security researchers Archives

AppWizard

August 5, 2026

Android Developers Unknowingly Leak User Location Data

Recent research from the Electronic Frontier Foundation (EFF) has revealed that millions of Android users' location data are being inadvertently exposed to advertisers through third-party code libraries. This occurs when seemingly harmless applications, like weather services and fitness trackers, integrate third-party SDKs that collect user location information automatically upon permission approval, often without developers' awareness. Data brokers aggregate this location information to create detailed movement profiles sold to advertisers and government agencies. Despite privacy regulations like GDPR and CCPA, enforcement is inconsistent, and developers may claim ignorance regarding data practices they did not implement. Google has improved Android's privacy controls, but visibility into third-party libraries accessing data remains limited. Developers face challenges in auditing third-party code due to resource constraints, leading to a complex landscape where user information traverses multiple entities without clear accountability. Privacy advocates are calling for new technical standards to require SDKs to disclose their data practices.

Winsage

August 4, 2026

Microsoft pays security researchers $20M following AI-backed surge in bug reports

The Microsoft Bounty Program awarded million to 562 researchers across 64 countries, surpassing last year's million distributed to 344 researchers. The program invites researchers to report vulnerabilities in Microsoft's products and services. This year's increase in submissions is partly due to advancements in artificial intelligence, which helps researchers identify vulnerabilities but also aids malicious actors. The Microsoft Zero Day Quest event resulted in over 700 vulnerability reports and more than .3 million awarded to participants.

AppWizard

August 4, 2026

Samsung follows LG in killing Smart TV apps that rent out your internet

Security researchers found that several Samsung Smart TV applications, including Pac-Man, were embedding residential proxy SDKs from data brokers like Bright Data. In response, Samsung has banned the inclusion of residential proxy functionality in new app submissions and is working to remove existing apps with such software. The investigation by Norwegian cybersecurity firm Mnemonic revealed that the Bright Data SDK was integrated into various gaming applications, some promoted by Samsung. While Samsung TVs were not automatically sharing internet connections, the SDK could be activated remotely by developers, requiring user consent. Once consent was granted, the proxy service could operate in the background. Many Samsung TV applications were found to download most of their code from remote servers, complicating verification processes. The issue of residential proxy software is not limited to Samsung, as it has also been identified in various Android apps and devices. Following these findings, LG and Google have also taken measures to address the risks associated with residential proxy networks.

Winsage

July 27, 2026

New Certighost PoC exploit lets attackers hijack Windows domains

A proof-of-concept exploit for the "Certighost" vulnerability (CVE-2026-54121) has been released, affecting Windows Active Directory Certificate Services. This vulnerability allows authenticated attackers to compromise a Windows domain by manipulating machine account attributes to obtain certificates from AD CS, enabling them to authenticate as that machine or even as a domain controller. The flaw was reported to Microsoft on May 14, 2026, and addressed in the July 2026 Patch Tuesday updates. The vulnerability exploits a fallback mechanism in AD CS during certificate enrollment requests, allowing attackers to direct the Certification Authority to their controlled systems. The researchers demonstrated that a low-privileged user could create a machine account and use it to impersonate a domain controller, leading to potential domain compromise. Microsoft has added validation to the chase process in the July updates to prevent this exploitation. For those unable to install the updates, a temporary workaround involves disabling the chase fallback, though this has not been extensively tested.

Tech Optimizer

July 27, 2026

Hackers are hiding malware behind AI agents that antivirus cannot see

Sergey Lozhkin, head of Kaspersky’s global research and analysis team for the Asia-Pacific, Middle East, Turkey, and Africa, reported an increase in malware injection attacks targeting AI agents, particularly from outside an organization’s network. He noted that traditional signature-based analysis is becoming ineffective as AI skills operate in the cloud, connecting to external resources. Dmitry Galov, leading Kaspersky’s research for Russia and the CIS, emphasized the importance of behavioral analysis and sandboxing AI applications to combat these threats. Lozhkin warned that the rapid growth of skills and plugins requires organizations to adopt innovative security measures, as old models are no longer sufficient.

Tech Optimizer

July 24, 2026

CrashStealer Mac malware steals passwords and wallets

A sophisticated new malware targeting Mac users, named CrashStealer, has been discovered by security researchers at Jamf Threat Labs. It masquerades as Apple's legitimate crash-reporting software and was first identified in May 2026, with active attacks detected by early July. CrashStealer is designed to extract sensitive information, including browser credentials, password manager data, and cryptocurrency wallet information, and can copy the Mac login Keychain. It uses native C++ programming, encrypts collected files, and employs anti-debugging features. The malware is distributed through a disk image labeled "Werkbit Setup," which features a polished installer that bypasses Mac security warnings by using a valid Apple Developer ID and notarization ticket. Once opened, it connects to GitHub for commands and downloads a script that installs a second disk image named CrashReporter.dmg, which mimics an Apple system component. CrashStealer presents a fake password prompt resembling a legitimate macOS request, verifying entered passwords locally. It targets data linked to various browsers and password managers, scanning for approximately 80 cryptocurrency wallet extensions and 14 password managers. Stolen data is stored in hidden folders, encrypted using AES-256-GCM, and packaged into hidden ZIP archives before being uploaded. Warning signs of infection include a website requiring a meeting PIN for download, unexpected password prompts, and unfamiliar apps requesting Full Disk Access. Users are advised to download apps from verified sources, avoid overriding security warnings, pause before entering passwords, review app permissions, install security updates, use antivirus software, and act quickly if they installed Werkbit Setup.

AppWizard

July 23, 2026

Active Exploitation Alert: Fake Bahrain Alert App Deploys Advanced Android Surveillance Malware Targeting Gulf Region Users

A cyber-espionage campaign has been identified involving a counterfeit Bahrain Alert Android application designed to surveil individuals in Bahrain and the Gulf region. The app masquerades as an official civil defense tool and employs social engineering tactics to compromise Android devices, extract sensitive data, and maintain remote access. It targets high-value individuals such as activists and journalists, particularly during civil unrest and missile alerts, leveraging trusted government branding to increase infection rates. The malware features a complex, multi-stage architecture with advanced evasion techniques and is distributed through phishing links and malicious websites. It initiates a four-stage infection process, ultimately installing a remote access trojan (RAT) that enables covert surveillance and encrypted communications. The malware can monitor device activity, capture credentials, and intercept communications, while also employing mechanisms to avoid detection and maintain persistence. The campaign primarily targets Bahraini citizens, exploiting fear during crises to encourage app installation. Although there are indications of Russian-speaking developers involved, there is no definitive attribution to a specific nation-state or APT group. Mitigation strategies include monitoring for suspicious app installations, user education on verifying app authenticity, and blocking known malicious domains.

Winsage

July 21, 2026

Persistent Telemetry: Permanent Microsoft Windows Identifier

Discussions about consumer privacy in the Windows ecosystem have focused on optional diagnostic settings and telemetry controls. Recently, the Global Device Identifier (GDID), a permanent device-level token embedded in the Windows operating system, was revealed in a U.S. Department of Justice complaint related to a cybercriminal investigation. The GDID uniquely identifies a Windows installation and is used by Microsoft services. It is generated when a device is linked to a Microsoft account and resides in the Windows registry, being included in data sent to remote servers. There is no option to disable or delete the GDID, and attempts to do so can disrupt essential features. This has led privacy-conscious users to consider alternatives like Linux, which offers more control over data and does not require persistent identifiers. For Windows users, strategies to minimize data linked to the GDID include using local accounts, disabling optional diagnostics, and reviewing cloud app sync settings. Privacy advocates are calling for better user controls and opt-out mechanisms for hardware tracking tokens.

Tech Optimizer

July 18, 2026

North Korea Buried Four-Stage Malware in Flag Images: Zero Antivirus Detections

North Korea's Contagious Interview hackers have been using a deceptive strategy to target developers by posing as recruiters and embedding malware in SVG files. Elastic Security Labs discovered that the attackers hid malicious payloads within HTML comment blocks of these files, allowing the malware to evade antivirus detection. At the time of the findings, no antivirus engines flagged the compromised repositories, which included trojanized GitHub repositories disguised as coding challenges. The malware executed automatically at server startup and deployed four modules: a browser credential and cryptocurrency wallet stealer, a file stealer, a remote access Trojan, and a clipboard monitor. The campaign, tracked as REF9403, is part of the ongoing Contagious Interview operation attributed to North Korea's Lazarus Group, which aims to generate revenue through cryptocurrency theft. Developers are advised to audit any projects run from unsolicited sources and to monitor specific domains associated with the attack.

Winsage

July 18, 2026

Windows 11’s massive July 2026 update fixes 570 vulnerabilities and shows how AI is quietly reshaping Patch Tuesday itself

Microsoft's July 2026 Patch Tuesday update for Windows 11, identified as KB5101650, addresses 570 vulnerabilities and upgrades Windows 11 to version 25H2 (build 26200.8875) and version 24H2 (build 26100.8875). The update includes critical fixes for BitLocker and File Explorer, targeting vulnerabilities that could enable remote code execution. Microsoft's MDASH tool, which uses AI for vulnerability analysis, has helped uncover 16 vulnerabilities in networking and authentication components. The update also introduces non-security enhancements like Point-in-time restore and improved Bluetooth reliability. Microsoft emphasizes the need for users to install updates quickly due to the rapid evolution of AI technology that benefits malicious actors.