NewApp Digest
search bot

System Information

Hackers Disguise CHOSEN BRICK Malware as AI Apps, Antivirus Software and MRI Results
Tech Optimizer
September 16, 2026

Hackers Disguise CHOSEN BRICK Malware as AI Apps, Antivirus Software and MRI Results

Iranian state-affiliated cyber actors are targeting dissidents, activists, and journalists using fake AI applications, counterfeit antivirus tools, and fabricated MRI scan results, primarily through a spyware family known as CHOSEN BRICK, which is designed for Windows systems. This campaign has been active since at least 2025 and affects individuals globally, including in the UK, US, and Netherlands. The malware establishes persistence via the Windows Registry Run key and communicates through Telegram, utilizing unique Bot IDs for each victim. CHOSEN BRICK is capable of extensive data collection, including capturing screenshots, recording audio, and stealing email content. Personal information from victims has been found on pro-Iranian leak sites, increasing harassment risks. Security measures should include monitoring for suspicious Registry entries and unusual communications, while users are advised to avoid unsolicited software installations and keep their systems updated. The FBI refers to this malware family as HEAVYGRAM.
Fake Software Installers Disable Windows Update and Weaken Microsoft Defender
Winsage
September 2, 2026

Fake Software Installers Disable Windows Update and Weaken Microsoft Defender

An active malware campaign is using counterfeit software-download websites to distribute malicious installers, primarily targeting users seeking popular software. This campaign has significantly affected China-based operations of multinational corporations and Chinese-speaking users. The malware, once executed, can establish persistence, undermine security measures, and communicate with attacker-controlled infrastructure. Victims span various sectors, including healthcare, manufacturing, gaming, technology, logistics, government, and education. Microsoft associates this campaign with a Chinese threat cluster called Silver Fox, known for using spoofed vendor download pages to spread Gh0st RAT and ValleyRAT. The malicious websites are hosted on .com.cn and .hl.cn domains, featuring Chinese-language content. The downloaded files are dynamically generated, and upon execution, they deploy a wrapper installer that initiates the malware payload. The malware achieves persistence through scheduled tasks and interferes with Windows Update services. The campaign establishes command-and-control communication over non-standard ports, with two identified domains linked to the activity. Microsoft Defender has detected the threat and initiated containment procedures. Kaspersky reported a related malicious installer exploiting a legitimate adware application to execute a backdoor, which captures keystrokes and clipboard contents. ValleyRAT, a sophisticated implant, can collect system information, reboot the computer, capture screenshots, and transmit logs. The attackers are motivated by cyber espionage and financial gain, targeting organizations globally. A subgroup within GoldenEyeDog, known as CuboidalCanine, has also been linked to the use of ValleyRAT, particularly in the gambling industry. In June 2026, Chinese authorities addressed cybercrime cases involving a new variant of the Silver Fox trojan.
6 awesome things you can do with a terminal emulator on Android
AppWizard
August 29, 2026

6 awesome things you can do with a terminal emulator on Android

Terminal emulators allow users to interact with operating systems through text commands. Termux is an open-source terminal emulator for Android available on the F-Droid store. Users can test internet speed directly from Termux by installing Python and using the speedtest command. Weather information can be accessed using the curl command for a three-day forecast, and users can create shortcuts for convenience. Termux can display system information using colorful ASCII art with tools like fastfetch or macchina. It allows remote access to the phone via SSH after installing openssh. Users can run AI chatbots locally using the command-line tool Ollama. Termux can also facilitate the installation of Linux-based operating systems on Android devices using the proot-distro tool.
Microsoft is killing this 25-year-old Windows tool. Your scripts might break
Winsage
August 18, 2026

Microsoft is killing this 25-year-old Windows tool. Your scripts might break

Microsoft is phasing out the Windows Management Instrumentation Command-line (WMIC) tool, which will be entirely absent from existing Windows PCs following the latest preview update. WMIC, a command-line utility for extracting system information and performing administrative tasks, is being removed, although the underlying Windows Management Instrumentation (WMI) framework will remain supported. Users relying on older management and automation scripts that utilize WMIC may face challenges, as commands associated with WMIC will no longer function after the update.
The guy who built Windows Task Manager in 1996 just remade it with a cyberpunk vibe — but there's one big issue for PC users
Winsage
August 13, 2026

The guy who built Windows Task Manager in 1996 just remade it with a cyberpunk vibe — but there’s one big issue for PC users

Dave W. Plummer, a notable figure in programming, contributed significantly to Microsoft by introducing ZIP file support for Windows, adapting Space Cadet Pinball for Windows NT, and creating the Windows Task Manager, which debuted in 1996. He has shared insights from his time at Microsoft through his platform, Dave's Garage. Recently, he released a mockup of a redesigned Task Manager, named "Task Manager OG" (TMOG), which features a cyberpunk aesthetic and is currently available as a beta version for macOS, with a Windows version planned. TMOG combines elements of macOS's Activity Monitor and Windows Task Manager, providing essential system information and deeper diagnostics. The application is described as being half the size of the Windows Task Manager and is available for free download.
Ditching Windows is the loudest feedback you can ever give Microsoft
Winsage
July 21, 2026

Ditching Windows is the loudest feedback you can ever give Microsoft

Frustration with Microsoft's data collection practices has increased, particularly since the transition from Windows 7, where the amount of user data collected has significantly risen. Microsoft gathers extensive data points, including device IDs, user IDs, operating system information, and application usage data. Many users are turning to Linux as an alternative, as it respects user privacy and does not collect personal data without consent. Microsoft has also employed manipulative design tactics to influence user behavior, such as persistent prompts and misleading visuals. Additionally, the introduction of ads in Windows 11 has been viewed as disrespectful to paying customers, while Linux remains ad-free. Users are encouraged to switch to Linux to express dissatisfaction with Microsoft's practices and to reclaim their digital autonomy.
GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware
Tech Optimizer
July 10, 2026

GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware

Microsoft Threat Intelligence has identified the GigaWiper malware, which has been detected in compromised environments since October 2025. This malware has destructive capabilities and comes in two forms: standalone wiper binaries and larger binaries with backdoor functionalities, both developed in Golang. The standalone wiper operates at the physical disk level, overwriting disk content and removing partition references. The backdoor variant includes the same wiper functionality and adds persistence through a registry key and scheduled tasks, along with command and control communication via RabbitMQ and Redis. GigaWiper can execute various commands, including wiping drives, triggering a Blue Screen of Death (BSOD), file encryption that mimics ransomware behavior, and managing system elements. The malware integrates components from multiple malware families, including wipers and ransomware mechanisms, and has been linked to a previous malware known as FlockWiper. To defend against GigaWiper, organizations are advised to implement security measures such as tamper protection, blocking access to known C2 infrastructure, and utilizing endpoint detection and response solutions. Microsoft Defender provides detections for GigaWiper and related malware, and threat intelligence reports are available for customers to stay informed about threats. Indicators of compromise include specific SHA-256 hashes and IP addresses associated with GigaWiper.
Search