advisory Archives

Winsage

April 14, 2026

Microsoft rolls out fast-track to reinstate Windows hardware dev accounts

Microsoft has implemented a fast-track reinstatement process for developers whose Windows Hardware Developer accounts were suspended due to incomplete identity verification. This initiative follows complaints from developers, including those of WireGuard and VeraCrypt, about unexpected account terminations that hindered their ability to publish Windows drivers and updates. Microsoft clarified that the suspensions were communicated to partners since October 2025 and emphasized the importance of identity verification for signing and distributing kernel-level drivers. Developers can expedite their reinstatement by opening a support case with a business justification. Microsoft has also provided guidance for navigating the support workflow and an alternative contact for those facing difficulties.

AppWizard

April 8, 2026

VP Duterte warns public vs individuals posing as her on messaging app

Vice President Sara Duterte has warned the public about individuals impersonating her on messaging platforms. She posted on her Facebook and the Office of the Vice President's official page, advising citizens to be cautious of suspicious messages claiming to be from her. A screenshot of a conversation was included where the impersonator requested a list of supportive congressmen. Duterte emphasized not to engage, share personal information, or send money, stating she does not solicit favors from the public.

AppWizard

April 8, 2026

The FBI Warns That Foreign Cybercriminals Have Targeted Messaging App Users

Cybercriminals connected to Russian intelligence are conducting a large phishing campaign targeting messaging applications, impacting thousands of accounts worldwide. A joint advisory from the FBI and CISA reveals that these attacks focus on individuals with access to sensitive information, including government officials, military personnel, political figures, and journalists. The campaign relies on deception, with attackers impersonating official support channels on platforms like Signal, sending messages that prompt victims to click malicious links or provide confidential information. Victims who comply risk losing control of their accounts, allowing attackers to read private messages and access contact lists. This trend has been observed not only in the U.S. but also in the Netherlands, where similar tactics are used against government employees. The FBI notes that the security of the messaging apps is not the issue; rather, the vulnerability lies in human error. The rise of social engineering tactics poses a risk to both high-profile individuals and potentially everyday users, and users are advised to be cautious with unsolicited messages and not to share sensitive information.

AppWizard

April 1, 2026

NCSC warns of messaging app targeting | National Cyber Security Centre

The National Cyber Security Centre (NCSC) has issued guidelines for individuals vulnerable to targeted attacks via messaging applications, particularly due to increased malicious activities from actors based in Russia. High-risk individuals, such as those with access to sensitive information, are especially susceptible. Past incidents involve state-affiliated groups like APT31 from China, the Russian FSB actor Star Blizzard, and Iran's IRGC targeting government officials. Attackers may use deceptive methods to obtain login codes, add devices to accounts, infiltrate group chats, impersonate contacts, and execute phishing attempts. To mitigate risks, individuals should avoid sharing sensitive information via messaging apps, use corporate services for work-related communications, refrain from sharing verification codes, activate two-step verification, utilize passkeys, regularly review linked devices, stay alert for impersonations, and consider using disappearing messages. The NCSC also provides guidance for enhancing account and device security for high-risk individuals.

Winsage

March 30, 2026

Microsoft’s March Security Update of High-Risk Vulnerability Notice for Multiple Products

On March 11, NSFOCUS CERT reported the release of Microsoft’s March Security Update, addressing 83 security vulnerabilities in products like Windows, Microsoft Office, Microsoft SQL Server, and Azure. The update includes eight critical vulnerabilities and 75 important ones, with risks such as privilege escalation and remote code execution. Key vulnerabilities include: - CVE-2026-26110: Microsoft Office Remote Code Execution Vulnerability (CVSS score: 8.4) - CVE-2026-26113: Microsoft Office Remote Code Execution Vulnerability (CVSS score: 8.4) - CVE-2026-26144: Microsoft Excel Information Disclosure Vulnerability (CVSS score: 7.5) - CVE-2026-23669: Windows Print Spooler Remote Code Execution Vulnerability (CVSS score: 8.8) - CVE-2026-24294: Windows SMB Server Privilege Escalation Vulnerability (CVSS score: 7.8) - CVE-2026-23668: Windows Graphics Component Privilege Escalation Vulnerability (CVSS score: 7.0) Affected product versions include various editions of Microsoft Office, Windows Server 2012 R2, Windows Server 2016, Windows 10, and Windows 11. Microsoft has released security patches for these vulnerabilities, and users are encouraged to install them promptly.

AppWizard

March 25, 2026

FBI warns of Russian, Iranian cyber activity involving messaging platforms

The FBI issued alerts regarding cyber campaigns by Russian and Iranian actors targeting messaging platforms. Russian intelligence services are reportedly infiltrating applications like Signal, leading to unauthorized access of thousands of accounts of U.S. government officials, military personnel, political figures, and journalists. Russian operatives are using phishing messages disguised as support notifications to trick users into providing verification codes or account PINs, potentially allowing attackers to take over accounts. Once compromised, attackers can access messages, contact lists, and launch further phishing attempts. The advisory emphasizes that while Signal is targeted, similar tactics can affect any messaging app. In a separate alert, the FBI highlighted Iran’s Ministry of Intelligence and Security (MOIS) using Telegram to distribute malware aimed at Iranian dissidents and journalists, enabling them to steal sensitive information. This malware often disguises itself as legitimate software and connects to Telegram bots for remote access and data exfiltration. The FBI linked these activities to the Handala Hack group, which claimed responsibility for a recent attack on medical device manufacturer Stryker. The malware can be introduced through social media by hackers posing as technical support. Experts note that the use of Telegram for cyber compromises is increasing, as it helps malicious actors avoid detection by blending their traffic with trusted platforms.

AppWizard

March 23, 2026

FBI Warns of Russian Hackers Targeting Messaging Apps – The Advocate-Messenger

The FBI has issued a warning about phishing campaigns conducted by cyber actors linked to the Russian Intelligence Services (RIS), which target commercial messaging applications (CMAs). These actors have compromised numerous individual accounts, focusing on individuals with significant intelligence value, such as U.S. government officials and journalists, without breaching the encryption of the applications. The campaigns have allowed unauthorized access to private messages, contact lists, and the ability to send deceptive messages. Users of CMAs, especially Signal, are particularly targeted. The phishing tactics involve disguising messages as communications from automated CMA support, leading victims to click malicious links or provide sensitive information. To mitigate risks, users are advised to enhance their cybersecurity measures, remain vigilant, and follow best practices such as scrutinizing links, verifying group chats, and reporting suspicious activity to the Internet Crime Complaint Center or local authorities.

AppWizard

March 23, 2026

Russian hackers hijack thousands of ‘high intelligence’ messaging app accounts, FBI warns

Hackers linked to Russian intelligence are targeting high-profile users of popular messaging applications, according to a warning from the FBI and CISA. The primary targets include U.S. government officials, military personnel, political figures, and journalists. The attackers compromise accounts to access messages and contact lists, allowing for further phishing attempts. Signal users are particularly at risk, though techniques can extend to WhatsApp and Telegram. The hackers use social engineering tactics, impersonating official support accounts to trick users into revealing sensitive information. The FBI and CISA advise users to be cautious of unexpected messages and suspicious links. Victims are encouraged to report incidents to the Internet Crime Complaint Center (IC3).

AppWizard

March 21, 2026

Cyber actors linked to Russia target messaging app users, FBI warns

The United States has issued a warning about cyber actors linked to Russian intelligence targeting users of commercial messaging applications, particularly Signal, compromising thousands of accounts worldwide. The FBI and CISA released a public service announcement detailing the operation's focus on individuals of “high intelligence value,” including U.S. government officials, military personnel, political figures, and journalists. Attackers have not breached the encryption of these platforms but manipulate users into disclosing credentials or linking devices. Russian intelligence-linked actors often pose as official support accounts, creating urgency to obtain security codes. Dutch intelligence agencies also reported a similar campaign targeting Signal and WhatsApp accounts of dignitaries and military personnel. Users are urged to be cautious of suspicious messages and to avoid sharing personal information. Signal reaffirmed that its encryption remains intact, emphasizing that vulnerabilities arise from user behavior rather than technical flaws in the application itself.

Winsage

March 15, 2026

Microsoft Releases Emergency Windows 11 Hotpatch to Fix Remote Code Execution Flaw

Microsoft has released an out-of-band hotpatch update, KB5084597, to address three critical remote code execution vulnerabilities (CVE-2026-25172, CVE-2026-25173, CVE-2026-26111) in the Windows Routing and Remote Access Service (RRAS) management tool. This update is specifically for Windows 11 Enterprise devices in the hotpatch program that did not receive fixes during the March 2026 Patch Tuesday. The vulnerabilities can be exploited by an authenticated attacker within the domain, potentially leading to remote code execution. Hotpatch updates apply fixes through in-memory patching without requiring a device reboot, making them suitable for mission-critical devices. The update is applicable to Windows 11 versions 24H2, 25H2, and Windows 11 Enterprise LTSC 2024, and will be automatically installed on enrolled devices without a restart. Non-enrolled devices received the fix via the standard March 10 Patch Tuesday update.