security alerts Archives

Winsage

June 2, 2026

New PHANTOMPULSE RAT Campaign Uses UAC Bypass in Windows Attacks

The REF6598 intrusion set has revealed a Remote Access Trojan (RAT) named PHANTOMPULSE, which is distributed via malicious Obsidian plugins. It uses advanced evasion techniques, including a blockchain-based command and control (C2) channel and a public User Account Control (UAC) bypass to infiltrate Windows systems. The malware disables security measures like the Antimalware Scan Interface (AMSI) and Windows Lockdown Policy (WLDP) through a hardware-breakpoint technique, allowing it to avoid detection by signature-based memory scanners. PHANTOMPULSE hides its core files in encrypted registry blobs and creates scheduled tasks that appear as .NET Framework updates. Its decentralized C2 framework queries public blockchains for operational data, but it lacks sender authentication, which can be exploited by defenders. The malware inventories the system for antivirus software and targets high-value applications. It employs a UAC bypass technique called “schuac” to gain elevated permissions. Analysts attribute this campaign to DPRK-aligned threat actors, particularly the BlueNoroff group, due to its focus on cryptocurrency wallets and blockchain exploitation. Defenders can identify new infrastructure by searching blockchain ledgers for a specific hex signature associated with the malware's C2 encryption routine.

Winsage

May 20, 2026

MSHTA abuse helps malware hide in Windows processes

Bitdefender's research highlights the use of Microsoft's MSHTA utility in malware attacks, noting its default activation in Windows systems. Cybercriminals exploit MSHTA to execute malicious scripts under the guise of legitimate processes, linking it to various malware families like LummaStealer and PurpleFox. The study reports a rise in MSHTA-related detections, indicating a shift towards "living-off-the-land" tactics that utilize legitimate tools to evade security alerts. Social engineering is identified as a common entry point for attacks, employing deceptive methods such as fake software downloads and phishing links. MSHTA can retrieve and execute additional payloads through multi-stage chains, complicating detection efforts. The attacks target sensitive information, including credentials and financial data, and the continued presence of MSHTA poses risks as it allows threat actors to conceal malicious actions. To mitigate these threats, organizations are advised to restrict or disable legacy scripting tools and exercise caution with untrusted downloads. The report emphasizes the challenge of detecting unusual behaviors associated with legitimate utilities in the context of cyber threats.

AppWizard

April 30, 2026

Brazilian LofyGang Resurfaces After Three Years With Minecraft LofyStealer Campaign

A Brazilian cybercriminal group known as LofyGang has re-emerged after three years, targeting Minecraft players with malware called LofyStealer, also known as GrabBot. This malware is disguised as a Minecraft hack named 'Slinky' and uses the official game icon to attract young users. The group has been active since late 2021 and previously leaked thousands of Minecraft accounts. The attack begins with the 'Slinky' hack, which deploys LofyStealer (identified as "chromelevator.exe") to harvest sensitive information from web browsers, including cookies, passwords, and credit card information, sending this data to a command-and-control server. ZenoX reports a shift in LofyGang's tactics from JavaScript supply chain attacks to a malware-as-a-service model, offering both free and premium tiers. Cybercriminals are increasingly exploiting trusted platforms like GitHub to distribute malware through bogus repositories and various deceptive tactics, including fake security alerts and counterfeit accounts. This trend highlights a strategy focused on volume targeting rather than precision, prompting cybersecurity experts to prioritize threats from GitHub-hosted downloads that appear legitimate.

AppWizard

April 27, 2026

Signal isn’t broken — so how are hackers targeting the world’s ‘most secure’ chat app?

On April 26, hackers allegedly linked to Russian groups targeted the Signal messaging app with phishing attacks aimed at senior politicians. These attacks did not compromise Signal's end-to-end encryption; rather, they deceived users into providing access to their accounts through fake messages. Signal is operated by the non-profit Signal Foundation, founded in 2012 by Moxie Marlinspike with funding from Brian Acton, a co-founder of WhatsApp. Signal distinguishes itself by rendering metadata invisible to its operators, unlike WhatsApp, which shares user data with its parent company. Signal's president, Meredith Whittaker, advocates for data privacy.

Tech Optimizer

April 8, 2026

Avast Antivirus: A Complete Guide to the Software and Its Security Features

Avast antivirus is a widely used digital security solution for mobile and desktop platforms, developed by Gen Digital. It offers a free version that is accessible and easy to set up, making it popular among first-time users. Key security features include real-time threat protection, web protection tools, email protection, behavior monitoring, and a network inspector. The software operates quietly in the background, has a clean and intuitive interface, and provides essential security features in its free version. However, users may experience intrusive upgrade prompts, and advanced tools require a paid subscription. Avast distinguishes itself by offering behavioral threat detection in both free and paid versions, and its extensive user base enhances its threat detection capabilities. The free version includes basic protections suitable for everyday online activities, but advanced features necessitate an upgrade. Users are encouraged to adopt strong passwords, utilize password managers, enable two-factor authentication, and practice safe browsing habits to ensure online privacy.

Tech Optimizer

April 1, 2026

Ransomware Groups Exploit Legit IT Tools to Bypass Antivirus

Ransomware attackers are increasingly using legitimate IT tools, referred to as the “dual-use dilemma,” to infiltrate systems instead of relying solely on traditional malware. Tools like Process Hacker and IOBit Unlocker, originally designed for troubleshooting, are now being weaponized to disable antivirus software. IOBit Unlocker has been linked to cyber campaigns by LockBit Black 3.0 and Dharma, while Process Hacker is used by Phobos and Makop ransomware operators. These tools have trusted digital signatures, allowing hackers to operate undetected. Ransomware attacks typically follow a kill chain, starting with phishing emails or compromised credentials. Attackers gain SYSTEM-level control using tools like PowerRun or YDArk. The attack unfolds in two phases: first, they use “process killers” to terminate antivirus monitoring, and then they employ tools like Mimikatz to extract passwords and erase logs, complicating tracking efforts. The evolution of ransomware tactics includes the use of Ransomware-as-a-Service (RaaS) kits, such as LockBit 3.0 and BlackCat, which are designed to disable antivirus protections. Future trends may involve AI-assisted methodologies that autonomously determine ways to circumvent security measures, indicating a shift in the security landscape.

Winsage

March 20, 2026

Microsoft publishes instructions on how to restore access to C: drive in Windows 11 on Samsung laptops

In March, users experienced issues accessing the C: drive on Samsung laptops, initially thought to be caused by an upcoming Windows 11 update. Microsoft clarified that the issue was due to Samsung's Galaxy Connect program. Both companies collaborated to resolve the problem, and Microsoft provided instructions for users to restore access, which typically takes around 15 minutes. Users should log in with an administrator account or contact Samsung support for help. The restoration process involves uninstalling the Samsung app, adjusting drive permissions, creating a restore file, and running it as an administrator. Microsoft's instructions do not require reinstalling Windows or deleting data, except for the Samsung applications. If issues persist, users are advised to contact Samsung technical support.

Tech Optimizer

January 30, 2026

Bitdefender vs McAfee

Bitdefender and McAfee are both established antivirus solutions that achieve similar lab test scores, often earning 18 points in assessments by AV-Test and AV-Comparatives. Bitdefender offers a more economical pricing structure, with its Antivirus Plus plan priced between .99 and .99 per year for three devices, while McAfee's plans start at .99 for one device. In real-world malware protection tests, Bitdefender achieved a 99.8% protection rate, compared to McAfee's 99.3%. McAfee includes firewall protection at the antivirus level, while Bitdefender reserves its firewall for higher-tier plans but offers better exploit protection. Bitdefender successfully thwarted 11 out of 12 ransomware attacks in controlled tests, while McAfee's ransomware protection is less reliable. Both offer limited VPN services, with Bitdefender providing 200MB per day and McAfee offering between 250MB and 500MB per month. McAfee completes scans more quickly but uses more CPU, while Bitdefender is more thorough. Bitdefender includes additional security features like anti-tracker and secure browser, whereas McAfee's features are more limited.