NewApp Digest
search bot

technique

I replaced my old Android Auto sideloading method with this, and it's so much easier
AppWizard
July 24, 2026

I replaced my old Android Auto sideloading method with this, and it’s so much easier

The process of sideloading apps for Android Auto can be complex due to varying permissions by device and app. Users often face issues with platforms like Android Auto Apps Download (AAAD), which may go offline. Some beneficial sideloaded apps include AABrowser for internet browsing and CarStream for watching YouTube. A new sideloading method allows users to bypass AAAD, ensuring app icons appear in the vehicle's infotainment system. This method was effective on a Pixel 10 Pro running Android 17 without being rooted, but results may vary on other devices. To enable this method, users must activate Developer Mode on their Android device and Android Auto. It is important to install apps from reputable sources, such as GitHub, as recent updates to Android Auto may remove sideloaded apps that circumvent restrictions. After enabling the Unknown Sources option in Android Auto's developer settings, users can install apps like AABrowser, which then appears in the Android Auto launcher and the vehicle's infotainment system.
How we pushed CDC into Postgres, and turned replication into clockwork
Tech Optimizer
July 24, 2026

How we pushed CDC into Postgres, and turned replication into clockwork

Making data from transactional databases accessible to analytical databases is essential in modern data architecture, but it faces challenges such as fragile tooling, high costs, and complex operations. Snowflake has developed a Postgres service that addresses these issues by reimagining Postgres replication. Postgres is a strong operational database, but its change data capture (CDC) capabilities need improvement. Many data pipelines are fragile due to complexities in managing continuous data flow, schema changes, snapshots, and failures. To enhance user experience with Snowflake Postgres, a complete reinvention of the replication process was necessary. A new feature called data mirroring is in public preview, allowing resilient data replication into Snowflake with low cost, minimal lag, and transactional consistency. This feature directly pushes changes from Postgres into Apache Iceberg™ tables in transactional batches, which are then automatically applied to Snowflake tables without extra infrastructure. Change data capture records changes from a transactional database for replay on another system, primarily using logical decoding in Postgres. This method decodes WAL records into logical operations, but the client bears the responsibility for subsequent steps like backfilling, managing schema changes, and handling failures. Built-in logical replication in Postgres only addresses some complexities. A limitation of logical decoding is that the external system does not recognize the state of Postgres, making it difficult to detect schema changes or correlate snapshots with changes. The solution is to push changes from Postgres into a data lake, specifically into Iceberg tables using compressed Parquet format, with object stores like Amazon S3 as the destination. The mirroring process uses a new Postgres extension called snowflake_cdc, which continuously pushes batches of changes into per-table change logs and a meta log. This extension understands the Postgres environment, coordinating schema changes and complex transactions while ensuring alignment between snapshots and changes.
ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories
AppWizard
July 23, 2026

ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories

GitHub will reject command-line support bundle uploads from outdated versions of GitHub Enterprise Server lacking security patches starting August 18, 2026. The npm package @copilot-mcp/apex has been identified as a post-install dropper that installs a macOS infostealer, phishing for sensitive information and maintaining a connection to an attacker's server. A rogue extension on the Microsoft Visual Studio Code marketplace, "Markdown All Pro," impersonates a legitimate tool and opens a backdoor after installation. A phishing campaign targeting Portuguese users delivers the Lampion banking malware, which has been active since 2019. DoubleVerify reports a rise in "AfterCall" apps that exploit user permissions for ad fraud. The GhostCommit attack method hides malicious instructions within PNG images in pull requests. The U.S. government has updated its advisory on Iranian-affiliated cyber activity targeting operational technology devices. An Android app posing as a civil defense alert system has been found to contain malware for data harvesting. An Iranian threat actor is distributing MarkiRAT malware through fake applications. An analysis of 28 AI-coded applications revealed 434 vulnerabilities, prompting Cisco to introduce Antares to identify vulnerabilities in codebases. A Russian-speaking threat actor is dismantling guardrails on AI models to create offensive tools.
Stop tap tap tapping on your Android keyboard and get the message through faster with this ancient but underrated feature
AppWizard
July 19, 2026

Stop tap tap tapping on your Android keyboard and get the message through faster with this ancient but underrated feature

The demand for faster typing on smartphones has increased, particularly for professionals, students, and interns. Swipe typing, also known as Glide Typing on Gboard, allows users to glide their finger across the keyboard without lifting it for each letter, significantly enhancing typing speed. To use this method on a Google Pixel 8 with Android 16 and Gboard, users should tap on a text box, slide their finger across the keyboard, and lift it only when finishing a word. For Samsung Keyboard users, Swype mode must be enabled in the settings. Gboard's swipe typing feature becomes more intelligent with use, providing word suggestions and allowing users to teach it new words. This feature is effective in multiple languages, including Urdu, and can also be used on Wear OS smartwatches. Although there may be an initial learning curve, swipe typing can greatly improve typing efficiency and is often met with curiosity from others.
North Korea Buried Four-Stage Malware in Flag Images: Zero Antivirus Detections
Tech Optimizer
July 18, 2026

North Korea Buried Four-Stage Malware in Flag Images: Zero Antivirus Detections

North Korea's Contagious Interview hackers have been using a deceptive strategy to target developers by posing as recruiters and embedding malware in SVG files. Elastic Security Labs discovered that the attackers hid malicious payloads within HTML comment blocks of these files, allowing the malware to evade antivirus detection. At the time of the findings, no antivirus engines flagged the compromised repositories, which included trojanized GitHub repositories disguised as coding challenges. The malware executed automatically at server startup and deployed four modules: a browser credential and cryptocurrency wallet stealer, a file stealer, a remote access Trojan, and a clipboard monitor. The campaign, tracked as REF9403, is part of the ongoing Contagious Interview operation attributed to North Korea's Lazarus Group, which aims to generate revenue through cryptocurrency theft. Developers are advised to audit any projects run from unsolicited sources and to monitor specific domains associated with the attack.
Hundreds of GitHub repos found posing as real software to push malware
Tech Optimizer
July 15, 2026

Hundreds of GitHub repos found posing as real software to push malware

Cybersecurity firm ArcticWolf has identified 292 malicious GitHub repositories that impersonate legitimate software tools, part of a campaign to deliver a new variant of the BoryptGrab infostealer. This malware can extract sensitive information from 19 web browsers, 32 cryptocurrency wallets, messaging applications like Telegram and Discord, gaming platforms such as Steam, and Windows Credential Manager. It can also exfiltrate files from users' Desktop and Documents folders and capture screenshots. This variant bypasses Chrome’s App-Bound Encryption using direct code injection and does not include an anti-analysis layer or conceal itself, aiming to harvest data quickly without persistence. The malicious activity began in late June, with most repositories removed from GitHub, though several dozen remain active. GitHub's status as a key platform in the open-source community makes it a target for cybercriminals, emphasizing the need for developers to thoroughly vet code before integration.
silver Android smartphone
Tech Optimizer
July 10, 2026

Hackers Use Fake VLC Executable and Malicious libvlc.dll to Deploy ValleyRAT

Cybercriminals are exploiting the VLC media player to install ValleyRAT, a remote access trojan, by embedding malware in a seemingly harmless file linked in phishing emails. The attack starts with an email that prompts the victim to download a ZIP archive containing a fake VLC executable and a malicious DLL named libvlc.dll. This method uses DLL sideloading to execute the malware under the guise of a legitimate application. Once executed, the malware establishes persistence by creating a registry entry and connects to a remote server to retrieve the final payload. ValleyRAT employs evasion tactics to avoid detection, including assessing system characteristics before executing harmful actions and using a fileless approach to deliver the payload directly into memory. Researchers have identified indicators of compromise, including specific SHA1 hashes and URLs associated with the malicious campaign.
Circle Generator Minecraft: Build With a Circle Chart
AppWizard
July 6, 2026

Circle Generator Minecraft: Build With a Circle Chart

Building a circle in Minecraft involves using a block grid, which can be challenging due to the need for specific block patterns for different diameters. A Minecraft circle graph visually represents a circle on this grid, where filled cells indicate placed blocks and empty cells are unoccupied. The Bresenham circle algorithm is used to create these graphs, making it a standard method for rendering curves in the game. A circle generator allows players to input a desired diameter and receive a grid layout to follow, ensuring accuracy in construction. To read a circle chart, players look at a square grid filled with filled and empty squares, placing blocks according to the layout row by row. For three-dimensional builds, the pattern is replicated across height layers. Odd diameters have a single center block, while even diameters have a 2x2 center, simplifying calculations. Optimal circle sizes for aesthetic results start from 15 blocks, with smaller circles often appearing more octagonal. Recommended diameters include 15-25 blocks for towers, 40-60 blocks for arenas, and starting from 30 blocks for domes. Errors can be corrected by comparing the current row with the generator's output and making adjustments. Large circles, such as those with a 60-block diameter, can strain server resources, making it essential to use a stable server for accurate block placement.
silver Android smartphone
Tech Optimizer
July 3, 2026

Hackers Use Fake VLC Executable and Malicious libvlc.dll to Deploy ValleyRAT

Cybercriminals are using a sophisticated method to bypass security measures by embedding malware within the VLC media player. This campaign exploits VLC to install ValleyRAT, a remote access trojan, through phishing emails that contain links to download a seemingly harmless file. Once the file is opened, it activates a hidden backdoor that evades detection by antivirus solutions. The malware has been active since 2023, with a significant increase in activity noted through 2025 and into 2026, particularly targeting Chinese and Japanese-speaking users. The infection process begins when a victim clicks a link in a phishing email, leading to a ZIP archive containing a disguised executable and a malicious DLL (libvlc.dll). The executable mimics a legitimate VLC file, and when executed, it loads the DLL, allowing the malware to run under the guise of VLC. The malware establishes persistence by creating a registry entry and connects to a remote server to retrieve the final payload. ValleyRAT employs evasion tactics to avoid detection, such as performing checks on system behavior and using a fileless approach to inject its payload directly into memory, avoiding storage on disk. Researchers recommend training employees to recognize suspicious filenames and deploying endpoint detection tools to identify DLL sideloading behavior. For organizations affected by this campaign, isolating compromised systems and reviewing security logs are critical initial steps. Indicators of compromise include a malicious email domain, a ZIP archive containing a fake VLC executable, and a download URL for ValleyRAT.
Search