NewApp Digest
search bot

Microsoft Defender

GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware
Tech Optimizer
July 10, 2026

GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware

Microsoft Threat Intelligence has identified the GigaWiper malware, which has been detected in compromised environments since October 2025. This malware has destructive capabilities and comes in two forms: standalone wiper binaries and larger binaries with backdoor functionalities, both developed in Golang. The standalone wiper operates at the physical disk level, overwriting disk content and removing partition references. The backdoor variant includes the same wiper functionality and adds persistence through a registry key and scheduled tasks, along with command and control communication via RabbitMQ and Redis. GigaWiper can execute various commands, including wiping drives, triggering a Blue Screen of Death (BSOD), file encryption that mimics ransomware behavior, and managing system elements. The malware integrates components from multiple malware families, including wipers and ransomware mechanisms, and has been linked to a previous malware known as FlockWiper. To defend against GigaWiper, organizations are advised to implement security measures such as tamper protection, blocking access to known C2 infrastructure, and utilizing endpoint detection and response solutions. Microsoft Defender provides detections for GigaWiper and related malware, and threat intelligence reports are available for customers to stay informed about threats. Indicators of compromise include specific SHA-256 hashes and IP addresses associated with GigaWiper.
Microsoft Warns of GigaWiper Backdoor Built to Destroy Windows PCs
Winsage
July 10, 2026

Microsoft Warns of GigaWiper Backdoor Built to Destroy Windows PCs

Microsoft has unveiled a destructive Windows backdoor named GigaWiper, which allows operators remote control over compromised systems to execute irreversible damage. GigaWiper originated from cyberattacks in October 2025 and is a composite of code from at least three malware families. It maintains its presence through a scheduled task disguised as “OneDrive Update,” executing at startup and every minute. GigaWiper can obliterate partition information, overwrite physical drives, and restart systems. It also mimics ransomware by encrypting files with the .candy extension, using randomly generated keys that are not stored, making recovery impossible. The malware has connections to the Crucio ransomware and resembles FlockWiper, with rewritten code in Go. GigaWiper features 20 command codes for various functions, including executing PowerShell instructions, managing processes, capturing screenshots, and remote access similar to VNC. It can remain on a system for surveillance until its destructive functions are activated. Microsoft Defender includes detection capabilities for GigaWiper, and users are advised to enable tamper protection and monitor for suspicious activities.
How to Use a Virus Checker on Your PC (2026)
Tech Optimizer
July 4, 2026

How to Use a Virus Checker on Your PC (2026)

Windows includes a built-in virus checker called Microsoft Defender Antivirus, which allows users to conduct virus scans. 1. To initiate a scan, open Windows Security, navigate to Virus & threat protection, and select Quick scan for a fast check. 2. Users can check which antivirus is active by going to Who's protecting me? in Windows Security. If a non-Microsoft antivirus is installed, Microsoft Defender will disable itself. 3. Before scanning, it's important to update the security intelligence by checking for updates in Protection updates. 4. A full scan can be executed by selecting Full scan in Scan options, while a custom scan allows users to specify a location to check. 5. For stubborn malware, Microsoft Defender Offline can be used, which requires a restart of Windows. 6. Scan results and quarantined threats can be reviewed in Protection history after any scan. 7. For additional checks, users can utilize VirusTotal for individual files or links, Microsoft Safety Scanner for a one-time scan, or the Malicious Software Removal Tool for specific malware. 8. Outdated tools like the Chrome Cleanup Tool and Norton Power Eraser should be disregarded as they are no longer effective. Users can scan individual files without scanning the entire PC, and results from the Microsoft Defender Offline scan are found in Protection history. The Microsoft Safety Scanner does not replace real-time antivirus protection, and managed devices can be scanned by IT administrators.
Do you still need third-party antivirus on your Windows PC?
Winsage
July 1, 2026

Do you still need third-party antivirus on your Windows PC?

In April, a statement on the Windows Learning Center claimed that Microsoft Defender Antivirus is sufficient for many Windows 11 users, leading to brief attention before the article was removed a month later without explanation. The link now redirects to the homepage, but the content is still accessible via the Internet Archive. Microsoft has not clarified the removal, and speculation suggests backlash from the third-party security industry may have influenced this decision. Research indicates that the infection rate for consumer PCs in 2023-2024 was 3.07%, lower than the 2.39% for business PCs, suggesting that risks may not be as widespread as often claimed. The 2025 Cybersecurity Threat Report noted that 56% of consumer endpoints that faced an infection in 2024 experienced subsequent infections, with user behavior playing a significant role. A survey found that 54% of Americans rely on default device protection, while 46% use third-party antivirus solutions. Modern antivirus solutions, including Microsoft Defender, achieve protection rates of 99% or higher, with Defender specifically reaching a 99.0% protection rate without false positives. This performance indicates that Defender is adequate for most consumers. Default security measures on platforms are generally effective, with modern antivirus applications blocking 99.2% of threats that bypass other protections. Consequently, 97% of PCs remain free from malware infections, suggesting that improving user training may be more beneficial than investing in superior software. In contrast, businesses face different challenges, as attacks are often executed by sophisticated criminal organizations targeting vulnerabilities in third-party software. Enterprise administrators typically use specialized endpoint security products for centralized management and continuous monitoring, which are essential for protecting business environments.
A critical Windows 11 and Windows 10 flaw turns Microsoft Defender into a hacker's best friend
Winsage
June 30, 2026

A critical Windows 11 and Windows 10 flaw turns Microsoft Defender into a hacker’s best friend

Chaotic Eclipse, also known as Nightmare-Eclipse, bypassed Windows 11's BitLocker security using a USB stick and claimed Microsoft left a backdoor in the system. Following this, Microsoft patched three zero-day exploits named YellowKey, GreenPlasma, and MiniPlasma. Nightmare-Eclipse then revealed another zero-day vulnerability called RoguePlanet, which affects Microsoft Defender on Windows 10 and 11, potentially allowing attackers full control over compromised systems. Microsoft is tracking this vulnerability as CVE-2026-50656 and is working on a security update. Nightmare-Eclipse provided a proof-of-concept exploit and described it as a race condition with variable success rates. Microsoft has promoted Windows Defender as adequate for most users but acknowledged that third-party tools can offer additional protection. The company initially threatened legal action against Nightmare-Eclipse but later decided not to pursue lawsuits against researchers sharing their findings.
A critical exploit bypasses Microsoft Defender in Windows 11 and Windows 10 — so much for "everyday risk protection without additional software"
Winsage
June 30, 2026

A critical exploit bypasses Microsoft Defender in Windows 11 and Windows 10 — so much for “everyday risk protection without additional software”

Security researcher Chaotic Eclipse, known as Nightmare-Eclipse, bypassed Windows 11's BitLocker security using a USB stick and claimed Microsoft intentionally included a backdoor in the feature. Microsoft responded by patching three zero-day exploits disclosed by Nightmare-Eclipse: YellowKey, GreenPlasma, and MiniPlasma, and is monitoring another exploit called RoguePlanet, cataloged as CVE-2026-50656. The RoguePlanet exploit is a race condition with varying success rates on different machines, achieving a 100% success rate on some devices. Microsoft acknowledged that while Windows 11's Defender is generally sufficient for most users, third-party tools can offer additional security features. Tensions between Nightmare-Eclipse and Microsoft have risen, with the company previously considering legal action but now indicating it will not pursue lawsuits against researchers sharing their findings.
Are Antivirus Subscriptions Essential Protection Or Clever Marketing?
Tech Optimizer
June 25, 2026

Are Antivirus Subscriptions Essential Protection Or Clever Marketing?

Many individuals question the value of their antivirus subscriptions, especially as free protection options have improved and the features of paid services may not be necessary for everyone. Modern antivirus solutions now include features like VPNs, password managers, parental controls, identity theft protection, and dark web monitoring, which may go unused by some users. Those with modern devices may already have built-in security measures, such as Microsoft Defender for Windows users and similar protections for Mac users, making paid subscriptions potentially unnecessary for those practicing safe online behaviors. Paid antivirus may be worthwhile for individuals managing multiple devices or users, or if the bundled features are more economical than purchasing them separately. Auto-renewal can lead to unexpected charges and upselling tactics, emphasizing the importance of reviewing subscriptions regularly. Ultimately, the decision to pay for antivirus depends on individual circumstances and comfort with technology. Disabling auto-renewal is recommended to allow for annual evaluations of needs and competitive offers.
Malware Has Gotten Smarter. Here's How Your Antivirus Has, Too
Tech Optimizer
June 21, 2026

Malware Has Gotten Smarter. Here’s How Your Antivirus Has, Too

Antivirus software is evolving from relying on static databases of known malware signatures to employing behavioral monitoring and machine learning for threat detection. Traditional antivirus solutions focused on recognizing known threats through unique signatures, but this approach has become inadequate due to the rapid evolution of malware, including polymorphic and metamorphic types. Modern antivirus systems now monitor program behavior, looking for suspicious activities such as unexpected file encryption or unusual network communication. Machine learning models analyze large datasets to identify patterns associated with malware, allowing for the classification of files as safe, potentially unwanted, or malicious. Techniques like sandboxing and dynamic analysis are used to preemptively neutralize threats. However, advancements in AI also present challenges, as cybercriminals can exploit these technologies to create sophisticated malware that evades detection. Despite improvements in antivirus effectiveness, modern cyberattacks increasingly target individuals through methods like phishing and social engineering, necessitating a combination of robust antivirus solutions and good cybersecurity practices.
Search