security breach Archives

Winsage

March 2, 2026

RAT Malware Via Windows Explorer Puts Crypto at Risk

Cofense Intelligence reported that threat actors are exploiting Windows File Explorer and WebDAV servers to deliver Remote Access Trojans (RATs) to corporate systems, bypassing browser security measures. This method allows attackers to infiltrate machines without using web browsers, taking advantage of File Explorer's ability to connect to remote WebDAV servers. Despite WebDAV being deprecated by Microsoft in November 2023, it is still supported in Windows, creating a vulnerability. The campaigns began in February 2024, with a significant increase in September 2024, and 87% of these campaigns deliver multiple RATs, including XWorm, Async RAT, and DcRAT. Victims typically receive phishing emails disguised as invoices, containing URL or LNK shortcut files that initiate a WebDAV connection. The attacks often utilize Cloudflare Tunnel for hosting malicious WebDAV servers, making the traffic appear legitimate. Notably, 50% of affected campaigns are in German, while 30% are in English. The report emphasizes the risks posed to individuals holding digital assets, as RATs can access sensitive information, including crypto wallet files. Organizations are advised to monitor network traffic for Cloudflare Tunnel instances and educate users about the risks associated with File Explorer's capabilities.

AppWizard

February 19, 2026

Android AI app exposes nearly 2m user files – including private videos

A privacy breach involving the "Video AI Art Generator & Maker" app has exposed millions of private user files due to a misconfigured Google Cloud Storage bucket lacking authentication. Since June 2023, approximately 8.27 million media files, including nearly 2 million original user-uploaded files, have become publicly accessible. This includes over 1.57 million private images, more than 385,000 personal videos, and millions of AI-generated assets. The app's developer, Codeway Dijital Hizmetler Anonim Sirketi, has fixed the configuration issue, but users remain at risk for phishing attacks, identity theft, and misuse of their private content. Legal experts suggest the app's privacy documentation may not comply with international standards like GDPR. Additionally, Codeway has a history of similar issues, as another app they developed also faced a security breach exposing 300 million messages from over 25 million users.

Tech Optimizer

January 29, 2026

Top antivirus hacked to push out a malicious update – find out if you’re affected

Recent reports indicate that the antivirus program eScan experienced a security breach, leading MicroWorld Technologies to conduct an internal investigation. A threat actor exploited compromised update servers to distribute malware to users who downloaded updates during a two-hour window on January 20, 2026. The exact number of affected users is unknown, but the company has isolated the compromised infrastructure and refreshed credentials while assisting impacted users. The eScan product itself was not altered, and the victims were limited to a specific regional cluster. The malware, identified as CONSCTLX, operates as a backdoor and downloader, allowing attackers to maintain access and execute commands on infected devices. The identity of the attackers is unknown, but North Korean cybercriminals previously exploited eScan's update mechanism in 2024. MicroWorld Technologies has provided support to millions of customers but has not disclosed the total number of eScan users.

AppWizard

December 5, 2025

Android TV users hit with SmartTube security disaster after rogue update

SmartTube, a YouTube client for Android TV, experienced a security breach where an attacker infiltrated the developer's signing keys, allowing the distribution of a compromised update that included a malicious library, libalphasdk.so. Google Play Protect issued warnings about the suspicious build, leading users to discover a hidden file that maintained remote communication channels. Users are advised to change Google Account passwords, conduct antivirus checks, and implement stricter firewall rules. The developer, Yuliskov, plans to address the vulnerabilities and release a new version through the F-Droid store.

AppWizard

December 1, 2025

SmartTube YouTube app for Android TV breached to push malicious update

An attacker gained access to the developer's signing keys for SmartTube, an open-source YouTube client for Android TV, leading to a malicious update being distributed. The developer, Yuriy Yuliskov, confirmed the compromise and plans to release a new version with a different app ID. Users reported that Play Protect flagged SmartTube as a potential threat. A reverse-engineered version, identified as 30.51, contained a hidden library named libalphasdk.so, which was not part of the public source code and collected device fingerprints without user knowledge. There is currently no evidence linking the malware to account theft or DDoS attacks, but concerns remain. Yuliskov has announced safe beta and stable test builds on Telegram, but they are not yet on GitHub. Users are advised to stay on older verified builds, avoid logging in with premium accounts, and disable auto-updates. Version 30.19 does not trigger Play Protect warnings, suggesting it may be safer.

AppWizard

December 1, 2025

Popular YouTube app for Android TV ‘SmartTube’ compromised with malware

The developer of SmartTube, an ad-free YouTube client for Android TV, confirmed a security breach involving the app's signing key, which allowed malicious actors to inject harmful code into app updates. The breach was disclosed by Yuriy Yuliskov, the maintainer, who advised users to avoid reinstalling the old app and instead wait for a newly signed version. A reverse-engineering analysis of the infected APKs revealed that they were gathering sensitive information and transmitting it to a remote server. Versions 28.56 to 30.52 were particularly affected, and Google Play Protect began disabling installations of SmartTube. In response, Yuliskov wiped his hard drive and released a new version, 30.56, with a different signing key and app ID. Transparency concerns remain, and the developer plans to disclose details about the breach and measures to prevent future incidents. Users have requested additional security assurances, including hashes of clean builds.

AppWizard

December 1, 2025

That popular YouTube alternative on Android TV was secretly distributing infected builds

SmartTube, a popular YouTube application for Android TV and Fire TV, was removed from these platforms due to malware that compromised the developer's build machine. Some versions released earlier this month contained this malware. Users are advised to reset their devices and review their YouTube and Google account information. Initially, it was thought that a digital signature leak was the reason for the app's removal, but it was later confirmed that the build environment was compromised. The developers are investigating which specific versions were affected, with versions 30.43 and 30.47 flagged as malicious. A new version, build number 30.56, has been released from a secure environment, but previous versions have been removed from GitHub. Users are recommended to perform a factory reset, review account permissions, and check YouTube activity for unusual activity.

AppWizard

December 1, 2025

SmartTube app was infected by malware, here’s what happened

Google Play Protect disabled the SmartTube app on Android TV, labeling it as potentially harmful due to a compromised digital signature. The developer, Yuliskov, confirmed that the signature breach allowed for the creation of counterfeit app versions that could carry malware. A user discovered that SmartTube version 30.51 contained a hidden library that collected device-specific information and transmitted it to external servers, raising concerns about botnet activity. Certain versions of SmartTube, specifically 30.43 and 30.47, were confirmed to have been compromised due to malware on the developer's computer. Users were advised to uninstall infected versions, including 28.56, 28.58, 28.66, 28.75, 28.78, 29.13, 29.37, 29.62, 29.63, 29.85, 30.27, 30.32, 30.38, 30.40, 30.43, 30.44, 30.45, and 30.51, and to download the newly released safe version from trusted sources. Yuliskov assured users that the compromised computer has been cleaned and that new releases are secure.

AppWizard

November 28, 2025

Vitalik Buterin Donates $765K in Ethereum to Privacy Messaging Apps

Vitalik Buterin donated approximately 5,000 ETH to the privacy messaging applications Session and SimpleX. He emphasized the importance of encrypted messaging for digital privacy and mentioned two key areas for improvement: permissionless account creation and metadata privacy. Session aims to minimize metadata leakage and saw its token, SESH, rise by 371% in a day. SimpleX focuses on user identity ownership and plans to introduce community support vouchers. Buterin acknowledged both applications have room for improvement in user experience and security. The increasing interest in privacy applications is driven by concerns over global surveillance, with recent government regulations highlighting the need for privacy solutions. The Ethereum Foundation has formed a new privacy team to enhance its initiatives. Privacy-focused cryptocurrencies like Zcash have also seen significant growth, with Zcash rising by 793% over the past year.

Winsage

November 17, 2025

Windows 10 update failure, autonomous AI cyberattack, Feds fumble Cisco patches

Microsoft has acknowledged an issue with the Windows 10 KB5068781 extended security update, which is failing to apply after installation for users with corporate licenses, resulting in a rollback. A group of hackers believed to be backed by China executed a large-scale cyberattack using Claude Code AI, targeting 30 organizations across various sectors. The Cybersecurity and Infrastructure Security Agency (CISA) reported that U.S. government agencies are struggling to patch critical vulnerabilities in Cisco devices amid the “Arcane Door” hacking campaign. Five individuals pleaded guilty to charges related to helping North Korean IT workers infiltrate 136 companies in the U.S. from September 2019 to November 2022. Port Alliance, a Russian port operator, reported disruptions due to a DDoS cyberattack targeting its operations related to coal and mineral fertilizer exports. DoorDash experienced a data breach on October 25, potentially affecting personal details of customers, Dashers, and merchants across the U.S. and Canada, traced back to a social engineering scam. North Korean hackers are using JSON storage services to host and deliver malware, approaching victims with job offers on platforms like LinkedIn. Jaguar Land Rover reported a financial impact of £196 million (0 million) from a cyberattack in September that forced production halts and compromised data.