investigation Archives

Tech Optimizer

April 13, 2026

Fake Windows 11 support site offers ‘update’ that steals data and evades antiviruses

Malwarebytes has discovered a counterfeit Windows support site offering a fake "cumulative update" for Windows 11 24H2. Users who click the "Download Update" button download an 83MB package designed to compromise sensitive information, including passwords and payment details. The file, named WindowsUpdate 1.0.0.msi, falsely lists Microsoft as the author and is created using WiX Toolset 4.0.0.5512. VirusTotal reported zero detections for the main executable and VBS launcher, highlighting the malware's architecture designed to evade detection. The malicious website's address includes "microsoft-update.support," differing from the legitimate support site. Malwarebytes has added the malicious site to its detection service database.

Winsage

April 13, 2026

Mozilla accuses Microsoft of running the old browser wars playbook to lock in AI dominance through Windows

Mozilla has accused Microsoft of using its dominance in the Windows operating system to marginalize competitors in the AI sector, particularly through the promotion of its Copilot feature. Mozilla claims that misleading update mechanisms are being used to push Copilot onto users and that system settings are being adjusted to hinder the performance of alternative browsers like Firefox. This situation is reminiscent of the 1990s browser wars when Microsoft bundled Internet Explorer with Windows to eliminate competition. In July 2025, Opera filed a formal antitrust complaint in Brazil against Microsoft, leading to an investigation into whether Microsoft was coercing hardware manufacturers to bundle Edge exclusively. A ruling against Microsoft could require a separation between the operating system and AI services. Microsoft's current strategy aims to control the AI inference layer, with each interaction through Copilot representing valuable data and monetization opportunities. Reports indicate that Microsoft is removing Copilot branding from standalone applications to further integrate it into the operating system. Despite Edge being the third most popular browser, Microsoft's tactics suggest a focus on securing AI infrastructure rather than just competing for browser market share. Regulatory scrutiny may increase due to ongoing antitrust challenges related to Microsoft's OpenAI investment and cloud AI bundling practices. The development of OEM relationships and potential resistance to Microsoft's requirements could significantly impact its integration strategy.

AppWizard

April 11, 2026

US government wants gamers to become air traffic controllers

The U.S. government is launching a campaign to attract gamers to become air traffic controllers, with Secretary of Transportation Sean Duffy promoting the initiative on social media. The air traffic control sector is facing a staffing shortage of approximately 4,000 controllers, with only 11,700 certified professionals and trainees available. This shortage has been worsened by a government shutdown that resulted in 44 days of unpaid work for controllers, leading to retirements. The average salary for an air traffic controller reaches 0,000 after three years. Duffy described the hiring process as "supercharged" and emphasized the need to adapt communication strategies to engage younger demographics. Recent incidents, including a crash at LaGuardia Airport, have raised concerns about staffing levels, although Duffy stated that no critical safety personnel were affected by previous staff reductions.

AppWizard

April 9, 2026

Project Zomboid bans rogue mods deploying “malicious code” to players’ PCs

The Indie Stone has removed a series of malicious mods associated with the 'True Moozic' soundtrack expander for Project Zomboid, which were found to generate harmful files outside the game’s directory. These mods were not linked to their original creator and have been taken down from the Steam Workshop. The developer banned the individual responsible for these uploads and advised players who downloaded the affected mods to take security precautions. A total of 14 mods from the same user were identified, with installations estimated between 500 and 2,200. The Indie Stone clarified that the exploit was limited to Build 42 branches and emphasized that the malicious uploads were unauthorized and not part of the True Moozic mod. Additionally, they released a security update for Build 41 to address a separate vulnerability, which has not been found to be exploited. The 'outdated unstable' branch has also been updated to ensure it remains one content update behind the 'unstable' branch.

AppWizard

April 9, 2026

Project Zomboid identifies and bans over a dozen Steam Workshop mods containing ‘heavily obfuscated code’ that was ‘creating malicious files’

The Indie Stone has identified a security issue involving 14 mods on the Steam Workshop for Project Zomboid, which contain heavily obfuscated code linked to the creation of malicious files outside the game's directory. Reports from players indicated that one mod was generating harmful code, prompting an investigation that confirmed the presence of the exploit across multiple mods uploaded by the same user. The affected mods had between 500 and 2,200 installations, and the user has been banned while the mods have been removed from the Steam Workshop. The exploit specifically affects Build 42 branches of Project Zomboid, with players using Build 41 being unaffected. The Indie Stone advises players who downloaded these mods to take security precautions beyond simply uninstalling them. The affected mods include various soundtracks, such as Risk of Rain 2 OST, NieR: Automata OST, and others, each with specific Workshop and Mod IDs.

Winsage

April 8, 2026

Microsoft rolls out fix for broken Windows Start Menu search

Microsoft has implemented a server-side remedy for an issue affecting the Windows Start Menu search functionality on select Windows 11 23H2 devices, which began impacting users on April 6. The problem was linked to a server-side Bing update aimed at improving search performance. Microsoft has rolled back the problematic Bing update and expects search issues to decrease as the fix is deployed. Users have reported blank search results in the Start Menu, but options remain clickable. Microsoft confirmed that the issue will resolve automatically with the rollout of the fix, provided devices are connected to the internet and Web Search is enabled. Additionally, there have been previous Start Menu-related issues, including crashes and error messages, with Microsoft working on permanent solutions for these problems.

AppWizard

April 8, 2026

The FBI Warns That Foreign Cybercriminals Have Targeted Messaging App Users

Cybercriminals connected to Russian intelligence are conducting a large phishing campaign targeting messaging applications, impacting thousands of accounts worldwide. A joint advisory from the FBI and CISA reveals that these attacks focus on individuals with access to sensitive information, including government officials, military personnel, political figures, and journalists. The campaign relies on deception, with attackers impersonating official support channels on platforms like Signal, sending messages that prompt victims to click malicious links or provide confidential information. Victims who comply risk losing control of their accounts, allowing attackers to read private messages and access contact lists. This trend has been observed not only in the U.S. but also in the Netherlands, where similar tactics are used against government employees. The FBI notes that the security of the messaging apps is not the issue; rather, the vulnerability lies in human error. The rise of social engineering tactics poses a risk to both high-profile individuals and potentially everyday users, and users are advised to be cautious with unsolicited messages and not to share sensitive information.

Winsage

April 7, 2026

“This was not opportunistic. It was precision.” — How North Korean hackers used Microsoft Teams and Slack to compromise Windows PCs with an elaborate ploy

On March 30, 2026, axios, a JavaScript HTTP client library, was temporarily compromised by suspected North Korean hackers who hijacked maintainer Jason Saayman's account. This allowed them to publish two malicious versions of axios on npm. The malicious versions were identified and removed within three hours by StepSecurity. A post-mortem blog on GitHub provided security measures for users of Windows, macOS, and Linux, highlighting risks from a Remote Access Trojan (RAT) introduced during the breach. The attack was attributed to a group known as UNC1069, which has been active since at least 2018. Two weeks prior to the breach, Saayman was targeted in a social engineering campaign where attackers posed as a legitimate company founder, leading him to install the RAT via a fake update during a Microsoft Teams meeting. Microsoft Teams was not compromised; it was used as a delivery method for the Trojan. Saayman noted the operation's sophistication.

AppWizard

April 7, 2026

Telegram to adapt to Russian restrictions, making traffic harder to detect and block, says app founder

Telegram's founder, Pavel Durov, announced that the messaging platform will adapt to increasing restrictions from the Russian government to make its traffic harder to detect and block. Approximately 65 million Russians use Telegram daily via VPNs, with over 50 million actively sending messages despite government efforts to slow down the service. The Russian government has attempted to ban VPNs, impacting the banking sector, and Durov compared the situation to Iran's previous Telegram ban, noting a similar rise in VPN usage. In February, Russia's communications regulator began slowing down Telegram for non-compliance with requests to remove prohibited content. Durov is under investigation for potential criminal charges related to aiding terrorist activities, which he claims are pretexts to limit access to Telegram. The crackdown on foreign communication tools has intensified, with recent restrictions on WhatsApp, and Kremlin spokesperson Dmitry Peskov has urged citizens to use the state-developed messaging app "Max." Telegram remains crucial for communication, especially for military purposes, amid pressure from Roskomnadzor, the Russian agency monitoring mass media.

AppWizard

April 6, 2026

Dangerous “NoVoice” malware found in over 50 Play Store apps that were installed 2.3 million times

A new malware threat called "NoVoice" has been found in over 50 applications on the Google Play Store, with 2.3 million installations on Android devices. Discovered by McAfee, this malware is hidden in seemingly harmless apps like system cleaners, games, and image galleries. It exploits Android vulnerabilities to gain root access, potentially allowing attackers to steal sensitive information and manipulate applications without user consent. In some cases, it may persist even after a factory reset. Google has stated that Android devices updated since May 2021 are protected against this threat and that Google Play Protect actively removes malicious apps and blocks new installations. The malware was not able to infect devices in Beijing and Shenzhen, suggesting the attackers may be avoiding local law enforcement. One identified app carrying the NoVoice payload is SwiftClean, developed by Biodun Popoola. The malware operates using a silent audio file, executing its code without user detection. Users are advised to download apps only from the Google Play Store and keep their devices updated.