scan Archives

Tech Optimizer

June 20, 2026

Chinese police bust cybercrime ring behind ‘Silver Fox’ Trojan virus

Chinese law enforcement has dismantled cybercrime operations linked to a new variant of the Silver Fox Trojan virus, which targets employees in enterprises and public institutions, particularly in financial roles. The malware allows cybercriminals remote access to steal account credentials, intercept SMS verification codes, and harvest personal information. A criminal syndicate in Jilin province, led by an individual named Chen, developed this Trojan and conducted mass phishing campaigns, resulting in losses exceeding 7 million yuan. Police have taken action against Chen and 26 accomplices, with ongoing investigations. Recommendations for enhancing personal cybersecurity include downloading software from official websites, scrutinizing website domains, verifying links before clicking, and disconnecting compromised computers from the internet. Under China's Criminal Law, unauthorized access to computer systems and data theft can lead to imprisonment and financial penalties.

Tech Optimizer

June 20, 2026

PostgreSQL 18 on Amazon Aurora and Amazon RDS: Performance enhancements

PostgreSQL 18 addresses common performance challenges for users, including managing query performance across composite indexes, diagnosing memory spills in materialized Common Table Expressions (CTEs), and upgrading major versions without plan regressions. Key enhancements include skip scan optimization for multicolumn indexes, improved EXPLAIN functionality, and optimizer statistics that persist through major version upgrades. Skip scan optimization allows PostgreSQL to efficiently utilize multicolumn B-tree indexes even when leading columns are not specified in the WHERE clause, significantly improving query performance. The EXPLAIN command has been enhanced to include buffer statistics by default, providing deeper insights into query execution and resource usage. PostgreSQL 18 also introduces visibility into the storage of materialized nodes in query plans, indicating whether intermediate results were stored in memory or spilled to disk. A new metric, Index Searches, has been added to EXPLAIN ANALYZE output, indicating how many times the database traversed the index tree during query execution. Additionally, Self-Join Elimination (SJE) automatically detects and removes unnecessary inner joins of a table to itself, optimizing query performance. The autovacuum mechanism has been improved with the introduction of autovacuum_vacuum_max_threshold, which caps the number of dead tuples that can accumulate before autovacuum triggers a VACUUM, addressing issues with large tables. The vacuum_truncate parameter provides a server-wide control point to disable VACUUM’s file truncation behavior, reducing locking issues on busy systems. PostgreSQL 18 also separates the allocation of autovacuum worker slots from their usage, allowing for dynamic adjustments to autovacuum_max_workers without requiring a server restart. Finally, new columns in pg_stat_all_tables track cumulative time spent on maintenance operations, providing better insights into maintenance overhead for each table.

Tech Optimizer

June 20, 2026

How Five PostgreSQL Optimizations Sped Up Our Dashboard

The dashboard operates on a Django monolith with PostgreSQL and is transitioning to ClickHouse for denormalization. The initial p50 metric was 0.7 seconds, but the p95 was 8 seconds, which was reduced to 1 second. Observability tools were established to monitor performance, and slow HTTP requests were identified using OpenTelemetry traces. Optimization techniques included late joining, asynchronous counting, creating a PostgreSQL replica for read operations, and improving full-text search. Denormalization was explored to enhance filtering performance by creating composite indexes. The production stack was upgraded to PostgreSQL 18, which provided incremental performance improvements. The final p95 value achieved was 1 second, below the target of 3 seconds.

Tech Optimizer

June 18, 2026

Here’s What Actually Happens When Antivirus Software Scans Your PC

Interactions with antivirus software occur during installation and when issues arise, while the software operates quietly in the background. Modern antivirus solutions continuously monitor for threats using various detection methods, including real-time scanning, which actively scrutinizes files as they are downloaded or accessed. The signature database is essential for identifying malware by comparing files against known signatures, but it can only detect documented threats. Heuristic detection and behavioral analysis help catch unknown malware by evaluating suspicious characteristics and monitoring file actions during execution. Sandboxing allows suspicious files to run in a controlled environment, logging their behavior to determine if they are malicious. Quarantine neutralizes threats by locking files in a secure location, allowing users to review them before deletion. Full scans are resource-intensive and can slow down system performance, while real-time scanning is less demanding. Users can schedule scans during idle times, exclude trusted folders, or consider cloud-based solutions to mitigate performance impacts.

Tech Optimizer

June 18, 2026

Retro gaming fans are the new target for fake GitHub malware

Retro gaming enthusiasts should be cautious when exploring GitHub projects for tools or plugins, as cybercriminals may disguise malware as homebrew software. A specific incident involved a project called EQVita, which pretended to be a free audio tool for PlayStation Vita but actually contained Windows malware. The downloaded file included three files: Launch.bat, luajit.exe, and x64.txt, with the latter concealing a hidden script that connected to the attacker's server upon execution. This scam is part of a broader trend where counterfeit GitHub repositories distribute SmartLoader malware, which retrieves additional malicious software aimed at stealing passwords and cryptocurrency wallets. The PS Vita community, despite the console's production ceasing, remains active in modding, making it a target for attackers. Legitimate plugins typically come in Vita-compatible formats, while fake ones may feature polished marketing materials and AI-generated descriptions. Users are advised to verify sources, be cautious of suspicious downloads, and utilize security tools like Malwarebytes. If someone has executed the malicious EQVitav1.3.zip file, they should conduct a malware scan, change important passwords, and monitor accounts for unauthorized access. Indicators of compromise include the domains https://github.com/Voistace/EQVita and https://voistace.github.io, and the IP address 85.137.52.21.

Tech Optimizer

June 18, 2026

I tested Norton’s Deepfake Protection — and it finally convinced me my next laptop needs an NPU

The landscape of online security has evolved significantly, with deepfake technology introducing new challenges. Users must be vigilant against both traditional malware and convincing fake images and videos. Antivirus software developers are enhancing their products by integrating cloud-based AI for better threat detection. For users with computers featuring neural processing units (NPUs), local solutions are available, such as Norton’s Deepfake Protection, which analyzes synthetic voices and images to flag potential threats. This feature operates in the background, providing peace of mind during online interactions. Norton 360 includes options for Deepfake Protection, Safe Web, and Safe SMS, but requires sufficient system resources to function effectively. Running this protection on older laptops may hinder performance, making NPUs a worthwhile investment for enhanced security against deepfakes and other online threats.

AppWizard

June 16, 2026

50+ Samsung Galaxy Store apps spread phone malware

Samsung's Galaxy Store had over 50 applications that unknowingly distributed a hidden Android trojan named MagicAd, which has since been removed. Users who downloaded these apps may still have the malware on their devices, as it establishes persistent background services that remain after the app is uninstalled and hides its icon. Signs of infection include unsolicited ads, battery drain, and unexplained data usage. The malware evades detection by assessing its environment and concealing its core code in encrypted files. Developers rotated the infected apps to maintain persistence and generated revenue through fraudulent ad impressions. Users are advised to run security scans and consider a factory reset if symptoms persist, ensuring to back up important files without including app settings. No app store can guarantee the exclusion of all threats, so users should check ratings and download counts before installing applications.

Winsage

June 12, 2026

Microsoft’s bug-hunting nemesis extends vendetta with more zero-day attacks — Nightmare Eclipse publishes RoguePlanet and GreatXML local privilege escalation exploits

Nightmare-Eclipse, also known as Chaotic-Eclipse, has introduced two new exploits: RoguePlanet and GreatXML. RoguePlanet exploits a vulnerability in Windows Defender, allowing attackers to gain SYSTEM user access privileges by tricking a user into executing a script. This access enables attackers to execute commands beyond standard Administrator capabilities, siphon sensitive data, and install malware. GreatXML provides a method for bypassing BitLocker encryption by creating a specially crafted "unattend.xml" file and a "Recovery" directory on the Windows recovery partition. Microsoft has shifted its stance from threatening legal action against Eclipse and is now monitoring the situation, while Eclipse has postponed a planned mass disclosure of zero-day Windows vulnerabilities initially set for July 14 due to delays in developing RoguePlanet.

Winsage

June 11, 2026

Microsoft refuses to add this File Explorer feature, so the Files app stepped up

The Files app has introduced a feature in version 4.1.3 that allows users to calculate folder sizes on demand, which was not available in Windows 11's File Explorer. Users can toggle this option in Settings, and when disabled, a View size button appears in the Size column for easy access. The app now retains selection across different layouts, ensuring previously selected items remain highlighted. It also offers multiple methods for clearing tags from files, including options from the context menu, toolbar, and Command Palette. Additionally, the update features a refreshed OneDrive icon that reflects current branding, and several fixes have been implemented, including resolving issues with extracting tar archives and correcting display problems for BitLocker locked drives.

Winsage

June 11, 2026

New GreatXML Exploit Bypasses Windows BitLocker via Recovery Partition XML Files

Security researcher Chaotic Eclipse has released a Windows BitLocker bypass tool named GreatXML, following a previously disclosed exploit targeting Microsoft Defender. The discovery was made accidentally and took four hours. A critical vulnerability exists for users who have used the Windows Defender Offline Scan feature, making them susceptible to the BitLocker bypass. The exploit involves copying an XML file and a recovery folder to the recovery partition and rebooting into the Windows Recovery Environment (WinRE). If the Defender offline scan was not initiated, users must log in to start it or find a way to boot into WinRE in offline scan state. GreatXML is the second BitLocker bypass tool released by Chaotic Eclipse, following the earlier exploit known as YellowKey (CVE-2026-45585), which has been patched by Microsoft.