screen capture Archives

Winsage

September 29, 2026

I replaced Windows’ Snipping Tool with ShareX for screenshots, but the best part is everything else it can do

The Snipping Tool in Windows has been modernized in Windows 11 but still has bugs that can disrupt user workflow. ShareX is a free and open-source alternative that excels in screenshot capabilities and offers advanced features, including precise selection tools, real-time editing, video recording, and GIF creation. ShareX supports multiple upload targets, including Imgur and cloud services like OneDrive and Google Drive, and allows users to upload various file types, including text documents to Pastebin. It includes bonus features such as a video converter, image comparison tools, and customization options for hotkeys. However, ShareX may be overwhelming for newcomers seeking basic screenshot functions, for whom the Snipping Tool remains a valid choice.

AppWizard

September 28, 2026

RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims

The operators behind RatHat have created an advanced Android banking trojan that allows control of infected devices through a web console. Since April 2026, nearly 100 instances of this console have been identified, indicating a malware-as-a-service model. The console collects sensitive data from compromised phones, including text messages and passwords. It uses Google's Gemini AI to assess victims' bank balances, categorizing them into high-value and mid-value segments, but does not facilitate financial transactions. The malware has remained largely unchanged since late 2025, but the console has seen significant updates, leading to three new versions: BlackCat Remote Control Management, Panda Workshop V5, and V6. These versions serve as both control interfaces and build tools for creating and distributing malware. The latest version includes templates for deceptive download pages. RatHat infiltrates devices via text messages and online ads, requesting Accessibility access to read screens and simulate user interactions. This access allows the malware to activate wireless debugging and connect to the Android Debug Bridge (ADB), giving operators elevated privileges to execute commands. A Go program can be deployed to maintain control, even after the app is uninstalled. Cleafy has tracked console deployments through web code analysis, noting that many IP addresses originate from a Singapore-registered network. The initial console version allowed operators to choose AI providers, but the latest exclusively uses Gemini. RatHat also utilizes Gemini on infected devices to determine tap locations based on screen layouts. Cleafy has compiled indicators related to the consoles' command-and-control servers, download links, and malware samples, including specific domains, IP addresses, and MD5 hashes. The consoles often use web addresses starting with "admin." and inexpensive top-level domains. Security tools are advised to monitor processes running under the shell user on affected devices.

AppWizard

September 12, 2026

New Android Ransomware Records Screens, Steals OTPs and Secretly Takes Photos of Victims

A newly identified malware threat in the Android ecosystem, named Mantax Otax, combines ransomware with espionage capabilities. It targets users who install applications from untrustworthy sources, often through messaging apps or phishing attempts. The malware is linked to Indonesian cybercriminals and can steal sensitive information such as SMS one-time passwords, chat histories, and lock-screen PINs, facilitating account takeovers. Mantax Otax requests device-administrator rights and seeks access to SMS messages, contacts, and media files. It encrypts files on devices running Android 9 and earlier using AES encryption and demands a ransom for recovery. Although the impact is reduced on Android 10 and later due to Scoped Storage, the malware still poses significant surveillance risks. The malware collects extensive sensitive data, including contacts, call logs, and location data, and targets multi-factor authentication codes. It uses a deceptive system-lock overlay to capture PINs and has introduced features like WebSocket communications and disruptive pop-ups in its second iteration. Users are advised to be cautious when installing applications, avoid unsolicited APKs, and reject permissions that do not align with an app's purpose. In case of suspicious activity, users should disconnect from networks and seek help before entering sensitive information. Organizations should monitor for signs of this malware on managed devices.

AppWizard

July 23, 2026

Active Exploitation Alert: Fake Bahrain Alert App Deploys Advanced Android Surveillance Malware Targeting Gulf Region Users

A cyber-espionage campaign has been identified involving a counterfeit Bahrain Alert Android application designed to surveil individuals in Bahrain and the Gulf region. The app masquerades as an official civil defense tool and employs social engineering tactics to compromise Android devices, extract sensitive data, and maintain remote access. It targets high-value individuals such as activists and journalists, particularly during civil unrest and missile alerts, leveraging trusted government branding to increase infection rates. The malware features a complex, multi-stage architecture with advanced evasion techniques and is distributed through phishing links and malicious websites. It initiates a four-stage infection process, ultimately installing a remote access trojan (RAT) that enables covert surveillance and encrypted communications. The malware can monitor device activity, capture credentials, and intercept communications, while also employing mechanisms to avoid detection and maintain persistence. The campaign primarily targets Bahraini citizens, exploiting fear during crises to encourage app installation. Although there are indications of Russian-speaking developers involved, there is no definitive attribution to a specific nation-state or APT group. Mitigation strategies include monitoring for suspicious app installations, user education on verifying app authenticity, and blocking known malicious domains.

Winsage

July 10, 2026

Microsoft Confirms Windows 11 Bug That Eats 500GB Of Your Storage

Microsoft has acknowledged a significant issue affecting Windows 11 users on versions 24H2 and 25H2, where a bug can consume up to 500GB of storage, leading to critical space shortages and potential system failure. This bug has been reported since May 2025, with a solution disclosed on June 29, but it will not be automatically rolled out until July 14. Users can check if they are affected by navigating to Settings > System > Storage and examining the “System files” category; if it exceeds 100GB, they are likely impacted. The issue is linked to a hidden file named CapabilityAccessManager.db-wal in the “%ProgramData%MicrosoftWindowsCapabilityAccessManager” directory. Microsoft has released an optional update (KB5095093) to address the bug, which also includes feature previews that may affect performance. Users are advised against deleting the problematic file to avoid disrupting WiFi connectivity and screen capture functionalities. An automatic fix will be deployed during the July 14 update.

Winsage

July 9, 2026

Microsoft Confirms Windows 11 Bug That Can Consume Over 500GB of Storage Through Permission Log File

Microsoft has acknowledged a bug in Windows 11 that causes the Capability Access Manager's write-ahead log file to expand indefinitely, potentially exceeding 500GB of storage on affected devices. This issue is addressed in update KB5095093, which includes builds 26200.8737 and 26100.8737. Users can manually install this update via the optional updates section of Windows Update or wait for its automatic rollout during the July 2026 Patch Tuesday. The Capability Access Manager manages app permissions and logs usage of privacy-sensitive features, but the WAL file continues to grow unchecked on affected systems. The file can reach sizes from 70GB to over 513GB. To check if a system is affected, users can check storage settings or use Robocopy to verify the file size. The update is available through the Optional updates section and will be included in the cumulative update on July 8, 2026. The excessive size of the WAL file can lead to critical storage shortages and related issues, but it does not compromise the security or core functionality of the permission system. Microsoft has not confirmed if Windows 11 26H1 Insider builds are affected.

Winsage

July 6, 2026

Microsoft admits a Windows 11 bug is eating up to 500GB of storage, verify if you are affected

To check for excessive storage consumption in Windows 11, navigate to Settings > Storage > System & Reserved. A file named CapabilityAccessManager.db-wal can cause significant storage issues, potentially consuming hundreds of gigabytes. This file is associated with the Windows Capability Access Manager service, which manages app permissions for features like microphone and camera access. Normally, this file should occupy only a few megabytes, but reports indicate it can expand to sizes like 200GB or even 513GB. Microsoft acknowledged this issue in the release notes for Windows 11 KB5095093, stating that an update to improve disk space usage for this file is scheduled for July 14, 2026. To check if your system is affected, tools like WizTree or TreeSize can be used, or a command can be executed in Command Prompt to verify the file size. If the file is excessively large, it is recommended to wait for the update or rename the file to allow Windows to regenerate it, rather than deleting it.

Winsage

June 19, 2026

Microsoft Details Windows Clipper Malware Campaign Using USB LNK Worm and Tor-Based C2

Microsoft has identified a Windows-based cryptocurrency clipper campaign that has been active since February 2026. This campaign uses clipboard-intercepting malware with self-spreading capabilities and operates through the Tor network. The clipper malware employs Windows Script Host and ActiveX to launch a Tor proxy and connect to a hidden command-and-control server. It focuses on stealing clipboard data, particularly cryptocurrency wallet addresses, and can exfiltrate screenshots. The malware is distributed via malicious Windows Shortcut (LNK) files on USB drives, which activate a worm that checks for existing infections and fetches the payload from a remote server. The clipper monitors the clipboard every 500 milliseconds for sensitive information and can replace copied wallet addresses with those controlled by attackers. Microsoft recommends behavioral detections, disabling AutoRun for removable media, blocking LNK execution from drives, and monitoring clipboard-related activities as mitigations against this threat.

AppWizard

June 10, 2026

Windows 11’s new performance boosting Low Latency mode is now available, and here’s what it does

The latest Windows 11 update includes the Low Latency Profile feature, which enhances performance for certain applications by temporarily increasing CPU speed for brief intervals. Currently, only Microsoft's applications and native Windows 11 features can utilize this capability, but third-party applications may be able to in the future. The update, identified as KB5094126, is necessary to activate the feature, which operates quietly in the background. Users can verify the feature's functionality by ensuring the update is installed and can conduct tests to observe changes in CPU clock speed. Personal experiences with the feature show varying degrees of improvement in responsiveness, particularly on older systems.

Winsage

April 5, 2026

Claude Cowork and Claude Code Can Now Control Your Windows Desktop

On April 3, 2026, Anthropic expanded Claude’s desktop control feature to Windows for Pro and Max subscribers, allowing users to operate applications, navigate web pages, and manage files on their PCs without prior configuration. The feature is in research preview and includes a Dispatch companion for task assignment from mobile devices. Claude uses a structured tool hierarchy for task execution, prioritizing connectors like Slack and Google Calendar, and engages in direct desktop control only when necessary. Users must opt in to activate the feature, which integrates with existing software without requiring API keys. The technology is partly derived from Anthropic’s acquisition of Vercept AI, which specializes in AI-driven computer control. Security concerns have arisen due to vulnerabilities demonstrated shortly after the launch, prompting Anthropic to implement safeguards while acknowledging the feature's potential errors. Users can stop Claude's operations, but the company admits it cannot disable the technology remotely once tasks have started. Competitors like Microsoft and Google are also exploring similar desktop-level AI automation capabilities.