NewApp Digest
search bot

scheduled tasks

Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week
Winsage
September 9, 2026

Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week

Recent investigations have identified the BlueMoon exploit kit, used by espionage-driven threat activity clusters, particularly linked to APT31, a China-aligned state-sponsored group, since August 28, 2026. BlueMoon exploits three vulnerabilities: CVE-2026-85046 (a type confusion vulnerability in Google Chrome's V8 engine), an unassigned V8 sandbox escape, and CVE-2026-85880 (a heap-based buffer overflow in Windows ALPC). Google and Microsoft have released patches for these vulnerabilities, which were exploited as "patch-gap" zero-days. The attack vectors typically begin with phishing emails that lead victims to malicious URLs, triggering the vulnerabilities for code execution and privilege escalation. Variants of BlueMoon have been detected, featuring modifications for specific campaigns. Notable attack chains include: - APT31 targeting NGOs and mining firms in the U.S. with a malicious browser add-on called GemStone. - UNK_LateNight targeting U.S. aerospace companies, deploying BlueMoon alongside the ShadowPad backdoor. - UNK_DoubleCheck targeting a Vietnamese manufacturer, using DLL sideloading to execute a Rust binary. - UNK_QuietRacket targeting government and financial organizations in Indonesia and Singapore, modifying BlueMoon to execute a .NET assembly. CISA added the Chrome flaw to its Known Exploited Vulnerabilities catalog on September 4, 2026, requiring federal agencies to apply patches by September 18, 2026. Indicators of compromise include specific process trees, files, folders, scheduled tasks, mutexes, and registry keys. Proofpoint has released detection rules to help organizations identify and mitigate these threats.
Fake Software Installers Disable Windows Update and Weaken Microsoft Defender
Winsage
September 2, 2026

Fake Software Installers Disable Windows Update and Weaken Microsoft Defender

An active malware campaign is using counterfeit software-download websites to distribute malicious installers, primarily targeting users seeking popular software. This campaign has significantly affected China-based operations of multinational corporations and Chinese-speaking users. The malware, once executed, can establish persistence, undermine security measures, and communicate with attacker-controlled infrastructure. Victims span various sectors, including healthcare, manufacturing, gaming, technology, logistics, government, and education. Microsoft associates this campaign with a Chinese threat cluster called Silver Fox, known for using spoofed vendor download pages to spread Gh0st RAT and ValleyRAT. The malicious websites are hosted on .com.cn and .hl.cn domains, featuring Chinese-language content. The downloaded files are dynamically generated, and upon execution, they deploy a wrapper installer that initiates the malware payload. The malware achieves persistence through scheduled tasks and interferes with Windows Update services. The campaign establishes command-and-control communication over non-standard ports, with two identified domains linked to the activity. Microsoft Defender has detected the threat and initiated containment procedures. Kaspersky reported a related malicious installer exploiting a legitimate adware application to execute a backdoor, which captures keystrokes and clipboard contents. ValleyRAT, a sophisticated implant, can collect system information, reboot the computer, capture screenshots, and transmit logs. The attackers are motivated by cyber espionage and financial gain, targeting organizations globally. A subgroup within GoldenEyeDog, known as CuboidalCanine, has also been linked to the use of ValleyRAT, particularly in the gambling industry. In June 2026, Chinese authorities addressed cybercrime cases involving a new variant of the Silver Fox trojan.
Fake Microsoft Edge, Kaspersky and Razer Installers Used to Compromise Windows Systems
Winsage
September 2, 2026

Fake Microsoft Edge, Kaspersky and Razer Installers Used to Compromise Windows Systems

An ongoing malware campaign is targeting Windows devices through counterfeit download pages for well-known software brands like Microsoft Edge, Kaspersky, and Razer. The campaign affects various sectors, including healthcare, manufacturing, gaming, technology, logistics, government, and education. It utilizes high-fidelity fraudulent websites that closely mimic legitimate vendors, with observed lure domains such as app-microsoft-edge[.]com[.]cn and kaspersky-lab[.]hl[.]cn. Attackers employ evasion tactics like server-side payload regeneration and create multiple copies of the same archive in quick succession. Victims are lured into downloading ZIP files that contain a bundled wrapper installer, which activates a stage-one executable in randomized directories. The malware often masquerades as legitimate software, with some payloads impersonating known applications. Persistence is achieved through scheduled tasks with unusual names, and the malware employs various evasion techniques, including deleting shadow copies and altering file permissions. Microsoft Defender has identified activity across multiple stages of the attack, including delivery, execution, and command-and-control communications. To mitigate risks, organizations are advised to block downloads from unofficial sources, enforce Tamper Protection, and implement Attack Surface Reduction rules. Indicators of compromise (IOCs) include specific lure domains and URLs associated with the campaign.
Your GPU's scheduling toggle was pointless in 2020, and a growing list of Windows features now need it
Winsage
August 30, 2026

Your GPU’s scheduling toggle was pointless in 2020, and a growing list of Windows features now need it

For over a decade, Windows managed graphics card operations through a single CPU thread. In May 2020, Microsoft introduced Hardware-Accelerated GPU Scheduling (HAGS), allowing users to transfer scheduling tasks to the GPU. HAGS shifts scheduling from the CPU to a dedicated processor on the GPU, reducing CPU overhead. The introduction of WDDM 3.0 with Windows 11 21H2 requires HAGS for the basic hardware flip queue, which reduces power consumption. The advanced hardware flip queue, which addresses presentation latency, also requires HAGS. With Windows 11 24H2 and WDDM 3.2, native GPU fences were introduced, allowing the GPU to manage dependencies without CPU intervention. Nvidia's frame generation features require HAGS, while Intel's Arc B-series cards do not. The state of HAGS is determined by GPU drivers, and applications like OBS have shown caution towards HAGS due to historical issues.
How to Stop McAfee from Running on Windows
Tech Optimizer
July 26, 2026

How to Stop McAfee from Running on Windows

McAfee offers features such as file scanning, network traffic filtering, VPN services, and browser warnings to protect users. Users can pause Real-Time Scanning by opening the McAfee app, selecting Real-Time Scanning under My Protection Widgets, and turning it off. To disable the Advanced Firewall, users must access the Advanced Firewall section in the app and turn it off. Scheduled scans can be stopped by navigating to Scheduled Scans in the app and clicking Turn off. To prevent Secure VPN from reconnecting, users can toggle it off in the Home tab and set Auto Connect to Never connect automatically. Browser protection features can be managed by toggling off McAfee WebAdvisor in Chrome, Edge, and Firefox. Users can block fake McAfee popups by adjusting notification settings in their browsers. To prevent McAfee startup helpers from opening, users can manage startup settings in Windows. To completely remove McAfee, users should uninstall it through Settings or Control Panel and follow the prompts. If remnants remain, the MCPR tool can be used for complete removal. Microsoft Defender will reactivate automatically after McAfee is uninstalled.
It's impossible to recommend paid Windows cleanup utilities when Windows Sysinternals does everything for free
Winsage
July 25, 2026

It’s impossible to recommend paid Windows cleanup utilities when Windows Sysinternals does everything for free

Many utility suites for Windows maintenance require a yearly subscription but often only aggregate basic tools. Users can achieve similar results without costs, as Windows manages routine maintenance effectively. Microsoft's Sysinternals suite offers advanced tools like Autoruns, which provides a comprehensive view of startup entries, and Process Explorer, which offers detailed process monitoring. SDelete securely deletes files beyond recovery, while RAMMap provides insights into memory usage without the risks of third-party applications. Although Sysinternals tools may lack polished interfaces, they deliver substantial functionality for users willing to learn how to use them.
silver Android smartphone
Winsage
July 25, 2026

It’s impossible to recommend paid Windows cleanup utilities when Windows Sysinternals does everything for free

Windows utility suites often charge a yearly subscription fee but frequently provide only basic functionalities like startup managers and process monitors. Many features can be accessed for free through Windows' built-in capabilities. Microsoft's Sysinternals suite offers powerful alternatives, such as Autoruns, which provides a comprehensive view of all startup locations, including registry keys and scheduled tasks. Process Explorer offers detailed insights into running processes, surpassing the standard Task Manager by displaying process trees and resource usage. SDelete securely deletes files by overwriting data multiple times, making recovery nearly impossible. While Sysinternals tools are powerful, they require a learning curve and deeper engagement compared to the polished interfaces of paid utilities. Sysinternals emphasizes functionality over marketing, proving that free tools can deliver exceptional performance without compromising quality.
Search