report Archives

AppWizard

September 10, 2026

Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks

The Gigabud banking trojan installs a secondary Android application called Vwork, which creates a work profile on compromised devices to evade detection from banking app security measures. This work profile separates its contents from the personal space of the device, allowing fraudulent transactions without triggering alerts. Group-IB confirmed this operational chain in Indonesia, where Gigabud has been active since 2022 and is linked to the GoldFactory group, which uses deceptive tactics to distribute the trojan. Vwork simplifies the creation of a work profile and communicates with an external server for authorization before cloning apps. The report indicates that Vwork has been detected in various countries, while approximately 1,469 devices and 1,281 logins were compromised in Indonesia, leading to estimated losses of around ,000,000. Users can check for a work profile in their phone's settings and are advised to download apps only from official stores and to deny unnecessary Accessibility access.

AppWizard

September 10, 2026

Tong Launches Investigation of Messaging App He Calls ‘Cesspool Of Sexual Abuse’

Attorney General William Tong has launched an investigation into MediaLab.AI Inc., the parent company of Kik, due to concerns about the app's child safety practices. Kik is described as having inadequate age verification and content screening, with about one-third of American teenagers using it, and 70% of users aged 13 to 24. The National Center on Sexual Exploitation identified Kik as a leading app for exposing children to sexual content and included it in their “Dirty Dozen” list. Between 2014 and 2020, over 2,000 federal cases involved Kik. MediaLab has attempted to improve safety by reclassifying the app to an 18+ rating and activating explicit content filters, but these efforts have been deemed insufficient. The investigation will also assess Kik's compliance with the Connecticut Data Privacy Act, focusing on the handling of sensitive data without consent.

BetaBeacon

September 10, 2026

Anbernic RG 55G1 Targets Retro Players With Snapdragon and 1080p Screen

Anbernic RG 55G1 is a new Android handheld with a Qualcomm Snapdragon G1 Gen 2 processor and a 5.5-inch full-HD display. It is priced at 9.99 in the United States and offers options for players seeking a larger screen and more power than entry-level retro consoles.

Winsage

September 9, 2026

Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week

Recent investigations have identified the BlueMoon exploit kit, used by espionage-driven threat activity clusters, particularly linked to APT31, a China-aligned state-sponsored group, since August 28, 2026. BlueMoon exploits three vulnerabilities: CVE-2026-85046 (a type confusion vulnerability in Google Chrome's V8 engine), an unassigned V8 sandbox escape, and CVE-2026-85880 (a heap-based buffer overflow in Windows ALPC). Google and Microsoft have released patches for these vulnerabilities, which were exploited as "patch-gap" zero-days. The attack vectors typically begin with phishing emails that lead victims to malicious URLs, triggering the vulnerabilities for code execution and privilege escalation. Variants of BlueMoon have been detected, featuring modifications for specific campaigns. Notable attack chains include: - APT31 targeting NGOs and mining firms in the U.S. with a malicious browser add-on called GemStone. - UNK_LateNight targeting U.S. aerospace companies, deploying BlueMoon alongside the ShadowPad backdoor. - UNK_DoubleCheck targeting a Vietnamese manufacturer, using DLL sideloading to execute a Rust binary. - UNK_QuietRacket targeting government and financial organizations in Indonesia and Singapore, modifying BlueMoon to execute a .NET assembly. CISA added the Chrome flaw to its Known Exploited Vulnerabilities catalog on September 4, 2026, requiring federal agencies to apply patches by September 18, 2026. Indicators of compromise include specific process trees, files, folders, scheduled tasks, mutexes, and registry keys. Proofpoint has released detection rules to help organizations identify and mitigate these threats.

AppWizard

September 9, 2026

Attorney General Tong Announces Investigation Into “Predator’s Paradise” Kik Messenger App

Attorney General William Tong has launched an investigation into MediaLab.AI Inc., the parent company of the messaging app Kik, following allegations of inadequate age verification and content moderation practices. Kik has been criticized for its reputation as a platform for sexual abuse, exploitation, and bullying, particularly among minors, with over one-third of American teens reportedly using the app. A 2025 report ranked Kik as the second worst app for extreme sexual content and the third worst for severe bullying, and the app has been included on the National Center on Child Exploitation's "Dirty Dozen" list. Despite claims of restricting new users to those aged 18 and older as of September 2023, evidence suggests that Kik continued to market to younger audiences, and the app maintained a "Teen" rating until early 2025. The Attorney General's office issued a notice of violation to MediaLab in July 2025 for deficiencies in Kik’s privacy practices and has issued a civil investigative demand for further records related to data processing and content moderation. This investigation is part of a broader effort to protect children from online threats in Connecticut.

AppWizard

September 9, 2026

Gigabud Uses Android App Cloning to Evade Fraud Detection

The Gigabud Android banking trojan can clone banking applications into a separate Android work profile, allowing fraudsters to bypass malware alerts during transactions. Research by Group-IB, released on September 9, indicates that Gigabud is used with Vwork, a modified app for cloning, attributed to the GoldFactory group. The infection has been confirmed in Indonesia but targets 11 countries, including Brazil, Colombia, Egypt, Mexico, Thailand, and Turkiye. Vwork uses Android's Work Profile feature to isolate cloned apps, making them less detectable. This allows operators to install malware, clone banking apps, and execute transactions without raising alarms. During fraud, fake login screens capture credentials, and an invisible overlay collects lock screen codes. From February to July 2026, 1,469 devices were compromised in Indonesia, with financial losses nearing 0,939. Gigabud spreads through phishing and social media, requesting permissions to control devices. Group-IB identified six behavioral signals for banks to monitor as indicators of high-risk sessions. Recommendations include device binding and downloading apps only from official stores.

AppWizard

September 9, 2026

Android Auto Users Lose the Google Maps Feature They’ve Been Drooling Over for Years

Android Auto users are experiencing issues with Google Maps, particularly the disappearance of the speedometer feature after its recent integration. Some users report that the speedometer vanishes when navigation is disabled, while others find it completely absent. Additionally, critical navigation data, such as traffic light indicators, may also be missing. A persistent bug affecting traffic colors in Google Maps further complicates navigation. Users have shared varying experiences, with some finding that exiting beta versions of the apps resolves the issue. Google has not yet addressed these concerns, and an upcoming update for Google Maps is expected to enhance navigation features, including detailed maps and improved turn-by-turn instructions. The update is currently rolling out in the U.S. and Canada, with no timeline for other regions.

AppWizard

September 8, 2026

Telegram down in Singapore: Thousands report messaging app outage

On Tuesday, Telegram users in Singapore reported nearly 4,000 service disruptions, peaking shortly after 10:30 AM local time, with about half related to the app itself, 40% to messaging issues, and 5% to login challenges. Downdetector's figures are based on user reports. Telegram has been releasing new features this year, including enhancements introduced in August, such as welcome messages, interactive buttons, and AI bots. The platform faces challenges from government restrictions, particularly in Russia, where authorities have imposed fines on Telegram for non-compliance with local regulations and accused it of harboring illegal content. In March, Telegram was fined 35 million roubles for failing to remove prohibited content.

Winsage

September 7, 2026

Windows 11 wants your trust. Microsoft keeps testing it

Microsoft is facing significant security and reliability issues, particularly related to system startup, BitLocker recovery, and updating Secure Boot certificates. Users have expressed confusion over these complexities, especially regarding Microsoft Defender Antivirus errors. These problems stem from a tumultuous period before the launch of Windows 11, including changes to the TPM requirement and the extension of Windows 10's life. Despite increased security patches, underlying issues remain, leading to user skepticism about the reliability of Windows systems.

AppWizard

September 7, 2026

Xbox Cloud Gaming Caps Hours: 15 for Ultimate [2026]

On September 3, 2026, Microsoft announced that Xbox Game Pass subscribers will see a shift in cloud gaming access. Starting November 2026, unlimited cloud streaming will be replaced by a tiered hour bank system: 15 hours for Ultimate, 10 for Premium, and 5 for Essential subscribers. Once a subscriber exhausts their allotted hours, they must wait for the next billing cycle or purchase additional time. This change is the most significant since the beta launch of Xbox Cloud Gaming in 2019. The announcement was made on Xbox Wire, and the new structure is reflected on Xbox’s product pages. The new tiered system introduces a scarcity model, with every paid tier now having its own cloud gaming quota. Essential subscribers, who previously had no cloud access, will now receive 5 hours per month. The pricing for the Game Pass tiers is as follows: Ultimate at .99 for 15 hours, Premium at .99 for 10 hours, and Essential at .99 for 5 hours. The free ad-supported tier remains unchanged at 5 hours per month. Microsoft's rationale for the change is based on usage data indicating that most subscribers do not heavily utilize cloud streaming, coupled with the rising costs of operating cloud gaming services. The company has stated that additional hours can be purchased once a subscriber's monthly allotment is used up, although pricing details for these add-ons have not yet been disclosed. The new hour caps will take effect in November 2026, following a shorter notice period compared to NVIDIA's GeForce NOW service, which implemented a 100-hour monthly cap earlier in 2026. The response from gaming communities has been largely negative, with concerns about the limits falling short of typical usage patterns and conflicting with the marketing of Game Pass as offering unlimited access. The introduction of hour caps could impact Game Pass's subscriber base, particularly among those who rely on cloud gaming as their primary access point. Microsoft's internal usage data will determine the extent of this impact, as the company aims to control costs without raising subscription prices.