Kategorie

The European Union has now published a set of measures aimed at boosting Europe’s tech industry to help reduce reliance on US and Chinese suppliers for AI, cloud, and semiconductors. The proposals include rules to restrict the use of US hyperscalers for certain public sector procurement purposes, but stop short of banning them outright.

“Technological sovereignty does not mean protectionism. Europe remains grounded in openness, partnership, and fair competition,” Henna Virkkunen, executive vice president for Tech Sovereignty, Security and Democracy, said in a statement Wednesday. “At the same time, Europe wants to be in the position to make its own choices, avoiding dependence on single dominant suppliers, especially from non-like-minded countries.”

The European Technological Sovereignty Package — released after several delays — includes two legislative proposals: the Cloud and AI Development Act and Chips Act (CAIDA) 2.0 and the Open Source Strategy and Strategic Roadmap for Digitalization and AI in Energy.

CAIDA aims to triple data center capacity in the next five to seven years by easing restrictions for deployments across the EU. It also includes rules that, if enacted, would require EU public bodies to meet certain sovereignty criteria for cloud service procurement related to certain sensitive workloads.

Amid ongoing trans-Atlantic tensions and a long-time deep reliance on US tech providers, European organizations have become increasingly wary of a “kill switch” that would cut off access to digital services. There are also concerns that US hyperscalers could be compelled to share data with US government under the CLOUD Act and Foreign Intelligence Services Act (FISA), even when data centers are located in Europe.

The CAIDA proposals include four levels of criteria for suppliers; the most basic includes data center infrastructure located and operated in the region – something  many US cloud suppliers already provide – with stricter rules around supplier ownership, full control over the software stack, and more stringent cybersecurity certification.

The majority of existing EU public sector workloads (70%) fall under the first level, with 20% at level 2, and 9% at level 3. Only a small proportion (1%) of the most sensitive workloads would require level 4.

Other proposals include the Chips Act 2.0, a follow-up to the 2023 legislation that sought to improve semiconductor production capabilities; the updated version now aims to boost research and spur demand for domestically produced processors. 

The legislative proposals must be negotiated by the European Parliament and Council of the European Union before adoption.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are exploiting vulnerabilities in the Linux kernel and Android operating system. [...]

A two-week penetration test can leave roughly 345 days of real-world exposure unvalidated. Sprocket Security explores why continuous testing is becoming critical as attack surfaces constantly change. [...]

The Fragmented State of Modern Enterprise Identity Enterprise IAM is approaching a breaking point. As organizations scale, identity becomes increasingly fragmented across thousands of applications, decentralized teams, machine identities, and autonomous systems. The result is Identity Dark Matter: identity activity that sits outside the visibility of centralized IAM and beyond the reach of [email protected]

Acer is working to address two maximum-severity zero-day vulnerabilities affecting its Wave 7 mesh routers. [...]

Assume the breach. Zero-days keep shipping, AI is writing exploits faster than anyone patches, and "patch everything in time" stopped working years ago. Stop betting the org on winning that race. You don't control which bug lands. You control what it can reach once it does. That is a question about the shape of your network, and most teams have the shape wrong. HD Moore, creator of Metasploit [email protected]

Apple’s MacBook Neo appears to be a triumph of strategic disruption that has already cast shock waves across the industry — and that energy is still playing out.

Approximately 55,000 MacBook Neo computers have been sold every day since it was introduced in March, according to IDC data (as first noted by TechCrunch). In fact, it looks as if Apple sold 1.1 million of these Macs in the first 20 days of sale, the analysts said.

There’s no real reason to imagine that level of demand has declined very much.

MacBook Neo: Millions sold

After all, not only do these Macs continue to dominate Amazon’s US laptop charts, but supply chain rumors claim Apple has doubled its manufacturing orders. “MacBook Neo shipments have come in better than expected, with the 2026 shipment forecast raised from 5 million to 10 million units,” Apple analyst Ming-Chi Kuo said recently. 

IDC’s March data may not capture the larger extent of the demand, as IDC analyst Navkendar Singh pointed out that MacBook Neo shipments “began to spike from early April”, which suggests demand has accelerated since then.

MacBook Neo demand exceeded expectations across multiple nations, including in India, where the company shifted 18,000 of them in the opening weeks.

Doing the business

Apple has also instructed processor maker TSMC to manufacture additional A18 processors specifically for its affordable laptop, while earlier speculation has claimed the company has been using ongoing memory price increases as a strategic competitive tool.  (The Neo starts at $599, with a pricier model set at $699.)

By expanding the potential customer base for Macs with a lower cost Neo, Apple is aiming a claim at the biggest-selling part of the PC market. And it is doing so even as rapidly increasing component prices force others to choose between higher product prices and profitability, or much-reduced margins in to compete at the same price. levels

That’s a losing battle; competitors for the most part can’t hope to match Apple’s bargaining position when it comes to the cost of components like memory because they don’t have the same scale. That means that even when component costs increase for everybody, Apple pays less, because it orders more. 

That scale means that for many component suppliers, it’s Apple’s business that keeps the meat on the table while other customers merely contribute the gravy. So, suppliers are happy to make deals with Apple to secure that main course — to continue the analogy — but are less likely to match those deals for dessert. As such, Apple is expected to be the only laptop vendor to see growth this year.

Apple’s great game

IDC’s figures confirm Apple’s strategy is working, with strong demand for the Neo, and, indeed, all Apple’s new laptops. At the same time, the researcher predicts overall global PC shipments will decline 11.3% this year, with a painful 20% sales drop envisioned for Q4. 

“We’re not seeing any relief to the memory shortage situation before the end of 2027, which means prices will continue to rise and PC manufacturers will struggle to maintain full product portfolios for the foreseeable future,” Jean Philippe Bouchard, vice president of devices and consumers at IDC said in a statement.

“The introduction of the MacBook Neo is putting real pressure on the entire PC ecosystem,” added Jitesh Ubrani, research manager for IDC’s Consumer Devices Trackers. 

Competitors are already responding with new devices equipped with ARM-based processors and aggressive promotional pricing. But none truly match what Apple has with MacBook Neo, and all must reach profitable scale to compete long-term. 

None have yet done so.

The strategy makes sense

“The MacBook Neo launch stands out as one of Apple’s most strategically important recent Mac releases,” Counterpoint analyst David Naranjo said. 

Apple is directly targeting customers that previously saw its products as too expensive. That allows it is also to aggressively build business in parts of the market such as education that tend to be more resilient to economic headwinds. MacBook Neo is also enjoying strong demand across the enterprise.

Both these parts of the market give Apple’s competitors their lunch. “The competitive pressure from the Neo is providing a partial offset to broader price increases, keeping some low-cost notebook options alive,” Ubrani said. “But the overall trajectory for average selling prices (ASPs) is firmly upward. IDC forecasts ASP growth of 17% in 2026, and even as memory capacity expands over the next two years, pricing is unlikely to return to 2025 levels.” 

Apple’s control over its processors, along with its strategic approach to component purchasing, means it should be able to maintain its existing Mac price points for a while. “Apple’s vertical integration (own silicon, own OS) gives it more levers than competitors reliant on third-party chips and Microsoft licensing,” Hexnode CEO Apu Pavithran told me recently.

So, while PC makers either exit the market or raise prices in pursuit of profits, MacBook Neo will continue racing off the shelves, particularly to large enterprise and education customers. 

The endgame? 

The Neo is more than a lower-cost Apple notebook. It’s a hugely disruptive product that is already driving noteworthy change across the PC industry; it’s forcing competitors to make difficult choices between cost and price — even as they grapple with the existential challenges of memory shortages, component price hikes, and raw materials costs. 

That’s not bad for a product that costs your local school just $499.

Just a reminder: the original $399 iPod cost only slightly less when it was first introduced, before subsequently disrupting the music industry.

You can follow me on social media! Join me on BlueSky,  LinkedIn, Mastodon, and follow The Core.

Nvidia’s RTX Spark could give PC makers a new high-end category, built around machines that run more demanding AI workloads locally rather than in the cloud.

The chipmaker and Microsoft said RTX Spark Windows PCs will be built for personal AI agents and heavier local AI workloads, from AI development to engineering and content creation.

Nvidia said RTX Spark will offer up to 1 petaflop of AI performance and up to 128GB of unified memory, allowing systems to run 120-billion-parameter large language models locally.

Nvidia has lined up several major PC makers for the launch. The company said RTX Spark laptops and compact desktops will be available this fall from Asus, Dell, HP, Lenovo, Microsoft Surface, and MSI, with models from Acer and Gigabyte to follow. Dell is bringing the platform to its XPS 16 Creator Edition, while HP said upcoming OmniBooks powered by Nvidia will target agentic developers. Microsoft is positioning its Surface Laptop Ultra for creators, developers, and engineers.

Microsoft is also introducing the Surface RTX Spark Dev Box, a compact Windows AI developer PC designed to let developers build and refine models locally before turning to the cloud for larger workloads.

That could create a premium tier above mainstream AI PCs based on Intel, AMD and Qualcomm chips, helping lift average selling prices in a PC market where growth has been uneven. It could also raise questions about whether current AI PCs have enough local computing power for the more ambitious AI workloads that software makers and chip companies are now promoting.

But broad enterprise adoption is not assured. According to Futurum Research, the AI PC market could grow at a compound annual growth rate of about 38% between 2025 and 2030, but adoption is likely to slow in 2026 after a Windows 10 end-of-support-driven refresh cycle and normalize through 2027.

Futurum expects another wave of upgrades around 2028, as systems with higher levels of on-device AI compute become capable of running agentic AI workloads locally, suggesting RTX Spark’s early impact may be felt more in premium and specialist systems than in broad corporate fleets.

Adoption potential

Analysts say RTX Spark’s first test will be whether enterprises treat local AI compute as a workstation requirement rather than a standard laptop feature.

“In the near term, RTX Spark is more likely to be a high-end enterprise AI workstation category than a mass-market PC category,” said Pareekh Jain, CEO of Pareekh Consulting. “Most enterprise users do not need the level of local AI compute that RTX Spark offers.”

Jain said the platform could establish a premium tier between traditional workstations and AI servers, similar to how gaming GPUs created a premium PC segment. Its longer-term significance, he said, may lie less in unit volumes than in whether it becomes a reference architecture for AI-native workstations that can run large models on-device with strong security and low latency.

Prabhu Ram, VP of the industry research group at Cybermedia Research, said RTX Spark adoption would start in niche segments but could expand over the next two to three years if the software vision materializes. Its prospects will depend on post-launch performance, real-world pricing, and early enterprise pilot results, he said.

Ram added that OEM uptake would be the clearest early signal of whether RTX Spark is becoming a real enterprise category rather than a niche workstation product.

Cost and competition

The clearest near-term effect may be at the high end of the PC market, where RTX Spark could give vendors a more powerful class of AI system to sell above mainstream business laptops.

Jain said RTX Spark systems, which he expects to cost more than $2,000, are designed for heavier local AI workloads, including large language models and advanced content creation. By contrast, he said mainstream AI PCs based on Intel, AMD and Qualcomm chips are typically priced below $1,500 and are aimed more at Copilot+, summarization and other office productivity tasks.

That split could raise enterprise PC spending for power users, while making mainstream AI PCs look more like productivity devices, Jain said. Over time, it could increase pressure on Intel, AMD and Qualcomm to add more AI capabilities at lower price points.

But the immediate impact may not be on demand for mainstream PCs based on Qualcomm, Intel or AMD chips, according to Neil Shah, vice president for research and partner at Counterpoint Research. He said the more likely scenario is that RTX Spark may create a new segment that competes more directly with gaming PCs, Apple’s Mac Mini, and higher-end Macs used for on-device AI applications.

Who needs RTX Spark?

Analysts said RTX Spark-class systems are likely to be justified only where running AI locally has clear business value.

Sanchit Vir Gogia, chief analyst at Greyhound Research, said the test for enterprises is not whether a workload uses AI, but whether the organization gains by running that AI closer to the user, data, device or operating environment.

“If the work is meeting summaries, drafting, email triage, transcription, translation, search and ordinary assistance, Spark is unnecessary and a mainstream AI PC will do,” Gogia said. “Issuing Spark to every employee for that would be sending a Formula One car to fetch the milk.”

Gogia said likely early users include software developers, AI engineers, data scientists and security teams working with sensitive code, larger models, forensic data or local retrieval pipelines that companies may not want to move into external systems.

The security question could also shape adoption. Nvidia said the platform will rely on new Windows security tools and its OpenShell runtime, allowing companies to set policies for agents while keeping some queries on local models and masking personal data before selected queries are sent to cloud services.

“Nvidia is not only selling endpoint hardware,” Gogia said. “It is installing itself into the endpoint’s runtime, its policy layer and its agent orchestration. The endpoint conversation has quietly expanded from endpoint hardware to endpoint agency, and that is a CISO question long before it is a procurement one.”

Manish Rawat, analyst at TechInsights, said local AI compute could support faster development cycles, stronger privacy and lower cloud inference costs, while enabling workloads such as 12K video editing, simulations, digital twins and edge AI applications.

“CIOs should buy Spark where the workload justifies it, where the governance model supports it, and where the economics hold, and nowhere else,” Gogia added.

Cybersecurity researchers have disclosed details of an unpatched issue that could be exploited to disclose a user's NTLMv2 hash to the attacker. Like in the case of CVE-2026-33829, which impacted the Windows Snipping Tool's ms-screensketch: URI handler, the newly flagged issue resides in the search: URI handler, per Huntress. CVE-2026-33829 refers to a spoofing vulnerability that could expose Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

European and international law enforcement agencies have dismantled nine organized crime groups and arrested 29 suspects in a major crackdown on illegal streaming operations. [...]

One of the best parts about using Android is the good old-fashioned geeky fun that comes with finding new ways to improve your digital environment — and improve your day-to-day efficiency.

That capability manifests itself in all sorts of interesting freedoms that (cough, cough) other mobile platforms don’t trust their users enough to allow — from added on-screen elements to custom air gestures, advanced multitasking additions, and all sorts of other shape-shifting enhancements that can completely change the way you interact with your device.

Perhaps the most classic example of advanced Android customization, though, is a splendid little somethin’ called the home screen launcher — a fancy way of saying the system that controls how your home screen and app drawer look and work. Your phone has a built-in process that handles that by default, but here in the land o’ Googley matters, you can always replace that with something completely different and make your device adapt to the way you like to work instead of the other way around.

We’ve got no shortage of interesting Android launcher options, too, ranging from versatile blank slates for complete customization to carefully crafted frameworks for ergonomic efficiency and even throwbacks to mobile operating systems past.

The real beauty of this ecosystem, though, is how much power it gives to Android developers — and subsequently to us, as Android-appreciating animals who embrace these creations! — to experiment and try out all sorts of new concepts. Sometimes, an Android launcher approach speaks to you for its practicality. Other times, it’s just a refreshingly interesting take on how you can get around your phone and get stuff done.

Today, I’ve got a perfect example to share with you. It’s a whole new approach to the Android home screen that’s both unlike anything else I’ve ever seen in this arena and delightfully familiar, in a retro-tech sense.

Lemme show ya what it’s all about.

[Get fresh Googley goodness in your inbox with my free Android Intelligence newsletter — three new things to try every Friday.]

The T9 Android launcher — with a modern twist

My friend and fellow enlightened Android phone owner, allow me to introduce you to a creative little concoction called Key Launcher.

Key Launcher has only been out and available on the Play Store for a matter of weeks now, but it’s impressively polished — and, even more important, impressively original while also having some fantastic geek-tech throwback vibes.

To that end, the core distinctive element of Key Launcher is the T9-style dialpad that sits front and center on the lower third of its primary panel. It is quite literally the same set of letter-packin’ numbers and characters you’d see on an old-school phone — or in the dialer of your favorite Android phone app.

width="1024" height="1022" sizes="auto, (max-width: 1024px) 100vw, 1024px">The T9 keypad is the centerpiece of the Key Launcher Android home screen experience.

JR Raphael, Foundry

And in this context, it serves some pretty interesting purposes:

• In true T9 style, you can find and access any app or contact on your phone simply by tapping the letter that corresponds with its name — and if you want to narrow down the list even further, you can keep typing letters to refine the results.
• You can long-press any number to create and then access a custom “super shortcut” — anything from a single specific action (opening a particular app or calling or texting a certain contact) to launching a group or category of apps or contacts, launching an on-demand pop-up widget or swipeable stack of widgets, or even launching a pre-filled search query.

One press, and poof: Any widget you want — or series of swipeable widgets, even — is right there and ready.

JR Raphael, Foundry

• If you tap the # key (known as “pound” in this context — not “hashtag” — for any non-olds among us), you can set up and then access a special “vault” area, where apps are hidden and only visible and accessible with authentication.
• And, in an especially nifty touch, you can also just use the dialpad as an actual dialpad — to punch in any number you want to text or call, even if it isn’t already in your contacts.

Your phone dialer is always right in front of you with Key Launcher as your home screen.

JR Raphael, Foundry

Function-packed as all of that may be, that dialpad is still just one piece of the Key Launcher puzzle. Above it sits a grid of app shortcuts that includes both your own pinned favorites and a dynamic selection of recently opened items. And above that is a handy built-in widget that shows a rotating array of upcoming calendar events from your agenda along with the local time and weather — and, in an especially neat twist, can also be customized to act as an interactive stack that lets you flip through your own set of standard Android widgets right then and there as well.

Key Launcher’s primary widget spot can be configured to hold numerous widgets in a swipeable stack.

JR Raphael, Foundry

Speaking of widgets, if you swipe toward the left on Key Launcher’s dialpad, you’ll reveal the launcher’s built-in “Widget Center” panel — which is an entire screen dedicated to holding however many widgets you want, in any configuration you like, for easy ongoing access.

The Widget Center is another interesting way to access widgets within Key Launcher.

JR Raphael, Foundry

A swipe in the other direction will take you to an enlarged view of your active notifications, meanwhile, while a swipe downward can be set to launch either a quick search (of Google or whatever provider you prefer), a search of your apps, or a direct Android app shortcut within any app on your device.

Swiping down on your home screen can trigger a shortcut of your choice.

JR Raphael, Foundry

And if all of that seems like a lot of productivity-boosting possibilities, just wait ’til you get into this thing’s settings. Key Launcher is overflowing with options to customize and control practically every facet of its operation, ranging from basic visuals to the specifics of how the dialpad works and even a toggle for optimizing the interface for left- or right-handed use.

Key Launcher is no slouch when it comes to settings.

JR Raphael, Foundry

Key Launcher is free on its base level with an optional Pro upgrade that unlocks certain limitations and more advanced features. That path is available for five bucks a year or $10 as a single lifetime purchase, and you get a month-long trial the first time you install the app so you can check it out in its full form.

The Pro path adds in lots of extras, but even Key Launcher’s free version is quite pleasant and functional.

JR Raphael, Foundry

Even if you just stick to the free version, though, this thing has an awful lot to offer — and it really is unlike anything else out there, with so many clever and potentially useful touches.

It’s that kind of creativity and constant discovery that keeps Android so interesting and advantageous, even after all this time — and that’s true whether you end up sticking with Key Launcher for the long haul or just giving it a go for a few hours and appreciating the deliciously original thinking it offers.

Keep the geeky goodies coming with my free Android Intelligence newsletter — three new things to try every Friday, straight from me to you.

Google is introducing a new Android security feature that will detect and flag phone calls in which scammers use artificial intelligence to impersonate a user's personal contacts. [...]

In April 2026, we discovered a new malware campaign targeting players of “hentai” games. Once launched, the infected games install a previously unknown malicious implant on the user’s machine. After a few days, the implant downloads and executes a Trojan, resulting in full system compromise and broad remote control capabilities for the attackers. We dubbed this malware family “Argamal”.

The malware uses COM hijacking to persist on the victim’s machine, replacing the InprocServer32 entry for Windows Color System Calibration Loader DLL. This task is triggered when the user logs in, effectively allowing the malware to run at startup.

Kaspersky solutions detect this threat as Trojan.Win32.Termixia.*, Trojan.Win32.Agent.*, HEUR:Trojan.Win32.Argamal.gen and HEUR:Trojan-Downloader.Win32.Argamal.gen.

Technical details Background

In April, as part of our ongoing monitoring of telemetry data, we found some suspicious DLLs. Further analysis revealed that various versions of these DLLs have existed since at least 2024.

The DLLs were spawned by different games written using various game engines and programming languages, including RenPy (Python) and RPG Maker MV (JavaScript), among others. However, they all had one thing in common: they were all hentai games. We searched for the distribution sources and found a number of websites hosting game screenshots and download links. These links redirected users to PixelDrain, a free file transfer service.

Adult games catalogue

In addition to these websites, the trojanized games have also been distributed via different torrent trackers, including AniRena.

Malicious game torrent in AniRena

Delivery

Both the dedicated websites and torrents delivered an archive containing the infected game.

Contents of the game archive

This archive contained fully functional, legitimate game files, as well as a modified FFmpeg DLL (SHA1: 42add9475e67a1ccc6a6af94b5475d3defc01b85), that imported the DllGetClassObject function from a file called natives2_blob.bin. Since the game needs ffmpeg.dll to run properly, the library loads as soon as the user starts the game.

Script executor

The natives2_blob.bin (SHA1: edce72f59e4c1d136cd1946af70d334c19df858d) file is a DLL that executes a Base64-encoded PowerShell script when loaded.

The natives2_blob.bin file code

This PowerShell script, which we’ll call Stage1, performs basic checks for controlled environments. For example, it checks for the Sandboxie folder in Program Files and Procmon64 in the process list. If all the checks indicate that the process is not running in a controlled environment, it proceeds to establish persistence.

Stage1 sets the MI_V environment variable (and also MI_V2 in the new versions of malware) for the current user to another Base64-encoded PowerShell script, which we’ll call Stage2. After that, it sets the InprocServer32 registry key at HKCU\SOFTWARE\Classes\CLSID\{722D0F89-B69C-4700-AE8C-4A44350E4876} to a random DLL file name in a random subdirectory of %USER%\AppData\Local, as well as the ShellFolder subkey to another random DLL file name in the same location. Stage1 also creates a scheduled task that will execute three days later. This task executes Stage2 and runs once.

Stage2 is a payload downloader script. It takes previously generated DLL filenames from the registry and downloads an encrypted payload called zaesdl.dat from GitHub using bitsadmin.exe. The downloaded payload is saved in the settings.dat file in the randomly chosen subdirectory of %USER%\AppData\Local. Stage2 decrypts it using AES-CBC with the key zbcd1j9234r670eh and an IV equal to the key. The decrypted payload is then saved in the DLL file specified in the ShellFolder registry subkey.

The decrypted payload is set as InprocServer32 at HKCU\SOFTWARE\Classes\CLSID\{B210D694-C8DF-490D-9576-9E20CDBC20BD}, which is a COM object used by the \Microsoft\Windows\WindowsColorSystem\Calibration Loader scheduled task. This task runs every time a user logs in, allowing the malware to run during every user session.

Before quitting, Stage2 also removes the changes made under the HKCU\SOFTWARE\Classes\CLSID\{722D0F89-B69C-4700-AE8C-4A44350E4876} registry key, unsets the MI_V environment variable (and MI_V2 in newer versions), and removes the scheduled task that launched Stage2.

Malicious agent

Early payload versions decrypted themselves using the 0xB0C1D4E9 rolling XOR key, where the decryption key for the i + 1 block is the encrypted content of the i block (each encrypted block being four bytes long). The most recent agent versions don’t do that.

The samples we found had string encryption; they use a simple substitution with a key that corresponds position-by-position to the following alphabet: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789@#$./:<>*&~. The decryption process involves finding the position of each symbol of the encrypted strings in the key, and replacing it with the symbol that occupies the same position in the alphabet.
During our investigation, we found the following keys were used:

• 17htUno/I3L&fK2H#yapE@b5NqZ$Q4xmeF.s96uB>jkdWCPvAgD*XwO:iR~TMrV0YGl8z<JSc
• 71htUno/I3L&fK2H#aypE@b5NqZ$Q4xmeF.s96uB>jdkWCPvAgD*XwO:iR~TMrV0YGl8z<JSc
• E1hUtno/IL3&fK2H#ypa7@b5NqZ$Q4xmeF.s69uB>jkdWCvPAgD*XwO:iR~TrMV0YGl8z<JcS

All symbols not used in the key remain unchanged.

String decryption

The payload checks for the presence of the following security solutions using the output of the tasklist command:

• Kaspersky
• Avast
• McAfee
• BitDefender
• MalwareBytes
• +36 other solutions

Security solution detection logic

The payload itself is a RAT with broad functionality. The default C2 server is asper1[.]freeddns[.]org for earlier versions and Winst0[.]kozow[.]com for the latest versions of the payload. Both domains point to 186[.]158.223.35. We also saw another IP address for the first C2 in pDNS records, though we haven’t actually seen it in use. The C2 address can change based on a C2 reply or when certain conditions are met. For example, if the user’s default locale is set to “zh-CN”, the RAT sets its C2 address to country1[.]ignorelist[.]com. During most of our investigation, this domain pointed to 127[.]0.0.1, but starting April 26, it has been pointing to 186[.]158.223.35 as well.

The payload sends UDP heartbeats to port 57441 of the C2 server. These heartbeats contain information about detected security solutions, system startup time, time since last input activity, architecture info, machine IP address and username.

The C2 may respond to the heartbeat. Based on this response, the payload can perform different actions. Below is the full list of available commands.

Response first byte Description 0x31 Run DLL on the system 0x57 Send UDP request to the specified address 0x55 Open file or link from the response 0x50 Collect information about the infected system (e.g. process list and architecture) 0x53 Execute command from the response using ShellExecuteW 0x52 Run the file specified in the response using WinExec 0x42 Delete the file specified in the response 0x41 Update C2 domain 0x59 Get new payload: connect to C2 port 63559/UDP, get new DLL and update COM path in the registry

The C2 can also set a flag in the response that will turn on the extended RAT mode. In this mode, the payload communicates with the C2 server using the 3747/tcp port.

TCP communications are encrypted using a simple substitution cipher. Each character is replaced using a fixed mapping defined by the key:

koP]Y4Os-_t?cB',aK.Wm>QM2[U!^C`*@Ff:X\6Dp8H%ATydE<e(#G&LhwRZ5znjJqgNrl)I7V$3=910"+Svxi/;ub

This key corresponds position-by-position to the standard ASCII character sequence:

!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}

In other words, each character in the ASCII set is replaced by the corresponding character in the key string.

C2 requests and responses are divided into two parts by the first space character. The first part is a command and the second part is usually an argument.
After connecting and before receiving information from the C2, the malware sends metadata about the infected machine using the NOOP command. This metadata includes a run cycle counter, mounted drive metadata, time since the last input activity and data about the display settings.

Based on the C2 command, the malware can execute commands on the infected machine, perform reboot and shutdown actions, control the cursor, take screenshots, compress files into archives, and send files to other specified servers. In short, it can fully control the machine. The full list of commands is as follows:

System control

• KILL REBOOT: Reboots the infected system
• KILL POWER: Shuts down the infected system
• KILL SELF: Same as the QUIT command (described below)
• KILL ME: Exits process running the malware

Surveillance

• SCREEN / SCREEN9: makes a screenshot, saves it to the ~wra1269.tmp file and sends it to the C2

File operations

• DELETE <filename>: deletes specified file
• DELDIR <dirname>: deletes specified directory
• REN <file path 1>#<file path 2>: moves specified file
• MAKDIR <path>: creates directory
• ZIPFILE <file or folder name> / ZIPFOLDER <file or folder name>: compresses specified file/folder into a .zip archive
• TAR <file or folder name> / TAR2 <file or folder name>: compresses specified file/folder into a .tar archive
• GETFILEDATE <filename>: sends file’s last modification date
• SETFILEDATE <filename>: sets file’s last modification date
• GETFILEACC <filename>: sends file’s last access date
• DWLOAD <filename>: sends file to the C2
• UPLOAD <filename>#<C2 address>: uploads file to the specified C2 server

Reconnaissance

• USER: sends username
• KALIVE: sends run cycle counter
• IDLE: sends number of seconds passed since last input activity
• DRIVES: sends information about mounted drives
• FOLDEX <folder type>: sends full path to a directory of the specified type:
• – type = 0x63: temporary directory
• – type = 0x64: \Google\Chrome\User Data\Default\ in AppData\Local folder
• – type = 0x65: \Downloads\ in user home directory
• – type = 0x66: \Microsoft\Excel\XLSTART\ in AppData folder
• – type = 0x67: AppData folder
• LFILES <folder path>: lists and sends paths to all files in the directory
• OSVER: sends information about user, hostname, OS architecture and version
• COMPILERDATE: sends constant hardcoded in the RAT, e.g., 25.10.2025

Generic control

• DSOCKE: recreates TCP keep-alive socket
• QUIT: notifies the C2 about quitting, closes the socket and stops the process
• RUNHID <command> / RUN <command>: runs specified command inside ShellExecuteW
• RUNDOS <command>: runs specified command inside CreateProcessW
• RUNTASK <command>: creates, runs and deletes task that executes specified command
• SKEY <key code>: presses specified key
• MOUSE FREEZE: freezes mouse movement
• MOUSE <command>: clicks the specified mouse button or sets the cursor position to the specified coordinates

Other delivery methods

During our research, we also observed other delivery methods for the RAT. Instead of patching FFmpeg and downloading the payload from GitHub, the attackers included the main payload as libpython64.dat or another file with a similar name in the lib\py3-windows-x86_64 directory of the game. This .dat file was loaded by one of the libraries used in the game, which was patched for this purpose.

In another case, the threat actor posted their malicious DLL file (payload downloader) on a gaming forum, disguising it as a cheat.

Infrastructure

Our research revealed the following infrastructure was used in this attack.

Domain IP First seen ASN asper1[.]freeddns[.]org 181[.]116.218.56 September 16, 2024 11664 186[.]158.223.35 July 01, 2025 11664 country1[.]ignorelist[.]com 186[.]158.223.35 September 10, 2025 11664 127[.]0.0.1 November 11, 2025 – Winst0.kozow[.]com 186[.]158.223.35 April 26, 2026 11664 Victims

According to our telemetry, hundreds of individuals were infected with this malware. The majority of the victims were located in Russia, Brazil, Germany and Vietnam.

Distribution of victims (download)

Attribution

Based on the language of the comments in the code, infrastructure data and other facts we assess with medium confidence that the developer of the downloader chain speaks Spanish.

The actor behind this attack uses Spanish in variable names and comments. For example, the Base64-decoded delivery script contains the following lines:

Part of the PowerShell script used in the payload delivery

In addition, the JavaScript code from the website distributing infected games contains variable names, function names and comments in Spanish:

JavaScript code from the malicious site

Notably, the malware payloads used in this attack had previously chosen 127.0.0.1 as their C2 server when the victim’s default locale is set to “zh-CN”, thus not targeting Chinese users. This may indicate that the attacker is associated with a Chinese-speaking threat actor or uses payloads developed by a Chinese-speaking threat actor. However, we still believe it’s unlikely that the developer of these delivery chains is Chinese-speaking.

Conclusions

The Argamal Trojan is a new RAT targeting individuals who seek adult games. During our analysis, we observed a steady stream of updates to the payload, including the addition of new features and fixes for various bugs, as well as changes to the infrastructure. This leads us to believe that the threat actor behind this malware will continue to develop and enhance it. The campaign’s goal is likely data and credential theft; however, the RAT enables the attacker to take full control of the device and execute any malicious activity they want.

Creating malware in today’s development landscape has become significantly easier thanks to the wide availability of detailed guides, tooling, and automation resources. As a result, it is crucial not only to detect known malware but also to identify new and evolving threats as they emerge. Kaspersky solutions prevented the malicious activity in the earliest stages of the attack. The solutions help ensure device security by identifying not only known threats but also the behavior of the software and its actions, providing comprehensive protection against malware.

Indicators of Compromise

File hashes
RAT payloads:
76253fb55aed707440e808ea78e7101318436b1c
1405a3c5e0aeb08012484134e16cdec4ab29b4a4
535f4337f261b6da20a3c614eb13270bed2d533a
d2cb0d7a9ad2b5d4ea7c2da8aec62beb37cf36d6
e05f1767c2a337910ed75e90288838d6d0541164
dad26f61da7b8bccc78364411812be74c025b475
29f1d346a6e71774c7dad25b90f446b2974393df
e815a9b418d09c2d4bcd074c2c0bc21406eeb22f
17f8f8f34dfa737f36182fed7ff9e9814a114058
954722b0c9c678b1313d1f8b204e102842dc5889
69331cfdac792dc79240e6a6bb6e803eabd70beb
901cfa97b1baaf908fd4a02bb52d970f576c4193
5f1f3689bcf23de1b280b5f35712946da0f7978f
c2d9d48b3b10bd58cdf5df9463e3ffcd60533ff3
2423a5bf0fa7cb9ec09211630a5488629499691b
ae4601a19d28332a3ec6ac31b385cdf53be53450

Trojan downloaders:
9803604ec45f31f9ef75bcca1e1310d8ac1fc3a6
edce72f59e4c1d136cd1946af70d334c19df858d
02819d200d1424882af81cb504b3e8614b32397a

Domains and IPs
asper1[.]freeddns[.]org
Winst0[.]kozow[.]com
Country1[.]ignorelist[.]com
186[.]158.223.35

GitHub repositories used in the campaign
hxxps://github[.]com/gmz159/u
hxxps://github[.]com/DnyP/files
hxxps://github[.]com/mgzv/p

Cybersecurity researchers have discovered a remote denial-of-service exploit that affects major web servers, including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora. The vulnerability has been codenamed HTTP/2 Bomb by Calif. "The vulnerable behavior exists in each server's default HTTP/2 configuration," the company said, adding it was discovered by OpenAI Codex by chaining Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

A security researcher has released exploit code for a Visual Studio Code (VS Code) zero-day vulnerability that allows attackers to steal GitHub authentication tokens by tricking users into clicking a link. [...]

Cybersecurity researchers have flagged a new campaign targeting Minecraft players via YouTube to spread malware capable of gaining control of victims' systems. The Minecraft-focused malware-as-a-service (MaaS) campaign has been codenamed Weedhack by McAfee Labs, stating the activity has been active since January 2026 and impersonates Minecraft clients and mods to infect users. In all, 3820 Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Cloud computing has reached a crossroads. The high cost and data sensitivity of AI workloads are raising the appeal of private clouds, even as neoclouds and sovereign clouds shake up the cloud provider landscape. New cyberthreats, shifting compute requirements, and management complexity are adding to cloud complications.

Download the June 2026 issue of the Enterprise Spotlight from the editors of CIO, Computerworld, CSO, InfoWorld, and Network World, and learn how to navigate the latest cloud strategy developments.

Microsoft announced today at its Build 2026 developer conference the release of Coreutils for Windows, bringing many commonly used Linux command-line utilities to Windows as native applications. [...]

OpenAI says it's rolling out a new update that improves the existing GPT-5.5 Instant model, and this move comes ahead of the scheduled retirement of multiple legacy models, including o3. [...]

Hackers are exploiting a critical privilege escalation vulnerability (CVE-2026-8206) in the Kirki plugin for WordPress to take over any user account, including those belonging to administrators. [...]