tunneling Archives

Winsage

July 15, 2026

LabubaRAT malware infiltrates Windows systems while posing as NVIDIA software

LabubaRAT is a newly identified Rust-based remote access tool (RAT) that disguises itself as NVIDIA software to facilitate operations on Windows systems. It establishes a reusable foothold for hands-on activity and can profile the host system, identify security tools, execute commands, transfer files, capture screenshots, and proxy network traffic. LabubaRAT retrieves its configuration at launch via command-line arguments or environment variables, allowing operators to specify parameters like the command-and-control server and API key at runtime. It maintains local state in a SQLite database and supports communication through HTTPS polling, Microsoft Edge WebView2, and DNS tunneling. The malware includes capabilities for command execution, file handling, and establishing persistence through a Windows Run registry key. The entry point for the attack is an executable named nvidia-sysruntime.exe, which masquerades as NVIDIA’s container runtime toolkit. LabubaRAT conducts thorough profiling of the host, checking for installed browsers and security products, and gathers information on the system's specifications. Blackpoint Cyber has shared indicators of compromise to help detect LabubaRAT activity.

Winsage

July 10, 2026

A hacker’s arrest just revealed how Microsoft can track your Windows device

A teenager named Peter Stokes is facing federal charges in Chicago for allegedly hacking a U.S. jewelry retailer while using a VPN to conceal his online activities. Microsoft provided the FBI with data linked to a tracking mechanism called the Global Device Identifier (GDID), which is a unique number assigned to every Windows installation that persists through updates. This identifier allowed authorities to connect Stokes' computer to specific websites, despite his VPN usage. Stokes was arrested in Helsinki in April 2026 while trying to board a flight to Japan, carrying two two-terabyte hard drives. The GDID enabled Microsoft to track Stokes' activities on third-party services, raising concerns about privacy and data tracking.

AppWizard

July 10, 2026

Proton VPN on Android: features, requirements, how to install

Proton VPN is a prominent VPN provider known for its speed and security, with its headquarters in Switzerland, which has strong privacy laws. The Android app features include Secure Core for enhanced anonymity, NetShield Ad-blocker to block ads and trackers, a kill switch to protect data during connection drops, alternative routing for bypassing restrictions, split tunneling for selective app usage, a VPN Accelerator for increased speeds, and P2P support for secure file sharing. The app requires Android 8 or later for installation, which can be done via the Play Store. Users can connect as guests to access limited features of Proton VPN Free.

Winsage

July 10, 2026

You can’t fully disable Microsoft’s GDID Windows 11 tracker, but these settings limit what it captures

A 19-year-old named Peter Stokes was detained at Helsinki airport in April 2026 while traveling to Japan, carrying two 2TB hard drives. He was subject to an Interpol Red Notice and faced a federal complaint from U.S. prosecutors by July for his alleged involvement in the Scattered Spider hacking group, which breached a U.S. luxury jewelry retailer in May 2025, leading to a ransom demand. The Global Device Identifier (GDID), developed by Microsoft, is a persistent identifier that uniquely identifies a Windows installation on a device. It links online activities back to a single identity, which law enforcement can use to trace a device's owner. The GDID is generated when a user signs into Windows with a Microsoft Account and remains through updates but does not survive a clean reinstall. Stokes' use of the same Windows device allowed investigators to trace his activities through the GDID, which linked him to the hacking incident. Privacy advocates have raised concerns about the lack of consent for GDID assignment and the potential for surveillance.

Winsage

July 8, 2026

Arrest and extradition of Scattered Spider hacker shines light on how Windows telemetry GDIDs can identify and track users — Microsoft device identifier is just one digital fingerprint in a software world rife with them

Peter Stokes, a 19-year-old from Estonia, was arrested and extradited to the United States on charges related to digital crimes, with the FBI using telemetry logs from Microsoft Windows to trace his online activities. These logs included his Global Device Identifier (GDID) and records of websites he visited. Stokes likely had his telemetry settings configured to Optional/Full, which allowed the transmission of URL data. The FBI connected Stokes to his ngrok account and linked his travel records to a New York IP address and a rental at the Empire Hotel, aided by photos he shared. Google and Apple assisted in the investigation by tracing Stokes' phishing phone number back to the same IP address used for his ngrok account. Stokes attempted to obscure his digital footprint using a VPN and other services, but modern digital identification methods made it difficult to remain anonymous.

AppWizard

June 13, 2026

As a longtime Android privacy nerd, here are 6 privacy apps I actually regret installing

The author shares experiences with six privacy applications that did not meet expectations. 1. Private Internet Access (PIA): A robust VPN service with a cluttered interface and concerns about its U.S. base; transitioned to NordVPN for a better user experience. 2. Brave Browser: Known for ad and tracker blocking, but had issues with Brave Search reliability, syncing, and battery drain; switched to Firefox with uBlock Origin. 3. LastPass: A former leading password manager that lost trust due to security breaches; moved to Bitwarden for its solid and secure platform. 4. KeePassDX: Impressive for local storage and clean UI, but lacked cloud syncing and required manual password management; eventually chose Bitwarden for convenience. 5. OpenBoard: A privacy-focused keyboard app that is no longer available on Google Play; basic features and installation hassles led to regret over its use; better alternatives exist. 6. OsmAnd: An open-source offline navigation app with extensive customization but a steep learning curve and rigid address searches; now prefers Organic Maps for ease of use.

AppWizard

May 12, 2026

TrickMo Android Malware Targets Banking, Wallet, and Authenticator Apps

TrickMo, an Android banking malware, has re-emerged with enhanced stealth and operational capabilities, targeting banking, fintech, wallet, and authenticator apps. It retains its core device takeover abilities while improving stealth, persistence, and flexibility. The malware persuades users to grant accessibility permissions, allowing full remote control, including real-time screen viewing. A significant advancement is its shift to The Open Network (TON) for command-and-control communication, complicating takedown efforts. TrickMo has been actively deployed in France, Italy, and Austria since early 2026, using fake login overlays to capture credentials while recording user activity. It communicates through .adnl endpoints within the TON network and employs DNS-over-HTTPS for encrypted DNS queries. The malware's modular design includes a primary application as a loader and a dynamically loaded APK module called “dex.module” for malicious capabilities. It features network reconnaissance and tunneling capabilities, allowing commands like HTTP probing and establishing SSH tunnels, which can bypass fraud detection systems. Dormant features suggest potential for future capabilities without altering the core application. Indicators of compromise include specific SHA-256 hashes and package names associated with TrickMo's various components.

AppWizard

May 11, 2026

New TrickMo Variant: Device Take Over malware targeting Banking, Fintech, Wallet & Auth apps

Modern Android banking malware is evolving with architectural enhancements for increased stealth, resilience, and operational flexibility. In early 2026, a new variant of the TrickMo Android banking trojan was identified, actively targeting banking and wallet users in France, Italy, and Austria. This variant has replaced its predecessor in ongoing campaigns and has transitioned its command-and-control traffic to The Open Network (TON). Key features of the new TrickMo variant include: - The primary command-and-control channel now operates over TON, utilizing .adnl endpoints through an embedded local TON proxy. - It employs a runtime-loaded APK (dex.module) with enhanced functionalities, including reconnaissance, SSH tunneling, and SOCKS5 proxying, allowing infected devices to act as network pivots. - TrickMo is classified as Device Take Over (DTO) malware, targeting banking, fintech, wallet, and authenticator applications on Android devices. - Operators gain control over infected devices through accessibility-service permissions, enabling capabilities such as credential phishing, keylogging, screen recording, remote control, and SMS interception. The new variant features a modular architecture with a host APK functioning as a launcher and persistence layer, while offensive capabilities are delivered through the dynamically loaded dex.module. Significant enhancements include network reconnaissance commands (curl, dnslookup, ping, telnet, traceroute) and socket-level tunneling via an embedded SSH client. Indicators of compromise include specific SHA-256 hashes and package names associated with TrickMo dropper applications and host applications. The malware retains unused permissions for NFC capabilities, suggesting a strategic approach to device filtering.

AppWizard

March 27, 2026

Android 17 to Finally Let You Exclude Specific Apps from Your VPN Connection

Using a VPN on Android can enhance privacy but may hinder access to location-dependent services. Many users utilize "split tunneling" to exclude specific apps from the VPN connection, allowing access to these services. Android 17 Beta 3 is set to standardize split tunneling across the operating system, providing a cohesive settings screen for users to manage app exceptions. This development aims to simplify the user experience by eliminating the need to navigate different VPN app interfaces. Users will be able to configure specific apps, like banking applications, to use their local IP address while keeping other web traffic secure under the VPN. The feature is still in development and will require updates from VPN applications to utilize the new system screen.

Tech Optimizer

March 21, 2026

Avast VPN: An in-depth review of its speed, security and value

Avast launched its VPN service, Avast Secureline VPN, in 2017, focusing on encryption, a no-logs policy, and DNS leak protection. The company operates outside the 5, 9, or 14 Eyes alliances, which limits data-sharing with intelligence agencies. In January 2020, Avast faced criticism for collecting user data for its subsidiary, Jumpshot, but ceased this practice shortly after. The VPN offers dedicated servers for streaming and torrenting, basic split tunneling, and a kill switch, but lacks comprehensive features compared to competitors. Supported protocols include WireGuard, OpenVPN, and IPsec, with encryption standards generally secure. Avast claims to operate 700 servers across 27 countries, with a limited selection of streaming-optimized servers. The app supports various platforms but lacks support for Linux or routers. Speed tests showed an average download speed of 275.69 Mbps, but performance in unblocking content was disappointing, with limited success on streaming services. Avast's privacy policy indicates extensive data collection, despite claims of addressing past issues. Customer support includes 24/7 access for paying customers. Pricing tiers include a 60-day free trial, with competitive rates but limited features. Pros include decent speeds and reasonable pricing, while cons highlight controversial data practices, limited information, poor streaming performance, and fewer features compared to competitors.