spoofing Archives

AppWizard

March 28, 2026

Undeliverable? Why the Kremlin might be set to silence online messaging apps in Russia.

Residents of Moscow are experiencing GPS spoofing in downtown areas, leading many to use paper maps instead of digital navigators due to signal manipulation by security forces to counter Ukrainian drones. The Russian government is "throttling" popular messaging apps like WhatsApp and Telegram in favor of a domestically developed super-app named Max. This strategy aims to reshape online interactions in Russia and is part of broader efforts to control the digital landscape. Analysts suggest that this could lead to a near-total internet shutdown during emergencies, with a published "whitelist" of about 900 essential websites. The internet disruptions have particularly affected younger generations who rely heavily on social networks and online services. Russia's media regulator, Roskomnadzor, has blocked foreign platforms for non-compliance with data localization laws and is targeting messaging apps, making them largely unusable without VPNs. Telegram may face a complete shutdown on April 1. Despite the crackdown, state agencies continue to use Telegram for communication, while security services view these apps as potential threats.

AppWizard

March 12, 2026

Fake Red Alert app used in Android spyware smishing

Acronis' Threat Research Unit has discovered a targeted campaign against Android users involving a counterfeit version of Israel's Red Alert rocket warning app that distributes spyware. The malicious software is spread through SMS messages that appear to be official communications from the Home Front Command, prompting users to download an "update." The fraudulent app mimics the legitimate safety tool, maintaining its rocket alert functionality to avoid detection. Once installed, the spyware collects sensitive data such as SMS messages, contacts, location information, device accounts, and a list of installed applications. This tactic, termed "smishing," combines SMS and phishing techniques. The malware uses sophisticated methods like certificate spoofing and runtime manipulation to bypass Android's signature checks, and it consists of a loader and a secondary component that executes the real alert application while the spyware operates in the background. The spyware monitors user permissions and can harvest SMS messages, contacts, and location data, adjusting its behavior based on the user's geographical position. It sends collected data to a remote command-and-control server, with the exfiltration endpoint identified as ra-backup[.]com. Acronis suggests this campaign may be linked to the group Arid Viper (APT-C-23), known for targeting Israeli interests with trojanized Android applications. Researchers recommend users only download apps from official sources, avoid sideloading packages from SMS links, and review app permissions carefully. They advise checking for the package name com.red.alertx on devices and performing a factory reset if found, along with changing credentials for any accessed accounts.

AppWizard

March 6, 2026

Research company claims spyware posing as Israel’s Red Alert Android app targeting users

Acronis Threat Research Unit (TRU) has uncovered a cyber espionage campaign targeting Israeli civilians through a fake version of the Red Alert app. The attack begins with a deceptive text message claiming to be from Israel's Home Front Command, urging users to download an updated app due to a malfunction. The fraudulent app closely resembles the legitimate Red Alert app but contains malware that collects sensitive personal information, including messages, contacts, location data, and device account details. This data is stored locally and then transmitted to a remote server controlled by the attackers. The hackers use certificate spoofing and other techniques to bypass Android's security measures, making the malicious app appear legitimate. Cybersecurity experts recommend that Israeli users take precautions to protect their personal information.

Winsage

February 27, 2026

De-Enshittify Windows 11: Make Windows 11 More Secure ⭐

Windows 11 offers a mix of security and privacy features, with a recommendation for users to opt for a Copilot+ PC with a Qualcomm Snapdragon X-series processor for enhanced security. Most users log in with a Microsoft account, which provides benefits such as two-factor authentication, device-bound passkeys, account recovery options, and automatic disk encryption. However, using a local account poses security risks, including limited recovery options and lack of support for key security features. To secure Windows 11, users should take several steps during initial setup or later, including enabling Windows Security features, verifying device encryption, and enhancing sign-in security through Windows Hello options like facial and fingerprint recognition. Additional security features such as Controlled Folder Access and Smart App Control can be configured for better protection. Users are advised to remove unnecessary third-party security apps and keep Windows 11 and installed applications up-to-date to maintain security. Regular updates and proper configuration of Windows Update settings are also essential for preventing disruptions and ensuring data safety.

AppWizard

February 20, 2026

Keeping Google Play & Android app ecosystems safe in 2025

The Android ecosystem focuses on preventing real-world harm, including malware and privacy invasions, by enhancing investments in AI and real-time defenses. In 2025, over 1.75 million policy-violating apps were prevented from being published, and more than 80,000 malicious developer accounts were banned. Google Play conducts over 10,000 safety checks on each app, blocking over 255,000 apps from accessing sensitive user data and 160 million spam ratings and reviews. Google Play Protect scans over 350 billion apps daily, identifying over 27 million new malicious apps last year. Enhanced fraud protection was expanded to 185 markets, blocking 266 million risky installation attempts. Developer tools like Play Policy Insights and the Play Integrity API were introduced to streamline app development and enhance security. Developer verification is being extended to ensure accountability, and Android 16 includes features to protect sensitive information with minimal code.

Winsage

February 16, 2026

Windows User Switches to Linux, Misses Windows Hello

The author transitioned from Windows to Linux for daily workflows, finding that most essential tools adapted well. Linux distributions can easily detect hardware on modern x86 laptops, and community projects enhance compatibility for devices like Microsoft’s Surface. Software integration was smooth, with applications like Microsoft Edge and 1Password functioning without issues. However, the author misses Windows Hello's biometric sign-in, which lacks a universal equivalent in Linux. Community solutions exist but often require technical adjustments. Linux desktops provide a polished experience, but challenges remain, such as webcam functionality and sleep/resume issues. Selecting compatible hardware is crucial for a successful transition, and Linux holds about 4% of the desktop market share globally.

Winsage

February 13, 2026

Four new reasons why Windows LNK files cannot be trusted

Researcher Beukema presented a method for concealing malicious command-line arguments within benign executables using LNK files. This technique allows attackers to initiate trusted Windows binaries while embedding instructions without directly referencing malware. The manipulation occurs in the LNK file's “ExtraData” section by enabling the “HasExpString” flag and configuring the “EnvironmentVariableDataBlock” with null bytes in the “TargetANSI/TargetUnicode” fields. This results in the target field becoming read-only and hiding command-line arguments, which are still passed on when the LNK is opened. This enables exploitation by allowing the execution of arbitrary commands while launching a harmless system component.

Winsage

February 13, 2026

Microsoft: New Windows LNK spoofing issues aren’t vulnerabilities

Security researcher Wietze Beukema revealed vulnerabilities in Windows LK shortcut files at the Wild West Hackin' Fest, which could allow attackers to deploy harmful payloads. He identified four undocumented techniques that manipulate these shortcut files, obscuring malicious targets from users. The vulnerabilities exploit inconsistencies in how Windows Explorer handles conflicting target paths, allowing for deceptive file properties. One technique involves using forbidden Windows path characters to create misleading paths, while another manipulates LinkTargetIDList values. The most sophisticated method alters the EnvironmentVariableDataBlock structure to present a false target in the properties window while executing malicious commands in the background. Microsoft declined to classify the EnvironmentVariableDataBlock issue as a security vulnerability, stating that exploitation requires user interaction and does not breach security boundaries. They emphasized that Windows recognizes shortcut files as potentially dangerous and provides warnings when opening them. However, Beukema noted that users often ignore these warnings. The vulnerabilities share similarities with CVE-2025-9491, which has been exploited by various state-sponsored and cybercrime groups. Microsoft initially did not address CVE-2025-9491 but later modified LNK files to mitigate the vulnerability after it was widely exploited.

Winsage

January 19, 2026

The Last Windows Security Updates of January 2026 Are Here

Microsoft released its first set of security updates for the Windows operating system and various products in January 2026, addressing over 110 vulnerabilities. The updates are available for all supported versions of Windows, with Windows 10 receiving fixes only through the Extended Security Updates (ESU) program. Windows 11 versions 24H2 and 25H2 are the main consumer releases benefiting from these updates. Approximately 112–114 security updates were released, with around 8 rated as Critical. At least one zero-day vulnerability is actively exploited. The updates include security fixes for Windows, Office, Edge, Azure, and server components. Windows 11 versions 23H2, 24H2, and 25H2, as well as Windows Server 2023 and 2025, have known issues. Windows 11 version 24H2 and 25H2 received security fixes for multiple vulnerabilities, while version 23H2 continues to receive support through enterprise servicing channels. Windows 10 updates are limited to ESU-enrolled systems, with general support ending in October 2025. Windows Server 2016, 2019, 2022, 2023, and 2025 received January security updates, addressing important vulnerabilities without disclosing any critical ones. Microsoft also released updates for Office products and SharePoint Server components. Known issues after the January updates include credential prompt failures and authentication issues in Azure Virtual Desktop and Windows 365, particularly affecting the new Windows App. Workarounds involve using the classic Remote Desktop client or the web-based RDP client. Additionally, devices with Secure Launch enabled may experience shutdown and sleep mode failures. Microsoft has provided out-of-band fixes for certain affected systems as of January 18, 2026. Users can manually install updates through the Windows Update feature, and it is recommended to create a full system backup before proceeding with updates.

Winsage

January 17, 2026

Microsoft Confirms First Free Windows Update For 2026

Windows 10 will reach its end of life on October 13, 2026. Microsoft is encouraging users to enroll in the Extended Security Updates (ESU) program before this date to avoid increased vulnerability to viruses and malware. Windows 10's market share has increased from 42% to 46%, while Windows 11 remains below 50%. The first Windows 10 ESU update for 2026, KB5073724, has been released, addressing 112 security issues, including 57 Elevation of Privilege vulnerabilities, 22 Information Disclosure vulnerabilities, and 5 Spoofing vulnerabilities. The January 2026 update will introduce new Secure Boot certificates to mitigate security risks. Payment options for the ESU include cash, Reward points, or a complimentary option for Microsoft account holders syncing settings via OneDrive.