Security Archives

AppWizard

April 25, 2026

Android Hackers Target 800 Banking, Crypto and Social Media Apps With ‘Near-Zero Detection Rates’: Zimperium

Android hackers are targeting over 800 applications in banking, cryptocurrency, and social media sectors, utilizing four active malware families: RecruitRat, SaferRat, Astrinox, and Massiv. These malware employ advanced techniques to evade detection and execute credential theft, unauthorized financial transactions, and data exfiltration. Attackers lure victims through phishing websites, fraudulent job offers, fake software updates, text-message scams, and promotional lures. Once installed, the malware can request Accessibility permissions, obscure app icons, obstruct uninstallation, and steal sensitive information through counterfeit lock screens. They can also capture one-time passcodes, stream device screens, and overlay fake login pages on legitimate applications. The malware uses HTTPS and WebSocket communications to blend malicious traffic with normal activity and may incorporate encryption layers to avoid detection.

Winsage

April 25, 2026

In France they “buried” Windows 10 at the Microsoft office

On April 24, a protest organized by environmental and consumer advocacy groups took place outside the Microsoft France office in Paris to oppose the company's decision to discontinue support for the Windows 10 operating system. Activists claim this could lead to the obsolescence of approximately 300 million computers worldwide, resulting in 58 million tons of carbon dioxide emissions and significant depletion of raw materials. Consumers may face an average cost of €600 for new devices if they upgrade. Experts warn users must choose between expensive new hardware or risking financial fraud due to lack of security updates. The organization Halte à l'Obsolescence Programmée is gathering signatures for a petition advocating for a mandatory 15-year software support period. Public advocacy previously convinced Microsoft to extend its software update releases by an additional 12 months. The protest aims to raise awareness and apply pressure until the end of October.

Tech Optimizer

April 25, 2026

The Main Street Tech Report: Microsoft Says Third Party Antivirus Software Is No Longer Needed

Microsoft has announced that users of Windows 11 do not need additional antivirus software, as Microsoft Defender is built-in and provides sufficient protection against malware, suspicious downloads, and phishing sites. OpenAI has shifted its advertising model for ChatGPT from cost-per-thousand impressions (CPM) to pay-per-click (CPC), allowing advertisers to bid between and per click. Yelp has upgraded its AI-powered assistant to answer inquiries, recommend services, and facilitate bookings through natural language processing, integrating with platforms like Vagaro and Calendly. Google has increased usage limits for subscribers of Google AI Pro and AI Ultra in Google AI Studio, making app creation more accessible and simplifying cost assessments for developers. HubSpot has introduced an outcome-based pricing model for its Breeze Customer Agent and Breeze Prospecting Agent, reducing costs per resolved conversation from to [openai_gpt model="gpt-4o-mini" prompt="Summarize the content and extract only the fact described in the text bellow. The summary shall NOT include a title, introduction and conclusion. Text: Welcome to this week’s edition of The Main Street Tech Report, where we delve into the latest advancements in small business technology. Here are five notable developments in AI, automation, and digital tools that have surfaced recently, along with their implications for your business. Microsoft Officially Says You Don't Need Extra Antivirus on Windows 11 In a recent announcement, Microsoft has clarified that users of Windows 11 do not require additional antivirus software. As reported by PCWorld, Microsoft Defender, the built-in protection software, is touted as “the most secure Windows yet.” This tool is activated by default and consistently updates to guard against malware, suspicious downloads, and phishing sites. While Microsoft acknowledges that users with multiple devices or those needing parental controls might consider supplementary protection, for the majority, the fully updated Windows Defender suffices. Why this is important for your small business: This development may not be welcomed by antivirus software manufacturers, but it underscores a significant shift in how security is approached. It raises the question of why such protection wasn’t integrated into operating systems sooner. For small businesses, collaborating with IT professionals to optimize Microsoft Defender is crucial. Ensuring that operating systems are updated and avoiding unnecessary bloatware from antivirus vendors can streamline security efforts. OpenAI Turns on Cost-Per-Click Ads Inside ChatGPT OpenAI has transitioned its advertising model for ChatGPT from a cost-per-thousand impressions (CPM) to a pay-per-click (CPC) system, as highlighted by Digiday. Advertisers can now bid between and per click, allowing for more direct and measurable engagement results. This change comes after a notable decline in CPM rates, which fell from to as low as since February. Gartner analyst Nicole Greene notes that this shift provides advertisers with consistent metrics to justify reallocating their budgets to OpenAI. Why this is important for your small business: As ChatGPT and similar AI platforms adopt a CPC model, businesses may find themselves navigating a challenging landscape. My own experiences with CPC advertising have often led to discrepancies between reported clicks and actual engagement, leaving many advertisers frustrated. Small businesses should approach these platforms with caution, ensuring they have clear tracking mechanisms in place to evaluate the effectiveness of their ad spend. Yelp Launches AI-Powered Assistant to Streamline Local Search and Bookings Yelp has enhanced its AI-powered assistant, Yelp Assistant, which now goes beyond merely listing businesses. This upgraded tool can answer inquiries, recommend services, and facilitate reservations or appointments through natural language processing. With integrations into platforms like Vagaro, Zodoc, and Calendly, Yelp is evolving from a search engine to a transaction-driven assistant, thereby enhancing the user experience. Why this is important for your small business: While my focus is primarily on B2B technology services, businesses in the B2C sector should take note of Yelp’s new capabilities. Engaging deeply with Yelp’s AI offerings could yield significant benefits, particularly for companies that align well with its audience. Collaborating with Yelp experts may also prove advantageous for those looking to maximize their presence on the platform. Start Vibe coding in AI Studio With Your Google AI Subscription Google has announced that subscribers to Google AI Pro and AI Ultra will enjoy increased usage limits in Google AI Studio, facilitating app creation. This update includes access to Gemini Pro and Nano Banana Pro, simplifying the transition from experimentation to production for developers. Previously, managing API keys and usage charges posed challenges, but the new subscription model allows for better cost assessment before committing to API pricing. Why this is important for your small business: While Claude has garnered attention in the AI space, Google’s advancements in AI Studio position it as a formidable player. As the company continues to roll out innovative tools, small businesses should keep a close watch on developments, particularly with the upcoming Google I/O event on May 19th, which promises to unveil exciting AI innovations. HubSpot Introduces Outcome-Based Pricing for AI Agents Starting April 14 HubSpot has launched an “outcome-based pricing” model for its Breeze Customer Agent and Breeze Prospecting Agent. This approach ties costs to completed tasks rather than just licensing fees. For instance, the cost per resolved conversation has dropped from to [cyberseo_openai model="gpt-4o-mini" prompt="Rewrite a news story for a business publication, in a calm style with creativity and flair based on text below, making sure it reads like human-written text in a natural way. The article shall NOT include a title, introduction and conclusion. The article shall NOT start from a title. Response language English. Generate HTML-formatted content using tag for a sub-heading. You can use only , , , , and HTML tags if necessary. Text: Welcome to The Main Street Tech Report, your weekly roundup of the most important small business technology news. Here are five key developments in AI, automation, and digital tools that emerged this week-and what they mean for your business.Microsoft Officially Says You Don't Need Extra Antivirus on Windows 11Hans-Christian Dirscherl of PCWorld reports that Microsoft has announced Windows 11 users do not need to add third-party antivirus software. According to the company, Microsoft Defender – Windows 11 built-in protection software – has made it “the most secure Windows yet.” Defender is activated by default and continuously updates to protect against malware, suspicious downloads, and phishing websites. Microsoft suggests for those who run multiple devices or implement parental controls may want to add an extra layer of protection but for most users Windows Defender is enough, providing it’s fully updated. (Source: PCWorld)Why this is important for your small business: I’m sure the makers of anti-virus software aren’t thrilled to hear that news, but wasn’t the writing on the wall? I always wondered why anti-virus and malware protection wasn’t already built into a device’s operating system and turns out it is (and probably always was). My advice is to work with your IT professionals to fully configure Microsoft Defender to provide protection, ensure that your users are upgrading their operating system when required and leave out any additional bloatware from anti-virus software makers.OpenAI Turns on Cost-Per-Click Ads Inside ChatGPTOpenAI has switched its ChatGPT ads to pay-per-click pricing in a significant shift from its previous cost per thousand impressions model, Digiday reports. According to details, advertisers can bid between $3 and $5 per click in the Ads Manager interface. Cost per clicks give advertisers more direct, measurable results for customer engagement in comparison to CPMs. And since February, the rate for CPMs has dropped from $60 to as low as $25, decreasing ad revenue for OpenAI. The benefit for advertisers is CPCs allow them to compare their ad spend on other platforms like Google. Gartner analyst Nicole Greene said, “In a world where everything is changing due to AI tech and consumer behaviors, this consistent measurement will help advertisers justify reallocation of spend to OpenAI.” (Source: Digiday)Why this is important for your small business: Sadly, ChatGPT – and likely other AI platforms – is heading down the same “cost-per-click” black hole that Google prefers. And it really is a black hole. My experience with CPC is frustrating and disappointing: Google tells me an ad got a thousand clicks and yet my landing page shows five people hit it. Why the difference? No one ever answers that question and yet my ad budget is duly depleted. Yelp Launches AI-Powered Assistant to Streamline Local Search and BookingsYelp has made significant upgrades to its AI-powered assistant – Yelp Assistant. Instead of just producing listings, the assistant can answer questions, recommend businesses, and complete actions like reservations or appointments. Users can complete these tasks using natural language with Yelp Assistant that can interpret complex queries and requests.Yelp’s large database of reviews and photos help explain why a specific business fits the request. The system is now integrated with platforms such as Vagaro (beauty/wellness), Zodoc (healthcare appointments), and Calendly. Also new is Menu Vision – a feature that allows users to view menus up-close before ordering. Yelp is evolving from a search/discovery engine to a transaction-powered assistant, making the search experience smoother. (Source: Search Engine Land)Why this is important for your small business: My company sells technology services and software B2B so I’m less inclined to use Yelp. But if I were a B2C company or my business was more attuned to Yelp’s audience I would be diving deeply into the platform’s latest AI offerings and integrations. I would probably be using an outside Yelp expert as well. I’ve worked with other small businesses who have done well reaching prospects on Yelp but only after investing a considerable amount of effort and resources to do so.Start Vibe coding in AI Studio With Your Google AI SubscriptionThis week, Google announced that Google AI Pro and AI Ultra subscribers have “increased usage limits” in Google AI Studio to make app creation more accessible. This includes access to Gemini Pro and Nano Banana Pro, making it easier for developers and hobbyists to transition from experiments to production. Before this update, developers had to manage API (Application Programming Interface) keys, quotas and usage-based charges early in the process. Now developers can more easily assess monthly costs before committing to API pricing through this new subscription model. “These benefits offer an easy entry point to developers who would like to experiment and prototype more deeply with AI Studio,” Google stated. (Source: Google)Why this is important for your small business: Claude has been receiving all the “vibe-coding” attention lately (with a little shared with OpenAI) but my prediction is that Google is going to ultimately be the main player, particularly as it rolls out more tools within their AI Studio to help developers create solutions. Keep a close eye on the upcoming Google I/O event on May 19th where I’m expecting the company to announce many blow-your-mind AI developments.HubSpot Introduces Outcome-Based Pricing for AI Agents Starting April 14HubSpot has introduced “outcome-based pricing” for its Breeze Customer Agent and Breeze Prospecting Agent, offering a more valuable way for businesses to leverage AI. Rather than paying just for licenses, HubSpot’s new model attaches costs to completed tasks. According to the company, the cost per conversation has been reduced to $0.50 from $1 per “resolved conversation” by its Breeze Prospecting Agent. For the Prospecting Agent, the cost is $1 per qualified lead. This move by HubSpot demonstrates an understanding that businesses are looking for measurable ROI that could make adoption easier for those who are more skeptical about AI tools. “Businesses are being asked to make big bets on AI right now… Outcome-based pricing removes that risk,” HubSpot’s Chief Customer Officer, Jon Dick, said. (Source: Small Business Trends)Why this is important for your small business:This is a very interesting way to price a product and one that’s more suitable to companies looking for clear ROI on their technology investments. As a CRM provider, it’s always difficult to quantify the value of what we sell. This type of approach makes it a more tangible discussion.“Have a technology story that small business owners should know about? Share it with me on X @genemarks, and it may be featured in a future edition of The Main Street Tech Report.”" temperature="0.3" top_p="1.0" best_of="1" presence_penalty="0.1" ].50, while the cost for qualified leads remains at . This pricing strategy reflects an understanding of businesses' needs for measurable ROI, making AI adoption more appealing. Why this is important for your small business: This innovative pricing model offers a tangible way for businesses to assess the value of their technology investments. As a CRM provider, quantifying value can be challenging, but outcome-based pricing fosters a more concrete discussion around ROI. Small businesses should consider how such models can enhance their technology strategies and drive measurable results. Have a technology story that small business owners should know about? Share it with me on X @genemarks, and it may be featured in a future edition of The Main Street Tech Report." max_tokens="3500" temperature="0.3" top_p="1.0" best_of="1" presence_penalty="0.1" frequency_penalty="frequency_penalty"].50 and maintaining a cost per qualified lead.

AppWizard

April 25, 2026

NoVoice malware hit 2.3 million Android devices through apps Google never should have approved

McAfee researchers discovered a complex Android rootkit campaign, dubbed Operation NoVoice, that infiltrated 50 applications on Google Play, exploiting vulnerabilities in the kernel that had been patched but not uninstalled. The malware was resilient enough to survive factory resets and was concealed within seemingly benign apps, which collectively garnered 2.3 million downloads. The malicious payload was hidden in the com.facebook.utils package and used steganography to embed an encrypted payload within a PNG image. The malware conducted multiple checks to avoid detection and established contact with a command-and-control server, polling for exploit packages every 60 seconds. It utilized 22 distinct exploits, including vulnerabilities that had received patches between 2016 and 2021. The malware disabled SELinux enforcement and installed a persistent rootkit that could survive factory resets. Google confirmed the removal of the infected apps but noted that users who had already downloaded them remained at risk, especially if their devices were running unpatched Android versions. McAfee advised affected users to treat their devices as compromised and consider professional inspection or hardware-level storage wiping for remediation.

Winsage

April 25, 2026

Don’t miss paying just $22 for MS Office and Windows 11 Pro

A bundle is available that includes Microsoft Office Professional Plus 2019 and Windows 11 Pro for a one-time price of .97, significantly lower than the MSRP of 8. Microsoft Office 2019 includes applications such as Word, Excel, PowerPoint, Outlook, OneNote, Publisher, and Access, featuring improved inking, expanded data analysis in Excel, and enhanced presentation options in PowerPoint. Windows 11 Pro offers a modern interface, performance and security features, Snap layouts, virtual desktops, and a built-in AI assistant called Copilot. The bundle is structured as a one-time purchase, avoiding ongoing subscription fees. Prices are subject to change.

Winsage

April 24, 2026

Your Windows update experience just got updated

Windows Insiders are receiving enhancements to the Windows Update experience based on user feedback, focusing on providing more control and reducing disruptions. Key features include: 1. The ability to skip updates during the out-of-box experience (OOBE). 2. Extended options for pausing updates for up to 35 days, with the ability to re-pause as needed. 3. Separation of power actions from update actions, allowing users to shut down or restart without triggering updates. 4. Enhanced insights on available updates, including device class information for driver updates. Additionally, the update process will be unified to minimize reboots, with a single restart expected per month for most users. Updates will download in the background and can be manually initiated by users. Improvements also focus on reducing update times and implementing automatic recovery measures for update failures.

Winsage

April 24, 2026

Microsoft to roll out Entra passkeys on Windows in late April

Microsoft will introduce passkey support for phishing-resistant passwordless authentication on Microsoft Entra-protected resources starting in late April, with broader availability expected by mid-June 2026. This feature will allow passwordless sign-in on unmanaged Windows devices and will support various device types, including corporate, personal, and shared options. Administrators can manage passkeys through Conditional Access and Authentication Methods policies. Users can create device-bound passkeys stored securely within the Windows Hello container, using methods like facial recognition, fingerprint scanning, or a PIN. The passkeys will adhere to FIDO2 standards and will be securely bound to individual devices, preventing transmission over the network to enhance security against phishing and malware attacks. Microsoft has also announced plans for mandatory multifactor authentication registration for Entra tenants by October 2024 and that all new accounts will be passwordless by default starting in May 2025.

Tech Optimizer

April 24, 2026

Fileless Malware and Email Authentication Gaps

Fileless malware operates stealthily within networks, utilizing legitimate system tools like PowerShell and Windows Management Instrumentation (WMI) to execute malicious code in memory without leaving traces on disk. Traditional antivirus solutions struggle to detect these threats due to their reliance on file signatures. The primary vector for fileless malware is email, where attackers use spoofed messages to trick users into activating malicious scripts. Misconfigurations in Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) records create vulnerabilities that attackers exploit to deliver spoofed emails. Traditional endpoint protection mechanisms are inadequate against fileless attacks, necessitating a shift towards behavioral analysis for detection. Organizations must assess their preparedness by ensuring proper email authentication configurations and enhancing endpoint security capabilities. Integration among security teams and updated employee security awareness programs are also essential. Sendmarc helps organizations mitigate vulnerabilities by providing visibility into SPF, DKIM, and DMARC configurations and enforcing DMARC to block unauthenticated messages.

Winsage

April 24, 2026

Windows 11 now shows if your Secure Boot certificates are ready for June

Windows 11 has introduced a feature that allows users to verify the status of their Secure Boot certificates directly from system settings, simplifying the process ahead of the June 2026 expiration deadline. This update enhances accessibility and empowers users to maintain system security against vulnerabilities. Secure Boot helps prevent unauthorized software and malware from loading during startup, and confirming certificate status can mitigate risks associated with system breaches.

AppWizard

April 24, 2026

Another spyware maker caught distributing fake Android snooping apps

The Italian digital rights organization Osservatorio Nessuno has revealed a new malware called Morpheus, used by government agencies for surveillance. Morpheus is disguised as a phone updating application and can extract various data from targets' devices. The spyware is linked to IPS, an Italian firm specializing in lawful interception technologies, which claims to operate in over 20 countries. Morpheus is categorized as "low cost" due to its straightforward infection method, which involves tricking targets into installing the software. Authorities collaborated with the target's mobile service provider to obstruct data and send an SMS prompting the installation of the malware. Once installed, Morpheus exploits Android's accessibility features to access extensive information and masquerades as the WhatsApp application to solicit biometric data. The spyware's code contains Italian phrases and references to "Gomorra," indicating its connection to the Italian spyware industry. The attack is likely linked to political activism in Italy. IPS is among several Italian spyware manufacturers that have emerged following the decline of Hacking Team.