records Archives

AppWizard

September 22, 2026

RatHat is a new Android malware that records your screen touches to steal passwords

Cybersecurity researchers at Zimperium have identified a new strain of malware called RatHat, targeting Android devices and linked to threat actors from China. RatHat uses generative AI to maintain persistence and control over infected devices. The malware is typically spread through social engineering, tricking users into downloading counterfeit applications that appear legitimate. Once installed, RatHat requests accessibility permissions, activates Wireless Debugging, and can capture text messages, create overlays, and steal passwords and multi-factor authentication codes. Its AI capabilities allow it to navigate the device interface in real-time, making detection by security software more difficult. To protect against RatHat, users should avoid downloading apps from untrustworthy sources, and removal requires a factory reset of the device.

Tech Optimizer

September 20, 2026

How to Remove a Keylogger: 12 Steps, 60 Min [2026]

A keylogger captures every keystroke made on a device and sends that information to an external source. In 2025, infostealer malware, including keyloggers, resulted in the theft of 642.4 million credentials from 13.2 million infections globally. In Australia, approximately 30,000 banking passwords were compromised between 2021 and 2025 due to this malware. The Australian Cyber Security Centre reported over 42,500 calls related to credential theft in one year, a 16% increase. Four main malware families dominate the landscape, with LummaC2 accounting for nearly 60% of credentials linked to infostealers in 2026. Keyloggers can be detected through signs such as typing lag, unexpected antivirus notifications, new browser extensions, and unexplained spikes in outbound data usage. Detection and removal steps include checking running processes, auditing startup programs, reviewing installed programs, running antivirus scans, and resetting passwords from a clean device. Keyloggers can infiltrate systems via phishing emails, malicious attachments, or compromised software downloads. Mobile devices can also be targeted by keyloggers disguised as legitimate apps.

AppWizard

September 19, 2026

Russia’s national messenger app Max found to contain backdoor capable of secret screen captures

Researchers have found that Max, a messaging app mandated by the Russian government, can secretly capture screenshots, access sensitive information, impersonate users, and inject code into other applications. Developed by VK, the app integrates messaging, banking, and government services. Since September 1 of last year, it has been preinstalled on new smartphones, following the blocking of WhatsApp and Telegram. Despite its reach, it is not widely used in political circles, with insiders indicating that compliance with its use is performative.

AppWizard

September 19, 2026

How to block and unblock a number on your Android phone

To block a number on a Samsung Android phone, open the Contacts app, select the contact, tap More, choose Block contact, and confirm. Alternatively, in the Phone app, copy the number, tap More, select Settings, tap Block numbers, add the number, and tap the plus sign. To block a number from the Recents section, navigate to the number, tap Details, More Options, and Block number. For Pixel phones or stock Android, open the Phone app, tap More, select Call history, choose the call, and tap Block/report spam. To unblock a number on a Samsung device, open the Contacts app, select the contact, tap More options, and select Unblock contact. In the Phone app, tap More, select Settings, tap Block numbers, and tap the (-) next to the number. For Google Pixel and stock Android, open the Phone app, tap More, select Settings, tap Blocked numbers, and tap Clear (x) next to the number. Calls made during the blocking period will not appear in call logs.

Winsage

September 19, 2026

These 4 built-in Windows tools helped me build a self-healing PC

Windows operating systems include built-in tools for maintaining PCs, allowing users to monitor system health, repair corrupted files, and recover from boot failures with minimal intervention. Task Scheduler automates maintenance tasks by triggering them based on schedules or events, accessible via the Start menu or taskschd.msc. It can activate tasks at fixed intervals, on startup, during idle periods, or in response to Event Viewer entries. Tasks should run with the highest privileges and can be configured to execute regardless of user sign-in status. The Settings tab allows missed tasks to run as soon as possible. DISM (Deployment Image Servicing and Management) is a command-line utility that repairs the component store, essential for installing updates and restoring system files. It offers three inspection levels: CheckHealth, ScanHealth, and RestoreHealth, with the latter requiring an internet connection for downloading replacement files. DISM logs operations in C:WindowsLogsDISMdism.log. SFC (System File Checker) verifies and repairs core operating system files using Windows Resource Protection. The command sfc /scannow checks all protected files, while /verifyonly provides a report without changes. SFC's effectiveness depends on the integrity of the component store, making it essential to run DISM first. Results are logged in C:WindowsLogsCBSCBS.log. Quick Machine Recovery (QMR), introduced in Windows 11, addresses boot failures by connecting to the internet to find solutions when repeated boot failures are detected. QMR is enabled by default on unmanaged devices and can continuously check for fixes. It is designed to respond to widespread issues rather than unique problems and may not work effectively on older hardware or without a network connection. Together, these tools provide a comprehensive approach to system maintenance in Windows 11, ensuring the operating system remains healthy and efficient without additional software.

AppWizard

September 19, 2026

Why ESG reporting standards matter in the Android and mobile tech ecosystem

ESG reporting standards are becoming increasingly important in mobile technology, affecting various aspects such as data management, material sourcing, energy consumption, privacy, supply chain dynamics, and product accountability. The lifecycle of mobile devices involves raw material sourcing, component manufacturing, device assembly, shipping, marketing, sales, updates, repairs, trade-ins, and disposal. Companies must understand ESG standards to create coherent sustainability narratives and may need to disclose supplier practices, carbon emissions, and governance documentation when partnering with larger firms. Consumers are now asking more questions about the longevity of software updates, repairability, data collection, packaging design, and the accountability of product creators. The rise of connected devices complicates ESG reporting due to extended product lifecycles and the need for ongoing software support. Companies should track product lifespan estimates, warranty data, repair trends, and update schedules to improve product quality and ESG reporting credibility. Emerging tech companies can start their ESG journey by cataloging product claims, consolidating evidence, designating ownership of records, and reviewing product lifecycle information. Global sustainability frameworks exist but may not align with consumer needs for straightforward product information. Successful mobile tech companies will need to bridge formal reporting requirements with accessible product-level communication. Trust and transparency in practices will increasingly influence consumer choices in mobile technology.

AppWizard

September 15, 2026

Where to Install Modified Android Games and Apps Safely?

Modified applications, or modded apps, for Android are distributed as .APK files and are installed manually rather than through app stores. These apps are altered versions of original applications, which may include changes in design, functionality, or the removal of restrictions. Users should be cautious when downloading modded APKs from third-party websites, as these can pose security risks. It is important to verify the website's reliability by checking for contact information, a privacy policy, and installation instructions. Users should scan APKs for security threats before installation and examine the permissions requested by the app. Maintaining an updated operating system and security applications is essential for protecting personal data. Modded applications may not receive regular updates, increasing the need for users to check for newer versions. Respecting developers' rights and avoiding unauthorized access to premium features is crucial to mitigate risks.

AppWizard

September 12, 2026

New Android Ransomware Records Screens, Steals OTPs and Secretly Takes Photos of Victims

A newly identified malware threat in the Android ecosystem, named Mantax Otax, combines ransomware with espionage capabilities. It targets users who install applications from untrustworthy sources, often through messaging apps or phishing attempts. The malware is linked to Indonesian cybercriminals and can steal sensitive information such as SMS one-time passwords, chat histories, and lock-screen PINs, facilitating account takeovers. Mantax Otax requests device-administrator rights and seeks access to SMS messages, contacts, and media files. It encrypts files on devices running Android 9 and earlier using AES encryption and demands a ransom for recovery. Although the impact is reduced on Android 10 and later due to Scoped Storage, the malware still poses significant surveillance risks. The malware collects extensive sensitive data, including contacts, call logs, and location data, and targets multi-factor authentication codes. It uses a deceptive system-lock overlay to capture PINs and has introduced features like WebSocket communications and disruptive pop-ups in its second iteration. Users are advised to be cautious when installing applications, avoid unsolicited APKs, and reject permissions that do not align with an app's purpose. In case of suspicious activity, users should disconnect from networks and seek help before entering sensitive information. Organizations should monitor for signs of this malware on managed devices.

Tech Optimizer

September 12, 2026

8 Antivirus (Endpoint Protection) Software for Business: Our Top Picks by Use Case (2026)

If you hold Microsoft 365 E5, you already have access to Microsoft Defender for Endpoint, which provides enterprise-grade endpoint protection at no additional cost. For organizations without a dedicated security specialist, Sophos is recommended. CrowdStrike is suitable for those with a mature Security Operations Center (SOC) and sufficient budget. Other options include SentinelOne for mid-sized organizations needing automation, ESET for older hardware and virtual desktops, Avast Business for very small businesses without IT staff, VIPRE for budget-conscious organizations, and Expel for tool-agnostic managed detection and response. It is essential to assess your organization's current situation honestly when evaluating endpoint protection options. Antivirus and EDR are now essentially the same agent, and organizations should inquire about update staging processes and review independent tests for protection rates. Coverage for servers and Linux environments is often overlooked but crucial, as Linux servers are prime targets for ransomware. Key recommendations include: - Microsoft Defender for Endpoint for organizations already on Microsoft 365 E5. - Sophos for organizations with 25-500 staff relying on IT generalists. - CrowdStrike for enterprises with a well-funded security operations function. - SentinelOne for mid-sized organizations needing autonomous operation. - ESET for organizations with older hardware or virtual desktop infrastructure. - Avast Business for micro and small businesses. - VIPRE for budget-conscious organizations. - Expel for those seeking managed detection across various environments. During deployment, avoid running two real-time agents simultaneously, ensure prevention features are activated, and test on line-of-business applications first. Verify update staging and rollback procedures with vendors, and confirm whether Microsoft licensing covers your needs to avoid unnecessary purchases.

Tech Optimizer

September 11, 2026

12-Year-Old PostgreSQL Flaw Lets Attackers Execute Code on Database Servers

A PostgreSQL vulnerability identified as CVE-2026-6471, known as PostGREShell, allows attackers with minimal replication access to execute arbitrary code on database servers. This flaw has existed for approximately 12 years and affects non-superuser PostgreSQL accounts with the REPLICATION attribute, commonly used for backup and replication tasks. The vulnerability arises from inadequate restrictions on the library path specified as an output plugin name, enabling an attacker to exploit the logical decoding feature to load a malicious library. Exploitation requires only a PostgreSQL account with REPLICATION privileges, wal_level set to logical, and access to SMB port 445. The flaw was discovered by Cyera Research and dates back to PostgreSQL 9.4's release in 2014. Patches have been released for versions 18.6, 17.11, 16.15, 15.19, and 14.24, and organizations are advised to upgrade to these versions. Database administrators should audit accounts with the REPLICATION attribute and restrict replication connections. Limiting outbound network access and monitoring logical replication activity is also recommended to mitigate risks.