NewApp Digest
search bot

bypass

Microsoft Dismantles Fox Tempest: Ransomware Groups Paid Up to $9,500 to Fake Windows Software Signatures
Winsage
May 22, 2026

Microsoft Dismantles Fox Tempest: Ransomware Groups Paid Up to $9,500 to Fake Windows Software Signatures

Microsoft's Digital Crimes Unit has filed a lawsuit against Fox Tempest, a criminal enterprise selling fraudulently signed malware to ransomware groups, affecting hospitals, schools, and critical infrastructure in ten countries. The lawsuit was filed on May 19 in the U.S. District Court for the Southern District of New York. Fox Tempest created a portal at signspace[.]cloud, offering a user-friendly interface for uploading malicious files and generating over 580 fraudulent Microsoft accounts to bypass identity verification. The group provided pre-configured virtual machines for customers to upload malicious payloads in exchange for signed binaries. Fox Tempest's operations were linked to a ransomware attack chain involving a counterfeit Microsoft Teams installer that deployed the Rhysida ransomware. This ransomware strain has caused significant breaches, including an October 2023 attack on the British Library, which resulted in a data exfiltration of about 600GB and recovery costs of £6 to £7 million, and a September 2024 attack on Seattle-Tacoma International Airport with a ransom demand of .8 million. Microsoft's civil litigation approach allowed for a quicker legal process, leading to the seizure of the signspace[.]cloud domain and the suspension of around 1,000 Fox Tempest accounts. Despite these actions, Fox Tempest has begun shifting to alternative code-signing services, highlighting the evolving nature of cybercrime and the need for users to verify software through independent channels. The confirmed targets of Fox Tempest included organizations in the United States, France, India, China, Brazil, Germany, Japan, the United Kingdom, Italy, and Spain.
Microsoft says public sharing of Windows 11 vulnerability violates 'best practices'
Winsage
May 22, 2026

Microsoft says public sharing of Windows 11 vulnerability violates ‘best practices’

A security researcher known as Nightmare-Eclipse revealed a vulnerability in Windows 11, named YellowKey, which allows attackers to access BitLocker-encrypted drives through the Windows Recovery Environment. Microsoft acknowledged the vulnerability, assigned it the identifier CVE-2026-45585, and criticized the public sharing of its proof of concept. Currently, there is no patch available for the BitLocker bypass, but physical access to the device provides some protection. The vulnerability does not exist in Windows 10 due to differences in the Windows Recovery Environment. The attack requires a stolen Windows 11 laptop and a USB stick, and the vulnerable filesystems include NTFS, FAT32, and exFAT. Nightmare-Eclipse speculated that the bypass may function as a backdoor, while Microsoft referred to it as a "security feature bypass vulnerability."
Microsoft Defender Zero-Day Vulnerabilities RedSun and UnDefend Actively Exploited on Windows 10, 11, and Server (April 2026 CVE Analysis)
Winsage
May 21, 2026

Microsoft Defender Zero-Day Vulnerabilities RedSun and UnDefend Actively Exploited on Windows 10, 11, and Server (April 2026 CVE Analysis)

In April 2026, two zero-day vulnerabilities, RedSun and UnDefend, were discovered in Microsoft Defender, affecting Windows 10, Windows 11, and Windows Server platforms. These vulnerabilities allow attackers to escalate privileges to SYSTEM and bypass Defender’s protections. RedSun exploits a flaw in Defender's remediation process, enabling low-privileged users to overwrite critical system files. UnDefend allows attackers to disrupt Defender’s updates, keeping it outdated and ineffective. Both vulnerabilities are actively being exploited, with attackers leveraging them to gain persistent access and deploy ransomware. The primary targets are organizations using Windows systems with Defender enabled, particularly in sectors like finance, healthcare, and government. Mitigation strategies include applying updates for related vulnerabilities, monitoring for suspicious activities, and implementing additional security measures.
A digital iron curtain? How an app is bolting Russia shut | Aleksanteri Institute
AppWizard
May 21, 2026

A digital iron curtain? How an app is bolting Russia shut | Aleksanteri Institute

Max is a domestic app developed by the Russian regime to assert control over the digital landscape, yet its creation reveals a vulnerability as the government fears citizens' access to non-state information. Despite efforts to impose a digital iron curtain, many Russians still use VPNs and messaging platforms like WhatsApp and Telegram. Public protests against restrictions have occurred, showcasing a desire for information access. Max has not gained popularity comparable to established apps, leading to dissatisfaction among pro-Russian supporters. The Kremlin's intensified control has prompted innovative ways for the populace to bypass restrictions, indicating that while the digital iron curtain exists, it has significant weaknesses.
007 First Light рискует оказаться на торрентах до официального релиза
TrendTechie
May 21, 2026

007 First Light рискует оказаться на торрентах до официального релиза

The game 007 First Light is set to launch on May 27, but there are concerns about it being leaked onto torrent sites before its release. Players who pre-order the game can start playing 24 hours earlier than the general public, increasing the risk of piracy. Recent trends show an increase in fully functional pirated versions of major games appearing before their official launches, including titles like Pragmata and Death Stranding 2. There is no confirmed information about the use of the anti-piracy system Denuvo on Steam, and even with such protections, hackers have been able to bypass them. Factors contributing to early availability of game builds to hackers include failures in pre-loading systems and actions by reviewers. Even if a game avoids leaks initially, it is likely to be pirated eventually.
Microsoft shares mitigation for YellowKey Windows zero-day
Winsage
May 20, 2026

Microsoft shares mitigation for YellowKey Windows zero-day

Microsoft has addressed the YellowKey vulnerability, a zero-day flaw in Windows BitLocker identified as CVE-2026-45585. This vulnerability allows unauthorized access to BitLocker-protected drives through a specific exploitation process involving 'FsTx' files. The flaw was disclosed by an anonymous researcher known as 'Nightmare Eclipse.' Microsoft has released mitigation strategies, including removing the autofstx.exe entry from the Session Manager's BootExecute REGMULTISZ value and reestablishing BitLocker trust for WinRE. Additionally, users are advised to change BitLocker settings from "TPM-only" to "TPM+PIN" mode, requiring a pre-boot PIN for drive decryption, and to enable "Require additional authentication at startup" for unencrypted devices.
How To Mitigate The Microsoft Windows BitLocker ‘Angry Hacker’ 0-Day
Winsage
May 20, 2026

How To Mitigate The Microsoft Windows BitLocker ‘Angry Hacker’ 0-Day

Microsoft is addressing a zero-day exploit known as YellowKey, identified as CVE-2026-45585, which allows attackers to bypass BitLocker security using a specially crafted USB device. Following the release of exploit code by a hacker named Chaotic Eclipse, Microsoft has issued urgent mitigation advice. Cybersecurity expert Neena Sharma recommends treating this as an active threat and suggests implementing compensating controls, such as restricting USB boot access, until a patch is available. Microsoft has provided guidance for users to protect their systems, including the recommendation to add a PIN to BitLocker protection to reduce the risk of exploitation. Detailed instructions for adding a PIN are included in the advisory. YellowKey has not yet been exploited in the wild but requires physical access to the device.
silver Android smartphone
AppWizard
May 20, 2026

PC Gamers React to Sony Making Its Narrative Single-Player Games PlayStation Exclusive

Sony is committing to keeping narrative single-player games exclusive to the PlayStation 5, with titles like Saros, Ghost of Yotei, Marvel’s Wolverine, and Intergalactic: The Heretic Prophet confirmed for the platform. Multiplayer titles will still be available on both PC and PlayStation. The PC gaming community has reacted with disappointment, with many gamers expressing indifference toward purchasing a PS5 for a few exclusive titles. Industry analysts speculate that disappointing sales of PlayStation titles on PC and the emergence of the next Xbox may have influenced Sony's decision. Historically, Sony has taken a staggered release approach for its games, while Microsoft has favored simultaneous launches. The rising costs of the PS5 and its games are raising questions about the sustainability of Sony's exclusivity strategy.
Search