URL Archives

Tech Optimizer

March 12, 2026

Free vs. Paid Antivirus: Is Paying for Protection Really Worth It?

Antivirus companies often offer free protection to build brand awareness, but many restrict their free versions to non-commercial use. Examples include Avast One Basic, AVG AntiVirus Free, Avira Free Security, and Panda Free Antivirus. Free antivirus software typically comes with limited tech support, with direct assistance reserved for paying customers. Key features may be missing in free versions, such as the ability to redirect users from dangerous websites or real-time protection. Microsoft Defender Antivirus is a built-in option that activates when no other antivirus is present but can be cumbersome and has limited protection against malicious URLs outside the Edge browser. Avast One Basic and AVG AntiVirus Free are recognized as top free options, but leading commercial products like Norton AntiVirus Plus and Bitdefender Antivirus Plus consistently outperform them. Both Norton and Bitdefender offer enhanced features beyond basic antivirus capabilities. While free antivirus can be effective, paid solutions provide greater protection and peace of mind.

AppWizard

March 11, 2026

How Advanced Browsing Protection Works in Messenger

Advanced Browsing Protection (ABP) in Messenger enhances user privacy by warning users about potentially harmful links shared in end-to-end encrypted communications. It analyzes links using on-device models and a dynamic watchlist of millions of potentially malicious sites, utilizing cryptographic techniques to maintain user privacy. ABP is based on a cryptographic primitive called private information retrieval (PIR), which minimizes the information a server learns from client queries. The system also employs oblivious pseudorandom functions (OPRFs) and manages URL queries through a privacy-preserving URL-matching scheme. The server groups links by domain, allowing clients to request a single bucket for domain-specific path components, and generates a ruleset to balance bucket sizes. To safeguard client queries, AMD's SEV-SNP technology creates a confidential virtual machine (CVM) that processes hash prefixes securely, generating attestation reports for integrity verification. The use of Oblivious RAM and Oblivious HTTP (OHTTP) enhances privacy by preventing exposure of memory access patterns and stripping identifying information from client requests. The lifecycle of an ABP request includes pre-processing phases where the server updates the URL database and computes rulesets, followed by client requests that involve calculating bucket identifiers, sending encrypted requests through a proxy, and checking for unsafe URLs based on server responses.

AppWizard

March 11, 2026

Messenger can warn you about sketchy links without knowing what you clicked

Meta has introduced Advanced Browsing Protection (ABP) in its Messenger application to enhance user safety by identifying harmful websites during chats. ABP utilizes a constantly updated watchlist of potentially harmful websites, improving upon the existing Safe Browsing feature. Due to end-to-end encryption, Messenger cannot access message content or links, so ABP uses cryptography and secure computing techniques for link verification without exposing them. When a user clicks a link, Messenger checks it against a blocklist using a privacy-preserving query system. Users can enable or disable ABP in the Messenger app under Settings, Privacy & safety, and Safe browsing. If the option is not visible, users may need to update the app.

Winsage

March 3, 2026

This third‑party Windows 11 app fixes one of its most annoying UX problems

The Files app has been updated to version 4.0.28, featuring an improved right-click context menu, bug fixes, support for the Microsoft Store version of Dropbox, icon customization for URL and shortcut files, and an option to disable smooth scrolling. The update resolves several issues, including problems with the 'Open With' menu, tab switching, and tag searches. The development team is focused on performance improvements, particularly for thumbnail loading times. Microsoft has plans to enhance Windows 11 and address user pain points related to File Explorer.

Winsage

March 2, 2026

RAT Malware Via Windows Explorer Puts Crypto at Risk

Cofense Intelligence reported that threat actors are exploiting Windows File Explorer and WebDAV servers to deliver Remote Access Trojans (RATs) to corporate systems, bypassing browser security measures. This method allows attackers to infiltrate machines without using web browsers, taking advantage of File Explorer's ability to connect to remote WebDAV servers. Despite WebDAV being deprecated by Microsoft in November 2023, it is still supported in Windows, creating a vulnerability. The campaigns began in February 2024, with a significant increase in September 2024, and 87% of these campaigns deliver multiple RATs, including XWorm, Async RAT, and DcRAT. Victims typically receive phishing emails disguised as invoices, containing URL or LNK shortcut files that initiate a WebDAV connection. The attacks often utilize Cloudflare Tunnel for hosting malicious WebDAV servers, making the traffic appear legitimate. Notably, 50% of affected campaigns are in German, while 30% are in English. The report emphasizes the risks posed to individuals holding digital assets, as RATs can access sensitive information, including crypto wallet files. Organizations are advised to monitor network traffic for Cloudflare Tunnel instances and educate users about the risks associated with File Explorer's capabilities.

Winsage

March 1, 2026

Hackers Abuse Windows File Explorer and WebDAV for Stealthy Malware Delivery

Cybercriminals are exploiting a legacy feature in Windows File Explorer, specifically the WebDAV protocol, to distribute malware and bypass traditional security measures. Despite Microsoft deprecating native WebDAV support in November 2023, it remains active on many systems. Attackers use WebDAV to deceive victims into executing malicious payloads by sending links that connect File Explorer directly to remote servers, avoiding web browsers and their security warnings. They employ methods such as direct linking, URL shortcut files, and LNK shortcut files to deliver exploits. The primary objective of these campaigns, which surged in late 2024, is to deploy Remote Access Trojans (RATs), with 87% of Active Threat Reports involving multiple RATs like XWorm RAT, Async RAT, and DcRAT. These campaigns predominantly target corporate networks in Europe, with many phishing emails written in German and English. Attackers use short-lived WebDAV servers hosted on Cloudflare Tunnel demo accounts to obscure their infrastructure. Security analysts are advised to monitor unusual network activity from Windows Explorer and educate users to verify addresses in File Explorer.

Tech Optimizer

February 24, 2026

Fake Zoom meeting “update” silently installs surveillance software

A deceptive website, uswebzoomus[.]com/zoom/, poses as a Zoom meeting platform and installs surveillance software on Windows devices without user consent. The software is a covert version of Teramind, a commercial monitoring tool. The site creates a fake Zoom waiting room experience, complete with scripted participants and background audio, to trick users into downloading a malicious file named zoomagentx64s-i(_941afee582cc71135202939296679e229dd7cced) (1).msi. This file is preconfigured to connect to an attacker-controlled Teramind server and operates in stealth mode, leaving minimal traces on the device. The installation process collects information about the device and is designed to evade detection by security tools. If users suspect they have been affected, they are advised not to open the downloaded file, check for its installation, and change passwords from a clean device.

TrendTechie

February 24, 2026

От ffmpeg до торрентов для терминала: 7 новых TUI-инструментов, которые советуем

Many developers are turning to TUI (Text User Interface) tools for tasks traditionally done in GUI applications. MONICA is an interactive layer over ffmpeg that simplifies command usage, available on GitHub. The lic tool allows users to create a LICENSE file with a single terminal command by selecting a license from a TUI menu. It can be installed via Homebrew or pip and debuted in late December 2024, receiving 21 stars. PNANA is a TUI editor that combines the simplicity of nano with features from modern editors like Sublime, built with C++17 and FTXUI. Users need to compile it from source as no binary releases are available. CodeWeaver compiles a codebase into a single Markdown document, allowing for easy sharing and documentation. It can be installed via Go. Clox (version 1.3) introduces console clocks and calendars in the terminal, supporting various time zones and formats, and can be installed as a Python module. Torrra v2 is a TUI torrent client that allows users to search and download torrents directly from the console, enhancing UI speed and navigation. It can be installed via pipx or other package managers. A command for visualizing git history in the terminal is provided: `git log --graph --decorate --all --pretty=format:'%C(auto)%h%d %C(#888888)(%an; %ar)%Creset %s'`. An alias can be created for convenience. All tools aim to enhance productivity in the terminal and are actively evolving.

Tech Optimizer

February 24, 2026

Fake Huorong Site Delivers ValleyRAT Backdoor in Targeted Malware Campaign

A cyber operation is targeting users of Huorong Security antivirus software through a typosquatted domain, huoronga[.]com, which mimics the legitimate site huorong.cn. Users who mistakenly visit the counterfeit site may download a file named BR火绒445[.]zip, which contains a trojanized installer that leads to the installation of ValleyRAT, a remote access trojan. The malware employs various techniques to evade detection, including using an intermediary domain for downloads, creating Windows Defender exclusions, and establishing a scheduled task for persistence. The backdoor facilitates activities such as keylogging and credential access while disguising its operations within legitimate processes like rundll32.exe. Attribution points to the Silver Fox APT group, and there has been a significant increase in ValleyRAT samples documented in recent months. Security measures include ensuring software downloads are from the official site and monitoring for specific malicious activities.

Winsage

February 20, 2026

Facebook ads spread fake Windows 11 downloads that steal passwords and crypto wallets

Attackers are using social media advertising, specifically paid Facebook ads, to promote a malware campaign disguised as legitimate Microsoft promotions. They create near-exact replicas of the official Windows 11 download page to lure users into downloading malicious software. The deceptive domains used include ms-25h2-download[.]pro and ms-25h2-update[.]pro. The malware campaign employs geofencing to selectively target victims, redirecting security researchers to benign sites while delivering malware to unsuspecting users. The malicious file, named ms-update32.exe, is hosted on GitHub and mimics the size of a legitimate Windows installer. Once executed, it checks for monitoring tools and, if none are detected, installs an application named "Lunar" that collects sensitive data, including cryptocurrency wallet information. The malware maintains persistence by writing data to the Windows registry and employs various obfuscation techniques to evade detection. The attackers run parallel ad campaigns with different Facebook Pixel IDs to ensure continued operation even if one is suspended. Indicators of compromise include specific file hashes, domains, file system artifacts, and registry keys associated with the malware.