hacking Archives

Winsage

July 12, 2026

Microsoft Confirms Windows GDID Device Identifier That Cannot Be Disabled, Documented in FBI Case Filing

Microsoft has confirmed the existence of the Global Device Identifier (GDID), a unique identifier assigned to Windows installations, in a federal complaint against an alleged member of the Scattered Spider hacking group. The GDID is generated when a Windows system is set up with a Microsoft Account and remains active through various Windows updates. Disabling the GDID could disrupt Windows activation and access to Microsoft Store applications. The GDID is described as "a persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device." It is created during the provisioning of Windows with a Microsoft Account and is stored in the Windows registry under HKCUSOFTWAREMicrosoftIdentityCRLExtendedProperties. The GDID remains persistent through Windows updates but is not retained after a clean reinstall. A single user can possess multiple GDIDs linked through their account, OneDrive, and activation history. The FBI used the GDID to track Peter Stokes, an alleged member of the Scattered Spider group, across various VPN connections and proxy servers. The GDID was recorded visiting specific websites and was linked to Stokes's accounts on platforms like Snapchat and Facebook. Concerns have been raised regarding user privacy, as the GDID is assigned without user consent and cannot be disabled without compromising essential Windows features. Microsoft has not committed to providing user-facing controls or comprehensive documentation for everyday users regarding the GDID. Legal requests can compel Microsoft to disclose GDID activity data to law enforcement. The GDID is linked to the Microsoft Account rather than the device itself, meaning reinstalling the operating system does not sever this connection.

Winsage

July 10, 2026

A hacker’s arrest just revealed how Microsoft can track your Windows device

A teenager named Peter Stokes is facing federal charges in Chicago for allegedly hacking a U.S. jewelry retailer while using a VPN to conceal his online activities. Microsoft provided the FBI with data linked to a tracking mechanism called the Global Device Identifier (GDID), which is a unique number assigned to every Windows installation that persists through updates. This identifier allowed authorities to connect Stokes' computer to specific websites, despite his VPN usage. Stokes was arrested in Helsinki in April 2026 while trying to board a flight to Japan, carrying two two-terabyte hard drives. The GDID enabled Microsoft to track Stokes' activities on third-party services, raising concerns about privacy and data tracking.

Winsage

July 10, 2026

You can’t fully disable Microsoft’s GDID Windows 11 tracker, but these settings limit what it captures

A 19-year-old named Peter Stokes was detained at Helsinki airport in April 2026 while traveling to Japan, carrying two 2TB hard drives. He was subject to an Interpol Red Notice and faced a federal complaint from U.S. prosecutors by July for his alleged involvement in the Scattered Spider hacking group, which breached a U.S. luxury jewelry retailer in May 2025, leading to a ransom demand. The Global Device Identifier (GDID), developed by Microsoft, is a persistent identifier that uniquely identifies a Windows installation on a device. It links online activities back to a single identity, which law enforcement can use to trace a device's owner. The GDID is generated when a user signs into Windows with a Microsoft Account and remains through updates but does not survive a clean reinstall. Stokes' use of the same Windows device allowed investigators to trace his activities through the GDID, which linked him to the hacking incident. Privacy advocates have raised concerns about the lack of consent for GDID assignment and the potential for surveillance.

Winsage

July 7, 2026

Microsoft Windows telemetry identified hacker despite VPN use

Microsoft's telemetry capabilities helped identify Peter Stokes, a 19-year-old suspected member of the Scattered Spider hacking group, despite his use of a VPN. The investigation revealed a significant cybersecurity breach in May 2025 at a luxury jewelry retailer, leading to the theft of approximately 77 GB of sensitive data and a ransom demand. Investigators linked Stokes to the breach through a Global Device Identifier (GDID) associated with a Windows device that created an ngrok account used in the attack. This device accessed various online platforms and shared IP addresses with Stokes' accounts on Apple, Snapchat, and Facebook, corroborated by travel records and social media posts. The evidence included server logs from Scattered Spider's infrastructure and records from ngrok and other providers.

AppWizard

July 7, 2026

‘Emotional cyber-noir adventure game’ MoonHack announced for PC

ASTRA, under Astro Production, has announced its upcoming project, MoonHack, an emotional cyber-noir adventure set to launch on PC via Steam in 2027. The game will support English, Japanese, Traditional Chinese, and Simplified Chinese. Set in the year 2125, MoonHack features a world where AI controls all aspects of life, and loving what you love is illegal. Players will collaborate with characters classified as illegal to navigate a digital realm governed by AI regulations, using music as a means to challenge the oppressive system. The gameplay combines storytelling with 3D rhythm-action mechanics, where vocal performances align with gameplay. An announcement trailer is available for viewing.

TrendTechie

July 2, 2026

На торрентах появилась взломанная версия игры 007 First Light

The hacker known as voices38 has breached the Denuvo protection system in the game 007 First Light, which was released on May 27, 2026, approximately two weeks before the hack was reported. Voices38's method is a conventional executable "crack" that does not require users to disable security mechanisms, making it more user-friendly than previous attempts by the group DenuvOwO. Voices38 has also successfully bypassed protections in other high-profile games, including Pragmata, Stellar Blade, Resident Evil: Requiem, and Mafia: The Old Country. The effectiveness of DRM solutions like Denuvo is being questioned as hackers develop more sophisticated methods to breach these systems.

Winsage

July 1, 2026

An enthusiast ran Windows 11 on a PC from 2003 with DDR1 and AGP, and played Half-Life 2

A modder demonstrated Windows 11 running on a vintage system with a Core 2 Quad Q6600 processor, DDR1 RAM, and an ATI Radeon HD 4650 AGP graphics card, achieving stable performance with games like Half-Life 2 and Crysis. The setup utilized an ASRock ConRoe865PE motherboard with an Intel i865PE chipset and required some "hacking interventions" for hardware compatibility, including launching the AGP 8X interface and activating H.264 video decoding. The Radeon HD 4650 AGP used Windows 7 64-bit drivers from 2012. The modder noted that Windows 11 officially supports BIOS systems via Windows 11 IoT, contributing to its stability on older hardware. The system's performance was enhanced by a Toshiba THNSNJ512GCSU solid-state drive (SSD). Additionally, another modder doubled the performance of a GeForce GTX 1650 by increasing its VRAM to 8 GB, and a different modder compressed GTA V to 2.5 GB.

Winsage

June 27, 2026

RAM crisis provokes enthusiast to try Windows 11 on DDR1-era hardware — other key vintage components included the Core 2 Q6600 and ATI Radeon HD 4650 AGP

Omores has successfully demonstrated running Windows 11 on a Core 2 Quad Q6600 with a DDR1 motherboard and an ATI Radeon HD 4650 AGP graphics card. The system is stable and capable of running modern browsers, games, and 3D benchmarks, including the demanding game Crysis. Compatibility was achieved by integrating ATI’s Windows 7 64-bit drivers from 2012. Windows 11 operates on older systems without UEFI and only ACPI 1.1, and it officially supports BIOS systems through Windows 11 IoT.

Winsage

June 27, 2026

New Millenium RAT version infects 62,000 Windows systems worldwide

A significant evolution of the Millenium remote access trojan (RAT) has impacted over 62,000 Windows devices across more than 160 countries. The latest version, 4.*, marks a departure from previous .NET-based versions and is attributed to a threat cluster known as Y2K Operators, with the creator identified as “ShinyEnigma.” There are 62,289 infected endpoints, with 39,730 infections occurring in the first quarter of 2026. The RAT is marketed as malware-as-a-service (MaaS) and promoted through underground forums and platforms like GitHub, with accessible pricing. Millenium RAT 4 is developed in native C++ and uses the Telegram Bot API for command-and-control communications. Its capabilities include stealing browser data, collecting system information, logging keystrokes, capturing screenshots and audio, accessing Telegram and Discord data, downloading additional payloads, and executing Windows or PowerShell commands. The malware ensures persistence by replicating itself in the %APPDATA% directory and creating an autorun registry entry. The malware is distributed through social engineering tactics such as cracked software, cryptocurrency utilities, hacking toolkits, OSINT tools, exploit builders, and Roblox-related cheats. Some campaigns have trojanized malware builders, infecting cybercriminals. One campaign used PDF-themed lures with a malicious Windows shortcut to download the RAT while displaying a legitimate document. Payloads often use filenames associated with Windows components or security software to blend into infected systems. Group-IB recommends avoiding untrusted executables, applying security updates, enabling multi-factor authentication, and monitoring for unusual autorun registry entries.

Tech Optimizer

June 24, 2026

Norton 360 Advanced gets 77% discount, drops price to £2.92/mo — top-rated antivirus, 200GB cloud backup, VPN, parental controls and more

Norton 360 Advanced is currently available at a 77% discount, reducing the monthly cost to £2.92 for protection of up to ten devices. It includes antivirus technology, 200GB Cloud Backup, a Password Manager, a VPN for secure browsing, a Parental Control App, Dark Web Monitoring, Identity Restoration Support, Social Media Monitoring, and Financial Monitoring services.