Zip Archives

AppWizard

September 25, 2026

Google Maps is failing to complete basic searches for some users

Users are experiencing a glitch with the search functionality in the browser version of Google Maps, where searching for general terms like "restaurants" results in an error message suggesting a misspelling or incomplete query. Specific location searches work normally, but general searches yield a message stating, “Google Maps can’t find restaurants,” prompting users to check spelling or provide additional location details. This issue appears to be limited to the browser version, with no problems reported on the mobile app. Some users have found that searching in incognito mode may resolve the issue, though this workaround is not universally effective. The glitch affects multiple browsers, not just Chrome. Android Authority has contacted Google for clarification on the matter.

Winsage

September 24, 2026

86Box Setup Guide 2026: Emulate a Windows 98 PC in 13 Steps

86Box is an emulator that meticulously reconstructs vintage PCs, allowing users to boot operating systems like MS-DOS, Windows 95, Windows 98, and Windows XP. The latest version, 6.0, was released on May 31, 2026, featuring a native Windows ARM64 build and discontinuing support for macOS 10.13 High Sierra. It has approximately 2,400 monthly searches in the U.S., indicating a demand for setup guides among enthusiasts. Unlike DOSBox, which creates a generic DOS environment, 86Box emulates specific hardware components for authentic execution of various operating systems. Originally a fork of PCem, 86Box has expanded its supported motherboards and developed a community of contributors. Version 6.0 has established it as the preferred choice for retro-PC builders in 2026. Before installation, users need a minimum of a 64-bit Intel Core 2, AMD Athlon 64, or ARMv8 CPU, 4 GB of RAM, and a compatible host operating system. The installation process involves downloading the appropriate build, sourcing a legal ROM set, and configuring the virtual machine using the 86Box Manager. Users can select specific graphics cards and sound hardware to replicate the original systems accurately. The setup requires installation media for the guest operating system, which must be sourced legally. Common pitfalls during setup include ensuring the BIOS ROM is available, matching CPU speed to software era, and installing the correct drivers. A properly configured virtual machine should display a BIOS POST screen and boot the selected operating system. Troubleshooting common issues often involves checking for missing ROMs, uninstalled drivers, or performance settings. 86Box is open-source and legal to use, but users must ensure they have legitimate licenses for any software used within the emulator.

AppWizard

September 23, 2026

RatHat Android Malware Uses AI to Target Banking Credentials in Real Time

A newly identified strain of Android malware, RatHat, utilizes generative AI to manipulate infected devices in real time. It is linked to threat actors believed to be operating out of China. RatHat serializes the device’s live Accessibility tree into XML format and communicates with a generative AI assistant to return screen coordinates, identify text, and issue navigation commands. The malware employs WebView-based HTML overlays to capture login credentials from banking and cryptocurrency applications and can infiltrate payment apps like WeChat and Alipay to extract PINs. It also features an SMS receiver and notification listener to intercept OTPs and 2FA codes. RatHat is disseminated through smishing, malvertising campaigns, and misleading third-party forums. It employs anti-analysis techniques such as container tampering, manifest bombing, DEX bytecode poisoning, string encryption, and anti-debugging. Once installed, it gains Accessibility access, activates Developer Options, and enables Wireless Debugging, allowing it to connect to the device's local ADB service and launch control agents with shell-level privileges. The malware captures raw touch coordinates to reconstruct PINs and unlock patterns, bypassing screenshot protections. It also includes persistence mechanisms that prevent uninstallation by presenting a fake Google Play failure overlay and automatically reinstalling itself if removed.

Tech Optimizer

September 22, 2026

This fake LastPass Authenticator app will just shut off your antivirus and leave you open to attack

LastPass has identified a sophisticated scheme targeting users of its Authenticator app, involving SEO poisoning and deceptive GitHub pages that distribute malicious ZIP files disguised as legitimate software. Users searching for "LastPass Authenticator download" may encounter these counterfeit pages, which redirect them to a malicious server delivering a ZIP file containing vsdbg.exe and vsdbg.dll. The executable is a legitimate Microsoft debugging tool exploited to execute the malicious DLL through DLL sideloading, allowing the malware to run undetected. Named Rapuncel by security researchers from Delphos, this malware is undetectable by antivirus engines and targets a hardcoded list of 145 antivirus and endpoint security products, disabling them upon detection. Rapuncel harvests sensitive information, including saved passwords from over 25 web browsers, cryptocurrency wallet files from more than 30 applications, and session tokens from platforms like Discord and Steam. It also captures screenshots and compiles a profile of the infected system, uploading the stolen data to an attacker-controlled server. The malware includes a kernel driver that intercepts web traffic, allowing for advertisement injection and search result manipulation. This campaign has been active for several months, with LastPass vaults remaining unaffected. Users are advised to download applications only from trusted sources. Rapuncel establishes persistence on infected machines by installing itself as a Windows service that starts with the system and terminates activated security products. Removing the kernel driver requires booting into Safe Mode or using external recovery tools, as standard Windows utilities cannot eliminate software operating at that level.

Tech Optimizer

September 21, 2026

Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR

On September 17, researchers from LastPass and Delphos Labs discovered a counterfeit LastPass Authenticator installer on GitHub that installs a malicious Windows kernel driver designed to disable antivirus and steal passwords. The driver, named Alinubx.sys, was signed through Microsoft's hardware compatibility program and initially scored zero detections on VirusTotal. The fake installer is hosted on a fraudulent GitHub page that mimics a legitimate LastPass product page. When executed, the installer uses DLL side-loading to gain SYSTEM-level access and terminates security processes, allowing it to harvest saved passwords from various browsers and applications. The driver is a renamed variant of a known malicious driver, evading detection due to its new file hash. Delphos reported the driver to Microsoft, but it was not considered a security vulnerability. Users who executed the fake installer should treat their passwords and sensitive data as compromised and change them from a secure device. The malicious server has been linked to impersonation pages for multiple brands, and the loader was likely created using a specific crypter tool.

AppWizard

September 18, 2026

RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall

Cybersecurity experts have identified a new Android malware named RatHat, believed to be operated by Chinese threat actors. RatHat is distributed primarily through smishing and malvertising campaigns, leading users to deceptive download portals. It employs an automated multi-stage infection process and exploits Accessibility features along with a local ADB self-pairing mechanism to escape the Android application sandbox. The malware uses various anti-analysis techniques, including container tampering, manifest bombs, DEX bytecode poisoning, and dual string-encryption. RatHat's architecture consists of a malicious Android application, a Go agent, and an FRP reverse-proxy client, which together enable it to gain critical system permissions and perform various malicious activities such as credential capturing, screen recording, and SMS interception. Even if uninstalled, the malware retains shell access to the device, allowing attackers to reinstall it. RatHat can serialize the device's Accessibility tree to XML and communicate with a Generative AI assistant for tasks like screen coordinate determination and text extraction. The Go Agent, masquerading as a native library, exploits shell access to execute commands and establish a persistent connection to a command-and-control server via the FRP client. The C2 server can issue extensive commands to collect sensitive information, including SMS messages, credentials, files, and keystrokes, and RatHat also features a hardware-level keylogger.

AppWizard

September 11, 2026

Bribing medics to revive me first in Wardogs is one of my favorite shooter mechanics in ages

Wardogs is a Battlefield-inspired shooter that allows players to invest in enhancements such as customized loadouts and taxi services to improve their gameplay experience. The game features an engaging economy that rewards players for their contributions, with over 300,000 players participating in its early access phase. The economic system incentivizes players to embrace their roles in the game, enhancing overall engagement and experience. The developers, Bulkhead, are focused on refining and expanding the game during this early access period.

AppWizard

September 6, 2026

Pterodactyl Multi-Game Cloud Server: 13 Steps [2026]

In 2026, hosting game servers has become more efficient, allowing multiple game servers to run on a single cloud VPS using Pterodactyl Panel, which utilizes Docker containers for isolation. Pterodactyl is a free, open-source game server management panel that gained popularity due to its user-friendly interface and robust architecture. The latest stable release, v1.12.0, was launched in January 2026, with newer deployment templates available as of August 2026. To set up Pterodactyl, prerequisites include a cloud VPS with specific CPU and RAM requirements, Ubuntu 24.04 LTS, PHP 8.3, MariaDB 11.8.8 or newer, Redis 8.10.0 or newer, Docker Engine, a registered domain for SSL, SteamCMD dependencies, and at least 80 GB SSD storage. The installation process involves provisioning the VPS, installing necessary software, configuring Pterodactyl, setting up Nginx with SSL, and deploying game servers. Common pitfalls include under-provisioning RAM for resource-intensive games, neglecting firewall settings, and allowing backup retention to grow uncontrollably. Troubleshooting may involve addressing PHP-FPM issues, connection problems, and ensuring proper resource allocation. Advanced scaling may require multiple VPS nodes, and security measures like two-factor authentication can help protect the server. Pterodactyl is free to use commercially and can run multiple game containers on a single node.

Winsage

September 2, 2026

Fake Software Installers Disable Windows Update and Weaken Microsoft Defender

An active malware campaign is using counterfeit software-download websites to distribute malicious installers, primarily targeting users seeking popular software. This campaign has significantly affected China-based operations of multinational corporations and Chinese-speaking users. The malware, once executed, can establish persistence, undermine security measures, and communicate with attacker-controlled infrastructure. Victims span various sectors, including healthcare, manufacturing, gaming, technology, logistics, government, and education. Microsoft associates this campaign with a Chinese threat cluster called Silver Fox, known for using spoofed vendor download pages to spread Gh0st RAT and ValleyRAT. The malicious websites are hosted on .com.cn and .hl.cn domains, featuring Chinese-language content. The downloaded files are dynamically generated, and upon execution, they deploy a wrapper installer that initiates the malware payload. The malware achieves persistence through scheduled tasks and interferes with Windows Update services. The campaign establishes command-and-control communication over non-standard ports, with two identified domains linked to the activity. Microsoft Defender has detected the threat and initiated containment procedures. Kaspersky reported a related malicious installer exploiting a legitimate adware application to execute a backdoor, which captures keystrokes and clipboard contents. ValleyRAT, a sophisticated implant, can collect system information, reboot the computer, capture screenshots, and transmit logs. The attackers are motivated by cyber espionage and financial gain, targeting organizations globally. A subgroup within GoldenEyeDog, known as CuboidalCanine, has also been linked to the use of ValleyRAT, particularly in the gambling industry. In June 2026, Chinese authorities addressed cybercrime cases involving a new variant of the Silver Fox trojan.

Winsage

September 2, 2026

Fake Microsoft Edge, Kaspersky and Razer Installers Used to Compromise Windows Systems

An ongoing malware campaign is targeting Windows devices through counterfeit download pages for well-known software brands like Microsoft Edge, Kaspersky, and Razer. The campaign affects various sectors, including healthcare, manufacturing, gaming, technology, logistics, government, and education. It utilizes high-fidelity fraudulent websites that closely mimic legitimate vendors, with observed lure domains such as app-microsoft-edge[.]com[.]cn and kaspersky-lab[.]hl[.]cn. Attackers employ evasion tactics like server-side payload regeneration and create multiple copies of the same archive in quick succession. Victims are lured into downloading ZIP files that contain a bundled wrapper installer, which activates a stage-one executable in randomized directories. The malware often masquerades as legitimate software, with some payloads impersonating known applications. Persistence is achieved through scheduled tasks with unusual names, and the malware employs various evasion techniques, including deleting shadow copies and altering file permissions. Microsoft Defender has identified activity across multiple stages of the attack, including delivery, execution, and command-and-control communications. To mitigate risks, organizations are advised to block downloads from unofficial sources, enforce Tamper Protection, and implement Attack Surface Reduction rules. Indicators of compromise (IOCs) include specific lure domains and URLs associated with the campaign.