reverse engineering Archives

AppWizard

May 29, 2026

Android App Security Essentials: How to Build Secure Mobile Applications

Mobile applications have transformed business operations and communication, becoming essential in various industries. As reliance on mobile technology increases, organizations face cybersecurity challenges such as malware, unauthorized access, data leaks, and phishing. This has led to a focus on Android app security, with businesses implementing advanced protection strategies. To address cybersecurity threats, modern Android applications require multiple security layers. Secure coding practices minimize vulnerabilities through structured frameworks, automated testing, and regular code reviews. Strong user authentication systems, including multi-factor authentication and biometric verification, protect against unauthorized access. Data encryption secures sensitive information during transmission and storage, helping organizations comply with data protection regulations. Malware attacks are a significant concern, prompting developers to implement anti-malware frameworks and application shielding technologies. To prevent reverse engineering, developers use code obfuscation and tamper detection systems. Managing mobile device permissions securely is crucial to protect sensitive user information. Emerging technologies, such as artificial intelligence, enhance mobile security by improving threat detection and response. DevSecOps integrates security practices into the development lifecycle, allowing for continuous vulnerability identification. Robust endpoint protection solutions monitor devices for malware and unauthorized access, supporting stronger cybersecurity governance across mobile ecosystems.

Winsage

May 18, 2026

Windows CE Ported to Nintendo 64

Throaty Mumbo successfully ran Windows CE 2.11 on the Nintendo 64 by leveraging the shared architecture of both systems, which are based on the MIPS R4000 processor family. The project involved a month of reverse engineering, using Microsoft toolchains, custom hardware modifications, and debugging techniques. An EverDrive flash cartridge was used to load custom ROMs, and a USB connection facilitated uploads from a PC. Challenges included crashes with the initial EverDrive cartridge, which were resolved by upgrading to the EverDrive-64 X7. A custom kernel clone was created to troubleshoot issues with the stock Windows CE kernel, ultimately allowing the project to revert to the unmodified version. The Nintendo 64 controller was repurposed as a mouse, and standard Windows CE applications could be launched from the desktop. Comprehensive build details are available on GitHub.

AppWizard

May 12, 2026

Popular PlayStation emulator clamps down on AI submissions: ‘Leave behind something useful to humanity when you’re gone, instead of peddling slop’

The RPCS3 development team has publicly addressed the influx of AI-generated pull requests (PRs) in their project, urging contributors to stop submitting what they call "AI slop code" and warning that they will ban those who do not disclose AI contributions. They expressed concern over poorly constructed PRs, particularly affecting their macOS build, and emphasized the importance of understanding the code being contributed. The team clarified that their issue is not with the use of AI code itself, but with the lack of disclosure. They have established new guidelines for AI contributions, allowing the use of AI tools for research and reverse engineering, but requiring contributors to fully understand and take ownership of their code. All communication with the team must come from human contributors, not AI.

Winsage

April 2, 2026

Wine has been translating Windows games to Linux since 1993, but Proton is what made it effortless

Wine is a compatibility layer, not an emulator, that translates Windows API calls into POSIX equivalents, allowing Windows applications to run on Linux. Proton, developed by Valve, builds on Wine and includes additional components like DXVK and VKD3D-Proton to enhance performance for Windows games on Linux through Steam. For Steam users, Proton is recommended for a streamlined gaming experience, while Lutris is suggested for those outside the Steam ecosystem. Wine has been in development since 1993, focusing on recreating the Windows API, but faced challenges with gaming compatibility. Cedega was an early attempt to improve gaming support over Wine but ultimately declined. Valve's development of Proton was motivated by the need for better compatibility for Windows games on Linux, especially highlighted by the launch of the Steam Deck. Wine struggled with synchronization issues and handling direct kernel access by Windows applications, which Proton addressed with seccomp-bpf filters and syscall user dispatch. Both Wine and Proton are crucial to the current state of Linux gaming.

Tech Optimizer

January 22, 2026

Hackers Weaponized 2,500+ Security Tools to Terminate Endpoint Protection Before Deploying Ransomware

A large-scale campaign is exploiting the truesight.sys Windows security driver from Adlice Software’s RogueKiller antivirus to disable endpoint detection and response (EDR) and antivirus solutions, facilitating the deployment of ransomware and remote access malware. This attack utilizes over 2,500 validly signed variants of the driver, allowing attackers to manipulate legacy driver signing rules to load pre-2015 signed drivers on Windows 11 machines. The vulnerable TrueSight driver exposes an IOCTL command that enables attackers to terminate security processes, providing them with kernel-level access to bypass user-mode protections. The infection chain typically starts with phishing emails or compromised sites, leading to the installation of a downloader that retrieves additional malicious components. The malware establishes persistence and deploys an EDR killer module targeting nearly 200 security products. Once defenses are disabled, the final payload, often a remote access trojan or ransomware, executes with minimal visibility, completing the attack in as little as 30 minutes.

AppWizard

December 25, 2025

Android Malware Operations Merge Droppers, SMS Theft, and RAT Capabilities at Scale

Threat actors in Uzbekistan are increasingly using sophisticated tactics to target mobile users, specifically through malicious dropper applications that appear as legitimate software. A recent analysis by Group-IB identified an Android SMS stealer called Wonderland, which was previously known as WretchedCat. Unlike traditional Trojan APKs that activate malware immediately upon installation, Wonderland utilizes droppers that activate malicious payloads locally after installation, even without an internet connection. Wonderland enables bidirectional command-and-control communication, allowing real-time execution of commands, including SMS theft and USSD requests. It disguises itself as Google Play or various file formats to evade detection. The financially motivated group behind this malware, TrickyWonders, uses Telegram for coordination and was first detected in November 2023. Wonderland is associated with two dropper families: MidnightDat and RoundRift. Propagation methods for Wonderland include counterfeit Google Play Store pages, Facebook ads, and fake accounts on dating apps. Attackers exploit stolen Telegram sessions from Uzbek users to distribute APK files. Once installed, Wonderland can access SMS messages, intercept one-time passwords, and siphon funds from victims' bank accounts. It can also retrieve phone numbers, exfiltrate contact lists, suppress security alerts, and send SMS messages from compromised devices. Users must enable installations from unknown sources to sideload the app, often misled by a fake update screen. If granted permissions, attackers can hijack the phone number and log into the associated Telegram account, perpetuating the malware's spread. Wonderland represents a significant evolution in mobile malware in Uzbekistan, moving from basic malware like Ajina.Banker to more sophisticated variants like Qwizzserial. The use of dropper applications enhances its deceptive nature, allowing it to evade security checks. Both the dropper and SMS stealer components are heavily obfuscated, complicating reverse engineering. The supporting infrastructure for Wonderland is dynamic, with rapidly changing domains complicating monitoring efforts. Malicious APKs are generated through a Telegram bot and distributed by a network of threat actors. New strains of malware, such as Cellik, Frogblight, and NexusRoute, have also emerged, each capable of harvesting sensitive information from compromised devices.

AppWizard

October 25, 2025

OWASP Mobile Top 10 for Android – How AutoSecT Detects Each Risk?

Mobile applications account for 70% of global interactions, with over 6.8 billion smartphone users. In 2023, 40% of data breaches are linked to vulnerabilities in mobile applications. The OWASP Mobile Top 10 outlines critical security risks for mobile apps, including: 1. Improper Credential Usage: Mishandling of passwords and session tokens. 2. Inadequate Supply Chain Security: Risks from unverified third-party components. 3. Insecure Authentication/Authorization: Failures in verifying user identities. 4. Insufficient Input/Output Validation: Lack of checks on incoming and outgoing data. 5. Insecure Communication: Unprotected data during transmission. 6. Inadequate Privacy Controls: Poor safeguards for personal data. 7. Insufficient Binary Protections: Lack of defenses against reverse engineering. 8. Security Misconfiguration: Improperly secured application settings. 9. Insecure Data Storage: Weak protection of sensitive information on devices. 10. Insufficient Cryptography: Use of weak or improperly implemented encryption. AutoSecT, an AI-driven mobile app security testing platform, detects these risks through various methods, including static code analysis, software composition analysis, and dynamic testing. It helps developers identify and mitigate vulnerabilities effectively.

AppWizard

October 15, 2025

GhostBat RAT Android Malware Poses as Fake RTO Apps to Steal Banking Data from Indian Users

The GhostBat RAT campaign employs sophisticated malware distribution techniques, utilizing infection vectors such as WhatsApp, SMS with shortened URLs, GitHub-hosted APKs, and compromised websites to deliver malicious Android droppers. These droppers utilize multi-stage workflows, ZIP header manipulation, and string obfuscation to evade detection. The malware includes tools for stealing banking credentials and cryptocurrency miners, directing victims to phishing pages resembling the mParivahan app to collect sensitive information. SMS messages with banking keywords are exfiltrated to command and control servers, while incoming messages may be forwarded for OTP harvesting. Device registration occurs through a Telegram bot named GhostBatRat_bot. In July 2024, Android malware impersonating Regional Transport Office applications was documented, designed to steal contacts and SMS messages. Observations from September 2025 revealed over forty samples propagating through WhatsApp and SMS, ultimately delivering a malicious version of the mParivahan app. The malware initiates phishing activities by requesting SMS permissions and harvesting banking credentials. VirusTotal detections for the malware remain low due to its multi-layered dropper mechanisms and obfuscation techniques. The architecture of GhostBat RAT features multi-stage dropper workflows, native binary packing, and heavy string obfuscation. The first-stage dropper verifies device architecture and manufacturer, while subsequent stages decrypt and execute payloads, including a cryptominer library and a malicious APK for data theft. Victims encounter a counterfeit Google Play update page, leading to the installation of the malicious APK, which requests SMS permissions and presents a phishing interface. Users are prompted to enter their UPI PIN into a fake payment flow, which forwards the PIN to a Firebase endpoint. The campaign highlights the need for careful SMS permission management and vigilance against shortened URLs to combat emerging Android malware threats.

Tech Optimizer

October 10, 2025

From infostealer to full RAT: dissecting the PureRAT attack chain

An investigation revealed that a Python-based infostealer campaign led to the deployment of PureRAT, a sophisticated remote access trojan (RAT). The campaign began with a phishing email containing a ZIP archive that included a legitimate PDF reader executable and a malicious DLL. The DLL executed a series of payloads, including a Python info-stealer that harvested sensitive data and exfiltrated it via the Telegram API. The attack progressed to a .NET executable, which employed techniques like process hollowing and evasion tactics to load additional payloads. The final payload, Mhgljosy.dll, was identified as PureRAT, which established an encrypted command-and-control (C2) channel and allowed for extensive control over the compromised host. The C2 server was traced to Vietnam, suggesting a connection to the PXA group. The malware's functionality included host fingerprinting, command execution, and potential access to sensitive information and resources. Indicators of compromise included specific file hashes, registry keys, and IP addresses associated with the C2 server.

AppWizard

October 2, 2025

This dangerous new Android malware disguises itself as a VPN or IPTV app – so be on your guard

Cybersecurity researchers from Cleafy have identified an Android trojan named Klopatra, which targets banking and cryptocurrency users by stealing funds from banking applications and cryptocurrency from hot wallets. This malware, attributed to a Turkish threat actor, has been active since March 2025 and has undergone 40 iterations. It is distributed through a deceptive app called Modpro IP TV + VPN, which requests Accessibility Services permissions upon installation. Klopatra employs advanced techniques to evade detection, including the use of Virbox for code protection, minimizing Java and Kotlin usage, NP Manager string encryption, and multiple anti-debugging features. Currently, at least 3,000 devices in Europe have been compromised by this malware.