URL Archives

Tech Optimizer

October 13, 2026

NordVPN Teams With Shaquille O’Neal To Promote Online Protection

NordVPN organized an event in Times Square featuring Shaquille O'Neal to highlight the importance of online protection. A survey revealed that nearly half of Americans are confident in identifying online fraud, yet 74% failed to recognize a fake URL, 82% could not identify a fake CAPTCHA, and less than half recognized a phishing email. Additionally, 71% believe common sense is enough for online safety, while 51% reuse similar passwords. Nearly half rely solely on antivirus software for protection, and 73% reported encountering scams, with 13% losing or nearly losing money. Shaquille O'Neal emphasized the need for vigilance and using the right tools for online safety, while NordVPN's CMO noted the disconnect between confidence and actual skills in cybersecurity.

AppWizard

September 28, 2026

RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims

The operators behind RatHat have created an advanced Android banking trojan that allows control of infected devices through a web console. Since April 2026, nearly 100 instances of this console have been identified, indicating a malware-as-a-service model. The console collects sensitive data from compromised phones, including text messages and passwords. It uses Google's Gemini AI to assess victims' bank balances, categorizing them into high-value and mid-value segments, but does not facilitate financial transactions. The malware has remained largely unchanged since late 2025, but the console has seen significant updates, leading to three new versions: BlackCat Remote Control Management, Panda Workshop V5, and V6. These versions serve as both control interfaces and build tools for creating and distributing malware. The latest version includes templates for deceptive download pages. RatHat infiltrates devices via text messages and online ads, requesting Accessibility access to read screens and simulate user interactions. This access allows the malware to activate wireless debugging and connect to the Android Debug Bridge (ADB), giving operators elevated privileges to execute commands. A Go program can be deployed to maintain control, even after the app is uninstalled. Cleafy has tracked console deployments through web code analysis, noting that many IP addresses originate from a Singapore-registered network. The initial console version allowed operators to choose AI providers, but the latest exclusively uses Gemini. RatHat also utilizes Gemini on infected devices to determine tap locations based on screen layouts. Cleafy has compiled indicators related to the consoles' command-and-control servers, download links, and malware samples, including specific domains, IP addresses, and MD5 hashes. The consoles often use web addresses starting with "admin." and inexpensive top-level domains. Security tools are advised to monitor processes running under the shell user on affected devices.

AppWizard

September 22, 2026

Google Messages is preparing its biggest search overhaul yet

Google Messages is testing a redesign of its search functionality to improve user experience. The search bar will move to the bottom of the home screen, featuring a dynamic visual overview of shared content, including preview rows for images, videos, links, and places. Users will be able to search within specific conversations from the main search page without opening each chat. The search results will display all matching messages on a dedicated results page instead of grouping them by conversation. Links and places will have larger, visually appealing cards, although timestamps and sender names will not be visible. A new media viewer will allow users to swipe through images and videos, enhancing the overall experience.

AppWizard

September 14, 2026

How to Convert a Website or AI-Built Web App into a Play Store-Ready Android App in 2026

Native App AI simplifies the process of converting websites or AI-generated web apps into Android applications ready for the Play Store without needing to rebuild from scratch. It allows users to input a website URL, customize the app's features, and generate APK and AAB files for testing and publishing. The platform supports various features such as push notifications, AdMob monetization, deep linking, and custom branding. It also assists in preparing necessary information for Google Play, ensuring compliance with policies and technical requirements. This service is beneficial for SaaS companies, startups, e-commerce ventures, and creators who have existing web products.

AppWizard

September 10, 2026

RistOS – The app-less Android whose brain stays at home

The narrative describes a Google Pixel smartphone using RistOS, a minimalist firmware designed for the Pixel 10a. Upon activation, the interface displays only the time, a microphone button, and a text input line. RistOS replaces the traditional Android launcher with a voice assistant and organizes phone functionalities in a side menu with seven entries: Phone, Messages, Camera, Gallery, Offline Maps (Organic Maps), Flashlight, and Settings. There is no app store, browser, or Google account, emphasizing simplicity. RistOS is built on GrapheneOS but is not affiliated with it or Google. It is only compatible with the Pixel 10a, priced at €389. The microphone button does not activate listening by default; users must configure settings to connect to a Rist backend for audio command processing. User data is centralized on a server, and the installation process erases existing data. The system does not support contacting emergency services, and alternatives like /e/OS are suggested for those wanting to avoid Google's ecosystem without server setup.

Winsage

September 9, 2026

Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week

Recent investigations have identified the BlueMoon exploit kit, used by espionage-driven threat activity clusters, particularly linked to APT31, a China-aligned state-sponsored group, since August 28, 2026. BlueMoon exploits three vulnerabilities: CVE-2026-85046 (a type confusion vulnerability in Google Chrome's V8 engine), an unassigned V8 sandbox escape, and CVE-2026-85880 (a heap-based buffer overflow in Windows ALPC). Google and Microsoft have released patches for these vulnerabilities, which were exploited as "patch-gap" zero-days. The attack vectors typically begin with phishing emails that lead victims to malicious URLs, triggering the vulnerabilities for code execution and privilege escalation. Variants of BlueMoon have been detected, featuring modifications for specific campaigns. Notable attack chains include: - APT31 targeting NGOs and mining firms in the U.S. with a malicious browser add-on called GemStone. - UNK_LateNight targeting U.S. aerospace companies, deploying BlueMoon alongside the ShadowPad backdoor. - UNK_DoubleCheck targeting a Vietnamese manufacturer, using DLL sideloading to execute a Rust binary. - UNK_QuietRacket targeting government and financial organizations in Indonesia and Singapore, modifying BlueMoon to execute a .NET assembly. CISA added the Chrome flaw to its Known Exploited Vulnerabilities catalog on September 4, 2026, requiring federal agencies to apply patches by September 18, 2026. Indicators of compromise include specific process trees, files, folders, scheduled tasks, mutexes, and registry keys. Proofpoint has released detection rules to help organizations identify and mitigate these threats.

AppWizard

September 4, 2026

This Google Chrome alternative is the most exciting Android browser I’ve used all year

Solipsism Browser is a third-party, open-source browser based on Chromium, launched just over three months ago. It features a unique side-rail design for navigation buttons, allowing for ergonomic one-handed use, especially on larger devices. Users can customize the homepage with HTML and CSS, and it includes a built-in ad blocker powered by uBlock Origin and a malware scanner. However, it lacks extension support, which is a strength of Firefox, and the address bar's placement at the top can hinder one-handed usability. Solipsism is not available on the Google Play Store and requires updates through platforms like F-Droid or Obtanium. The developer plans to create a future version based on the Servo engine.

Winsage

September 3, 2026

17 Useful WinGet Commands Every Windows 11 User Should Know

WinGet is a package manager included with Windows 11, accessible via a command line interface. It provides a more efficient method for installing applications compared to traditional download methods. Users can verify WinGet installation by running the command winget --version. Key commands include: 1. winget search : Finds packages by name, publisher, or moniker. 2. winget show --id : Displays detailed information about a specific package. 3. winget install -e --id : Installs a package using its exact ID. 4. winget install -e --id --version : Installs a specific version of a package. 5. winget install -e --id --silent --accept-package-agreements --accept-source-agreements: Installs a package silently without user prompts. 6. winget list: Lists all installed applications. 7. winget upgrade: Lists installed packages with available updates. 8. winget upgrade --all --include-unknown --silent --accept-package-agreements --accept-source-agreements: Updates all packages without user input. 9. winget uninstall : Removes a specified package. 10. winget export: Generates a JSON file of installed packages. 11. winget import: Reinstalls applications from an exported file. 12. winget pin : Prevents a package from being updated. 13. winget download : Retrieves an installer without executing it. 14. winget repair : Initiates a repair routine for an application. 15. winget source: Manages package sources. 16. winget settings: Opens the WinGet settings file for customization. 17. winget configure: Applies a configuration file for installations. Three commands are primarily for package publishers and can be ignored by most users: PLACEHOLDER3dfbcb91baab02cd, PLACEHOLDER5b3baaac6e2d9202, and winget dscv3. If WinGet is not recognized, it may be due to a missing App Installer package, a missing PATH entry, or running in an unsupported context. WinGet is safe to use, compatible with Windows 10 version 1809 and later, and does not require administrator rights for all commands.

Winsage

September 2, 2026

Fake Microsoft Edge, Kaspersky and Razer Installers Used to Compromise Windows Systems

An ongoing malware campaign is targeting Windows devices through counterfeit download pages for well-known software brands like Microsoft Edge, Kaspersky, and Razer. The campaign affects various sectors, including healthcare, manufacturing, gaming, technology, logistics, government, and education. It utilizes high-fidelity fraudulent websites that closely mimic legitimate vendors, with observed lure domains such as app-microsoft-edge[.]com[.]cn and kaspersky-lab[.]hl[.]cn. Attackers employ evasion tactics like server-side payload regeneration and create multiple copies of the same archive in quick succession. Victims are lured into downloading ZIP files that contain a bundled wrapper installer, which activates a stage-one executable in randomized directories. The malware often masquerades as legitimate software, with some payloads impersonating known applications. Persistence is achieved through scheduled tasks with unusual names, and the malware employs various evasion techniques, including deleting shadow copies and altering file permissions. Microsoft Defender has identified activity across multiple stages of the attack, including delivery, execution, and command-and-control communications. To mitigate risks, organizations are advised to block downloads from unofficial sources, enforce Tamper Protection, and implement Attack Surface Reduction rules. Indicators of compromise (IOCs) include specific lure domains and URLs associated with the campaign.

Tech Optimizer

September 2, 2026

Connecting My LangGraph AI Agent to Postgres

A stateful LangGraph agent was developed to streamline a 15-minute booking process, mimicking a customer service representative. It features a user-friendly Streamlit UI and a backend powered by a Postgres database. The agent can respond to customer queries, calculate service prices, manage acceptance or rejection of services, propose appointment time slots, and confirm booking details. The agent operates in two persistence modes: in-memory for quick testing and Postgres for durability. Testing can be conducted locally with Streamlit or using Docker to simulate a production environment. Docker allows the application to interact with a PostgreSQL server without local installation, enhancing reproducibility. The project includes a docker-compose.yml file to initiate a PostgreSQL container, and users can also utilize a cloud-based Postgres solution. The application behavior remains consistent regardless of the database setup. The complete source code is available on GitHub for testing and further enhancements.