report Archives

AppWizard

September 11, 2026

NetScaler vulnerability exploited, AdaptHealth suffers breach, new Android malware

The Cybersecurity and Infrastructure Security Agency (CISA) warned of a critical vulnerability in NetScaler, identified as CVE-2026-19490, with a CVSS score of 9.3, which has been exploited and affects all NetScaler ADC and Gateway appliances. Citrix has patched this vulnerability as of August 19. AdaptHealth reported a data breach affecting over 4.1 million individuals, compromising personal, health, and insurance information, but not Social Security numbers or financial data. A new strain of Android malware, MantaxOtax, attributed to Indonesian threat actors, combines ransomware and spyware, stealing sensitive information and affecting older Android versions. The Gigabud banking trojan has evolved to evade detection by installing a secondary app that hides the malicious application. CISA acting director Nick Andersen emphasized the need for swift adaptation to cybersecurity threats and highlighted staffing improvements within CISA. Russian e-commerce giant Wildberries experienced disruptions from a DDoS attack affecting payments to sellers, following claims of a cyber operation by Ukraine's military intelligence. McKesson faced a cyberattack exposing sensitive data of 6.4 million individuals, with the ShinyHunters group releasing this data after a failed extortion attempt. IDScan confirmed a data breach affecting 150 million individuals, resulting in the theft of personally identifiable information and government-issued documents.

Winsage

September 11, 2026

Is this Windows 11’s new modern cursor? Microsoft quietly shows a redesigned pointer

Microsoft released Experimental Windows 11 build version 26340.9354, which includes a mock-up of a new Resume hovercard featuring a redesigned mouse pointer. The new pointer has a broader shape, a softer curve on its lower-left side, and a more symmetrical appearance, differing from the traditional thin tail-like extension of Windows cursors. Although Microsoft has not confirmed any changes to the system cursor, the release notes mention a known issue with cursor customization but do not address any redesign. Reports from June indicated that Microsoft was testing a new cursor as part of its Windows 11 modernization initiative. The mock-up resembles a Fluent icon, with a cleaner and wider shape compared to the classic Windows arrow. Despite this, the current developer documentation still refers to the traditional pointer as the "arrow cursor." Windows 11 has modernized many UI elements, but the pointer has remained largely unchanged, with limited customization options. The combination of the recent mock-up and previous reports suggests a potential transformation in the cursor design may be forthcoming.

AppWizard

September 11, 2026

Dragon Age: Origins Fans Are Fixing The Game Themselves Because The Official PC Version Is Busted

Dragon Age: Origins on PC faces technical issues such as game crashes, memory leaks, and corrupted save files, which hinder player experience. Although fan-made fixes exist, they can be difficult to install and are not always effective, especially with larger save files. There is a growing need for comprehensive updates to improve the game's functionality and appeal.

AppWizard

September 11, 2026

Another New Android Auto Feature Is Mysteriously Gone

In recent months, the wavy progress bar feature in music applications on Android Auto, which replaced the traditional straight line, has disappeared for some users, particularly affecting Spotify. This feature was introduced to enhance the user interface but did not provide significant functional benefits. Users have reported that the wavy design reverts to a straight line when the app is in full-screen mode, while it appears on the Coolwalk screen. Additionally, Google Maps has stopped displaying a speedometer, which users find frustrating. There are calls for Google to implement a toggle feature for the progress bar design preference. The latest version of Android Auto, build 17.6, is currently available, with updates expected soon.

AppWizard

September 10, 2026

Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks

The Gigabud banking trojan installs a secondary Android application called Vwork, which creates a work profile on compromised devices to evade detection from banking app security measures. This work profile separates its contents from the personal space of the device, allowing fraudulent transactions without triggering alerts. Group-IB confirmed this operational chain in Indonesia, where Gigabud has been active since 2022 and is linked to the GoldFactory group, which uses deceptive tactics to distribute the trojan. Vwork simplifies the creation of a work profile and communicates with an external server for authorization before cloning apps. The report indicates that Vwork has been detected in various countries, while approximately 1,469 devices and 1,281 logins were compromised in Indonesia, leading to estimated losses of around ,000,000. Users can check for a work profile in their phone's settings and are advised to download apps only from official stores and to deny unnecessary Accessibility access.

AppWizard

September 10, 2026

Tong Launches Investigation of Messaging App He Calls ‘Cesspool Of Sexual Abuse’

Attorney General William Tong has launched an investigation into MediaLab.AI Inc., the parent company of Kik, due to concerns about the app's child safety practices. Kik is described as having inadequate age verification and content screening, with about one-third of American teenagers using it, and 70% of users aged 13 to 24. The National Center on Sexual Exploitation identified Kik as a leading app for exposing children to sexual content and included it in their “Dirty Dozen” list. Between 2014 and 2020, over 2,000 federal cases involved Kik. MediaLab has attempted to improve safety by reclassifying the app to an 18+ rating and activating explicit content filters, but these efforts have been deemed insufficient. The investigation will also assess Kik's compliance with the Connecticut Data Privacy Act, focusing on the handling of sensitive data without consent.

BetaBeacon

September 10, 2026

Anbernic RG 55G1 Targets Retro Players With Snapdragon and 1080p Screen

Anbernic RG 55G1 is a new Android handheld with a Qualcomm Snapdragon G1 Gen 2 processor and a 5.5-inch full-HD display. It is priced at 9.99 in the United States and offers options for players seeking a larger screen and more power than entry-level retro consoles.

Winsage

September 9, 2026

Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week

Recent investigations have identified the BlueMoon exploit kit, used by espionage-driven threat activity clusters, particularly linked to APT31, a China-aligned state-sponsored group, since August 28, 2026. BlueMoon exploits three vulnerabilities: CVE-2026-85046 (a type confusion vulnerability in Google Chrome's V8 engine), an unassigned V8 sandbox escape, and CVE-2026-85880 (a heap-based buffer overflow in Windows ALPC). Google and Microsoft have released patches for these vulnerabilities, which were exploited as "patch-gap" zero-days. The attack vectors typically begin with phishing emails that lead victims to malicious URLs, triggering the vulnerabilities for code execution and privilege escalation. Variants of BlueMoon have been detected, featuring modifications for specific campaigns. Notable attack chains include: - APT31 targeting NGOs and mining firms in the U.S. with a malicious browser add-on called GemStone. - UNK_LateNight targeting U.S. aerospace companies, deploying BlueMoon alongside the ShadowPad backdoor. - UNK_DoubleCheck targeting a Vietnamese manufacturer, using DLL sideloading to execute a Rust binary. - UNK_QuietRacket targeting government and financial organizations in Indonesia and Singapore, modifying BlueMoon to execute a .NET assembly. CISA added the Chrome flaw to its Known Exploited Vulnerabilities catalog on September 4, 2026, requiring federal agencies to apply patches by September 18, 2026. Indicators of compromise include specific process trees, files, folders, scheduled tasks, mutexes, and registry keys. Proofpoint has released detection rules to help organizations identify and mitigate these threats.

AppWizard

September 9, 2026

Attorney General Tong Announces Investigation Into “Predator’s Paradise” Kik Messenger App

Attorney General William Tong has launched an investigation into MediaLab.AI Inc., the parent company of the messaging app Kik, following allegations of inadequate age verification and content moderation practices. Kik has been criticized for its reputation as a platform for sexual abuse, exploitation, and bullying, particularly among minors, with over one-third of American teens reportedly using the app. A 2025 report ranked Kik as the second worst app for extreme sexual content and the third worst for severe bullying, and the app has been included on the National Center on Child Exploitation's "Dirty Dozen" list. Despite claims of restricting new users to those aged 18 and older as of September 2023, evidence suggests that Kik continued to market to younger audiences, and the app maintained a "Teen" rating until early 2025. The Attorney General's office issued a notice of violation to MediaLab in July 2025 for deficiencies in Kik’s privacy practices and has issued a civil investigative demand for further records related to data processing and content moderation. This investigation is part of a broader effort to protect children from online threats in Connecticut.

AppWizard

September 9, 2026

Gigabud Uses Android App Cloning to Evade Fraud Detection

The Gigabud Android banking trojan can clone banking applications into a separate Android work profile, allowing fraudsters to bypass malware alerts during transactions. Research by Group-IB, released on September 9, indicates that Gigabud is used with Vwork, a modified app for cloning, attributed to the GoldFactory group. The infection has been confirmed in Indonesia but targets 11 countries, including Brazil, Colombia, Egypt, Mexico, Thailand, and Turkiye. Vwork uses Android's Work Profile feature to isolate cloned apps, making them less detectable. This allows operators to install malware, clone banking apps, and execute transactions without raising alarms. During fraud, fake login screens capture credentials, and an invisible overlay collects lock screen codes. From February to July 2026, 1,469 devices were compromised in Indonesia, with financial losses nearing 0,939. Gigabud spreads through phishing and social media, requesting permissions to control devices. Group-IB identified six behavioral signals for banks to monitor as indicators of high-risk sessions. Recommendations include device binding and downloading apps only from official stores.