remote control Archives

AppWizard

September 28, 2026

RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims

The operators behind RatHat have created an advanced Android banking trojan that allows control of infected devices through a web console. Since April 2026, nearly 100 instances of this console have been identified, indicating a malware-as-a-service model. The console collects sensitive data from compromised phones, including text messages and passwords. It uses Google's Gemini AI to assess victims' bank balances, categorizing them into high-value and mid-value segments, but does not facilitate financial transactions. The malware has remained largely unchanged since late 2025, but the console has seen significant updates, leading to three new versions: BlackCat Remote Control Management, Panda Workshop V5, and V6. These versions serve as both control interfaces and build tools for creating and distributing malware. The latest version includes templates for deceptive download pages. RatHat infiltrates devices via text messages and online ads, requesting Accessibility access to read screens and simulate user interactions. This access allows the malware to activate wireless debugging and connect to the Android Debug Bridge (ADB), giving operators elevated privileges to execute commands. A Go program can be deployed to maintain control, even after the app is uninstalled. Cleafy has tracked console deployments through web code analysis, noting that many IP addresses originate from a Singapore-registered network. The initial console version allowed operators to choose AI providers, but the latest exclusively uses Gemini. RatHat also utilizes Gemini on infected devices to determine tap locations based on screen layouts. Cleafy has compiled indicators related to the consoles' command-and-control servers, download links, and malware samples, including specific domains, IP addresses, and MD5 hashes. The consoles often use web addresses starting with "admin." and inexpensive top-level domains. Security tools are advised to monitor processes running under the shell user on affected devices.

Tech Optimizer

September 24, 2026

The Best Small Business Cybersecurity Suites for 2026

A small business is typically defined as one where the owner can personally name all employees, usually comprising a workforce of a few dozen. Licensing options for IT protection for small businesses vary, with Malwarebytes and Norton covering up to 20 devices, ESET offering plans for five to 25 devices, and Bitdefender providing options for three, five, ten, or 25 users. Avast and AVG allow licenses for one to 999 devices. All security suites support Windows, and most, except AVG, also support Mac devices. Four suites offer protection for Android and iOS devices, while Avast and AVG do not support mobile devices. Bitdefender, ESET, and Norton provide dedicated server editions, while Avast and AVG allow individual policy definitions for servers. Remote installation features vary in reliability, but all suites enable administrators to manage installations and monitor device status. Norton offers backup solutions and 500GB of shared hosted storage, while firewall protection is standard except for Malwarebytes. Bitdefender and ESET provide anti-theft systems for lost devices, and both ESET and Avast have measures against unauthorized device access. Malwarebytes and Norton offer 24/7 priority support, and Norton provides dark web monitoring for sensitive information.

Tech Optimizer

September 16, 2026

Chinese state security authorities warn outdated antivirus software can expose systems to cyberattack

Chinese state security officials have emphasized the necessity for organizations to keep antivirus software and virus databases updated to prevent data breaches and unauthorized access. The Ministry of State Security (MSS) highlighted that neglecting these updates has led to significant security incidents, including the theft of sensitive data and cyberattacks on work email accounts. Specific cases include a research institute that suffered a breach due to unpatched vulnerabilities, an institution exposed to cyberattacks for not enforcing regular virus scans, and a company that operated a poorly protected server with outdated antivirus software. Contributing factors to delayed updates include a lack of awareness about cybersecurity risks, insufficient network maintenance, and unclear responsibilities within organizations. Under China's Cybersecurity Law, network operators must implement measures to protect against cybersecurity threats. The MSS advises organizations to enhance their cybersecurity measures by adopting technologies like automated risk alerts and intelligent behavioral analysis.

AppWizard

September 13, 2026

Your Phone Can Use Android Auto Without A Car – Here’s How (And Why You Should)

Open Headunit, previously known as Headunit Revived or Headunit Reloaded, is available for .99 and .99 respectively. To use an old tablet as a head unit, purchase and install the app on the device, connect it to a phone using a USB OTG cable, and select the USB connection in the app. Wireless connectivity options are available for both apps, including using a wireless Android Auto dongle, a native Wi-Fi P2P connection, or the third-party app Wireless Helper. Wi-Fi Launcher can be paired with Headunit Reloaded for a similar experience. The Android Auto developer server allows broadcasting a self-hosted server to run Android Auto on a single device. Utilizing Android Auto can enhance productivity by allowing users to read messages, check notifications, and access smart home controls while minimizing distractions. Setting up an old device creatively can enhance a workspace, as virtually any device can serve as a display for the head unit apps.

AppWizard

September 10, 2026

Google Play Early Access Abused to Push Thousands of Deceptive Android Apps

Bad actors are exploiting Google Play's Early Access program to distribute misleading applications that promise money, rewards, and casino winnings. This program allows developers to gather user feedback on unreleased apps but lacks public reviews or star ratings, enabling malicious actors to launch numerous fraudulent applications without immediate scrutiny. An example is the app "Vice Streets: Open World," which mimics Grand Theft Auto, has over 1 million downloads, and recently disappeared from the store without reviews or ratings. These deceptive apps are often promoted on social media with misleading advertisements and promise cash rewards, but users face obstacles when trying to withdraw their earnings. The primary goal of these apps is to generate revenue through excessive advertisements while circumventing regulatory requirements for legitimate gambling apps. Additionally, various malware families targeting Android devices have emerged, including Hagaseca, Mantax Otax, StreamRat, and GoldFactory's use of the Gigabud banking trojan, highlighting ongoing security threats in the digital landscape.

AppWizard

September 9, 2026

Hackers Clone Banking Apps into Hidden Profiles, Android Malware Raises New Fraud Concerns

Cybercriminals are using advanced Android malware that mimics banking applications within hidden Work Profiles to bypass traditional fraud detection systems. This method is linked to Gigabud, a Remote Access Trojan active since at least 2022, and Vwork, an application cloning tool based on open-source software. Attackers distribute phishing links via social media and messaging, tricking victims into installing malicious files disguised as legitimate utilities. Once installed, the malware seeks Accessibility permissions and other capabilities to capture screen credentials and control the device. Vwork creates an isolated Work Profile to duplicate banking apps, allowing attackers to conduct fraudulent transactions without triggering security alerts in the personal space. Instances of counterfeit financial applications operating from these isolated environments have been documented, particularly in Indonesia. Between February and July 2026, monitoring revealed around 1,469 compromised devices and 1,281 compromised account credentials in Indonesia, resulting in estimated financial losses of 8.2 crore rupees. The operation is believed to be part of a larger international campaign linked to GoldFactory, with malware targeting users in multiple countries including Brazil, Colombia, Egypt, and others. Security experts warn that unusual Work Profile installations, duplicated banking apps, and unexpected requests for Accessibility permissions indicate a compromised device. Users are advised against sideloading APK files from private messages and should limit sensitive permissions to verified applications. Researchers emphasize the need for financial institutions to adopt behavioral analysis to detect unauthorized transactions effectively.

Tech Optimizer

August 23, 2026

The First Antivirus Built for Family IT Support Misses the Mark on Protection

Splashtop has launched its antivirus product, Splashtop Shield, after over two decades in remote access solutions. The antivirus received a four-star rating but is still being refined. It offers remote care capabilities for families, with various licensing options: an Individual license for two computers, a Family Lite license for up to five devices, and a full Family subscription for ten devices. Pricing is competitive within the market. Splashtop Shield enhances security by blocking unapproved remote access tools and provides a control console for family members to manage antivirus settings. In testing, it scored 7.8 out of 10 for malware protection, lower than competitors, and blocked 86% of malware-hosting URLs. It excelled in phishing protection, detecting 99% of fraudulent attempts. The Family Guardian feature allows comprehensive control over family members' antivirus settings, facilitating remote assistance. However, the antivirus component lacks the robustness of established competitors, and its performance raises concerns.

AppWizard

July 14, 2026

AI hacks apps in five minutes: fake builds can flood messengers

Recent findings from a study by Positive Technologies indicate that AI is increasingly being used by hackers to modify mobile applications, with a success rate of over 60% for embedding unauthorized code without disrupting functionality. The study analyzed 90 Android applications, finding closed commercial models had an 84% success rate, while open-source applications had a 61% success rate. Modifications were completed in as little as 5 minutes and 38 seconds to up to 9 minutes and 9 seconds, with costs ranging from 0.88 to 40.89 rubles per modification. Messaging platforms and third-party sites are particularly at risk, especially for users seeking unofficial app versions. Developers are advised to improve security against code modification and unauthorized clones.

Winsage

July 11, 2026

This Windows feature has been eating users’ RAM for years, Microsoft still hasn’t fixed it

Memory leaks have been reported with the Phone Link feature in Windows 11, specifically the Cross Device Service, which is consuming excessive amounts of RAM. Users have noted that this service can use between 15 to 30GB of RAM, leading to significant system slowdowns and reduced internet speeds. Complaints about this issue have been ongoing since early 2023, with users often needing to manually intervene via Task Manager to restore system performance. The Cross Device Service is intended to facilitate features like clipboard sharing and notification syncing but appears to malfunction and enter a loop that increases memory usage. Microsoft has not officially acknowledged the problem, and while generic troubleshooting steps have been suggested, they may not resolve the issue for all users. Disabling the Phone Link feature has been proposed as a potential solution to mitigate memory consumption.

Tech Optimizer

July 10, 2026

GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware

Microsoft Threat Intelligence has identified the GigaWiper malware, which has been detected in compromised environments since October 2025. This malware has destructive capabilities and comes in two forms: standalone wiper binaries and larger binaries with backdoor functionalities, both developed in Golang. The standalone wiper operates at the physical disk level, overwriting disk content and removing partition references. The backdoor variant includes the same wiper functionality and adds persistence through a registry key and scheduled tasks, along with command and control communication via RabbitMQ and Redis. GigaWiper can execute various commands, including wiping drives, triggering a Blue Screen of Death (BSOD), file encryption that mimics ransomware behavior, and managing system elements. The malware integrates components from multiple malware families, including wipers and ransomware mechanisms, and has been linked to a previous malware known as FlockWiper. To defend against GigaWiper, organizations are advised to implement security measures such as tamper protection, blocking access to known C2 infrastructure, and utilizing endpoint detection and response solutions. Microsoft Defender provides detections for GigaWiper and related malware, and threat intelligence reports are available for customers to stay informed about threats. Indicators of compromise include specific SHA-256 hashes and IP addresses associated with GigaWiper.