information Archives

Winsage

July 10, 2026

Microsoft Warns of GigaWiper Backdoor Built to Destroy Windows PCs

Microsoft has unveiled a destructive Windows backdoor named GigaWiper, which allows operators remote control over compromised systems to execute irreversible damage. GigaWiper originated from cyberattacks in October 2025 and is a composite of code from at least three malware families. It maintains its presence through a scheduled task disguised as “OneDrive Update,” executing at startup and every minute. GigaWiper can obliterate partition information, overwrite physical drives, and restart systems. It also mimics ransomware by encrypting files with the .candy extension, using randomly generated keys that are not stored, making recovery impossible. The malware has connections to the Crucio ransomware and resembles FlockWiper, with rewritten code in Go. GigaWiper features 20 command codes for various functions, including executing PowerShell instructions, managing processes, capturing screenshots, and remote access similar to VNC. It can remain on a system for surveillance until its destructive functions are activated. Microsoft Defender includes detection capabilities for GigaWiper, and users are advised to enable tamper protection and monitor for suspicious activities.

Winsage

July 9, 2026

Evolving Windows vulnerability management to meet the speed of AI-powered discovery

Microsoft is enhancing its security measures for Windows by integrating artificial intelligence (AI) to improve the discovery and analysis of vulnerabilities across its codebase. This includes the use of a multi-model agentic scanning harness (MDASH) that employs various AI models to identify and validate potential vulnerabilities efficiently. A dedicated cloud infrastructure supports this scanning process, which aims to minimize false positives and reduce the time from discovery to customer protection. The company collaborates across divisions to promote AI-powered tools and practices, refining its internal systems to integrate vulnerability discovery into development processes. This includes updating Secure Development Lifecycle (SDL) practices to address AI-enabled attack techniques. Customers can expect an increase in security updates as AI enhances vulnerability discovery capabilities. Windows updates undergo rigorous validation through programs like the Security Update Validation Program (SUVP) to ensure quality and compatibility. Microsoft also offers tools like Known Issue Rollback (KIR) for quick reversion of changes if issues arise during updates. Customers are encouraged to stay current with security updates and utilize resources like the Security Update Guide for prioritizing protections. To facilitate smoother update processes, Microsoft provides optional non-security preview releases for compatibility testing and employs modern management capabilities like Windows Autopatch to automate security updates. Azure Arc enables rebootless updates for Windows Servers, while Microsoft Defender and Intune help manage vulnerabilities and compliance across endpoints. Overall, Microsoft is committed to continuous improvement in its security practices to adapt to the evolving threat landscape and ensure customer protection through timely updates.

AppWizard

July 9, 2026

PC gamers remain skeptical of Steam’s AI disclaimers, poll shows many believe game devs are hiding it

A poll by GameDiscoverCo involving nearly 3,800 Steam users from June 25 to July 2, 2026, found that 43% of respondents are comfortable purchasing games with AI disclosures, while 31% view such disclosures negatively, and 8% refuse to buy games featuring them. Approximately 44% of participants read AI disclosures in detail, and 45% at least glance at them, indicating that 89% consider this information in their purchasing decisions. Trust in the accuracy of these disclosures is low, with only 17% believing developers fully disclose AI use, while 25% think many are transparent, and 35% feel only some provide accurate information. Additionally, 56% of respondents believe AI-assisted development tools should be disclosed, with only 8% disagreeing. Nearly 20% of games in Steam’s recent Next Fest event included a generative AI warning, a figure expected to rise as the industry evolves.

Winsage

July 9, 2026

Windows hides a secret identifier that Microsoft hands over to the FBI

19-year-old Peter Stokes, a member of the Scattered Spider group, was arrested by the FBI due to a unique number embedded in his Windows operating system known as the Global Device Identifier (GDID). This identifier, assigned during Windows installation, remains unchanged and can leak user information despite the use of VPNs. The FBI identified Stokes by obtaining a history of IP addresses linked to his GDID from Microsoft, which allowed them to trace his online activities across various platforms. Microsoft tracks over a billion devices with this permanent identifier, which cannot be disabled.

Winsage

July 9, 2026

GDID Windows – Cut the tracker that follows you even through a VPN

In April 2026, the FBI apprehended an individual associated with the Scattered Spider group, who had concealed his online activities using a VPN. His efforts were thwarted by the GDID, a 64-bit Persistent Unique Identifier assigned by Microsoft upon logging into Windows. The GDID is stored in plain text in the registry and is linked to Microsoft’s servers, remaining unaffected by changes to IP addresses or attempts to delete it. Disabling Windows telemetry does not prevent the GDID from being accessed, as it operates through other services. To mitigate its transmission, users can disable certain services and modify the hosts file, although the GDID itself remains stored on Microsoft’s servers. Scripts are available on GitHub to audit and implement changes regarding the GDID. Transitioning to a local account does not guarantee anonymity, and for sensitive activities, using a live Linux system is recommended for better data control.

AppWizard

July 8, 2026

Wear OS 7: New features, eligible smartwatches, and everything you need to know

Wear OS 7 has been rolled out for smartwatches currently operating on Wear OS 6, with future models like the Galaxy Watch 9 expected to come with this update pre-installed. Current devices eligible for the upgrade include the Galaxy Watch 8 series and the OnePlus Watch 3 (release date pending). Key features of Wear OS 7 include Live Updates for real-time notifications, Remote Media Routing and Per-App Auto Launch for media apps, and Android XR Control for managing Android XR devices. The update introduces a new Neural Expressive design language, Gemini Intelligence for task automation, and a Personal Intelligence feature for personalized suggestions based on app data. Customization is enhanced with Widgets replacing traditional tiles, allowing users to create dynamic dashboards. Updates to the Google Contacts app include an improved search interface and an Emergency Sharing feature for location sharing during emergencies. The Wear Workout Tracker standardizes fitness tracking across devices, and battery life improvements promise up to a 10% increase in longevity. Samsung's One UI Watch is evolving with the upcoming One UI 9 Watch, which is expected to feature a refreshed interface and new customizations. Firmware for One UI 9 Watch has been detected on Galaxy Watch 8 models, indicating an imminent release, with the Galaxy Watch 9 series anticipated to launch in July alongside the Galaxy Z Fold 8.

Winsage

July 8, 2026

Arrest and extradition of Scattered Spider hacker shines light on how Windows telemetry GDIDs can identify and track users — Microsoft device identifier is just one digital fingerprint in a software world rife with them

Peter Stokes, a 19-year-old from Estonia, was arrested and extradited to the United States on charges related to digital crimes, with the FBI using telemetry logs from Microsoft Windows to trace his online activities. These logs included his Global Device Identifier (GDID) and records of websites he visited. Stokes likely had his telemetry settings configured to Optional/Full, which allowed the transmission of URL data. The FBI connected Stokes to his ngrok account and linked his travel records to a New York IP address and a rental at the Empire Hotel, aided by photos he shared. Google and Apple assisted in the investigation by tracing Stokes' phishing phone number back to the same IP address used for his ngrok account. Stokes attempted to obscure his digital footprint using a VPN and other services, but modern digital identification methods made it difficult to remain anonymous.

Winsage

July 8, 2026

Trojanized LetsVPN installer gives attackers remote access to Windows PCs

A malware campaign has been discovered that exploits the VPN service LetsVPN. Researchers from ThreatLocker found a malicious Windows installer that pretends to be the legitimate LetsVPN application while deploying a remote access trojan (RAT) called GoodPersonRAT. The malware allows attackers to control infected systems using stealth techniques. The malicious installer first deploys the RAT and then installs the authentic LetsVPN application, creating an illusion of legitimacy. The package identified as Kuailian_win-setup.86.msi contains the legitimate LetsVPN installer, a loader, and an encrypted payload. GoodPersonRAT features include remote desktop control, file upload/download, command execution, proxying, keylogging, and clipboard monitoring. It specifically targets Telegram Desktop users by archiving critical account information and altering proxy settings. The malware ensures persistence through Windows services and scheduled tasks and can undermine security software. The LetsVPN installer is legitimate and signed, but the MSI package is unsigned and contains malicious components. Users are advised to download software only from official sources and verify digital signatures.

BetaBeacon

July 8, 2026

Best Android Casinos and Apps for Players in The U.S.

FanDuel Android Casino App has a rating of 4.6/5 and is recommended as the top-rated Android casino app. It is available in MI, NJ, PA, WV, and CT and offers a bonus of deposit , get 500 bonus spins & casino bonus.

Winsage

July 8, 2026

Here’s How to Check If Windows 11 Is Secretly Gobbling Up Your Disk Space

Users upgrading to Windows 11 have reported a significant decrease in available storage on their C: drive, attributed to the Capability Access Manager process consuming excessive disk space. Microsoft has acknowledged this issue and released an optional update (KB5095093) to improve disk space management for the CapabilityAccessManager.db-wal file, which can grow to several hundred gigabytes instead of the typical few megabytes. Users can check the file size in the directory C:ProgramDataMicrosoftWindowsCapabilityAccessManager, and tools like TreeSize or the command prompt can assist in this process. The CapabilityAccessManager.db-wal file functions as a write-ahead log for application access requests to system components, and its abnormal growth indicates it is not being properly merged back into the main database.