Microsoft Archives

Tech Optimizer

September 23, 2026

BigDiskBuster PoC Blocks Windows Defender Updates

A new tool named BigDiskBuster has been released on GitHub, which disrupts Microsoft Defender Antivirus by preventing it from installing updates. It does this by consuming available disk space during the update process, causing Defender to remain on its current version and unable to receive new platform or signature updates. BigDiskBuster operates as a local denial-of-service technique and requires prior access to the target machine to execute. The tool was created by researcher Abdelhamid Naceri, known as Nightmare Eclipse, who has previously worked on similar projects. As of now, there is no CVE identifier, patch, or advisory from Microsoft regarding this issue.

Winsage

September 23, 2026

DOC IN A BOX: Confused? Your Windows 10 PC still works, but the clock is running out

A customer brought in a functional Dell laptop running Windows 10, which lost mainstream support from Microsoft in October 2025. Although the laptop still operates, Microsoft has stopped patching security vulnerabilities unless users take specific actions. Users have three options: upgrade to Windows 11 if their PC meets requirements, purchase a new or refurbished PC, or enroll in extended security updates available until October 2027. There is also a warning about potential scams related to Windows 10's support status. Users can check their PC's eligibility for Windows 11 using the "PC Health Check" app from Microsoft.

AppWizard

September 23, 2026

Google Rolls Out Googlebook: A New Era for Android Laptops

On September 22, 2026, Google introduced the Googlebook, a laptop built on a shared Android foundation, designed to combine the convenience of mobile devices with the power of traditional laptops. Collaborating with manufacturers like HP, Dell, Lenovo, Acer, and Asus, the Googlebook features high-resolution OLED touchscreens, precise trackpads, dedicated keyboards, and boasts a 14-hour battery life. It operates on either Intel’s Core Ultra Series 3 processors or Qualcomm’s Snapdragon X chips, with initial shipping in the U.S. set for October 4, 2026, followed by launches in the UK, France, and Australia on October 5. The Googlebook can run Android applications natively, enhancing multi-tasking capabilities, and developers are encouraged to optimize their apps for the device using Google's Adaptive Development framework. Google plans to provide a decade of software updates for the Googlebook operating system.

Winsage

September 23, 2026

New Windows Defender zero-day blocks Microsoft antivirus updates

Security researcher Abdelhamid Naceri, known as Nightmare Eclipse, released a zero-day exploit called BigDiskBuster that targets Microsoft Defender, preventing antivirus updates and leaving systems vulnerable. BigDiskBuster operates across all supported Windows versions and must run in the background to block updates. Naceri has previously released a similar exploit called UnDefend and has a history of releasing multiple zero-day exploits since April 2026 amid a dispute with Microsoft. Two weeks before BigDiskBuster, he introduced another exploit named ShieldCrash, which grants SYSTEM access and circumvents a patched flaw. Naceri's recent exploits include tools like LegacyHive, BlueHammer, RedSun, YellowKey, GreenPlasma, and MiniPlasma, all targeting Microsoft Defender and other Windows components. Microsoft has warned of potential legal action against malicious activities but has not commented on BigDiskBuster.

Winsage

September 23, 2026

PAYLOAD ransomware hijacks Windows Group Policy in encryption-less attacks

A sophisticated PAYLOAD ransomware attack targeted an unnamed manufacturing organization in the Middle East, exploiting vulnerabilities in Microsoft Active Directory Group Policy. The attackers accessed the network through a compromised domain account via FortiGate SSL VPN on April 11, escalated privileges to domain administrator by April 13, and created a malicious Group Policy Object (GPO) named "PAYLOAD." This GPO was linked at the root of the domain, allowing it to affect nearly all domain-joined Windows workstations. The attackers distributed ransom notes, altered desktop images, displayed ransom messages at login, and disabled local administrator accounts. A second GPO, "win Firewall Off," was deployed to disable Windows Firewall across all profiles. The malicious policies activated on April 14 after systems were rebooted, causing widespread disruption. The attackers also exfiltrated data from file servers and published it on the dark web, while Kaspersky found no evidence of Windows file encryption or active malware processes. Recommendations for organizations include monitoring GPO creation, checking for unexpected changes, implementing multi-factor authentication for VPN access, and protecting privileged accounts.

Winsage

September 22, 2026

PAYLOAD ransomware hijacks Windows Group Policy in encryption-less attacks

A sophisticated PAYLOAD ransomware attack targeted a manufacturing organization in the Middle East, exploiting vulnerabilities in Microsoft Active Directory Group Policy. The attackers gained initial access on April 11 by compromising a domain account through the company's FortiGate SSL VPN. By April 13, they escalated privileges to a domain administrator and created a malicious Group Policy Object (GPO) named “PAYLOAD,” which was linked at the root of the domain. This GPO allowed them to distribute a ransom note, change desktop images, display a ransom message during login, and disable the local administrator account. A secondary GPO, “win Firewall Off,” was used to disable Windows Firewall across all profiles. The malicious changes activated on April 14 after system reboots, causing widespread disruption. The attackers also exfiltrated sensitive data, which was later released on the dark web. Kaspersky's investigation found no evidence of file encryption or active malware processes, indicating the attack was contained within Active Directory. Recommendations for organizations include monitoring GPO modifications, implementing multi-factor authentication for VPN access, and safeguarding privileged accounts.

Winsage

September 22, 2026

Microsoft’s most useful Windows toolkit turns 30 this year, and it still doesn’t ship with Windows 11

A fresh installation of Microsoft Windows 11 includes features like Copilot but lacks certain user control tools. The Sysinternals suite, maintained by Microsoft since its acquisition in 2006, consists of over 70 utilities and has received regular updates since its establishment in 1996. Notable updates include a modern interface for DebugView and enhanced support for startup apps in Autoruns. Sysinternals tools, such as Process Explorer and Autoruns, offer advanced functionality compared to standard Windows tools. Microsoft is integrating some Sysinternals utilities into PowerToys, starting with ZoomIt, and Sysmon has been introduced in Windows 11 Insider builds. Users have expressed interest in further integration of Sysinternals tools, particularly Process Explorer.

Winsage

September 22, 2026

Windows has been so buggy I paused monthly updates, and now I wait for reports before installing anything

Users frequently express frustration with Windows updates due to unexpected restarts and frequent breakdowns, leading to a perception of being beta testers for Microsoft. Problems often arise with updates, including significant disruptions from routine maintenance updates. Recent issues included difficulties with the Windows Subsystem for Linux and copy-paste functionality in Microsoft Excel. In July, Microsoft paused an update due to unexpected shutdowns on some Dell PCs. Users are increasingly adopting a wait-and-see approach before installing updates, utilizing Windows 11's ability to pause updates for several weeks. Historically, Windows lacked robust update management, but recent changes have extended the pause period. There is a significant concern regarding the limited control users have over updates and the need for improved quality control from Microsoft.

Tech Optimizer

September 22, 2026

This fake LastPass Authenticator app will just shut off your antivirus and leave you open to attack

LastPass has identified a sophisticated scheme targeting users of its Authenticator app, involving SEO poisoning and deceptive GitHub pages that distribute malicious ZIP files disguised as legitimate software. Users searching for "LastPass Authenticator download" may encounter these counterfeit pages, which redirect them to a malicious server delivering a ZIP file containing vsdbg.exe and vsdbg.dll. The executable is a legitimate Microsoft debugging tool exploited to execute the malicious DLL through DLL sideloading, allowing the malware to run undetected. Named Rapuncel by security researchers from Delphos, this malware is undetectable by antivirus engines and targets a hardcoded list of 145 antivirus and endpoint security products, disabling them upon detection. Rapuncel harvests sensitive information, including saved passwords from over 25 web browsers, cryptocurrency wallet files from more than 30 applications, and session tokens from platforms like Discord and Steam. It also captures screenshots and compiles a profile of the infected system, uploading the stolen data to an attacker-controlled server. The malware includes a kernel driver that intercepts web traffic, allowing for advertisement injection and search result manipulation. This campaign has been active for several months, with LastPass vaults remaining unaffected. Users are advised to download applications only from trusted sources. Rapuncel establishes persistence on infected machines by installing itself as a Windows service that starts with the system and terminates activated security products. Removing the kernel driver requires booting into Safe Mode or using external recovery tools, as standard Windows utilities cannot eliminate software operating at that level.

Winsage

September 22, 2026

Microsoft engineer explains what made Windows 7 take 30 seconds to show the desktop

Changing the desktop wallpaper to a solid color in Windows 7 caused a 30-second delay on the Welcome screen after entering a password. This issue arose because the system waited for a signal from the wallpaper component, which only sent its "I'm ready" signal when an image file was used. When a solid color was selected, this signal was not sent, leading to unnecessary waiting. The problem was acknowledged by Microsoft for both Windows 7 and Windows Server 2008 R2, and it was resolved with a Hotfix update in November 2009. Users found workarounds, such as switching to an image or creating a small solid-color image, to eliminate the delay.