NewApp Digest
search bot

Additional layer of protection

Microsoft: New Windows LNK spoofing issues aren't vulnerabilities
Winsage
February 13, 2026

Microsoft: New Windows LNK spoofing issues aren’t vulnerabilities

Security researcher Wietze Beukema revealed vulnerabilities in Windows LK shortcut files at the Wild West Hackin' Fest, which could allow attackers to deploy harmful payloads. He identified four undocumented techniques that manipulate these shortcut files, obscuring malicious targets from users. The vulnerabilities exploit inconsistencies in how Windows Explorer handles conflicting target paths, allowing for deceptive file properties. One technique involves using forbidden Windows path characters to create misleading paths, while another manipulates LinkTargetIDList values. The most sophisticated method alters the EnvironmentVariableDataBlock structure to present a false target in the properties window while executing malicious commands in the background. Microsoft declined to classify the EnvironmentVariableDataBlock issue as a security vulnerability, stating that exploitation requires user interaction and does not breach security boundaries. They emphasized that Windows recognizes shortcut files as potentially dangerous and provides warnings when opening them. However, Beukema noted that users often ignore these warnings. The vulnerabilities share similarities with CVE-2025-9491, which has been exploited by various state-sponsored and cybercrime groups. Microsoft initially did not address CVE-2025-9491 but later modified LNK files to mitigate the vulnerability after it was widely exploited.
Office sandbox file security to disappear from enterprise Windows by late 2027, Microsoft confirms
Winsage
November 6, 2025

Office sandbox file security to disappear from enterprise Windows by late 2027, Microsoft confirms

A phased removal schedule for Office version 2612 has been established, with the Current Channel's full removal by December 2026, the Monthly Enterprise Channel by February 2027, and the Semi-Annual Enterprise Channel by July 2027. A final removal date is set for December 2027 for customers with extended support licenses. Additionally, MDAG (Malware Detection and Guard) has been introduced to enhance security by using a Hyper-V sandbox for file execution, isolating potential malware from the operating system. However, this may result in slower document load times, impacting productivity.
China-Linked Hackers Exploit Windows Shortcut Flaw to Target European Diplomats
Winsage
October 31, 2025

China-Linked Hackers Exploit Windows Shortcut Flaw to Target European Diplomats

A China-affiliated threat actor, UNC6384, has been conducting cyber attacks targeting diplomatic and governmental entities in Europe, including Hungary, Belgium, Italy, the Netherlands, and Serbia. These attacks exploit an unpatched Windows shortcut vulnerability (CVE-2025-9491) through spear-phishing emails that appear relevant to diplomatic events. The emails deliver malicious LNK files that deploy PlugX malware via DLL side-loading. PlugX is a remote access trojan that allows extensive control over compromised systems and has been linked to another hacking group, Mustang Panda. Microsoft Defender can detect these attacks, and Smart App Control provides additional protection. The LNK file executes a PowerShell command to extract a TAR archive containing a legitimate utility, a malicious DLL, and an encrypted PlugX payload. The size of the malicious artifacts has decreased significantly, indicating ongoing evolution. UNC6384 has also begun using HTML Application files to load external JavaScript for retrieving malicious payloads, aligning with Chinese intelligence objectives regarding European defense policies.
The Outer Worlds 2 zyranium gas explained and how to protect yourself
AppWizard
October 25, 2025

The Outer Worlds 2 zyranium gas explained and how to protect yourself

Eden and Arcadia in The Outer Worlds 2 present challenges including combat with Raptidons and the environmental hazard of zyranium gas, which can be lethal upon contact. Players must find alternative routes to complete the quest The Saboteur of Paradise due to the presence of zyranium gas on the west coast bridge. Zyranium gas appears as fine particles or viscous pools that cause gradual poisoning or immediate death if contacted. Players need to complete the Zyranium Collector side quest to obtain the Gas-Energy Deflection Apparatus, which provides temporary protection against zyranium gas but depletes quickly when running through it. The Zyranium Collector quest involves gathering components for Chief Deviser Delphinia Bryant at the Euphoria Coast Automech Repair Center, which is accessed by acquiring a pass from the Ministry of Accuracy. Players must engage in specific dialogue options to assist Delphinia and gather samples from a zyranium cloud. After obtaining a catalytic amplifier from Chief Mechanist Woodrow Contos, players return to Delphinia to finalize the Gas-Energy Deflection Apparatus, enabling safe navigation through zyranium gas areas.
This devious Android malware spoofs WhatsApp, TikTok and more - here's how to stay safe
AppWizard
October 10, 2025

This devious Android malware spoofs WhatsApp, TikTok and more – here’s how to stay safe

A new strain of malware called ClayRat has emerged, targeting Android users, particularly in Russia, by disguising itself as popular applications like WhatsApp, TikTok, Google Photos, and YouTube. It exploits SMS handler capabilities to gain access to sensitive information without user consent and spreads through the victim's contact list. Over 600 variants of ClayRat have been identified. Users are advised to download apps only from trusted sources, check app legitimacy through reviews, use antivirus tools, and manage app permissions to protect personal data.
3 apps that are saying 'no' to Microsoft's invasive Recall tool, and how you can too
Winsage
August 9, 2025

3 apps that are saying ‘no’ to Microsoft’s invasive Recall tool, and how you can too

Microsoft's Recall tool is currently available only on Copilot+ PCs, and users can easily disable it. There are concerns that Recall may become an integral part of Windows, limiting user control. Signal has developed a workaround to prevent Recall from capturing data by enabling screen security, which uses Microsoft's DRM to keep its windows blank during screenshots. Brave has implemented a similar strategy by labeling every browser window as a private browsing session, preventing Recall access while allowing screenshots. AdGuard has updated its functionality to specifically target Recall, providing an additional layer of protection for users concerned about data privacy.
Search