hacker Archives

Winsage

July 10, 2026

A hacker’s arrest just revealed how Microsoft can track your Windows device

A teenager named Peter Stokes is facing federal charges in Chicago for allegedly hacking a U.S. jewelry retailer while using a VPN to conceal his online activities. Microsoft provided the FBI with data linked to a tracking mechanism called the Global Device Identifier (GDID), which is a unique number assigned to every Windows installation that persists through updates. This identifier allowed authorities to connect Stokes' computer to specific websites, despite his VPN usage. Stokes was arrested in Helsinki in April 2026 while trying to board a flight to Japan, carrying two two-terabyte hard drives. The GDID enabled Microsoft to track Stokes' activities on third-party services, raising concerns about privacy and data tracking.

Winsage

July 10, 2026

StatCounter can’t identify 1 in 5 visits (and it’s skewing everything)

Windows' market share has dropped to 56.61% as of June 2026, falling below the 60% threshold. The "Unknown" category accounts for 21.45% of the market share, while Windows' adjusted market share, excluding unidentified visitors, is 72%. In June 2025, Windows held a 70.13% share, with "Unknown" at 9.17%. Over the past year, Windows' market share decreased from 77.22% to 72%, Linux rose from 4.50% to 5.59%, and Apple increased from 16.90% to 20.87%. As of early July 2026, the "Unknown" segment has surged to 23.67%. StatCounter's data collection has faced inaccuracies, with revisions possible for 45 days. The rise of Linux is noted as a significant trend, influenced by compatibility with Windows games and changes in Windows support.

Winsage

July 10, 2026

You can’t fully disable Microsoft’s GDID Windows 11 tracker, but these settings limit what it captures

A 19-year-old named Peter Stokes was detained at Helsinki airport in April 2026 while traveling to Japan, carrying two 2TB hard drives. He was subject to an Interpol Red Notice and faced a federal complaint from U.S. prosecutors by July for his alleged involvement in the Scattered Spider hacking group, which breached a U.S. luxury jewelry retailer in May 2025, leading to a ransom demand. The Global Device Identifier (GDID), developed by Microsoft, is a persistent identifier that uniquely identifies a Windows installation on a device. It links online activities back to a single identity, which law enforcement can use to trace a device's owner. The GDID is generated when a user signs into Windows with a Microsoft Account and remains through updates but does not survive a clean reinstall. Stokes' use of the same Windows device allowed investigators to trace his activities through the GDID, which linked him to the hacking incident. Privacy advocates have raised concerns about the lack of consent for GDID assignment and the potential for surveillance.

Winsage

July 8, 2026

Arrest and extradition of Scattered Spider hacker shines light on how Windows telemetry GDIDs can identify and track users — Microsoft device identifier is just one digital fingerprint in a software world rife with them

Peter Stokes, a 19-year-old from Estonia, was arrested and extradited to the United States on charges related to digital crimes, with the FBI using telemetry logs from Microsoft Windows to trace his online activities. These logs included his Global Device Identifier (GDID) and records of websites he visited. Stokes likely had his telemetry settings configured to Optional/Full, which allowed the transmission of URL data. The FBI connected Stokes to his ngrok account and linked his travel records to a New York IP address and a rental at the Empire Hotel, aided by photos he shared. Google and Apple assisted in the investigation by tracing Stokes' phishing phone number back to the same IP address used for his ngrok account. Stokes attempted to obscure his digital footprint using a VPN and other services, but modern digital identification methods made it difficult to remain anonymous.

Winsage

July 7, 2026

Microsoft Windows telemetry identified hacker despite VPN use

Microsoft's telemetry capabilities helped identify Peter Stokes, a 19-year-old suspected member of the Scattered Spider hacking group, despite his use of a VPN. The investigation revealed a significant cybersecurity breach in May 2025 at a luxury jewelry retailer, leading to the theft of approximately 77 GB of sensitive data and a ransom demand. Investigators linked Stokes to the breach through a Global Device Identifier (GDID) associated with a Windows device that created an ngrok account used in the attack. This device accessed various online platforms and shared IP addresses with Stokes' accounts on Apple, Snapchat, and Facebook, corroborated by travel records and social media posts. The evidence included server logs from Scattered Spider's infrastructure and records from ngrok and other providers.

TrendTechie

July 2, 2026

На торрентах появилась взломанная версия игры 007 First Light

The hacker known as voices38 has breached the Denuvo protection system in the game 007 First Light, which was released on May 27, 2026, approximately two weeks before the hack was reported. Voices38's method is a conventional executable "crack" that does not require users to disable security mechanisms, making it more user-friendly than previous attempts by the group DenuvOwO. Voices38 has also successfully bypassed protections in other high-profile games, including Pragmata, Stellar Blade, Resident Evil: Requiem, and Mafia: The Old Country. The effectiveness of DRM solutions like Denuvo is being questioned as hackers develop more sophisticated methods to breach these systems.

Winsage

June 30, 2026

A critical Windows 11 and Windows 10 flaw turns Microsoft Defender into a hacker’s best friend

Chaotic Eclipse, also known as Nightmare-Eclipse, bypassed Windows 11's BitLocker security using a USB stick and claimed Microsoft left a backdoor in the system. Following this, Microsoft patched three zero-day exploits named YellowKey, GreenPlasma, and MiniPlasma. Nightmare-Eclipse then revealed another zero-day vulnerability called RoguePlanet, which affects Microsoft Defender on Windows 10 and 11, potentially allowing attackers full control over compromised systems. Microsoft is tracking this vulnerability as CVE-2026-50656 and is working on a security update. Nightmare-Eclipse provided a proof-of-concept exploit and described it as a race condition with variable success rates. Microsoft has promoted Windows Defender as adequate for most users but acknowledged that third-party tools can offer additional protection. The company initially threatened legal action against Nightmare-Eclipse but later decided not to pursue lawsuits against researchers sharing their findings.

Winsage

June 30, 2026

Windows Defender ‘BlueHammer’ vulnerability now exploited as part of malware campaigns — CISA issues warning despite patch release on April 14

A race condition vulnerability in Windows Defender, known as BlueHammer, has been exploited by the hacker Nightmare Eclipse, allowing attackers to gain SYSTEM user access. Microsoft released a patch for this vulnerability on April 14, but the Cybersecurity and Infrastructure Security Agency (CISA) has flagged it as actively exploited in ransomware campaigns. The average time to apply critical OS patches across Windows 10 and 11 is now 127 days, with enterprise environments averaging 76 days. Estimates suggest that 15% to 26% of Windows 10 machines remain unpatched, with a conservative estimate of 20% translating to one in five machines being vulnerable. Microsoft has extended security updates for Windows 10 until October 14, 2027, but public awareness of the updates remains low.

TrendTechie

June 20, 2026

Житель Светлогорска зарабатывал на скрытом майнинге через торренты

Law enforcement officials in the Grodno region have arrested a 35-year-old resident of Svetlogorsk for allegedly distributing malicious software. The suspect modified a hidden virus miner, embedding it in free torrent downloads, which activated on users' computers to mine cryptocurrency without their consent. This activity reportedly earned the hacker about 1,000 Belarusian rubles monthly and affected over 500 computers in Belarus and neighboring countries. An official criminal case has been initiated to address this cybercrime.

TrendTechie

June 20, 2026

Светлогорский хакер зарабатывал на скрытом майнинге, заражая компьютеры через торрент-раздачи

Cybercrime prevention officers in the Grodno region arrested a 35-year-old resident of Svetlogorsk for profiting from modified malware known as a "cryptojacker." This malware was embedded in free torrent downloads, activating on users' computers to mine cryptocurrency, which degraded the machines' performance. The suspect earned approximately one thousand Belarusian rubles monthly and was exploiting over 500 computers at the time of his arrest, affecting users in Belarus and neighboring countries. An investigation is underway to identify the victims, and criminal charges have been filed against him.