script Archives

AppWizard

April 11, 2026

Roblox unveils new Roblox Plus monthly subscription that pays creators who get players to sign up for the new Roblox Plus monthly subscription

Roblox has contributed over 60% to the net growth in consumer spending within the games industry, excluding China, since 2021. The company has launched a new subscription plan called Roblox Plus, aimed at enhancing user experience and providing creators with additional revenue opportunities. Roblox will absorb the costs of discounts, ensuring creators earn the same amount on individual purchases. The platform's API documentation includes a script that encourages players to subscribe to Roblox Plus, offering immediate rewards and access to exclusive areas. Roblox has indicated that this launch is just the beginning of their plans for expansion.

Winsage

April 9, 2026

This fake Windows support website delivers password-stealing malware

A phishing campaign has been identified that uses a counterfeit Microsoft support website, microsoft-update[.]support, to trick users into downloading a malicious Windows update disguised as WindowsUpdate 1.0.0.msi. This file, created on April 4, 2026, appears legitimate but contains malware designed to steal sensitive information. The campaign targets French-speaking users, leveraging recent data breaches in France to create convincing scams. The malware, once executed, installs an Electron application that runs a Python interpreter, which then deploys various data theft tools. It employs two persistence mechanisms: modifying the Windows registry and creating a shortcut in the Startup folder. The malware connects to external sites for reconnaissance and data exfiltration, using domains like datawebsync-lvmv.onrender[.]com and store8.gofile[.]io. The malware's components have evaded detection by antivirus tools, with VirusTotal reporting zero detections for the main executable and its launcher. Users are advised to check their registry, remove suspicious files, change passwords, and run a full system scan if they suspect installation of the malicious update. Safe updating practices include using the built-in Windows update feature and being cautious of phishing attempts. Indicators of compromise include specific file hashes, domains associated with the phishing campaign, and file system artifacts related to the malware's installation.

Winsage

April 8, 2026

“Wait, Windows uses less?”: I break down the surprising requirement that flips the Linux vs. Windows script

Ubuntu 26.04 LTS, developed by Canonical, will be released on April 23, 2026, with updated desktop requirements of a 2GHz dual-core processor, 6GB of RAM, and 25GB of storage. Unlike Windows 11, which enforces strict minimum requirements, Ubuntu allows installation on lower-spec machines, though performance may be compromised. The new requirements reflect a shift away from supporting older hardware, as the operating system incorporates a modern desktop stack with updated GNOME components and Wayland support. Ubuntu's installer evaluates hardware capabilities but does not block installation on unsupported devices, contrasting with Windows 11's rigid installation process that requires specific hardware features like TPM 2.0 and Secure Boot.

AppWizard

April 7, 2026

I watched the first TV show ever based on a game and it made me realize: we’ve really got it good these days

The animated series Pac-Man, produced by Hanna-Barbera from 1982 to 1983, features characters such as Pac-Man, Ms. Pac-Man (Pepper), and Pac-Baby living in Pac-Village, which is governed by the Pac-President and protected by Super-Pac. The series includes antagonists like Mezmaron and a group of ghost monsters: Inky, Blinky, Pinky, Clyde, and Sue. Mezmaron seeks to capture Pac-Man for his knowledge of Power Pellets, which grow on Power Pellet Trees in the Power Pellet Forest. The show consists of 44 episodes over two seasons and often concludes with Pac-Man consuming the ghosts, who then return to Mezmaron in new ghost suits. The humor is aimed at children but lacks cleverness, and notable voice actors include Peter Cullen and Alan Lurie. The second season introduced a younger version of Pac-Man named PJ and increasingly bizarre plots.

Tech Optimizer

April 6, 2026

36 Malicious npm Packages Exploited Redis, PostgreSQL to Deploy Persistent Implants

Cybersecurity researchers have discovered 36 malicious packages in the npm registry that impersonate Strapi CMS plugins. These packages exploit Redis and PostgreSQL, deploy reverse shells, harvest credentials, and establish persistent implants. Each package consists of three files—package.json, index.js, and postinstall.js—without descriptions or repositories, and all use version 3.6.8 to mimic legitimate Strapi plugins. The malicious packages follow a naming convention starting with "strapi-plugin-" and were uploaded by four accounts within 13 hours. The identified packages include names like strapi-plugin-cron, strapi-plugin-database, and strapi-plugin-server. The malicious code is embedded in the postinstall script, executing automatically upon installation with the same privileges as the user. The payloads evolve from exploiting Redis for remote code execution to attempting direct PostgreSQL database exploitation and deploying persistent implants for remote access. The campaign appears to target cryptocurrency platforms, as indicated by the focus on credential theft and digital assets. Users of these packages are advised to assume compromise and rotate credentials. This incident reflects a broader trend of supply chain attacks in the open-source ecosystem, with recent examples including credential exfiltration payloads in GitHub repositories and compromised GitHub Actions workflows. Group-IB reported that software supply chain attacks are increasingly reshaping the cyber threat landscape, targeting trusted vendors and open-source software to gain access to downstream organizations.

Winsage

April 4, 2026

WhatsApp Malware Campaign Uses VBS to Hijack Windows

Microsoft has identified a cyberattack campaign that uses WhatsApp messages to distribute malicious Visual Basic Script (VBS) files targeting Windows systems. First detected in late February 2026, the campaign employs social engineering to trick users into executing the VBS files, which then create hidden directories and disguise themselves as legitimate Windows utilities. The malware downloads additional payloads from cloud platforms like AWS, Tencent Cloud, and Backblaze B2 to establish persistence and escalate privileges. It can bypass User Account Control (UAC), alter registry settings, and install malicious MSI packages, including remote access tools like AnyDesk, to maintain continuous access for attackers.

AppWizard

April 4, 2026

Battlefield 6’s transformative new creation tool makes Portal much more powerful: “no more compromises”

The upcoming Hunter/Prey update for Battlefield 6, set to launch on April 14, will introduce the Portal Gadget, enhancing the Portal creation tools by allowing players to trigger interactions with greater precision. This update marks the final phase of Season 2 and aims to resolve previous limitations in custom logic deployment. The Portal Gadget can be integrated into a player's inventory and will serve as a trigger for custom events linked to the logic script of the Portal Experience. Additionally, the update will refine the core multiplayer progression system, allowing players to earn Mastery XP through weapon and vehicle use, and address issues related to spotting and ping reliability in both battle royale and multiplayer modes. Battlefield Studios is also evaluating feedback from tests on battle royale solos to inform future adjustments.

Winsage

April 2, 2026

Malwarebytes highlights Microsoft findings on WhatsApp attachments used in Windows attacks

A campaign targeting Windows users exploits WhatsApp attachments to execute a malicious .vbs script. Victims receive what appears to be a harmless attachment, which, when opened, duplicates legitimate Windows tools into a hidden folder and renames them to avoid detection. These tools are then used to download additional malware from reputable cloud services, disguising the malicious activity. The malware seeks administrator privileges by altering User Account Control settings and registry entries for persistence. It ultimately installs remote-access software and other payloads to maintain control over the compromised device. Malwarebytes recommends safety measures such as avoiding unsolicited attachments, enabling file extensions, using updated anti-malware tools, downloading software from official sites, being cautious of unexpected UAC prompts, and keeping systems updated.

Winsage

April 1, 2026

WhatsApp on Windows users targeted in new campaign, warns Microsoft

Microsoft researchers have identified a campaign that exploits WhatsApp attachments to infiltrate Windows machines, allowing attackers remote control. The attack uses social engineering tactics, where users receive a seemingly benign .vbs (Visual Basic Script) file that can be executed on Windows. This method does not rely on software vulnerabilities but on persuading victims to execute the malicious file. Attackers manipulate built-in Windows tools to download further malware, employing a technique known as living off the land (LOTL) to avoid detection. The malware seeks to elevate its privileges to administrator status, modifying User Account Control (UAC) prompts and registry settings for persistence. An unsigned MSI (Microsoft Installer) is deployed to establish remote-access software, granting continuous access to the compromised machine.

Tech Optimizer

March 30, 2026

Fake Cloudflare CAPTCHA Pages Spread Infiniti Stealer On macOS

Security researchers have identified a new macOS information stealer called Infiniti Stealer, which extracts sensitive information from Mac users using a social engineering tactic known as ClickFix. This method involves a counterfeit Cloudflare human verification page that prompts users to enter a command in their Mac Terminal, allowing the malware to bypass security measures. The infection process consists of three stages: 1. A Bash dropper script downloads and decodes a hidden payload. 2. A Nuitka loader, designed for Apple Silicon Macs, complicates detection by compiling Python code into a native application. 3. The final payload, Infiniti Stealer, harvests personal data such as browser passwords, macOS Keychain entries, cryptocurrency wallets, and captures screenshots. Indicators of Compromise (IOCs) associated with Infiniti Stealer include: - MD5 Dropper: da73e42d1f9746065f061a6e85e28f0c - SHA256 Stage-3: 1e63be724bf651bb17bcf181d11bacfabef6a6360dcdfda945d6389e80f2b958 - C2 Domain: update-check[.]com - C2 URL: https://update-check[.]com/m/7d8df27d95d9 - Panel: Infiniti-stealer[.]com - Packer Magic: 4b 41 59 28 b5 2f fd (KAY + zstd) - Debug Log: /tmp/.bs_debug.log