NewApp Digest
search bot

surveillance

Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week
Winsage
September 9, 2026

Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week

Recent investigations have identified the BlueMoon exploit kit, used by espionage-driven threat activity clusters, particularly linked to APT31, a China-aligned state-sponsored group, since August 28, 2026. BlueMoon exploits three vulnerabilities: CVE-2026-85046 (a type confusion vulnerability in Google Chrome's V8 engine), an unassigned V8 sandbox escape, and CVE-2026-85880 (a heap-based buffer overflow in Windows ALPC). Google and Microsoft have released patches for these vulnerabilities, which were exploited as "patch-gap" zero-days. The attack vectors typically begin with phishing emails that lead victims to malicious URLs, triggering the vulnerabilities for code execution and privilege escalation. Variants of BlueMoon have been detected, featuring modifications for specific campaigns. Notable attack chains include: - APT31 targeting NGOs and mining firms in the U.S. with a malicious browser add-on called GemStone. - UNK_LateNight targeting U.S. aerospace companies, deploying BlueMoon alongside the ShadowPad backdoor. - UNK_DoubleCheck targeting a Vietnamese manufacturer, using DLL sideloading to execute a Rust binary. - UNK_QuietRacket targeting government and financial organizations in Indonesia and Singapore, modifying BlueMoon to execute a .NET assembly. CISA added the Chrome flaw to its Known Exploited Vulnerabilities catalog on September 4, 2026, requiring federal agencies to apply patches by September 18, 2026. Indicators of compromise include specific process trees, files, folders, scheduled tasks, mutexes, and registry keys. Proofpoint has released detection rules to help organizations identify and mitigate these threats.
New JK Terror Tactic: Pornography Apps, Tor Network Used For Secret Messaging
AppWizard
August 30, 2026

New JK Terror Tactic: Pornography Apps, Tor Network Used For Secret Messaging

Security agencies in India have observed a shift in the tactics of terrorist groups, which are now using pornography websites and niche encrypted applications for communication instead of traditional social media. These groups, often collaborating with Pakistan's ISI, utilize platforms with real-time chat tools disguised as dating services to send instructions to recruits in Jammu and Kashmir. Security agencies are monitoring various digital tools, including Tor-based applications like Coatex and Conion, which obscure user identities. Some privacy-focused platforms do not require phone numbers for registration, complicating tracking efforts. Despite bans on certain pornography applications in India, they are still accessed illegally via VPNs, which mask users' IP addresses. The use of the Tor network presents additional tracking challenges, as it obscures data origins and destinations. Security agencies are adapting their surveillance methods in response to these developments, which include the use of virtual SIM cards in terrorist activities, as highlighted during investigations into the 2019 Pulwama attack.
Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices
AppWizard
August 23, 2026

Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices

A new Android malware threat, codenamed Manic, poses significant risks to Ukrainian banks, government services, and messaging applications, with a reach extending to Russian and European financial institutions, global fintech platforms, cryptocurrency services, and military communication channels. Manic combines Android banking malware and mobile spyware, targeting sensitive applications and enabling comprehensive device takeover. It features a novel Wi-Fi mesh technique for data relay through compromised devices and utilizes phishing sites and dropper apps. The malware originated in February 2026, with initial development leading to its first deployment by late May. It monitors 169 package IDs related to banks, payment services, and messaging applications, primarily affecting Ukrainian targets but also impacting applications in Russia and Europe. Manic can infiltrate commercial and military messaging apps, track locations, monitor notifications, and collect files. It exploits Android's accessibility services to capture sensitive data and employs a store-and-forward relay mechanism for data exfiltration through nearby compromised devices. Google has stated that no apps containing this malware are found on Google Play, and Android users are protected by Google Play Protect.
Aussie developer Monomyth Games announces Photo Roboto: A Timesnap Adventure for PC
AppWizard
August 20, 2026

Aussie developer Monomyth Games announces Photo Roboto: A Timesnap Adventure for PC

Monomyth Games has announced its new title, Photo Roboto: A Timesnap Adventure, marking its first game since 2018's Need to Know. Players will take on the role of Peppino the Roboto, who operates a time-warp photography business on an Italian island. Key features include the Timewarp Camera for capturing images from different time periods, running a photography business, exploring the island of Pallacanezza, helping locals, experiencing a handcrafted narrative, trying new camera modes, and personalizing the shop and character. The game is set for release on PC via Steam in 2027.
⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More
Winsage
August 17, 2026

⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More

A suspected advanced persistent threat (APT) group linked to China exploited a newly patched vulnerability in VMware vCenter (CVE-2026-59310), which has a critical CVSS score of 9.8, allowing for arbitrary code execution and the deployment of Babuk-derived ransomware. A recently patched vulnerability in Apple macOS (CVE-2026-65400) has been exploited to deploy a cryptocurrency miner, granting unauthorized root access. The Lazarus Group from North Korea exploited a zero-day vulnerability in Microsoft Windows, targeting defense and aerospace sectors. GeoServer patched a critical SQL injection vulnerability that was actively exploited. A new macOS malware, Amnesia Stealer, targets users through ClickFix attacks, stealing data and allowing real-time access to authenticated sessions. A novel attack technique named GhostSplice can manipulate AI coding assistants. Research revealed a method exploiting Chromium's DevTools Protocol for data theft. Noteworthy CVEs this week include CVE-2026-68820, CVE-2026-58231, and multiple others across various platforms. A high-severity command injection flaw in FileRun allows remote code execution. An advanced ClickFix attack has been reported, deploying sophisticated malware. A heap overflow vulnerability in Citrix NetScaler was patched after indications of exploitation. A new malware loader targeting Portuguese-speaking users has been identified. A significant reduction in exposed Automatic Tank Gauge systems has been observed. A phishing campaign targeting Brazil has been detected, and an F.B.I. agent faces charges for unauthorized crypto withdrawals. Authorities in Ukraine dismantled fraudulent call centers, and a North Carolina man was sentenced for cyber extortion. Unauthorized access to sensitive data by the ExfilSquad group has been confirmed. LightSpy activity linked to China has been detected in over 13 countries. A supply chain attack exposed over 2,500 companies, and an Azure exfiltration campaign has exposed millions of enterprise records.
The Watcher is a new surveillance thriller game coming to PC
AppWizard
August 17, 2026

The Watcher is a new surveillance thriller game coming to PC

Developer Yesterday’s Sandwich has announced a new psychological thriller game titled The Watcher, set to launch on PC through Steam. The game utilizes Unreal Engine 5 and allows players to act as a voyeuristic observer, stationed across the street from an apartment building with binoculars and surveillance tools. Players can snap photos, record video, listen to conversations, acquire documents, create an evidence board, upgrade their surveillance headquarters, and submit reports on their findings. Decisions made by players impact the residents' fates, and the game presents complex narratives and ethical dilemmas, challenging players' perceptions of guilt and innocence. The Watcher is available for pre-order on PC via Steam.
I tested an Android app that lets anyone fight censorship - and shows your impact in real time
AppWizard
August 14, 2026

I tested an Android app that lets anyone fight censorship – and shows your impact in real time

Snowflake Volunteer is a newly launched Android app available on the Google Play Store, created by the Tor Project, that allows users to contribute to internet freedom by transforming their smartphones into proxies for the Tor Network. It is a collaboration between Bloco, the Tor Network, and Guardian Project, building on the original Snowflake initiative from 2019. The app connects users needing access to the Tor Network, particularly in regions with heavy internet restrictions, by simulating user traffic as a video call via WebRTC and using dynamic proxies. Users can customize settings such as enabling/disabling the app, charging preferences, Wi-Fi operation, background operation, and connection limits. The app is open-source and available on both Google Play and F-Droid. Testing indicates that it does not significantly drain battery life, showing only a gradual decline over three hours with multiple connections. The app aims to enhance the robustness of the Snowflake network, making it harder for oppressive regimes to impose restrictions.
Японская полиция начала войну с торрентами — теперь у нее есть способ находить первоисточники раздач
TrendTechie
August 13, 2026

Японская полиция начала войну с торрентами — теперь у нее есть способ находить первоисточники раздач

Masakazu Ono, a 56-year-old resident of Sagamihara, was arrested by the Kyoto Prefectural Police for his role as a prolific seeder on the torrent tracker Nyaa, with assistance from the anti-piracy organization CODA and the Japan Hacker Association. His arrest was linked to the upload of the television series Midnight Taxi, but he had been sharing various programs from the Japanese broadcasting corporation for years. CODA identified him using tracker metadata analysis and de-anonymization techniques through Deep Packet Inspection, rather than traditional methods of monitoring torrent swarms.
Search