NewApp Digest
search bot

system access

New Albiriox MaaS Malware Targets 400+ Apps for On-Device Fraud and Screen Control
AppWizard
December 2, 2025

New Albiriox MaaS Malware Targets 400+ Apps for On-Device Fraud and Screen Control

A new Android malware named Albiriox has emerged, marketed as malware-as-a-service (MaaS). It features a hard-coded list of over 400 applications, including banking and cryptocurrency platforms, and is distributed through social engineering tactics using dropper applications. Initially advertised in late September 2025, it became a full MaaS offering by October, with Russian-speaking threat actors behind its development. Albiriox allows remote control of compromised devices via an unencrypted TCP socket connection and Virtual Network Computing (VNC), enabling attackers to extract sensitive information and perform overlay attacks for credential theft. One campaign targeted victims in Austria using German-language lures and counterfeit Google Play Store listings. Albiriox also utilizes Android's accessibility services to bypass security measures and employs a novel distribution strategy involving a counterfeit website that collects phone numbers. Additionally, another Android MaaS tool, RadzaRat, was introduced, masquerading as a file management utility while offering extensive surveillance and remote control capabilities. RadzaRat can log keystrokes and maintain persistence through specific permissions, highlighting a trend in the availability of sophisticated cybercrime tools.
CISA Issues Warning Over Microsoft Windows Vulnerability Actively Exploited by Attackers
Winsage
October 17, 2025

CISA Issues Warning Over Microsoft Windows Vulnerability Actively Exploited by Attackers

CVE-2025-59230 is a significant vulnerability affecting Microsoft Windows, classified as an improper access control flaw that allows authorized attackers to escalate their privileges on compromised systems. It is embedded within the Windows Remote Access Connection Manager and enables attackers to execute malicious code with elevated rights, access sensitive data, and move laterally across network segments. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on October 14, mandating federal civilian executive branch agencies to apply security patches by November 4, in accordance with Binding Operational Directive 22-01. Organizations are encouraged to apply Microsoft’s security updates promptly, follow BOD 22-01 guidance, and isolate affected systems if patches cannot be applied.
New IAmAntimalware Tool Injects Malicious Code Into Processes Of Popular Antiviruses
Tech Optimizer
October 14, 2025

New IAmAntimalware Tool Injects Malicious Code Into Processes Of Popular Antiviruses

A new tool called IAmAntimalware was released on October 11, 2025, by a developer known as Two Seven One Three on GitHub. It is designed to infiltrate antivirus software by injecting malicious code, exploiting vulnerabilities in Windows service cloning and digital signature manipulation. IAmAntimalware can clone legitimate antivirus services, allowing it to bypass antivirus self-protection mechanisms. It modifies the Windows Cryptography API registry to hijack the cryptographic provider and supports COM object CLSID manipulation for component loading. The tool relies on a companion tool named CertClone to duplicate valid Windows certificates, making injected DLLs appear legitimate. Demonstrations have shown its ability to inject code into processes like Bitdefender’s BDProtSrv, creating unauthorized files within antivirus folders. Although widespread exploitation has not yet occurred, its open-source nature and straightforward design could lead to increased adoption. Security analysts rate the technique as medium severity due to its reliance on system access and lack of zero-day exploits, highlighting vulnerabilities in antivirus trust models. Experts recommend monitoring unusual module loads and enforcing strict certificate trust policies to mitigate risks associated with IAmAntimalware.
Threat Actors Market Stealthy New RAT as Alternative to ScreenConnect FUD
Tech Optimizer
September 22, 2025

Threat Actors Market Stealthy New RAT as Alternative to ScreenConnect FUD

Cybersecurity researchers have identified a sophisticated Remote Access Trojan (RAT) being marketed as a fully undetectable alternative to the legitimate ScreenConnect remote access solution. This malware evades security measures like Google Chrome and Windows SmartScreen by bundling itself with valid Extended Validation (EV) certificates, allowing it to appear legitimate and evade detection. The RAT employs a comprehensive evasion toolkit, including antibot mechanisms and cloaked landing pages, to mislead automated security scanners while delivering malicious payloads. It utilizes fileless execution techniques via PowerShell commands, enabling it to operate without leaving traditional file traces. The malware provides attackers with real-time control over compromised systems, facilitating data exfiltration and system manipulation. The sales strategy of the threat actors indicates a mature cybercrime-as-a-service model, with the tool marketed as a "FUD loader" for establishing persistent access before deploying secondary payloads. This trend highlights an increasing focus on exploiting user trust in legitimate brands and undermining security technologies, particularly through the use of valid EV certificates. Security professionals are warned to expect more instances of brand impersonation and sophisticated evasion techniques.
Steam's new Performance Overlay is more accurate than Task Manager, says Valve — GPU utilization monitoring comes directly to Steam in latest client beta
AppWizard
August 18, 2025

Steam’s new Performance Overlay is more accurate than Task Manager, says Valve — GPU utilization monitoring comes directly to Steam in latest client beta

Valve's latest Steam Client Beta enhances GPU monitoring capabilities, providing more accurate utilization readings compared to the Windows Task Manager, which often under-reports GPU usage. The updated in-game overlay captures all related processes, reducing sampling errors and aligning statistics with third-party tools like MSI Afterburner. It aggregates GPU usage across multiple processes, offering a comprehensive view of a game's GPU demands. The overlay also distinguishes between native frames and those generated by technologies like DLSS and FSR, and provides real-time readings of CPU load, RAM usage, clock speeds, and frame timing graphs. Additionally, it includes a CPU temperature display on both Windows and Linux, enabled by a trusted CPUID-derived kernel driver. Users are cautioned about the stability of the updated GPU metrics, as this feature is currently in beta and may not be suitable for general use.
Search