information Archives

Tech Optimizer

July 10, 2026

Layered Security Essentials: Protect Your Devices from Threats

Safeguarding modern devices requires a multifaceted security strategy that includes antivirus software, VPNs, strong authentication methods, and regular system updates. Layered security combines multiple protective measures such as encryption, malware detection, and authentication controls to address diverse threats. Key elements of solid cyber hygiene include strong passwords, timely software updates, phishing awareness, and multi-factor authentication. Network protection is crucial, especially when using public Wi-Fi; users should verify the presence of encryption indicators like "HTTPS" before sharing personal information. Employing WPA3 encryption on home routers and changing default admin credentials are essential safeguards. Regular updates to operating systems and applications help close known vulnerabilities, while safe browsing habits are necessary to avoid potential threats. Antivirus software and anti-phishing tools offer real-time monitoring, and device encryption protects data in case of loss or theft. Regular backups are vital to prevent data loss from ransomware attacks or hardware failures. Phishing-resistant multi-factor authentication and passkeys provide strong defenses against credential-based attacks.

Tech Optimizer

July 10, 2026

GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware

Microsoft Threat Intelligence has identified the GigaWiper malware, which has been detected in compromised environments since October 2025. This malware has destructive capabilities and comes in two forms: standalone wiper binaries and larger binaries with backdoor functionalities, both developed in Golang. The standalone wiper operates at the physical disk level, overwriting disk content and removing partition references. The backdoor variant includes the same wiper functionality and adds persistence through a registry key and scheduled tasks, along with command and control communication via RabbitMQ and Redis. GigaWiper can execute various commands, including wiping drives, triggering a Blue Screen of Death (BSOD), file encryption that mimics ransomware behavior, and managing system elements. The malware integrates components from multiple malware families, including wipers and ransomware mechanisms, and has been linked to a previous malware known as FlockWiper. To defend against GigaWiper, organizations are advised to implement security measures such as tamper protection, blocking access to known C2 infrastructure, and utilizing endpoint detection and response solutions. Microsoft Defender provides detections for GigaWiper and related malware, and threat intelligence reports are available for customers to stay informed about threats. Indicators of compromise include specific SHA-256 hashes and IP addresses associated with GigaWiper.

Winsage

July 10, 2026

Microsoft Warns of GigaWiper Backdoor Built to Destroy Windows PCs

Microsoft has unveiled a destructive Windows backdoor named GigaWiper, which allows operators remote control over compromised systems to execute irreversible damage. GigaWiper originated from cyberattacks in October 2025 and is a composite of code from at least three malware families. It maintains its presence through a scheduled task disguised as “OneDrive Update,” executing at startup and every minute. GigaWiper can obliterate partition information, overwrite physical drives, and restart systems. It also mimics ransomware by encrypting files with the .candy extension, using randomly generated keys that are not stored, making recovery impossible. The malware has connections to the Crucio ransomware and resembles FlockWiper, with rewritten code in Go. GigaWiper features 20 command codes for various functions, including executing PowerShell instructions, managing processes, capturing screenshots, and remote access similar to VNC. It can remain on a system for surveillance until its destructive functions are activated. Microsoft Defender includes detection capabilities for GigaWiper, and users are advised to enable tamper protection and monitor for suspicious activities.

Winsage

July 9, 2026

Evolving Windows vulnerability management to meet the speed of AI-powered discovery

Microsoft is enhancing its security measures for Windows by integrating artificial intelligence (AI) to improve the discovery and analysis of vulnerabilities across its codebase. This includes the use of a multi-model agentic scanning harness (MDASH) that employs various AI models to identify and validate potential vulnerabilities efficiently. A dedicated cloud infrastructure supports this scanning process, which aims to minimize false positives and reduce the time from discovery to customer protection. The company collaborates across divisions to promote AI-powered tools and practices, refining its internal systems to integrate vulnerability discovery into development processes. This includes updating Secure Development Lifecycle (SDL) practices to address AI-enabled attack techniques. Customers can expect an increase in security updates as AI enhances vulnerability discovery capabilities. Windows updates undergo rigorous validation through programs like the Security Update Validation Program (SUVP) to ensure quality and compatibility. Microsoft also offers tools like Known Issue Rollback (KIR) for quick reversion of changes if issues arise during updates. Customers are encouraged to stay current with security updates and utilize resources like the Security Update Guide for prioritizing protections. To facilitate smoother update processes, Microsoft provides optional non-security preview releases for compatibility testing and employs modern management capabilities like Windows Autopatch to automate security updates. Azure Arc enables rebootless updates for Windows Servers, while Microsoft Defender and Intune help manage vulnerabilities and compliance across endpoints. Overall, Microsoft is committed to continuous improvement in its security practices to adapt to the evolving threat landscape and ensure customer protection through timely updates.

AppWizard

July 9, 2026

PC gamers remain skeptical of Steam’s AI disclaimers, poll shows many believe game devs are hiding it

A poll by GameDiscoverCo involving nearly 3,800 Steam users from June 25 to July 2, 2026, found that 43% of respondents are comfortable purchasing games with AI disclosures, while 31% view such disclosures negatively, and 8% refuse to buy games featuring them. Approximately 44% of participants read AI disclosures in detail, and 45% at least glance at them, indicating that 89% consider this information in their purchasing decisions. Trust in the accuracy of these disclosures is low, with only 17% believing developers fully disclose AI use, while 25% think many are transparent, and 35% feel only some provide accurate information. Additionally, 56% of respondents believe AI-assisted development tools should be disclosed, with only 8% disagreeing. Nearly 20% of games in Steam’s recent Next Fest event included a generative AI warning, a figure expected to rise as the industry evolves.

Winsage

July 9, 2026

Windows hides a secret identifier that Microsoft hands over to the FBI

19-year-old Peter Stokes, a member of the Scattered Spider group, was arrested by the FBI due to a unique number embedded in his Windows operating system known as the Global Device Identifier (GDID). This identifier, assigned during Windows installation, remains unchanged and can leak user information despite the use of VPNs. The FBI identified Stokes by obtaining a history of IP addresses linked to his GDID from Microsoft, which allowed them to trace his online activities across various platforms. Microsoft tracks over a billion devices with this permanent identifier, which cannot be disabled.

Winsage

July 9, 2026

GDID Windows – Cut the tracker that follows you even through a VPN

In April 2026, the FBI apprehended an individual associated with the Scattered Spider group, who had concealed his online activities using a VPN. His efforts were thwarted by the GDID, a 64-bit Persistent Unique Identifier assigned by Microsoft upon logging into Windows. The GDID is stored in plain text in the registry and is linked to Microsoft’s servers, remaining unaffected by changes to IP addresses or attempts to delete it. Disabling Windows telemetry does not prevent the GDID from being accessed, as it operates through other services. To mitigate its transmission, users can disable certain services and modify the hosts file, although the GDID itself remains stored on Microsoft’s servers. Scripts are available on GitHub to audit and implement changes regarding the GDID. Transitioning to a local account does not guarantee anonymity, and for sensitive activities, using a live Linux system is recommended for better data control.

AppWizard

July 8, 2026

Wear OS 7: New features, eligible smartwatches, and everything you need to know

Wear OS 7 has been rolled out for smartwatches currently operating on Wear OS 6, with future models like the Galaxy Watch 9 expected to come with this update pre-installed. Current devices eligible for the upgrade include the Galaxy Watch 8 series and the OnePlus Watch 3 (release date pending). Key features of Wear OS 7 include Live Updates for real-time notifications, Remote Media Routing and Per-App Auto Launch for media apps, and Android XR Control for managing Android XR devices. The update introduces a new Neural Expressive design language, Gemini Intelligence for task automation, and a Personal Intelligence feature for personalized suggestions based on app data. Customization is enhanced with Widgets replacing traditional tiles, allowing users to create dynamic dashboards. Updates to the Google Contacts app include an improved search interface and an Emergency Sharing feature for location sharing during emergencies. The Wear Workout Tracker standardizes fitness tracking across devices, and battery life improvements promise up to a 10% increase in longevity. Samsung's One UI Watch is evolving with the upcoming One UI 9 Watch, which is expected to feature a refreshed interface and new customizations. Firmware for One UI 9 Watch has been detected on Galaxy Watch 8 models, indicating an imminent release, with the Galaxy Watch 9 series anticipated to launch in July alongside the Galaxy Z Fold 8.

Winsage

July 8, 2026

Arrest and extradition of Scattered Spider hacker shines light on how Windows telemetry GDIDs can identify and track users — Microsoft device identifier is just one digital fingerprint in a software world rife with them

Peter Stokes, a 19-year-old from Estonia, was arrested and extradited to the United States on charges related to digital crimes, with the FBI using telemetry logs from Microsoft Windows to trace his online activities. These logs included his Global Device Identifier (GDID) and records of websites he visited. Stokes likely had his telemetry settings configured to Optional/Full, which allowed the transmission of URL data. The FBI connected Stokes to his ngrok account and linked his travel records to a New York IP address and a rental at the Empire Hotel, aided by photos he shared. Google and Apple assisted in the investigation by tracing Stokes' phishing phone number back to the same IP address used for his ngrok account. Stokes attempted to obscure his digital footprint using a VPN and other services, but modern digital identification methods made it difficult to remain anonymous.

Winsage

July 8, 2026

Trojanized LetsVPN installer gives attackers remote access to Windows PCs

A malware campaign has been discovered that exploits the VPN service LetsVPN. Researchers from ThreatLocker found a malicious Windows installer that pretends to be the legitimate LetsVPN application while deploying a remote access trojan (RAT) called GoodPersonRAT. The malware allows attackers to control infected systems using stealth techniques. The malicious installer first deploys the RAT and then installs the authentic LetsVPN application, creating an illusion of legitimacy. The package identified as Kuailian_win-setup.86.msi contains the legitimate LetsVPN installer, a loader, and an encrypted payload. GoodPersonRAT features include remote desktop control, file upload/download, command execution, proxying, keylogging, and clipboard monitoring. It specifically targets Telegram Desktop users by archiving critical account information and altering proxy settings. The malware ensures persistence through Windows services and scheduled tasks and can undermine security software. The LetsVPN installer is legitimate and signed, but the MSI package is unsigned and contains malicious components. Users are advised to download software only from official sources and verify digital signatures.