signature Archives

Winsage

June 2, 2026

New PHANTOMPULSE RAT Campaign Uses UAC Bypass in Windows Attacks

The REF6598 intrusion set has revealed a Remote Access Trojan (RAT) named PHANTOMPULSE, which is distributed via malicious Obsidian plugins. It uses advanced evasion techniques, including a blockchain-based command and control (C2) channel and a public User Account Control (UAC) bypass to infiltrate Windows systems. The malware disables security measures like the Antimalware Scan Interface (AMSI) and Windows Lockdown Policy (WLDP) through a hardware-breakpoint technique, allowing it to avoid detection by signature-based memory scanners. PHANTOMPULSE hides its core files in encrypted registry blobs and creates scheduled tasks that appear as .NET Framework updates. Its decentralized C2 framework queries public blockchains for operational data, but it lacks sender authentication, which can be exploited by defenders. The malware inventories the system for antivirus software and targets high-value applications. It employs a UAC bypass technique called “schuac” to gain elevated permissions. Analysts attribute this campaign to DPRK-aligned threat actors, particularly the BlueNoroff group, due to its focus on cryptocurrency wallets and blockchain exploitation. Defenders can identify new infrastructure by searching blockchain ledgers for a specific hex signature associated with the malware's C2 encryption routine.

Tech Optimizer

June 1, 2026

Avast Free Antivirus for Windows: Features, Limits, and US Use

Avast Free Antivirus for Windows is a free malware protection software designed for American home users, operating under Gen Digital, which also includes Norton. It provides essential security features such as real-time scanning, on-demand scans, and regular updates, but has limitations compared to paid versions, including the absence of features like VPN and advanced ransomware protection. The software is intended for home PC use and is available for download on Windows PCs. While it serves as a basic defense against common malware threats, it is not suitable for small businesses needing comprehensive security solutions. Users are advised to maintain safe browsing habits even with the antivirus installed.

AppWizard

May 30, 2026

Call of Duty: Modern Warfare 4 – First Details on the Next Epic Call of Duty Campaign

Activision is offering a 10% pre-order loyalty discount for previous owners of the Call of Duty® franchise on the Modern Warfare® 4 Vault Edition. Pre-ordering any digital edition grants early access to the Open Beta and the Hunter Killer Operator Skin for use in Call of Duty®: Black Ops 7 and Call of Duty®: Warzone™. The Vault Edition includes Call of Duty®: Modern Warfare® 4, the Hostile Alliance Operator Pack, the Special Forces Operator Pack, a Signature Weapon Collection, a BlackCell (1 Season) with a Battle Pass and additional content, and a DMZ Deployment Bonus. The game is set during a full-scale invasion on the Korean Peninsula, featuring a narrative involving South Korean soldiers and Captain Price. Gameplay includes various combat scenarios, a multiplayer mode focused on grounded combat, and a DMZ mode where players make critical decisions. Modern Warfare® 4 will be available on Xbox Series X|S and PC, but not on Xbox One, and online multiplayer requires a Game Pass Essential subscription and specific PC security requirements.

AppWizard

May 29, 2026

31 hours with the spit-shined Mina the Hollower (and 34 with the four games that came before it)

Mina The Hollower is a game developed by Yacht Club Games over six years for PC and consoles. The protagonist, Mina, has a unique move called "hollowing," which allows her to dive into the ground to find treasures and navigate through walls, contrasting with the jumping mechanic of Super Mario. The co-founder of Yacht Club Games, David D’Angelo, recommended starting with Shovel Knight to prepare for Mina The Hollower, noting that Specter of Torment is the least difficult and quickest to finish, while King of Cards offers a polished experience similar to Mina. Engaging with Yacht Club's previous titles enhances understanding of their game design evolution.

Winsage

May 28, 2026

Your Windows PC has a security deadline in June 2026

A Secure Boot certificate refresh is being deployed across supported Windows devices via Windows Update. The Secure Boot certificates from 2011 will begin to expire in June 2026, prompting Microsoft to introduce new 2023-dated certificates to maintain security. Most users will require minimal action if their PCs are updated, but older devices may face challenges. The current certificates include: - Microsoft Corporation KEK CA 2011: expires June 24, 2026 - Microsoft UEFI CA 2011: expires June 27, 2026 - Microsoft Windows Production PCA 2011: expires October 19, 2026 The new certificates will remain valid until 2038, with plans for post-quantum cryptography around 2030. While PCs using the 2011 certificates will continue to function, they will lose access to new security protections, making them vulnerable to emerging threats. A notable example of such a threat is the BlackLotus bootkit, which exploited vulnerabilities to bypass Secure Boot. Microsoft's rollout strategy involves a staged update process that typically takes around 48 hours and may require restarts. Users are advised to keep Windows updated and check their Secure Boot status. Known issues may arise for older PCs, systems that bypassed Windows 11 requirements, Legacy BIOS systems, and custom firmware configurations. IT teams managing devices should inventory their systems, monitor specific event IDs, test updates, and document devices that cannot be updated.

Winsage

May 27, 2026

Windows Users Targeted in New Phishing Campaign

Research from FortiGuard Labs has identified a phishing campaign that disguises itself as purchase orders, prompting recipients to open harmful attachments. The campaign begins with a phishing email containing a malicious JavaScript file. When executed, this JavaScript decrypts and runs a PowerShell script that uses process hollowing to inject a .NET downloader module into the trusted Windows process MsBuild.exe. This downloader connects to a remote command and control (C2) server to download and execute additional modules, allowing the attacker to alter the malware's behavior after the initial compromise. The campaign poses significant detection challenges for Windows users due to its use of multiple encryption layers, fileless execution techniques, and process hollowing strategies. Security experts emphasize the need for organizations to enhance their detection capabilities beyond traditional methods, focusing on identifying suspicious activity across various devices and applications. The phishing attack exploits social engineering tactics and blends malicious actions with legitimate administrative tools, complicating detection efforts. Additionally, the human element plays a crucial role in breaches, highlighting the importance of effective communication and collaboration between security teams and other departments to improve security awareness and behavior.

AppWizard

May 24, 2026

LEGO Minecraft Steve’s Desert Expedtion 21251 Review

LEGO Minecraft set Steve’s Desert Expedition (set number 21251) was released in 2024 and consists of 75 pieces, aimed at ages six and above. The set features Steve building a temporary dwelling in a desert and defending it from a Phantom. It includes a new version of the Steve minifigure with a dark azure shirt and a medium lavender enchanted axe, which is exclusive to four sets. The set also introduces a baby camel, designed with a 1X1 tan tile for its nose and constructed from two 1X2 tan bricks. The Phantom, a character in Minecraft since 2017, has a build that allows for dynamic flying poses. Steve's campsite is built on a tan plate, includes a small water source, a cactus, and a crafting table, though the campfire design could be improved for realism.

AppWizard

May 24, 2026

Jackbox’s first externally published game looks like the shot in the arm the stealth genre needs, and it’ll be out this year

My Arms Are Longer Now is a game that combines stealth mechanics with comedy, featuring a unique control system that allows players to manipulate a wiggly arm. Players engage in stealthy maneuvers while avoiding detection by witnesses and interacting with various characters, including a detective. The game emphasizes humor through its gameplay and narrative, creating a distinctive experience.

Tech Optimizer

May 23, 2026

CVE-2026-9082: Critical Drupal Core SQLi Flaw

Drupal has issued critical security updates for a vulnerability in Drupal Core, identified as CVE-2026-9082, which affects sites using PostgreSQL databases. This flaw allows anonymous attackers to exploit the system through arbitrary SQL injection, posing risks such as sensitive information disclosure, privilege escalation, and remote code execution. The vulnerability is rated 20 out of 25 by Drupal and 6.5 out of 10 by CVE.org. It specifically impacts the database abstraction API, which fails to properly sanitize queries. The fixed versions include 11.3.10, 11.2.12, 11.1.10, 10.6.9, 10.5.10, and 10.4.10, with best-effort patches available for unsupported versions 9.5 and 8.9. Organizations are advised to inventory their Drupal installations, verify PostgreSQL usage, and prioritize patching for public-facing sites.

Winsage

May 21, 2026

Microsoft Defender Zero-Day Vulnerabilities RedSun and UnDefend Actively Exploited on Windows 10, 11, and Server (April 2026 CVE Analysis)

In April 2026, two zero-day vulnerabilities, RedSun and UnDefend, were discovered in Microsoft Defender, affecting Windows 10, Windows 11, and Windows Server platforms. These vulnerabilities allow attackers to escalate privileges to SYSTEM and bypass Defender’s protections. RedSun exploits a flaw in Defender's remediation process, enabling low-privileged users to overwrite critical system files. UnDefend allows attackers to disrupt Defender’s updates, keeping it outdated and ineffective. Both vulnerabilities are actively being exploited, with attackers leveraging them to gain persistent access and deploy ransomware. The primary targets are organizations using Windows systems with Defender enabled, particularly in sectors like finance, healthcare, and government. Mitigation strategies include applying updates for related vulnerabilities, monitoring for suspicious activities, and implementing additional security measures.