Researcher Archives

Winsage

September 17, 2026

Bill Gates’s ‘kind lesson’ that Windows developer, now a billionaire, took to Sea when he built his $500 million Yacht

Gabe Newell, co-founder of Valve, created a custom-built superyacht named Leviathan, delivered by Oceanco. The 364-foot yacht features a glass wall etched with the names of nearly 3,000 contributors, honoring the collaborative effort behind its creation. Leviathan includes luxurious amenities like a 10-meter swimming pool and operates as a sophisticated oceanic base, equipped with a dive and scientific workstation, a laboratory, and 3D printing capabilities. The yacht also has an entertainment lounge optimized for holographic displays and a soundproof suite for music and video editing.

Winsage

September 10, 2026

Windows users are getting Harry Potter ads as their Bing Wallpaper, and they aren’t happy

Microsoft's Bing Wallpaper app has faced backlash after users discovered that their daily wallpaper, typically featuring serene landscapes, was replaced by an advertisement for the Harry Potter and Fantastic Beasts film collection. This change has frustrated users, with some questioning the presence of ads and considering uninstalling the app. Social media reactions have been critical, with users expressing disappointment over the shift from nature images to promotional content. The choice of a Harry Potter-themed advertisement has also drawn ire due to the controversial views of series creator J.K. Rowling. This incident follows a history of Microsoft integrating advertisements into its Windows ecosystem, starting with ads in Windows 10 in 2016 and continuing with various promotional content in Windows 11.

AppWizard

September 9, 2026

Hackers Clone Banking Apps into Hidden Profiles, Android Malware Raises New Fraud Concerns

Cybercriminals are using advanced Android malware that mimics banking applications within hidden Work Profiles to bypass traditional fraud detection systems. This method is linked to Gigabud, a Remote Access Trojan active since at least 2022, and Vwork, an application cloning tool based on open-source software. Attackers distribute phishing links via social media and messaging, tricking victims into installing malicious files disguised as legitimate utilities. Once installed, the malware seeks Accessibility permissions and other capabilities to capture screen credentials and control the device. Vwork creates an isolated Work Profile to duplicate banking apps, allowing attackers to conduct fraudulent transactions without triggering security alerts in the personal space. Instances of counterfeit financial applications operating from these isolated environments have been documented, particularly in Indonesia. Between February and July 2026, monitoring revealed around 1,469 compromised devices and 1,281 compromised account credentials in Indonesia, resulting in estimated financial losses of 8.2 crore rupees. The operation is believed to be part of a larger international campaign linked to GoldFactory, with malware targeting users in multiple countries including Brazil, Colombia, Egypt, and others. Security experts warn that unusual Work Profile installations, duplicated banking apps, and unexpected requests for Accessibility permissions indicate a compromised device. Users are advised against sideloading APK files from private messages and should limit sensitive permissions to verified applications. Researchers emphasize the need for financial institutions to adopt behavioral analysis to detect unauthorized transactions effectively.

AppWizard

September 4, 2026

WhatsApp rolls out emergency fix for locked Android photo access bug

WhatsApp is rolling out a fix for a privacy vulnerability affecting Android users that could allow individuals with physical access to a locked device to view the owner's photos during a video call. The issue was identified by security researcher Jose Rodriguez, who demonstrated that an incoming WhatsApp video call could provide access from the lock-screen to the device's photo gallery without unlocking the phone. WhatsApp confirmed the implementation of a fix and noted that the issue is limited to situations where someone has physical access to the device. Rodriguez reported the vulnerability to both Meta and Google, receiving limited responses. Users are advised to update WhatsApp and adjust app permissions to enhance privacy.

Tech Optimizer

September 3, 2026

Avast Antivirus Zero-Day PoC Lets Attackers Dump SAM Database and Gain SYSTEM Shell

A public proof-of-concept (PoC) repository has revealed a local privilege escalation zero-day vulnerability in GenDigital's Avast Antivirus, allowing attackers with local execution access to extract the Windows Security Account Manager (SAM) database and execute a shell with NT AUTHORITYSYSTEM privileges. The flaw is located in the Avast Sandbox component and could enable a complete local takeover of the system. The PoC is compatible with any version of Avast Antivirus and has been tested on fully patched versions of Avast and Windows 11 25H2. The repository does not provide a formal release, CVE identifier, or patch details. The vulnerability may also affect other GenDigital products like AVG and Norton. Security teams are advised to monitor for suspicious activities related to Avast services and restrict local administrator access. Organizations should inventory their deployed versions and apply vendor-provided updates as they become available.

Tech Optimizer

September 3, 2026

Prolific Microsoft 0-day hunter drops CrowdStrike Falcon exploit PoC

Nightmare Eclipse, a security researcher known for identifying vulnerabilities in Microsoft products, has shifted focus to other vendors, revealing a zero-day vulnerability called FalconFlank that targets CrowdStrike’s Falcon endpoint security platform. FalconFlank is a privilege escalation vulnerability that exploits the Microsoft Office malicious macros remediation feature within CrowdStrike Falcon. CrowdStrike is investigating the claims and advises customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting while assuring them of continued protection through Cloud Anti-malware settings. The exploit works on fully updated Windows 11 25H2 and Windows Server 2025 systems running CrowdStrike Falcon with Optimal Protection enabled. Nightmare Eclipse has also discovered other vulnerabilities, including HardBreacher affecting Kaspersky’s endpoint antivirus and PrettyPrague in Gen Digital’s Avast antivirus, which allows attackers to dump the SAM database. Gen Digital is developing a patch for the Avast vulnerability, while Kaspersky has not commented. Additionally, Nightmare disclosed a memory corruption zero-day vulnerability in Nvidia, named GreenSection, which causes system crashes.

Winsage

September 2, 2026

Fake Software Installers Disable Windows Update and Weaken Microsoft Defender

An active malware campaign is using counterfeit software-download websites to distribute malicious installers, primarily targeting users seeking popular software. This campaign has significantly affected China-based operations of multinational corporations and Chinese-speaking users. The malware, once executed, can establish persistence, undermine security measures, and communicate with attacker-controlled infrastructure. Victims span various sectors, including healthcare, manufacturing, gaming, technology, logistics, government, and education. Microsoft associates this campaign with a Chinese threat cluster called Silver Fox, known for using spoofed vendor download pages to spread Gh0st RAT and ValleyRAT. The malicious websites are hosted on .com.cn and .hl.cn domains, featuring Chinese-language content. The downloaded files are dynamically generated, and upon execution, they deploy a wrapper installer that initiates the malware payload. The malware achieves persistence through scheduled tasks and interferes with Windows Update services. The campaign establishes command-and-control communication over non-standard ports, with two identified domains linked to the activity. Microsoft Defender has detected the threat and initiated containment procedures. Kaspersky reported a related malicious installer exploiting a legitimate adware application to execute a backdoor, which captures keystrokes and clipboard contents. ValleyRAT, a sophisticated implant, can collect system information, reboot the computer, capture screenshots, and transmit logs. The attackers are motivated by cyber espionage and financial gain, targeting organizations globally. A subgroup within GoldenEyeDog, known as CuboidalCanine, has also been linked to the use of ValleyRAT, particularly in the gambling industry. In June 2026, Chinese authorities addressed cybercrime cases involving a new variant of the Silver Fox trojan.

Winsage

August 27, 2026

New Windows malware lays dormant until a custom command activates it like a sleeper agent

Researcher Dominik Reichel has identified a new malware implant called SLEEPWALKER, which is disguised as an agent from ESET. SLEEPWALKER is unique because it does not contain malicious code and remains dormant until it receives specific network signals to activate. It appears to be designed for targeted attacks, likely orchestrated by nation-states. Although it was submitted to VirusTotal last year, it has not been linked to any active campaigns or confirmed victims. The origins of SLEEPWALKER are unknown, and its code is described as somewhat "rough around the edges," indicating it may still be in development.

AppWizard

August 26, 2026

Beware of fake Indeed interview apps used to install spyware

Scammers are exploiting the Indeed platform to target job seekers by using counterfeit Android "interview" applications. Users in the UK and Brazil reported being instructed by supposed employers to download fraudulent apps like MyInterview, which compromised their devices. These scammers post fake job listings and prompt applicants to install apps that mimic Indeed's login page and establish a VPN connection. The malicious apps, classified as Trojan.Droppers, can install additional untrusted software and gain control over devices, complicating uninstallation efforts. Indeed confirmed that their interview process does not require downloading any separate app and warned job seekers against such scams. Indicators of compromise include specific MD5 hashes and package names associated with the Trojan droppers and dropped malware payloads.

AppWizard

August 26, 2026

GBA Emulator Android: My Boy! vs John GBAC vs RetroArch

Game Boy Advance emulation on Android has gained significant traction in 2026, with key applications like My Boy! priced at .99, John GBAC receiving an update on May 19, 2026, and RetroArch enhancing its mGBA core for free use. The search term "gba emulator android" sees around 8,100 monthly searches in the U.S., reflecting a resurgence in interest, particularly among former GBA owners now in their late 20s and 30s who prefer using their smartphones for gaming. All five apps—My Boy!, GBA.emu, John GBAC, RetroArch, and Lemuroid—can run the entire GBA library at full speed on devices from the last six years. The main differences lie in software quality, including save state management, cheat code reliability, controller mapping, and update frequency. My Boy! and GBA.emu utilize cores derived from VisualBoyAdvance (VBA), while John GBAC uses a custom core, and RetroArch and Lemuroid rely on the mGBA core. In terms of features, all apps support save states, but My Boy! offers multiple named slots with thumbnail previews, while RetroArch has a more complex system. Cheat code support is available across the board, with My Boy! and GBA.emu accepting GameShark and CodeBreaker formats, and RetroArch providing a built-in cheat database. My Boy! stands out for its link-cable emulation, allowing local multiplayer connections, whereas RetroArch's netplay is designed for online gaming. All apps support external controllers, but RetroArch excels in visual enhancements with its extensive shader options. The setup process for all five apps is similar and typically takes under ten minutes. GBA ROMs are small, ranging from 4MB to 32MB, making them easy to store on modern devices without significant battery drain. Common issues include save files not loading, audio problems, and cheat codes failing to apply, with solutions often involving file management and settings adjustments. Users can migrate save files between emulators by ensuring the correct file naming and directory structure. Pros and cons of each app include: - My Boy!: Ad-free, strong multiplayer support, but lower rating and closed-source. - GBA.emu: High rating and broad support, but outdated and lacks a free trial. - John GBAC: Free and recently updated, but lower rating and ad-supported. - RetroArch: Free and feature-rich, but complex setup. - Lemuroid: User-friendly and actively maintained, but limited shader options. All five apps are legally available on Google Play, as they do not distribute copyrighted ROM files. Users are advised to source their ROMs legally, ideally by dumping from their own physical cartridges. GBA emulation remains an accessible entry point into retro gaming on Android, especially compared to more demanding systems like the PS2 or GameCube.