Telegram Archives

Winsage

September 6, 2026

Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

Elastic Security Labs has identified four previously undocumented programs associated with REVSTEALER, a Windows information stealer that persists on infected machines after self-deletion. The programs are ProManager, WinUpdate, SoftManager, and LockAppHost, each with distinct functionalities. ProManager steals wallet files and logs passwords, WinUpdate monitors the clipboard for cryptocurrency addresses, SoftManager acts as a reverse proxy, and LockAppHost executes a cryptocurrency miner after disabling Windows Update and Microsoft Defender. REVSTEALER has been marketed as a commercial infostealer since February 2026, exfiltrating sensitive data such as browser passwords, cookies, and cryptocurrency wallet information. It deletes itself after reporting its activities but leaves the four programs installed for persistence. These programs share build tradecraft with REVSTEALER, including the use of identical packers and runtime function resolutions. REVSTEALER primarily spreads through game-cheat lures and disguises itself as pirated software. It employs evasion techniques to resist analysis, including checking for sandbox environments and using indirect system calls. Users are advised to avoid unofficial software and to follow specific steps if infected, such as re-enabling Windows Update services and changing passwords. Indicators of compromise include SHA-256 hashes for REVSTEALER and its associated programs, as well as domains linked to their command and control servers.

AppWizard

September 3, 2026

The weather app on your Pixel Watch is adding new watch face modules

Google has updated the Pixel Weather app for Wear OS to version 1.0.0.94, adding three new complications: Air Quality Index, Pollen levels, and Precipitation information. This update allows users to display these complications on their watch faces, enhancing the app's functionality beyond the initial offerings of sunrise and sunset times, UV Index, and general weather conditions. Complications function like widgets, providing real-time information. Users can customize their watch faces by long-pressing the display. Some users have questioned why these features were not included at the app's initial launch, while others note the existence of third-party weather apps with similar functionalities.

Tech Optimizer

September 1, 2026

Fake Microsoft Security Scan Tells You to Remove Antivirus—Then Scammers Ask for Remote Access

A new web-based scam is using counterfeit Microsoft-branded security scans to deceive users into uninstalling their antivirus software. The scam websites conduct fake inspections, reporting false security failures and claiming third-party antivirus products are unsupported by Windows. They gather browser information to create customized-looking scan reports and aim to mislead victims into a fraudulent refund process. Investigators have identified 11 related scam sites under the name SysScan, which present themselves as legitimate Microsoft security checks. The scam does not involve file downloads but relies on convincing websites, fabricated security scores, and personal information forms. The scan results are hard-coded, and the security score is limited to a range between 13 and 30 out of 100. The scams instruct users to uninstall antivirus software, which is misleading since Windows does not cease support for third-party antivirus solutions. The scam sites request extensive personal information, including names, addresses, phone numbers, and banking details, and redirect victims to a page claiming a refund manager will call shortly. This process allows scammers to gain remote access to victims' computers. Indicators of compromise include specific IP addresses and domains associated with the scam.

Tech Optimizer

August 27, 2026

Scammers Impersonate Microsoft to Push Fake Security Scans and Refund Fraud

A network of fraudulent websites, branded as SysScan, has been discovered, which falsely claims to evaluate antivirus software effectiveness through deceptive security scans. These sites manipulate users into uninstalling legitimate antivirus products and disclosing sensitive personal and banking information. Eleven distinct domains associated with SysScan have been identified, all hosted on a single server. The fraudulent scans generate misleading results based on static findings rather than actual system assessments, and users are coerced into believing their computers are at risk. The scams misrepresent normal browser behaviors as security threats and instruct victims to uninstall their antivirus software, compromising their defenses. The operation targets both individual and business users, collecting extensive personal information and utilizing remote-access tools. The data submitted is sent to Telegram via its bot API. Users are advised to disconnect from the internet and secure their devices if they suspect they have been compromised. Indicators of compromise include specific IP addresses and domains associated with the scam.

Tech Optimizer

August 26, 2026

Catch Of The Week: The ‘Security Scan’ That Wants You Defenseless

Researchers at Malwarebytes have identified a network of deceptive websites posing as a service called “SysScan,” which pretends to conduct Microsoft security checkups. Users encounter these sites through search results, browser hijacking pop-ups, or unsolicited emails. The sites use Microsoft branding and a fake progress bar to create the illusion of a scan, but they only collect harmless data like operating system and location, which are then manipulated into alarming fake alerts. The fabricated security score is predetermined and does not reflect the user's actual security status. The scam misleads users into believing that Windows no longer supports third-party antivirus software, prompting them to uninstall their protections, which increases their vulnerability. Users are then asked to provide personal and banking information through a form that sends data via a Telegram bot. Eleven fraudulent sites have been traced back to a single server. Indicators of the scam include requests to disable antivirus software, installation of remote-access software, and solicitation of sensitive information. Microsoft does not initiate cold calls or scan computers through web pages. If someone has engaged with the scam, they should disconnect from the internet, uninstall any remote-access tools, reinstall antivirus software, and report the incident to authorities.

Tech Optimizer

August 24, 2026

Fake Microsoft security scans trick victims into uninstalling their antivirus

A surge of fraudulent websites claiming to verify antivirus software functionality has emerged, using the name SysScan and misleadingly asserting that Windows no longer supports third-party antivirus solutions. These sites conduct fake security scans, gather personal information, and set up a refund scam. Eleven such websites were found hosted on a single server, executing similar deceptive tactics. They can access basic browser data but cannot conduct genuine security scans. Microsoft continues to support third-party antivirus software, and legitimate refund processes do not require uninstalling security tools. The scams instruct users to remove their antivirus software to facilitate further manipulation and to collect information about the antivirus in use. The customer information forms collect extensive personal data and are designed to send this information to a Telegram bot API. Victims are promised a refund call after submitting their information, which is part of the scam's manipulation. Signs of such scams include claims of deep problems with the computer, consistently negative diagnostic results, requests to uninstall antivirus software, and demands for banking information. If affected, victims should disconnect from the internet, remove remote-access tools, and contact their bank. The hosting IP address for these sites is 157.230.180.90, with multiple associated domains listed.

AppWizard

August 17, 2026

Convos Wants to Be the First Messaging App Built for the Age of AI

Convos integrates an assistant directly within group chats to provide answers without switching apps. Users can create an identity without a phone number or email, enhancing privacy and simplifying setup. The app features "Little Assistants," specialized agents for tasks, powered by ChatGPT or Claude, allowing them to interact seamlessly in conversations. The messaging interface is similar to popular apps, with a unique "Explode" function for permanent deletion of chats. Convos is designed for privacy-focused users, group planners, and early adopters, though it may not suit those needing a complete contact list or instant responses. The app has a 4.8 rating on the App Store and over 100 downloads on the Play Store.

Winsage

August 13, 2026

Images of Microsoft’s Canceled Windows Surface Phone Have, Well… Surfaced

A recent leak has revealed images of a Microsoft smartphone prototype believed to date back to 2013 or 2014, speculated to be a Surface-branded Windows Phone that never reached the market. The images show a sleek phone with a silver metal frame, navigation keys beneath a 720p display, and a Microsoft logo on the back. The device operates on an early internal build of Windows Phone 8.1 from September 2013. Key specifications hinted at include an unidentified Qualcomm processor, a micro-USB port, a headphone jack, a SIM slot, volume controls, and a dedicated camera button. However, details such as the chipset model, RAM, storage capacity, battery size, or camera specifications are not disclosed. The design resembles Microsoft's early Surface devices, but there is no definitive evidence it was intended for commercial release. This leak follows Microsoft's acquisition of Nokia's Devices and Services business, which was announced in September 2013 and finalized in April 2014, potentially explaining the decision to shelve this smartphone design.

AppWizard

August 12, 2026

Russia charges Telegram CEO Pavel Durov with aiding terrorism

Russian authorities have charged Pavel Durov, the founder and CEO of Telegram, with aiding terrorism and placed him on an international wanted list. The Federal Security Service (FSB) alleges that Telegram facilitates criminal activities and operations related to Ukrainian intelligence, classifying it as a facilitator of "acts of sabotage and terrorism, mass murder, and cyber fraud." Instead of targeting the platform with fines or restrictions, Russian authorities are pursuing Durov personally. If convicted in Russia, he faces the possibility of life imprisonment. This case reflects a broader trend of governments holding technology executives accountable for content and activities on their platforms, with similar legal pressures observed on other platforms like Meta, TikTok, Snap, and YouTube.

AppWizard

August 12, 2026

Apple restores Telegram after child abuse material ban; Gram token recovers

Apple has reinstated Telegram to its App Store after a temporary removal due to the discovery of child sexual abuse material. Telegram responded by removing the offending content and banning the user responsible, which helped recover the value of the Gram token that had initially dipped by approximately 6.4%. The incident underscores the scrutiny messaging platforms face regarding illegal content, with Telegram currently under scrutiny in Russia, France, and Australia for alleged facilitation of illegal activities and extremist content.