threat intelligence Archives

Winsage

September 2, 2026

Fake Microsoft Edge, Kaspersky and Razer Installers Used to Compromise Windows Systems

An ongoing malware campaign is targeting Windows devices through counterfeit download pages for well-known software brands like Microsoft Edge, Kaspersky, and Razer. The campaign affects various sectors, including healthcare, manufacturing, gaming, technology, logistics, government, and education. It utilizes high-fidelity fraudulent websites that closely mimic legitimate vendors, with observed lure domains such as app-microsoft-edge[.]com[.]cn and kaspersky-lab[.]hl[.]cn. Attackers employ evasion tactics like server-side payload regeneration and create multiple copies of the same archive in quick succession. Victims are lured into downloading ZIP files that contain a bundled wrapper installer, which activates a stage-one executable in randomized directories. The malware often masquerades as legitimate software, with some payloads impersonating known applications. Persistence is achieved through scheduled tasks with unusual names, and the malware employs various evasion techniques, including deleting shadow copies and altering file permissions. Microsoft Defender has identified activity across multiple stages of the attack, including delivery, execution, and command-and-control communications. To mitigate risks, organizations are advised to block downloads from unofficial sources, enforce Tamper Protection, and implement Attack Surface Reduction rules. Indicators of compromise (IOCs) include specific lure domains and URLs associated with the campaign.

Tech Optimizer

September 2, 2026

Gen Digital stock dips after valuation call amid steady cybersecurity momentum

Gen Digital stock (ISIN US3687361044) traded at 30.02 dollars on September 1, 2026, reflecting a 3.2 percent decline from the previous close. The stock is within a 52-week trading range of 17.78 to 31.29 dollars, currently less than 4 percent below the 52-week high of 31.29 dollars. The intrinsic GF Value for the shares is estimated at 33.22 dollars, indicating the current price is 9.6 percent below this fair value. The stock has increased approximately 69 percent from its 52-week low of 17.78 dollars. Gen Digital introduced the Fearless Planet Index, showing North America with an average digital risk score of 29.6 percent, Europe at 28.5 percent, Asia-Pacific at 27.4 percent, the Middle East and Africa at 25.6 percent, and Latin America at 22.0 percent. The stock is quoted at 30.02 dollars on Nasdaq as of September 1, 2026.

Winsage

September 1, 2026

TerminalFix Attacks Use Fake CAPTCHAs To Secretly Hack Windows PCs

Microsoft Threat Intelligence has identified a new variant of the ClickFix malware campaign called "TerminalFix." This variant uses deceptive CAPTCHAs that mimic trusted services like Cloudflare and directs users to PowerShell or a command prompt, allowing for the execution of complex scripts. TerminalFix aims to orchestrate a multi-stage attack that provides attackers with persistent, network-level proxy access through the compromised host, potentially leading to significant data theft and malware propagation within unsecured enterprise networks. Recommendations for defense against TerminalFix include restricting access to PowerShell and Windows Run dialogs, monitoring for DLL sideloading indicators, blocking Flash plugins, and enabling cloud-delivered protection in Microsoft Defender Antivirus. The attacks primarily target enterprise environments rather than individual consumers.

Tech Optimizer

September 1, 2026

Fake Microsoft Security Scan Tells You to Remove Antivirus—Then Scammers Ask for Remote Access

A new web-based scam is using counterfeit Microsoft-branded security scans to deceive users into uninstalling their antivirus software. The scam websites conduct fake inspections, reporting false security failures and claiming third-party antivirus products are unsupported by Windows. They gather browser information to create customized-looking scan reports and aim to mislead victims into a fraudulent refund process. Investigators have identified 11 related scam sites under the name SysScan, which present themselves as legitimate Microsoft security checks. The scam does not involve file downloads but relies on convincing websites, fabricated security scores, and personal information forms. The scan results are hard-coded, and the security score is limited to a range between 13 and 30 out of 100. The scams instruct users to uninstall antivirus software, which is misleading since Windows does not cease support for third-party antivirus solutions. The scam sites request extensive personal information, including names, addresses, phone numbers, and banking details, and redirect victims to a page claiming a refund manager will call shortly. This process allows scammers to gain remote access to victims' computers. Indicators of compromise include specific IP addresses and domains associated with the scam.

Tech Optimizer

August 27, 2026

Scammers Impersonate Microsoft to Push Fake Security Scans and Refund Fraud

A network of fraudulent websites, branded as SysScan, has been discovered, which falsely claims to evaluate antivirus software effectiveness through deceptive security scans. These sites manipulate users into uninstalling legitimate antivirus products and disclosing sensitive personal and banking information. Eleven distinct domains associated with SysScan have been identified, all hosted on a single server. The fraudulent scans generate misleading results based on static findings rather than actual system assessments, and users are coerced into believing their computers are at risk. The scams misrepresent normal browser behaviors as security threats and instruct victims to uninstall their antivirus software, compromising their defenses. The operation targets both individual and business users, collecting extensive personal information and utilizing remote-access tools. The data submitted is sent to Telegram via its bot API. Users are advised to disconnect from the internet and secure their devices if they suspect they have been compromised. Indicators of compromise include specific IP addresses and domains associated with the scam.

Tech Optimizer

August 26, 2026

How to Protect Against Ransomware: 13 Steps [2026]

Global ransomware attacks increased by 0.8% quarter-over-quarter in Q2 2026. The group Qilin has 279 confirmed victims, maintaining its position as the leading threat actor for four consecutive quarters. The rival group The Gentlemen saw a 62% increase in victims, reaching 269. Checkpoint Research's report indicates a shift in the ransomware landscape, challenging the narrative of declining attacks. IBM's analysis shows breaches within supply chains and third-party vendors have quadrupled over the past five years. Effective ransomware protection requires administrative access to endpoints, firewalls, and backup systems, along with specific software versions and tools. The 3-2-1-1-0 backup strategy is recommended, emphasizing offline, immutable backups. Organizations should implement multi-factor authentication (MFA) across all access points and actively patch known vulnerabilities. Network segmentation is crucial to limit ransomware spread, and canary files can provide early warnings of attacks. Regular phishing simulations and a well-documented incident response plan are essential for preparedness.

AppWizard

August 26, 2026

GBA Emulator Android: My Boy! vs John GBAC vs RetroArch

Game Boy Advance emulation on Android has gained significant traction in 2026, with key applications like My Boy! priced at .99, John GBAC receiving an update on May 19, 2026, and RetroArch enhancing its mGBA core for free use. The search term "gba emulator android" sees around 8,100 monthly searches in the U.S., reflecting a resurgence in interest, particularly among former GBA owners now in their late 20s and 30s who prefer using their smartphones for gaming. All five apps—My Boy!, GBA.emu, John GBAC, RetroArch, and Lemuroid—can run the entire GBA library at full speed on devices from the last six years. The main differences lie in software quality, including save state management, cheat code reliability, controller mapping, and update frequency. My Boy! and GBA.emu utilize cores derived from VisualBoyAdvance (VBA), while John GBAC uses a custom core, and RetroArch and Lemuroid rely on the mGBA core. In terms of features, all apps support save states, but My Boy! offers multiple named slots with thumbnail previews, while RetroArch has a more complex system. Cheat code support is available across the board, with My Boy! and GBA.emu accepting GameShark and CodeBreaker formats, and RetroArch providing a built-in cheat database. My Boy! stands out for its link-cable emulation, allowing local multiplayer connections, whereas RetroArch's netplay is designed for online gaming. All apps support external controllers, but RetroArch excels in visual enhancements with its extensive shader options. The setup process for all five apps is similar and typically takes under ten minutes. GBA ROMs are small, ranging from 4MB to 32MB, making them easy to store on modern devices without significant battery drain. Common issues include save files not loading, audio problems, and cheat codes failing to apply, with solutions often involving file management and settings adjustments. Users can migrate save files between emulators by ensuring the correct file naming and directory structure. Pros and cons of each app include: - My Boy!: Ad-free, strong multiplayer support, but lower rating and closed-source. - GBA.emu: High rating and broad support, but outdated and lacks a free trial. - John GBAC: Free and recently updated, but lower rating and ad-supported. - RetroArch: Free and feature-rich, but complex setup. - Lemuroid: User-friendly and actively maintained, but limited shader options. All five apps are legally available on Google Play, as they do not distribute copyrighted ROM files. Users are advised to source their ROMs legally, ideally by dumping from their own physical cartridges. GBA emulation remains an accessible entry point into retro gaming on Android, especially compared to more demanding systems like the PS2 or GameCube.

Winsage

August 22, 2026

Hackers abuse FTP server banners to deliver new Windows malware

Threat actors are exploiting FTP banners to conceal commands for deploying two undocumented remote access trojans (RATs), E4del and PINHOLE. This method was first observed by MalwareHunterTeam in July 2026, using shortcut files (.LNK) and FTP server banners as dead-drop resolvers to retrieve malicious commands. SOCRadar confirmed that this technique has been weaponized since early July 2026 and remains active, with new infrastructure identified as recently as August 2026. The attacks typically start with a ZIP archive leading to an LNK-based infection chain, likely initiated through phishing tactics. E4del is a Node.js-based RAT disguised within a digitally signed Electron application mimicking Discord, capable of executing commands, capturing screenshots, streaming desktops, and downloading additional payloads. It also includes a module for privilege escalation. PINHOLE retrieves its command and control configuration from Pinterest and SurveyMonkey, designed to leave a minimal footprint and employing shellcode fluctuation. It supports 14 commands, including file management and credential theft, but had only recorded 11 execution events at the time of analysis. SOCRadar notes that while using FTP banners is a novel approach, it is less stealthy than traditional web-based dead-drop resolvers. They provide indicators of compromise to help identify malicious infrastructure and infected machines.

Winsage

August 7, 2026

Microsoft Flags BNB Chain Malware Campaign Targeting Windows Users

Microsoft has identified a sophisticated malware campaign that uses the infrastructure of BNB Chain to spread harmful code through compromised websites. The attackers deceive visitors into executing malicious commands disguised as standard security checks, exploiting vulnerabilities in conventional website security measures. This campaign affects both businesses and individual users, utilizing ClickFix lures and EtherHiding techniques. An injected Base64-encoded JavaScript communicates with a BNB Smart Chain RPC gateway to facilitate these malicious operations.

Winsage

August 3, 2026

Microsoft warns Windows PC users of Russian hackers on hotel WiFi

Microsoft has issued a warning to Windows PC users about Russian hackers targeting individuals using hotel WiFi networks. The campaign, named CaptiveCrunch and attributed to the Storm-2945 group, focuses on corporate travelers and employs tactics like credential theft and malware distribution through compromised guest networks. Microsoft has been monitoring this activity since May, noting its impact on hospitality networks utilizing captive portals. Hackers have been redirecting users to counterfeit sign-in pages to steal credentials without phishing emails. The threat may also extend to Android devices, with hackers using deceptive techniques to manipulate users into downloading malicious APK files. The hackers employ fake verification checks and sign-in prompts, sometimes misleading users into Microsoft's legitimate authentication process to gain access to accounts. Microsoft has identified a specific remote-access trojan named CornFlake, which can record keystrokes, steal credentials, and capture screenshots. Recommendations for travelers include using mobile hotspots, avoiding updates through captive portals, strengthening authentication methods, and blocking unnecessary device-code authentication.