Telegram Archives

AppWizard

September 29, 2026

Google’s Phone app begins reverting one of its most controversial changes

The Phone by Google app is reintroducing the Contacts tab to the bottom navigation bar, which had been absent since last year. This update is currently available only to beta users, with reports of the feature's return on platforms like GApps and Leaks Telegram. The latest beta version (240.0.98) on a Pixel 9 has shown this feature, while previously, the Contacts tab was moved to a sidebar. Some users have not yet seen the reappearance of the Contacts tab, indicating a gradual rollout. In the current stable version, users only see two tabs at the bottom, with the Contacts option accessible via a sidebar menu. The timeline for a wider release of the update remains uncertain.

AppWizard

September 29, 2026

This app turns Motorola’s locked-down AI key into a button you’ll actually use

Motorola is enhancing the Android experience with a cleaner software interface and extended support timelines. The dedicated AI key on select Motorola devices has limited functionality, traditionally controlled by Motorola. The MotoKey Plus app allows users to customize the AI key, making it a programmable shortcut button for various actions, including launching the flashlight, taking screenshots, controlling media playback, accessing notifications, and launching apps. Users can adjust the responsiveness of the AI key by changing double-tap timing and hold thresholds. Feedback from early adopters has been positive, though some have faced issues with the mute function. MotoKey Plus is currently available only through sideloading and is not open source, but a Google Play release is planned. The current version on GitHub is 1.1.1, while the Telegram channel has version 1.1.7 with fixes for press-and-hold behavior.

AppWizard

September 28, 2026

RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims

The operators behind RatHat have created an advanced Android banking trojan that allows control of infected devices through a web console. Since April 2026, nearly 100 instances of this console have been identified, indicating a malware-as-a-service model. The console collects sensitive data from compromised phones, including text messages and passwords. It uses Google's Gemini AI to assess victims' bank balances, categorizing them into high-value and mid-value segments, but does not facilitate financial transactions. The malware has remained largely unchanged since late 2025, but the console has seen significant updates, leading to three new versions: BlackCat Remote Control Management, Panda Workshop V5, and V6. These versions serve as both control interfaces and build tools for creating and distributing malware. The latest version includes templates for deceptive download pages. RatHat infiltrates devices via text messages and online ads, requesting Accessibility access to read screens and simulate user interactions. This access allows the malware to activate wireless debugging and connect to the Android Debug Bridge (ADB), giving operators elevated privileges to execute commands. A Go program can be deployed to maintain control, even after the app is uninstalled. Cleafy has tracked console deployments through web code analysis, noting that many IP addresses originate from a Singapore-registered network. The initial console version allowed operators to choose AI providers, but the latest exclusively uses Gemini. RatHat also utilizes Gemini on infected devices to determine tap locations based on screen layouts. Cleafy has compiled indicators related to the consoles' command-and-control servers, download links, and malware samples, including specific domains, IP addresses, and MD5 hashes. The consoles often use web addresses starting with "admin." and inexpensive top-level domains. Security tools are advised to monitor processes running under the shell user on affected devices.

AppWizard

September 28, 2026

Google Messages could soon make voice notes easier to initiate

Google Messages is exploring a single-tap feature for initiating voice recordings in RCS chats, as seen in the beta version messages.android2026092101_RC00. This change aims to simplify the current two-step process of sending voice notes, which involves tapping the waveform icon and then the microphone icon or long-pressing the waveform icon. While the single-tap feature could enhance accessibility, it raises concerns about accidental activation. Other messaging platforms, like Telegram, require a long press to start a voice note to minimize unintentional recordings. WhatsApp for Android has already implemented a similar single-tap feature. There is hope that Google will introduce a toggle in the settings menu to allow users to choose between the new single-tap method and the traditional approach.

AppWizard

September 24, 2026

Russia’s state-backed messaging app Max can secretly change how it surveils individual users, researchers at InterSecLab find

The Max messenger, developed by VK, has significant user tracking capabilities. A report from InterSecLab revealed that: - Max's features can vary for individual users without app updates. - It lacks end-to-end encryption, allowing VK access to messages, even in "secret chats." - Each account can be configured to perform specific actions, such as decrypting messages on VK's servers and blocking messages if a VPN is detected. - Upon launching, Max reports the user’s network environment to VK, including their public IP address and mobile carrier. - The app uploads users’ entire address books unencrypted to VK's servers, accessing contacts of non-registered individuals. - A phone number query can reveal extensive user information without notification. - Max stops functioning if it detects a VPN, requiring users to disable it to send messages, although workarounds exist. - New users receive a curated list of recommended channels, primarily featuring state media and pro-government figures.

Tech Optimizer

September 21, 2026

Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR

On September 17, researchers from LastPass and Delphos Labs discovered a counterfeit LastPass Authenticator installer on GitHub that installs a malicious Windows kernel driver designed to disable antivirus and steal passwords. The driver, named Alinubx.sys, was signed through Microsoft's hardware compatibility program and initially scored zero detections on VirusTotal. The fake installer is hosted on a fraudulent GitHub page that mimics a legitimate LastPass product page. When executed, the installer uses DLL side-loading to gain SYSTEM-level access and terminates security processes, allowing it to harvest saved passwords from various browsers and applications. The driver is a renamed variant of a known malicious driver, evading detection due to its new file hash. Delphos reported the driver to Microsoft, but it was not considered a security vulnerability. Users who executed the fake installer should treat their passwords and sensitive data as compromised and change them from a secure device. The malicious server has been linked to impersonation pages for multiple brands, and the loader was likely created using a specific crypter tool.

AppWizard

September 19, 2026

Russia’s national messenger app Max found to contain backdoor capable of secret screen captures

Researchers have found that Max, a messaging app mandated by the Russian government, can secretly capture screenshots, access sensitive information, impersonate users, and inject code into other applications. Developed by VK, the app integrates messaging, banking, and government services. Since September 1 of last year, it has been preinstalled on new smartphones, following the blocking of WhatsApp and Telegram. Despite its reach, it is not widely used in political circles, with insiders indicating that compliance with its use is performative.

AppWizard

September 19, 2026

Russia’s “National Messenger” Turned Out to Be… “Putin Is Watching”

The Russian government is pressuring citizens to download a mobile app called "Max," which has raised privacy and surveillance concerns. Max is a popular messaging platform in Russia and integrates messaging, government services, and payment functionalities. Research by a University of Michigan team found that Max can capture users' screens without consent, access sensitive information, impersonate users, and potentially enable cyberattacks via code injection. Despite these concerns, many Russians still use alternative messaging platforms like Telegram and Signal. Some government officials are using separate devices for Max, indicating unease about its surveillance capabilities. The app is linked to a social media company connected to the Russian government, and President Putin may have an indirect financial stake in it.

AppWizard

September 18, 2026

Revealed: How Russia use mobile ‘super-app’ Max to spy on its citizens

A new messaging and payment app called Max has emerged in Russia, developed by VKontakte, and has become the country's most utilized messaging platform. Max integrates various services, including banking and government services, and has been adopted by tens of millions of Russians. It features extensive surveillance capabilities, allowing it to take screenshots, access information without consent, impersonate users, and potentially conduct cyberattacks. The app's adoption has been largely mandatory, particularly among state employees and students. Despite its rise, Max has not replaced Telegram as a primary news source, and users have raised concerns about privacy and surveillance. Experts warn that Russia's swift implementation of digital control strategies reflects a growing trend of digital authoritarianism.

Tech Optimizer

September 16, 2026

Hackers Disguise CHOSEN BRICK Malware as AI Apps, Antivirus Software and MRI Results

Iranian state-affiliated cyber actors are targeting dissidents, activists, and journalists using fake AI applications, counterfeit antivirus tools, and fabricated MRI scan results, primarily through a spyware family known as CHOSEN BRICK, which is designed for Windows systems. This campaign has been active since at least 2025 and affects individuals globally, including in the UK, US, and Netherlands. The malware establishes persistence via the Windows Registry Run key and communicates through Telegram, utilizing unique Bot IDs for each victim. CHOSEN BRICK is capable of extensive data collection, including capturing screenshots, recording audio, and stealing email content. Personal information from victims has been found on pro-Iranian leak sites, increasing harassment risks. Security measures should include monitoring for suspicious Registry entries and unusual communications, while users are advised to avoid unsolicited software installations and keep their systems updated. The FBI refers to this malware family as HEAVYGRAM.