NewApp Digest
search bot

utilities

Fake Xeno and Roblox Utilities Used to Install Windows RAT, Microsoft Warns
Winsage
March 2, 2026

Fake Xeno and Roblox Utilities Used to Install Windows RAT, Microsoft Warns

Cybersecurity experts at Microsoft Threat Intelligence have identified a trend where attackers distribute counterfeit gaming tools that install a remote access trojan (RAT) on users' systems. These trojanized executables, such as Xeno.exe or RobloxPlayerBeta.exe, are shared through browsers and chat platforms. The initial executable acts as a downloader, installing a portable Java runtime environment and launching a harmful Java archive, jd-gui.jar. Attackers use built-in Windows tools to execute commands via PowerShell and exploit trusted system binaries, minimizing detection risk. The embedded PowerShell script connects to remote locations, downloads an executable as update.exe, and executes it. The malware erases evidence of the downloader and modifies Microsoft Defender settings to allow RAT components to function undetected. It establishes persistence through scheduled tasks and a startup script named world.vbs, enabling prolonged access to the compromised device. Microsoft Defender can detect the malware and its behaviors, and organizations are advised to monitor outbound traffic and block identified domains and IP addresses. Users are encouraged to scrutinize Microsoft Defender exclusions and scheduled tasks for irregularities and remain cautious about downloading tools from unofficial sources.
Windows 11’s new Start menu is here, and the community reaction is basically “why is this worse?”
Winsage
February 27, 2026

Windows 11’s new Start menu is here, and the community reaction is basically “why is this worse?”

Microsoft's redesign of the Start menu in Windows 11 has received mixed reactions, with many users criticizing its excessive size, automation, and lack of customization options. Users on larger monitors find the menu to be a "colossal waste of space," while those on laptops have a more favorable view. The automatic categorization of apps has been deemed ineffective, with users frustrated by the inability to rename or adjust categories. Some users appreciate the "List" view option, but overall, the menu's size overshadows its positive aspects. Functional issues such as icons failing to render and laggy animations have also been reported, contributing to dissatisfaction. Users express a desire for more control over their interface, suggesting that options for category editing and resizing could improve the experience.
От ffmpeg до торрентов для терминала: 7 новых TUI-инструментов, которые советуем
TrendTechie
February 24, 2026

От ffmpeg до торрентов для терминала: 7 новых TUI-инструментов, которые советуем

Many developers are turning to TUI (Text User Interface) tools for tasks traditionally done in GUI applications. MONICA is an interactive layer over ffmpeg that simplifies command usage, available on GitHub. The lic tool allows users to create a LICENSE file with a single terminal command by selecting a license from a TUI menu. It can be installed via Homebrew or pip and debuted in late December 2024, receiving 21 stars. PNANA is a TUI editor that combines the simplicity of nano with features from modern editors like Sublime, built with C++17 and FTXUI. Users need to compile it from source as no binary releases are available. CodeWeaver compiles a codebase into a single Markdown document, allowing for easy sharing and documentation. It can be installed via Go. Clox (version 1.3) introduces console clocks and calendars in the terminal, supporting various time zones and formats, and can be installed as a Python module. Torrra v2 is a TUI torrent client that allows users to search and download torrents directly from the console, enhancing UI speed and navigation. It can be installed via pipx or other package managers. A command for visualizing git history in the terminal is provided: `git log --graph --decorate --all --pretty=format:'%C(auto)%h%d %C(#888888)(%an; %ar)%Creset %s'`. An alias can be created for convenience. All tools aim to enhance productivity in the terminal and are actively evolving.
Fake Huorong Site Delivers ValleyRAT Backdoor in Targeted Malware Campaign
Tech Optimizer
February 24, 2026

Fake Huorong Site Delivers ValleyRAT Backdoor in Targeted Malware Campaign

A cyber operation is targeting users of Huorong Security antivirus software through a typosquatted domain, huoronga[.]com, which mimics the legitimate site huorong.cn. Users who mistakenly visit the counterfeit site may download a file named BR火绒445[.]zip, which contains a trojanized installer that leads to the installation of ValleyRAT, a remote access trojan. The malware employs various techniques to evade detection, including using an intermediary domain for downloads, creating Windows Defender exclusions, and establishing a scheduled task for persistence. The backdoor facilitates activities such as keylogging and credential access while disguising its operations within legitimate processes like rundll32.exe. Attribution points to the Silver Fox APT group, and there has been a significant increase in ValleyRAT samples documented in recent months. Security measures include ensuring software downloads are from the official site and monitoring for specific malicious activities.
If you're still debloating Windows manually, this one tool does it better
Winsage
February 21, 2026

If you’re still debloating Windows manually, this one tool does it better

Windows has a nearly 70% global market share as the dominant desktop operating system, but users often complain about bloatware. Windows Utility by Chris Titus is a tool that simplifies the debloating process through a single command in Windows PowerShell, offering a graphical user interface for tasks like debloating, disabling telemetry, uninstalling preinstalled applications, and managing services. It enhances performance by enabling high-performance power plans and optimizing Windows Update behavior. The utility includes O&O's ShutUp10++ for managing data collection practices and allows users to save customized settings for future installations. It features a built-in package installer that supports Chocolatey and WinGet, enabling bulk installations of applications.
From Marquette to Microsoft: This alumnus leads global communications for over a billion Microsoft devices
Winsage
February 19, 2026

From Marquette to Microsoft: This alumnus leads global communications for over a billion Microsoft devices

A representative from Marquette University visited University of Detroit Jesuit High School during Chris Morrissey’s junior year, shortly after Marquette’s men’s basketball team won the national championship in 1977. Morrissey decided to attend Marquette, influenced by friends with siblings enrolled there. He has had a diverse career, moving from the automotive sector to chemicals, and is currently the senior director of communications for Windows and devices at Microsoft. Morrissey worked the midnight shift at the downtown Hilton during college, which allowed him to complete homework and read major newspapers. His interest in technology began at Chrysler, where he embraced new PCs while others were hesitant. At Microsoft, he manages a team that handles communications for Windows device updates and features, emphasizing the global impact of their work. Recently, his team addressed a crisis involving a cybersecurity issue affecting Windows devices, focusing on customer support. Morrissey credits his Marquette education with teaching him to prioritize others in crisis situations. He has also become involved in community service in Seattle, volunteering at food banks and serving on the board of North Helpline. As a father and grandfather, he values the growth mindset he sees in his children.
Phishing Lures Spread XWorm Remote Access Trojan
Tech Optimizer
February 16, 2026

Phishing Lures Spread XWorm Remote Access Trojan

A cyber-espionage campaign is utilizing the XWorm Remote Access Trojan (RAT) to infiltrate systems via phishing emails and a Microsoft Office vulnerability (CVE-2018-0802). XWorm, first detected in 2022, allows attackers remote control over infected computers for surveillance and data theft. The campaign uses business-oriented phishing emails with malicious Excel attachments that exploit the vulnerability to execute a fileless attack. The malware connects to a command-and-control server, encrypting communications and transmitting system details. XWorm features a plugin architecture with over 50 modules for various malicious activities, including credential theft and DDoS attacks. Security experts highlight the ongoing risk of legacy software vulnerabilities and recommend patching outdated components.
Microsoft Fixes Critical Windows 11 Notepad Flaw
Winsage
February 14, 2026

Microsoft Fixes Critical Windows 11 Notepad Flaw

Microsoft has released a patch for a significant vulnerability in Notepad on Windows 11 that could allow attackers to execute code by opening a Markdown file and clicking on a malicious link. This vulnerability was due to how Notepad processed links within Markdown files, which could trigger unverified protocols to load remote content. The patch now includes a security warning before such links can be activated. Users are advised to check for updates via Windows Update and the Microsoft Store to ensure Notepad and related components are up to date. Security tips include inspecting URLs before clicking and keeping Microsoft Defender features enabled.
Search