remote access Archives

Winsage

July 28, 2026

Your Windows Recycle Bin is a privacy risk—here’s how to actually delete your files

The Recycle Bin in Windows, introduced in 1995, serves as a temporary storage for deleted files rather than permanently removing them. When a file is deleted, it is moved to the Recycle Bin, which requires manual emptying or activation of a Storage Sense policy to clear its contents. This can lead to reduced hard drive space for users unaware of its behavior. The Recycle Bin can contain sensitive information, and if someone gains access to a Microsoft account, they can view its contents. Even after emptying the Recycle Bin, data can be recovered unless overwritten, with different recovery processes for solid-state drives (SSDs) due to maintenance routines like the TRIM command. Risks extend beyond physical access, as compromised accounts or malware can access deleted files. To securely delete sensitive files, users can use the Shift + Del shortcut, file shredding applications, and consider encrypting their drives with BitLocker. Specialized shredders for SSDs exist, and users can optimize drives through Windows settings to manage data recovery risks.

AppWizard

July 27, 2026

My parents’ Android phones were ruined by invasive ads. Here’s how I fixed them for good

Mobile advertising on Android devices has seen a rise in deceptive pop-ups that mimic legitimate notifications or system updates, leaving many users, particularly less tech-savvy individuals, vulnerable. A personal experience highlighted this issue when a family member fell for a misleading PDF ad, leading to the installation of multiple fraudulent applications. Recently, similar deceptive ads were encountered on YouTube, raising concerns about the safety of family members who rely on their devices for important tasks. Discussions on platforms like Reddit have pointed out the prevalence of misleading ads on family-friendly platforms. The author expressed a desire to block all ads if companies cannot ensure their safety. To address the issue, the author sought an ad-blocking solution that allows for remote management and network-wide filtering, ultimately choosing NextDNS. This content filtering solution offers a free account with sufficient monthly DNS queries and supports individual profiles for tailored settings. The setup process for NextDNS involves creating profiles for each family member, allowing for distinct settings and blocklists, and configuring devices with the provided DNS-over-TLS endpoint details. While NextDNS is effective, it does not eliminate all ads, particularly those from platforms like YouTube, indicating that additional measures may be necessary for comprehensive security. Regularly reviewing app permissions and uninstalling unnecessary applications are also recommended for enhancing security.

Tech Optimizer

July 25, 2026

Scrappy RAT Malware Targets Chrome And Edge Users

A new remote access trojan (RAT) named msaRAT has been identified by Cisco Talos, linked to the Chaos ransomware group and built using Rust. It exploits Chrome and Edge browsers to disguise its traffic and evade detection. MsaRAT operates through a headless browser process, enabling remote code execution and facilitating ransomware deployment, data theft, and other malicious activities. It is typically installed via phishing emails or malicious files, making it resistant to standard browser patches. Cisco Talos recommends specific SNORT rules and a ClamAV signature for detection. Indicators of Compromise (IoC) include traffic to the IP address 172.86.126.18 and the domain is-01-ast.ols-img-12.workers.dev. The malware primarily targets large organizations, but individual users may also be at risk.

AppWizard

July 23, 2026

Active Exploitation Alert: Fake Bahrain Alert App Deploys Advanced Android Surveillance Malware Targeting Gulf Region Users

A cyber-espionage campaign has been identified involving a counterfeit Bahrain Alert Android application designed to surveil individuals in Bahrain and the Gulf region. The app masquerades as an official civil defense tool and employs social engineering tactics to compromise Android devices, extract sensitive data, and maintain remote access. It targets high-value individuals such as activists and journalists, particularly during civil unrest and missile alerts, leveraging trusted government branding to increase infection rates. The malware features a complex, multi-stage architecture with advanced evasion techniques and is distributed through phishing links and malicious websites. It initiates a four-stage infection process, ultimately installing a remote access trojan (RAT) that enables covert surveillance and encrypted communications. The malware can monitor device activity, capture credentials, and intercept communications, while also employing mechanisms to avoid detection and maintain persistence. The campaign primarily targets Bahraini citizens, exploiting fear during crises to encourage app installation. Although there are indications of Russian-speaking developers involved, there is no definitive attribution to a specific nation-state or APT group. Mitigation strategies include monitoring for suspicious app installations, user education on verifying app authenticity, and blocking known malicious domains.

Winsage

July 20, 2026

July 2026 Patch Tuesday: KB5101650 Windows 11 Update

On July 14, 2026, Microsoft released cumulative update KB5101650 for Windows 11 versions 25H2 and 24H2, addressing OS Builds 26200.8875 and 26100.8875. This update includes essential security fixes, updates to Secure Boot certificates, and enhanced Remote Desktop Protocol (RDP) defenses against phishing attacks. It consolidates July 2026's security content, addressing known vulnerabilities and introducing functional improvements. The update is critical for minimizing exposure to identified threats and is prioritized for systems managing remote access or nearing certificate expiration. The update enhances Remote Desktop security by supporting SHA-2 certificate thumbprints while retaining SHA-1 for legacy compatibility. It includes new Group Policy options to mitigate phishing risks associated with malicious .rdp files. The curl upgrade to version 8.21.0 incorporates security patches for command-line tools in Windows environments. Secure Boot certificates are automatically updated through Windows updates, ensuring boot security across various hardware. KB5101650 installs primarily through the Windows Update interface, requiring a restart to activate changes. Enterprise environments can use the Microsoft Update Catalog for manual distribution. A temporary restriction affects certain Dell devices with Intel Innovation Platform Framework drivers, which Microsoft plans to address in a future update. The cumulative update resolves a total of 622 Microsoft CVEs, including 416 affecting Windows components. Users are advised to verify and install the update promptly to secure the full suite of improvements.

Tech Optimizer

July 18, 2026

North Korea Buried Four-Stage Malware in Flag Images: Zero Antivirus Detections

North Korea's Contagious Interview hackers have been using a deceptive strategy to target developers by posing as recruiters and embedding malware in SVG files. Elastic Security Labs discovered that the attackers hid malicious payloads within HTML comment blocks of these files, allowing the malware to evade antivirus detection. At the time of the findings, no antivirus engines flagged the compromised repositories, which included trojanized GitHub repositories disguised as coding challenges. The malware executed automatically at server startup and deployed four modules: a browser credential and cryptocurrency wallet stealer, a file stealer, a remote access Trojan, and a clipboard monitor. The campaign, tracked as REF9403, is part of the ongoing Contagious Interview operation attributed to North Korea's Lazarus Group, which aims to generate revenue through cryptocurrency theft. Developers are advised to audit any projects run from unsolicited sources and to monitor specific domains associated with the attack.

Winsage

July 15, 2026

LabubaRAT malware infiltrates Windows systems while posing as NVIDIA software

LabubaRAT is a newly identified Rust-based remote access tool (RAT) that disguises itself as NVIDIA software to facilitate operations on Windows systems. It establishes a reusable foothold for hands-on activity and can profile the host system, identify security tools, execute commands, transfer files, capture screenshots, and proxy network traffic. LabubaRAT retrieves its configuration at launch via command-line arguments or environment variables, allowing operators to specify parameters like the command-and-control server and API key at runtime. It maintains local state in a SQLite database and supports communication through HTTPS polling, Microsoft Edge WebView2, and DNS tunneling. The malware includes capabilities for command execution, file handling, and establishing persistence through a Windows Run registry key. The entry point for the attack is an executable named nvidia-sysruntime.exe, which masquerades as NVIDIA’s container runtime toolkit. LabubaRAT conducts thorough profiling of the host, checking for installed browsers and security products, and gathers information on the system's specifications. Blackpoint Cyber has shared indicators of compromise to help detect LabubaRAT activity.

Tech Optimizer

July 11, 2026

Microsoft closes RoguePlanet vulnerability in Defender: SYSTEM privileges via the antivirus engine

A vulnerability known as RoguePlanet was identified in Microsoft Defender, tracked as CVE-2026-50656. This flaw allows local privilege escalation to the NT AUTHORITYSYSTEM account, requiring an attacker to have local code execution capabilities. It can be exploited through methods such as opening malicious email attachments. The vulnerability is categorized under CWE-59: “Improper Link Resolution Before File Access” and involves a race condition that affects the Defender engine's operations. RoguePlanet was disclosed by security researcher Nightmare-Eclipse on June 10, 2026, and confirmed by various security firms. Microsoft released a fix in version 1.1.26060.3008 of the Microsoft Malware Protection Engine, which should be installed automatically in standard Windows configurations. Users can verify their engine version using PowerShell. The vulnerability affects both Windows 10 and Windows 11 systems with the June 2026 security updates, and disabling real-time protection does not reliably mitigate it.

Tech Optimizer

July 10, 2026

Hackers Use Fake VLC Executable and Malicious libvlc.dll to Deploy ValleyRAT

Cybercriminals are exploiting the VLC media player to install ValleyRAT, a remote access trojan, by embedding malware in a seemingly harmless file linked in phishing emails. The attack starts with an email that prompts the victim to download a ZIP archive containing a fake VLC executable and a malicious DLL named libvlc.dll. This method uses DLL sideloading to execute the malware under the guise of a legitimate application. Once executed, the malware establishes persistence by creating a registry entry and connects to a remote server to retrieve the final payload. ValleyRAT employs evasion tactics to avoid detection, including assessing system characteristics before executing harmful actions and using a fileless approach to deliver the payload directly into memory. Researchers have identified indicators of compromise, including specific SHA1 hashes and URLs associated with the malicious campaign.

Winsage

July 10, 2026

Microsoft Warns of GigaWiper Backdoor Built to Destroy Windows PCs

Microsoft has unveiled a destructive Windows backdoor named GigaWiper, which allows operators remote control over compromised systems to execute irreversible damage. GigaWiper originated from cyberattacks in October 2025 and is a composite of code from at least three malware families. It maintains its presence through a scheduled task disguised as “OneDrive Update,” executing at startup and every minute. GigaWiper can obliterate partition information, overwrite physical drives, and restart systems. It also mimics ransomware by encrypting files with the .candy extension, using randomly generated keys that are not stored, making recovery impossible. The malware has connections to the Crucio ransomware and resembles FlockWiper, with rewritten code in Go. GigaWiper features 20 command codes for various functions, including executing PowerShell instructions, managing processes, capturing screenshots, and remote access similar to VNC. It can remain on a system for surveillance until its destructive functions are activated. Microsoft Defender includes detection capabilities for GigaWiper, and users are advised to enable tamper protection and monitor for suspicious activities.