tactics Archives

Winsage

September 4, 2026

Microsoft warns fake CAPTCHA is tricking Windows users into running malware

Microsoft has identified a new malware campaign called TerminalFix that uses fake CAPTCHA prompts to trick Windows users into executing malicious commands. This campaign is a variation of ClickFix attacks and employs deceptive pages that impersonate reputable services like Cloudflare. Instead of traditional CAPTCHA challenges, users are instructed to open PowerShell or Command Prompt and paste in commands, allowing attackers to execute complex scripts more easily. TerminalFix initiates a multi-stage intrusion, granting attackers persistent proxy access to the infected machine, which can lead to further exploitation of the company's network. The campaign relies on social engineering tactics, requiring user compliance with counterfeit verification instructions. Microsoft has released mitigation guidance, recommending restrictions on PowerShell access, monitoring for DLL sideloading, blocking outdated Flash plugins, and enabling cloud-delivered protection in Microsoft Defender Antivirus. The campaign poses significant risks to enterprise networks, but individual users should also be cautious about executing commands requested by websites.

Winsage

September 2, 2026

Fake Microsoft Edge, Kaspersky and Razer Installers Used to Compromise Windows Systems

An ongoing malware campaign is targeting Windows devices through counterfeit download pages for well-known software brands like Microsoft Edge, Kaspersky, and Razer. The campaign affects various sectors, including healthcare, manufacturing, gaming, technology, logistics, government, and education. It utilizes high-fidelity fraudulent websites that closely mimic legitimate vendors, with observed lure domains such as app-microsoft-edge[.]com[.]cn and kaspersky-lab[.]hl[.]cn. Attackers employ evasion tactics like server-side payload regeneration and create multiple copies of the same archive in quick succession. Victims are lured into downloading ZIP files that contain a bundled wrapper installer, which activates a stage-one executable in randomized directories. The malware often masquerades as legitimate software, with some payloads impersonating known applications. Persistence is achieved through scheduled tasks with unusual names, and the malware employs various evasion techniques, including deleting shadow copies and altering file permissions. Microsoft Defender has identified activity across multiple stages of the attack, including delivery, execution, and command-and-control communications. To mitigate risks, organizations are advised to block downloads from unofficial sources, enforce Tamper Protection, and implement Attack Surface Reduction rules. Indicators of compromise (IOCs) include specific lure domains and URLs associated with the campaign.

AppWizard

September 2, 2026

MHA issues advisory on malicious Android apps used to steal money, take control of phones

Cybercriminals are increasingly using malicious Android applications disguised as pornography apps to take control of users' devices and conduct unauthorized financial transactions. The Indian Cyber Crime Coordination Centre (I4C) has issued a warning about this trend. These apps are often promoted on social media and require users to download APK files from outside the Google Play Store. The National Cybercrime Threat Analytics Unit (NCTAU) has reported a rise in financial fraud linked to these applications, which include names like “Night Play,” “Reloop,” and “Kyss.” Once installed, these apps request sensitive permissions, such as Accessibility access, allowing malware to read screen information, click buttons, enter OTPs or PINs, confirm transactions, and initiate fund transfers, leading to unauthorized access to bank accounts. Additionally, the malware may install secondary applications or a VPN to reroute internet traffic through attacker-controlled servers, exposing sensitive data. These apps may also prevent uninstallation through standard device settings. The NCTAU advises users to only install apps from trusted sources, avoid unknown APK files, refrain from granting Accessibility permissions to unfamiliar apps, regularly review installed applications, and keep their devices updated. Users should monitor bank accounts for suspicious activity and, if compromised, restart in Safe Mode to uninstall malicious apps. If removal is difficult, backing up data and performing a factory reset is recommended. Citizens are encouraged to report fraudulent applications or cybercrime incidents through the national cybercrime helpline 1930 or the government’s reporting portal.

Tech Optimizer

September 1, 2026

What a smart firewall does and why it matters on home Wi-Fi

Home Wi-Fi connects various devices and presents security risks, making firewalls important for network protection. A router firewall is built into the home router and protects all connected devices, while a software firewall operates on individual devices for additional security. Inbound traffic is data coming to a device, while outbound traffic is data leaving it; firewalls analyze this traffic to manage connections. Network security is critical as sensitive information is often accessed on devices used for leisure, and remote work increases data overlap. Firewalls can control network connections and filter unwanted traffic but cannot replace weak passwords or antivirus protection. To enhance home network security, users should secure router settings, keep routers updated, strengthen Wi-Fi access, check connected devices, and replace outdated routers. A comprehensive security strategy includes keeping software updated, using multifactor authentication, being cautious with links, and strengthening firewalls with antivirus protection. Protecting valuable data is essential, and understanding ransomware risks is crucial. The 3-2-1 backup strategy involves maintaining three copies of data on two different storage types, with one copy offsite. Regularly testing backups and knowing how to respond to ransomware incidents are also important.

Winsage

September 1, 2026

TerminalFix Attacks Use Fake CAPTCHAs To Secretly Hack Windows PCs

Microsoft Threat Intelligence has identified a new variant of the ClickFix malware campaign called "TerminalFix." This variant uses deceptive CAPTCHAs that mimic trusted services like Cloudflare and directs users to PowerShell or a command prompt, allowing for the execution of complex scripts. TerminalFix aims to orchestrate a multi-stage attack that provides attackers with persistent, network-level proxy access through the compromised host, potentially leading to significant data theft and malware propagation within unsecured enterprise networks. Recommendations for defense against TerminalFix include restricting access to PowerShell and Windows Run dialogs, monitoring for DLL sideloading indicators, blocking Flash plugins, and enabling cloud-delivered protection in Microsoft Defender Antivirus. The attacks primarily target enterprise environments rather than individual consumers.

Winsage

September 1, 2026

New ClickFix campaign can deploy powerful multi-stage malware directly through Windows Terminal and PowerShell

Security researchers at Microsoft have identified a campaign named "TerminalFix" that exploits compromised websites to trick users into installing a backdoor. Users visiting these sites encounter a deceptive overlay prompting them to complete a fake Cloudflare CAPTCHA, which requires executing a malicious PowerShell command. This leads victims to inadvertently sideload dynamic link libraries (DLLs) and deploy a Python implant that creates encrypted reverse tunnels, allowing attackers to access internal networks.

Winsage

September 1, 2026

Microsoft extended Windows 10, but Nvidia just made the extension meaningless for gamers

Windows 10 will receive support until October 2027 under the Extended Security Updates (ESU) program, with approximately 30% of PCs still operating on this system. Nvidia will stop releasing Game Ready Drivers for Windows 10 in October 2026, and from November 2026, users will not receive game-related fixes or optimizations. Security updates will remain available until at least October 2029, but the lack of patches for new bugs may affect gaming experiences. HP reports that around 30% of PCs are still running Windows 10, and the company expects these users to transition to Windows 11 or invest in new hardware. Microsoft acknowledges that the growth of Windows 11 has slowed and is focusing on enhancing its features.

Tech Optimizer

August 31, 2026

ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions

Silver Fox is linked to the distribution of a backdoor malware called ValleyRAT, disguised as the legitimate QN Wallpaper adware application. Once installed, ValleyRAT provides complete control over the compromised machine. The malware uses DLL sideloading to operate under the guise of a legitimate process, bypassing security measures. It disables Windows Defender and adds itself to autorun entries, and can mark its process as critical, causing system crashes if terminated. Kaspersky has identified specific indicators of compromise (IoCs) including hashes, command-and-control servers, and associated domains. In 2026, Kaspersky recorded over 100,000 detections of ValleyRAT affecting more than 1,500 unique users, mainly in China and India.

AppWizard

August 31, 2026

Game review: Star Wars Zero Company (PC)

Star Wars Zero Company is a turn-based strategy game set during the waning days of the Clone Wars, where players lead a mercenary unit called Zero Company, led by former Republic officer Tesh Hawks. The game features tactical gameplay reminiscent of the X-COM series, with players managing a squad and engaging in combat missions while also exploring an upgradeable hub called The Den. Players can choose between Operations and Tactical Missions, with character customization options available for generic recruits. The game includes a variety of missions and enemies from the Star Wars universe, including a notable antagonist, The Coil. It features a permadeath system, strategic gameplay that emphasizes positioning and cover, and a soundtrack inspired by the franchise. The game is developed in collaboration with Lucasfilm, EA Games, and Bit Reactor.

Tech Optimizer

August 30, 2026

WHAT THE TECH? iPhone antivirus scam

A viewer received a popup warning claiming her device had 120 viruses, which is a scam designed to prompt her to download a free antivirus app called "Total Cleaner." This alert is misleading and cannot scan the phone for viruses. The app has fake reviews, hidden costs, and privacy concerns, as it collects personal data. Most modern smartphones do not need traditional antivirus programs, and such popups are advertisements from free apps, misleading websites, or ad networks. To protect yourself, close the tab immediately, keep your device updated, and only download apps from official app stores after thorough research.