ETW telemetry and delaying activity to avoid sandbox analyses. It connects to legitimate API endpoints, making blocking ineffective without disrupting enterprise applications. Talos recommends behavioral combination detection strategies and the use of a YARA rule for detection. The CAIRN toolkit has been introduced to detect AI-integrated malware without executing binaries. Unlike previous AI-assisted malware, CLOSEDQUORUM removes human decision-making from the attack process.

AppWizard

September 23, 2026

Spotify could soon fix a major storage issue that users have complained about for years

Spotify is developing a "Cache Limit" feature for Android users that will allow them to manage the local storage used by temporary files. This feature aims to give users control over the app's caching behavior, which currently operates automatically and can accumulate several gigabytes of data over time. Users can manually clear the cache but may find it tedious. The new feature will enable users to set a cap on storage for temporary files, with notifications about the implications of their choices, such as increased data usage or potential effects on playback quality. The feature will not affect downloaded music or podcasts and is expected to first appear in the beta version of the app before being rolled out to all users.

AppWizard

September 22, 2026

Googlebook OS: Goodbye Windows? Google’s New OS Brings Android and AI to Laptops

Google has announced its new operating system, Googlebook OS, previously known as Aluminium OS, alongside the launch of the Googlebook laptop series. Googlebook OS allows Android applications to run natively, enhancing performance compared to ChromeOS. It features "Continue On," which enables task transfer from mobile apps to the laptop, and incorporates AI tools like "Magic Pointer" for assistant access and "Rambler" for improved voice input. Users can also create personalized widgets with the "Create My Widget" option. Googlebook OS is positioned as a distinct product with advanced capabilities, although future commercial device details are not yet available.

Winsage

September 21, 2026

Do This If You Want Another Year of Windows 10 Security Updates

Microsoft has extended its security update support for Windows 10 until October 12, 2027, through the Extended Security Updates (ESU) program. This extension allows users to maintain essential protection against threats despite the official end of support last year. The ESU program will continue for existing participants without further action required, while new users can enroll until the program concludes next year. To qualify, devices must be running Windows 10 version 22H2 and have the latest updates installed. Enrollment options include purchasing coverage or redeeming Microsoft Rewards points. The program focuses solely on security, providing critical monthly updates without new features.