Safe Mode Archives

Tech Optimizer

September 22, 2026

This fake LastPass Authenticator app will just shut off your antivirus and leave you open to attack

LastPass has identified a sophisticated scheme targeting users of its Authenticator app, involving SEO poisoning and deceptive GitHub pages that distribute malicious ZIP files disguised as legitimate software. Users searching for "LastPass Authenticator download" may encounter these counterfeit pages, which redirect them to a malicious server delivering a ZIP file containing vsdbg.exe and vsdbg.dll. The executable is a legitimate Microsoft debugging tool exploited to execute the malicious DLL through DLL sideloading, allowing the malware to run undetected. Named Rapuncel by security researchers from Delphos, this malware is undetectable by antivirus engines and targets a hardcoded list of 145 antivirus and endpoint security products, disabling them upon detection. Rapuncel harvests sensitive information, including saved passwords from over 25 web browsers, cryptocurrency wallet files from more than 30 applications, and session tokens from platforms like Discord and Steam. It also captures screenshots and compiles a profile of the infected system, uploading the stolen data to an attacker-controlled server. The malware includes a kernel driver that intercepts web traffic, allowing for advertisement injection and search result manipulation. This campaign has been active for several months, with LastPass vaults remaining unaffected. Users are advised to download applications only from trusted sources. Rapuncel establishes persistence on infected machines by installing itself as a Windows service that starts with the system and terminates activated security products. Removing the kernel driver requires booting into Safe Mode or using external recovery tools, as standard Windows utilities cannot eliminate software operating at that level.

Tech Optimizer

September 20, 2026

How to Remove a Keylogger: 12 Steps, 60 Min [2026]

A keylogger captures every keystroke made on a device and sends that information to an external source. In 2025, infostealer malware, including keyloggers, resulted in the theft of 642.4 million credentials from 13.2 million infections globally. In Australia, approximately 30,000 banking passwords were compromised between 2021 and 2025 due to this malware. The Australian Cyber Security Centre reported over 42,500 calls related to credential theft in one year, a 16% increase. Four main malware families dominate the landscape, with LummaC2 accounting for nearly 60% of credentials linked to infostealers in 2026. Keyloggers can be detected through signs such as typing lag, unexpected antivirus notifications, new browser extensions, and unexplained spikes in outbound data usage. Detection and removal steps include checking running processes, auditing startup programs, reviewing installed programs, running antivirus scans, and resetting passwords from a clean device. Keyloggers can infiltrate systems via phishing emails, malicious attachments, or compromised software downloads. Mobile devices can also be targeted by keyloggers disguised as legitimate apps.

Winsage

September 7, 2026

Windows 11 wants your trust. Microsoft keeps testing it

Microsoft is facing significant security and reliability issues, particularly related to system startup, BitLocker recovery, and updating Secure Boot certificates. Users have expressed confusion over these complexities, especially regarding Microsoft Defender Antivirus errors. These problems stem from a tumultuous period before the launch of Windows 11, including changes to the TPM requirement and the extension of Windows 10's life. Despite increased security patches, underlying issues remain, leading to user skepticism about the reliability of Windows systems.

AppWizard

September 3, 2026

Android stuck in Safe Mode? Here’s how to turn it off

Safe Mode on Android disables all third-party applications and engages Airplane Mode to help troubleshoot device issues. It can be activated by holding down the Power Off button and selecting the Safe Mode option, which may lead to unintentional activation. To disable Safe Mode, users can either restart the device or tap the notification in the Notification Menu indicating Safe Mode is active. After exiting Safe Mode, Airplane Mode may remain active, which can be turned off through the Quick Settings menu. Google Play Protect also provides additional security measures that may cause user frustration.

AppWizard

September 2, 2026

MHA issues advisory on malicious Android apps used to steal money, take control of phones

Cybercriminals are increasingly using malicious Android applications disguised as pornography apps to take control of users' devices and conduct unauthorized financial transactions. The Indian Cyber Crime Coordination Centre (I4C) has issued a warning about this trend. These apps are often promoted on social media and require users to download APK files from outside the Google Play Store. The National Cybercrime Threat Analytics Unit (NCTAU) has reported a rise in financial fraud linked to these applications, which include names like “Night Play,” “Reloop,” and “Kyss.” Once installed, these apps request sensitive permissions, such as Accessibility access, allowing malware to read screen information, click buttons, enter OTPs or PINs, confirm transactions, and initiate fund transfers, leading to unauthorized access to bank accounts. Additionally, the malware may install secondary applications or a VPN to reroute internet traffic through attacker-controlled servers, exposing sensitive data. These apps may also prevent uninstallation through standard device settings. The NCTAU advises users to only install apps from trusted sources, avoid unknown APK files, refrain from granting Accessibility permissions to unfamiliar apps, regularly review installed applications, and keep their devices updated. Users should monitor bank accounts for suspicious activity and, if compromised, restart in Safe Mode to uninstall malicious apps. If removal is difficult, backing up data and performing a factory reset is recommended. Citizens are encouraged to report fraudulent applications or cybercrime incidents through the national cybercrime helpline 1930 or the government’s reporting portal.

AppWizard

September 1, 2026

Fake Porn Apps Target Android Users Via Ads On Facebook, Instagram: How To Stay Safe

Cybercriminals are targeting Android users with deceptive advertisements for malicious applications disguised as pornographic content on platforms like Facebook and Instagram. The National Cybercrime Threat Analytics Unit (NCTAU) has reported that these ads lead users to phishing traps or malware downloads that can compromise banking credentials. Malicious applications linked to this threat include “Night Play,” “Reloop,” “Kyss,” “Vimo,” “Rivo,” “Nexo,” and “Vixa.” The scam involves promoting these apps through enticing ads, redirecting users to websites offering pornographic content, and prompting them to download APK files directly from these sites, often using “.live” domains. The initial app may request users to download a second package disguised as an update, which can exploit permissions granted to the first app. This malware can gain extensive control over the device, potentially installing a VPN that routes internet traffic through attackers' servers. To protect against this threat, users should download apps only from trusted sources, avoid installing APK files from ads or suspicious links, refrain from granting Accessibility access to unknown apps, regularly review installed apps, keep Google Play Protect enabled, and monitor bank accounts for unusual activity. If a suspicious app cannot be uninstalled, users can try Safe Mode, remove special permissions, or perform a factory reset as a last resort.

AppWizard

August 31, 2026

Home Ministry alerts about rise in financial frauds through malicious Android apps

The Indian Cyber Crime Coordination Centre (I4C) has reported a rise in financial frauds associated with malicious Android applications disguised as pornography apps. These apps, including names like "Night Play," "Reloop," and "Kyss," are promoted through ads on Facebook and Instagram, leading users to phishing websites where they are encouraged to download APK files from unverified sources. The malicious apps exploit permissions granted by users to take control of devices, potentially facilitating unauthorized financial transactions. Recommendations for safety include only installing apps from reputable sources, avoiding suspicious downloads, and regularly monitoring financial transactions. Instructions for uninstalling these apps involve starting the phone in Safe Mode, uninstalling the suspicious app, and then restarting the device.

AppWizard

August 31, 2026

Fake dating apps are being used to target Android users: How the new cyber scam works

India's cybercrime authorities have warned about the misuse of dating and adult-themed advertisements on social media platforms like Instagram and Facebook, which are being exploited by criminals to distribute malicious Android applications. These ads redirect users to external websites where they are prompted to download APK files, bypassing security measures of trusted app stores. The Indian Cybercrime Coordination Centre (I4C) has identified several malicious applications, including Night Play, Reloop, Kyss, Vimo, Rivo, Nexo, and Vixa, and cautions against installing unfamiliar applications promoted through unsolicited ads. These apps may request sensitive permissions, such as access to SMS messages, contacts, photos, device storage, and Accessibility Services, which can allow fraudsters to access valuable information. Compromised devices can lead to financial fraud by intercepting OTPs and other verification details. The I4C recommends using trusted app stores, keeping Google Play Protect active, reviewing app permissions, and being cautious with social media ads. If a suspicious app is installed, users should restart their phone in Safe Mode to uninstall it, disable its permissions if necessary, and consider a factory reset if removal fails. Users who suspect fraud are encouraged to report incidents promptly.

Tech Optimizer

August 17, 2026

Best Malware Removal Tools of 2026: Tested on Infected PC

A hands-on evaluation was conducted to assess the effectiveness of various malware removal tools by deliberately infecting a PC and running six different cleanup tools. The recommended steps for users suspecting malware infection include disconnecting from the internet, installing an on-demand scanner, removing detected threats, rebooting the system, and changing passwords. The top malware removal tools identified were: 1. Malwarebytes Free: Quick scan in 2 minutes and 20 seconds; complete removal with no remnants. 2. Bitdefender: Quick scan in 1 minute and 4 seconds; complete removal confirmed. 3. Norton 360: Quick scan in 58 seconds; effective for severely compromised devices. 4. Avast One Free: Quick scan in 1 minute and 12 seconds; complete removal with ongoing protection. 5. McAfee: Full system scan took 16 minutes and 47 seconds; complete removal but slower than others. 6. NordVPN Threat Protection Pro: Focuses on preventing reinfection, does not remove existing malware. Signs of infection include unexpected pop-ups, altered homepage settings, and sluggish performance. For Windows, Safe Mode with Networking is recommended for removal, while Mac users should use Activity Monitor to identify suspicious processes. Android users can utilize Safe Mode and Play Protect for scanning. A factory reset may be necessary if infections persist. Malwarebytes Free and Avast One Free are highlighted as effective free options for malware removal.

Tech Optimizer

August 16, 2026

Best Android Antivirus Apps 2026: Tested and Ranked

Bitdefender Mobile Security is rated as the best antivirus app for Android in 2026, achieving a 100% detection rate, 0.5% battery drain, and unobtrusive operation. The evaluation compared five antivirus applications on a Galaxy S26 Ultra, assessing detection rates, battery drain, scan speed, and permissions. Other notable antivirus apps include Norton 360 for Mobile, which is recognized for its features; Avast Mobile Security, known for its free version; McAfee Mobile Security, which excels in scam call and text filtering; and NordVPN Threat Protection, praised for web and Wi-Fi security. Most users may not need an antivirus app due to built-in protections like Google Play Protect, which automatically scans apps. However, specific scenarios warrant the installation of an antivirus app, such as sideloading apps, receiving scam texts and calls, assisting relatives, conducting banking and shopping on mobile, and using public Wi-Fi. The top five antivirus apps tested are: 1. Bitdefender Mobile Security: 100% detection, 0.5% battery drain, 31-second scan time. 2. Norton 360 for Mobile: 99.9% detection, 0.9% battery drain, 24-second scan time. 3. Avast Mobile Security: 99.9% detection, 0.7% battery drain, 26-second scan time. 4. McAfee Mobile Security: 99.78% detection, 1.0% battery drain, 34-second scan time. 5. NordVPN Threat Protection: 95.60% detection of web threats, 0.2% battery drain. Battery consumption varied, with NordVPN being the lightest and McAfee the heaviest. Permissions requested by each app also varied significantly, with Bitdefender requiring the most extensive permissions. Users are advised to check for legitimate antivirus apps by verifying the developer, installation count, update history, lab participation, and permission requests. Free antivirus apps like Avast and AVG offer effective protection but may lack some features of paid versions. Users should be cautious of fake security apps that mimic legitimate ones. If malware is suspected, users can run scans with Google Play Protect or other anti-malware apps and follow specific steps to remove malware if detected.