sandbox Archives

AppWizard

September 26, 2026

#1 Best-Selling Steam Game Just Achieved Something No PC Game Has Since Palworld

The top-selling title on Steam from September 8 to September 22, 2026, is War Dogs, which has achieved significant sales and a peak of over 428,000 concurrent players. It ranks as the 36th biggest title on Steam and has received a "Very Positive" rating based on an 82% approval rating from nearly 52,000 user reviews. War Dogs is an online tactical first-person shooter featuring three teams in strategic combat, emphasizing collaboration and requiring players to invest time to master its mechanics. The game is currently in early access and is priced at .99, with expectations for a higher retail price upon final release.

AppWizard

September 24, 2026

RTX 5090 and DLSS 5 Transform Classic Minecraft into 4K

A recent benchmark in Minecraft contrasts the original aesthetic with a modified version using the NVIDIA GeForce RTX 5090 graphics card and DLSS 5 neural network rendering technology. The modified build features an AdaptiveVision shader, optimized ReShade post-processing presets, and material maps for roughness and reflectivity. DLSS 5 enhances textures without changing polygonal meshes, eliminating subpixel flickering and improving light and shadow gradients. The RTX 5090's video memory and tensor units maintain high frame rates during demanding path tracing and neural network computations. This project demonstrates the potential of machine learning technologies in enhancing classic games.

AppWizard

September 24, 2026

Survival RPG Everwind introduces a Minecraft-style sandbox mode in major new update

Everwind's latest update, Winds of Creation, introduces a sandbox mode that allows players to explore creativity without survival constraints. The update enhances the game with new features such as a revamped starting island for Arcanists, Wolverine-style claws for melee combat, and a Steamer Localizer device for locating points of interest. It also includes quality-of-life improvements like health and stamina restoration upon leveling up, streamlined item placement, and refreshed item icons and enemy names. The update is available as of September 24, and future developments are planned, including inter-ship teleportation and modding support.

Winsage

September 24, 2026

Windows 11 Pro is now only $10

Windows 11 Pro includes advanced features such as BitLocker for full disk encryption, Hyper-V and Windows Sandbox for running virtual machines, and integration with Azure Active Directory for business connectivity. It also offers Snap layouts for multitasking, DirectX 12 Ultimate for gaming, biometric login options with TPM 2.0 for enhanced security, and a Copilot feature for productivity assistance. A lifetime license for Windows 11 Pro is available for .97 until October 4.

Winsage

September 24, 2026

Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware

A Chinese threat actor, codenamed UTA0565, has exploited newly disclosed vulnerabilities in Google Chrome (CVE-2026-85046, CVE-2026-87491) and Windows (CVE-2026-85880) through deceptive websites, achieving remote code execution. The attacks were detected on September 3 and 4, 2026, and involved impersonating organizations to mislead victims, particularly targeting Asian government entities with phishing emails related to Hong Kong activist Chow Hang-tung. The phishing messages directed users to fraudulent sites that loaded an HTML element using the BlueMoon exploit kit, which delivered a payload named "chrome_cleanup.exe," associated with the CLEANGULP malware family. This malware allows for command execution, process listing, file uploads and downloads, and uses a hard-coded domain for command-and-control communications. The exploit's widespread use suggests a coordinated effort within the Chinese cyber espionage community, with indications that multiple groups are sharing and weaponizing the exploit.

Winsage

September 23, 2026

Cisco Talos Discloses Autonomous Windows Malware: Four AI Models Direct Each Attack

Cisco Talos has disclosed a new Windows implant called CLOSEDQUORUM, which operates without human operators by using four commercial large language models (LLMs) to autonomously decide on actions after deployment. The implant is a 16.4-megabyte executable that conducts reconnaissance on the target system and sends structured prompts to the LLMs, which respond with one of four actions: steal, inject, persist, or move. When the "steal" action is chosen, it simultaneously attacks three credential stores, extracting Windows credentials, browser passwords, and cryptocurrency wallet data. The "inject" action uses either Early Bird APC injection or process hollowing based on model recommendations. For persistence, it employs three overlapping mechanisms, including a Registry Run key, a scheduled task, and a WMI event subscription. To evade detection, CLOSEDQUORUM suppresses ETW telemetry and introduces delays before executing actions. It circumvents traditional command-and-control structures by calling legitimate API endpoints, making blocking these domains impractical. Talos introduced the CAIRN toolkit for detecting AI-integrated malware, which operates on metadata and employs rule-based detection. Unlike previous AI-assisted malware, CLOSEDQUORUM automates decision-making processes entirely, highlighting a significant evolution in malware capabilities. Security teams are advised to focus on behavioral detection strategies and utilize the YARA rule and CAIRN toolkit for identifying this threat.

Winsage

September 23, 2026

Cisco Talos Discloses Autonomous Windows Malware: Four AI Models Direct Each Attack

Cisco Talos has disclosed a Windows implant called CLOSEDQUORUM, which automates cyberattack execution using four advanced commercial large language models: DeepSeek, Qwen, Mistral, and Google Gemini. The implant is a 16.4-megabyte executable that conducts reconnaissance on the system and formats the gathered data into prompts for the AI models. Each model votes on one of four actions: steal, inject, persist, or move, with the action receiving the most votes being executed. When stealing, CLOSEDQUORUM targets three credential stores, dumping LSASS memory and retrieving saved passwords from browsers and cryptocurrency wallets. The stolen data is encrypted and sent to the operator via Discord. For injection, it uses Early Bird APC injection or process hollowing based on model responses. The persist action creates three mechanisms for longevity, including a Registry Run key, a scheduled task, and a WMI event subscription. CLOSEDQUORUM evades detection by suppressing ETW telemetry and delaying activity to avoid sandbox analyses. It connects to legitimate API endpoints, making blocking ineffective without disrupting enterprise applications. Talos recommends behavioral combination detection strategies and the use of a YARA rule for detection. The CAIRN toolkit has been introduced to detect AI-integrated malware without executing binaries. Unlike previous AI-assisted malware, CLOSEDQUORUM removes human decision-making from the attack process.

Winsage

September 22, 2026

Microsoft admits Windows 11’s emergency update still breaks audio, and a fix may not arrive until October

Windows 11 is facing ongoing challenges with audio functionality following recent updates, particularly with the emergency update KB5129195 released on September 14. This update aimed to fix issues from the September Patch Tuesday update (KB5124008) but has led to new problems, including compromised audio output on some devices and disruptions in secure trust relationships for enterprise systems. Users have reported error messages like “This device cannot start (Code 10)” in Device Manager, and issues with USB audio devices. Microsoft is investigating these audio problems but has not provided a timeline for resolution. Additionally, there are reports of GPU issues on AMD systems, including driver timeouts and black screens, affecting various Radeon models such as RX 6600, RX 7700 XT, RX 7800 XT, RX 7900 GRE, RX 7900 XTX, and RX 9070 XT. Some users found that uninstalling the September update alleviated these problems, but the emergency update KB5129195 does not address the GPU errors.

AppWizard

September 19, 2026

New RatHat Android Malware Uses AI to Steal Banking Logins, PINs and OTP Codes

Security researchers have identified an Android banking Trojan named RatHat, which utilizes artificial intelligence, accessibility features, and Android Debug Bridge (ADB) to steal financial credentials, PINs, and one-time passcodes. Unlike traditional malware, RatHat employs a live AI assistant that interacts with the Android accessibility tree, allowing it to make real-time decisions based on the victim's screen content. The infection typically starts with social-engineering tactics, leading victims to counterfeit download pages where they are tricked into sideloading a malicious APK. Once installed, RatHat prompts users to enable Android Accessibility Service permissions, which it exploits to navigate Developer Options and enable Wireless Debugging. This grants it shell-level ADB access, allowing it to bypass application sandbox restrictions. RatHat deploys two native binaries for executing commands and maintaining a connection to the attacker's infrastructure. It targets banking applications through credential-stealing overlays and can intercept SMS messages for transaction verification codes. Additionally, it can record touch coordinates to reconstruct PINs and unlock patterns. RatHat includes persistence mechanisms to restore itself after removal, and users are advised to perform a factory reset if they suspect compromise. To reduce infection risk, users should avoid sideloading apps from unknown links, deny unnecessary Accessibility Service requests, and refrain from enabling Developer Options or Wireless Debugging for unfamiliar applications.

Winsage

September 19, 2026

Give your PC a Windows 11 Pro upgrade for less than $10

Windows 11 Pro is available for .97, reduced from its regular price of 9. This limited-time offer is valid until September 27 at 11:59 p.m. PT. The operating system includes features such as Hyper-V, Windows Sandbox, BitLocker encryption, Azure AD integration, and Copilot, an AI-powered assistant.