remote control Archives

AppWizard

July 14, 2026

AI hacks apps in five minutes: fake builds can flood messengers

Recent findings from a study by Positive Technologies indicate that AI is increasingly being used by hackers to modify mobile applications, with a success rate of over 60% for embedding unauthorized code without disrupting functionality. The study analyzed 90 Android applications, finding closed commercial models had an 84% success rate, while open-source applications had a 61% success rate. Modifications were completed in as little as 5 minutes and 38 seconds to up to 9 minutes and 9 seconds, with costs ranging from 0.88 to 40.89 rubles per modification. Messaging platforms and third-party sites are particularly at risk, especially for users seeking unofficial app versions. Developers are advised to improve security against code modification and unauthorized clones.

Winsage

July 11, 2026

This Windows feature has been eating users’ RAM for years, Microsoft still hasn’t fixed it

Memory leaks have been reported with the Phone Link feature in Windows 11, specifically the Cross Device Service, which is consuming excessive amounts of RAM. Users have noted that this service can use between 15 to 30GB of RAM, leading to significant system slowdowns and reduced internet speeds. Complaints about this issue have been ongoing since early 2023, with users often needing to manually intervene via Task Manager to restore system performance. The Cross Device Service is intended to facilitate features like clipboard sharing and notification syncing but appears to malfunction and enter a loop that increases memory usage. Microsoft has not officially acknowledged the problem, and while generic troubleshooting steps have been suggested, they may not resolve the issue for all users. Disabling the Phone Link feature has been proposed as a potential solution to mitigate memory consumption.

Tech Optimizer

July 10, 2026

GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware

Microsoft Threat Intelligence has identified the GigaWiper malware, which has been detected in compromised environments since October 2025. This malware has destructive capabilities and comes in two forms: standalone wiper binaries and larger binaries with backdoor functionalities, both developed in Golang. The standalone wiper operates at the physical disk level, overwriting disk content and removing partition references. The backdoor variant includes the same wiper functionality and adds persistence through a registry key and scheduled tasks, along with command and control communication via RabbitMQ and Redis. GigaWiper can execute various commands, including wiping drives, triggering a Blue Screen of Death (BSOD), file encryption that mimics ransomware behavior, and managing system elements. The malware integrates components from multiple malware families, including wipers and ransomware mechanisms, and has been linked to a previous malware known as FlockWiper. To defend against GigaWiper, organizations are advised to implement security measures such as tamper protection, blocking access to known C2 infrastructure, and utilizing endpoint detection and response solutions. Microsoft Defender provides detections for GigaWiper and related malware, and threat intelligence reports are available for customers to stay informed about threats. Indicators of compromise include specific SHA-256 hashes and IP addresses associated with GigaWiper.

Winsage

July 10, 2026

Microsoft Warns of GigaWiper Backdoor Built to Destroy Windows PCs

Microsoft has unveiled a destructive Windows backdoor named GigaWiper, which allows operators remote control over compromised systems to execute irreversible damage. GigaWiper originated from cyberattacks in October 2025 and is a composite of code from at least three malware families. It maintains its presence through a scheduled task disguised as “OneDrive Update,” executing at startup and every minute. GigaWiper can obliterate partition information, overwrite physical drives, and restart systems. It also mimics ransomware by encrypting files with the .candy extension, using randomly generated keys that are not stored, making recovery impossible. The malware has connections to the Crucio ransomware and resembles FlockWiper, with rewritten code in Go. GigaWiper features 20 command codes for various functions, including executing PowerShell instructions, managing processes, capturing screenshots, and remote access similar to VNC. It can remain on a system for surveillance until its destructive functions are activated. Microsoft Defender includes detection capabilities for GigaWiper, and users are advised to enable tamper protection and monitor for suspicious activities.

AppWizard

July 1, 2026

Google App Update: A Stunning Gemini AI Upgrade For Mac Users

Google is developing a feature that allows Android users to remotely command and monitor AI workflows on their Macs through the Android Google app. This feature is linked to Gemini Spark, Google's AI agent, and includes a "new thread" system to prevent data leakage. The upgrade aims to create a cross-platform ecosystem for Android users to utilize AI capabilities on Apple-silicon Macs. The feature, internally codenamed "Robin," requires Gemini for macOS to be installed on Apple-silicon devices and allows users to perform tasks like summarizing PDFs or triggering scripts remotely. This functionality is currently exclusive to Mac users, providing them an advantage over Windows users who lack a standalone Gemini desktop client. The Gemini Spark AI framework is still in an experimental stage, and its performance on macOS has yet to be fully validated.

AppWizard

June 24, 2026

Minecraft mod hides malware sweeping Australian gaming communities

A new US price point in cybersecurity has made advanced cyber capabilities accessible to a wider audience, including individuals who may want to cause harm for personal reasons rather than financial gain. In Australia, personal cyber insurance products have traditionally focused on risks like identity theft and financial fraud, driven by economic incentives. As the nature of cyber threats evolves, existing insurance products may not adequately cover risks from individuals motivated by personal grievances, prompting a need for insurers to reevaluate coverage, risk assessment, and customer education.

Winsage

June 24, 2026

Windows RAT Uses Encrypted HTTP C2 and Registry Persistence After npm Infection

A malware campaign targets Windows systems through a malicious npm package named postcss-minify-selector-parser, which mimics the legitimate postcss-selector-parser. This counterfeit package installs a Remote Access Trojan (RAT) on developer machines, beginning with a multi-stage attack triggered by the installation of the package. The RAT can steal credentials, execute shell commands, and communicate with a remote attacker. Security researchers at JFrog identified this threat and reported it on June 22, 2026, noting that two additional related packages, postcss-minify-selector and aes-decode-runner-pro, are linked to the same publisher and remain live on the npm registry. The RAT employs encrypted HTTP communication with a command-and-control (C2) server and ensures persistence by creating a registry key under the Windows Run key. It has capabilities for remote shell execution, file uploads and downloads, and can steal saved login data from Google Chrome using Windows decryption APIs. The malware is designed for organized batch exfiltration of stolen data. Indicators of compromise include specific IP addresses, domains, file paths, and SHA-256 hashes associated with the malware components. JFrog advises users to remove the malicious packages, inspect their dependency trees, and treat any stored credentials as compromised.

TrendTechie

June 20, 2026

Что такое торрент, как он работает и можно ли им пользоваться

Downloading a Linux distribution from the official website typically takes about half an hour, but during high-demand periods, such as new Ubuntu releases, speeds can drastically decrease due to server overload. Torrents, which use a peer-to-peer file-sharing protocol, allow users to download and share data simultaneously, reducing the load on a single server. Torrents operate by enabling direct exchanges between users through the BitTorrent protocol, where files are divided into smaller pieces and downloaded in parallel from multiple sources. Key terms include peers (users with parts of the file), seeds (users who have fully downloaded the file), .torrent files (metadata files), and magnet links (text-based alternatives to .torrent files). The BitTorrent protocol does not rely on a central server, enhancing resilience as files can continue to circulate as long as at least one seed is available. To use torrents, a torrent client is needed, with recommended options for 2026 including qBittorrent, Transmission, and BiglyBT. The BitTorrent technology itself is legal, but legality depends on the content being shared. Legal uses include downloading Linux distributions, open-source software, and scientific datasets, while unlicensed movies and cracked software are illegal. In Russia, while torrent technology is not prohibited, downloading copyrighted content without permission is a violation. Risks of using torrents include exposure to viruses and malware, copyright infringement, fake distributions, and IP address exposure. To protect oneself, users should choose moderated trackers, avoid suspicious files, use antivirus software, and limit upload speeds. Common problems include slow speeds, connection issues, and disappearing files, which can often be resolved by checking settings or ensuring there are seeds available. Sharing files after downloading is not legally mandatory but is considered good etiquette in the torrent community.

AppWizard

June 12, 2026

Android users need to uninstall these apps ASAP as they are a security risk

Google will soon notify Android users when an app they installed has lost developer support. Currently, users only receive alerts from Play Protect for significant security threats or potentially harmful apps. The only way to discover if an app has been delisted is through external sources or by trying to install it on a new device. Recent findings in the Play Store indicate that Google is preparing to inform users when apps have been removed from the Play Store and will no longer receive updates. Abandoned apps pose significant security risks, as they may contain vulnerabilities that can be exploited by malicious actors. Google's new notifications aim to encourage users to uninstall unsupported apps to protect their personal data.

AppWizard

June 8, 2026

Pirated PC games are delivering password-stealing malware

A surge in Windows malware campaigns has been identified, with malicious software hidden in pirated PC games and modified installers for popular franchises like Far Cry, Need for Speed, FIFA, and Assassin’s Creed. Over 400,000 devices globally have been affected, with around 30,000 cases in the United States. The malware, known as the "RenEngine loader," is disguised as a legitimate game launcher and infects systems when users download cracked games. It aims to deploy an infostealer called ARC, which can capture sensitive information such as passwords and cryptocurrency wallets, and may also install other harmful payloads like the Rhadamanthys stealer and Async Remote Access Trojan (RAT). Users often remain unaware of their infection until significant damage occurs. Recommendations for safety include avoiding unofficial downloads, using up-to-date anti-malware protection, and regularly updating software.