Researcher Archives

Winsage

August 27, 2026

New Windows malware lays dormant until a custom command activates it like a sleeper agent

Researcher Dominik Reichel has identified a new malware implant called SLEEPWALKER, which is disguised as an agent from ESET. SLEEPWALKER is unique because it does not contain malicious code and remains dormant until it receives specific network signals to activate. It appears to be designed for targeted attacks, likely orchestrated by nation-states. Although it was submitted to VirusTotal last year, it has not been linked to any active campaigns or confirmed victims. The origins of SLEEPWALKER are unknown, and its code is described as somewhat "rough around the edges," indicating it may still be in development.

AppWizard

August 26, 2026

Beware of fake Indeed interview apps used to install spyware

Scammers are exploiting the Indeed platform to target job seekers by using counterfeit Android "interview" applications. Users in the UK and Brazil reported being instructed by supposed employers to download fraudulent apps like MyInterview, which compromised their devices. These scammers post fake job listings and prompt applicants to install apps that mimic Indeed's login page and establish a VPN connection. The malicious apps, classified as Trojan.Droppers, can install additional untrusted software and gain control over devices, complicating uninstallation efforts. Indeed confirmed that their interview process does not require downloading any separate app and warned job seekers against such scams. Indicators of compromise include specific MD5 hashes and package names associated with the Trojan droppers and dropped malware payloads.

AppWizard

August 26, 2026

GBA Emulator Android: My Boy! vs John GBAC vs RetroArch

Game Boy Advance emulation on Android has gained significant traction in 2026, with key applications like My Boy! priced at .99, John GBAC receiving an update on May 19, 2026, and RetroArch enhancing its mGBA core for free use. The search term "gba emulator android" sees around 8,100 monthly searches in the U.S., reflecting a resurgence in interest, particularly among former GBA owners now in their late 20s and 30s who prefer using their smartphones for gaming. All five apps—My Boy!, GBA.emu, John GBAC, RetroArch, and Lemuroid—can run the entire GBA library at full speed on devices from the last six years. The main differences lie in software quality, including save state management, cheat code reliability, controller mapping, and update frequency. My Boy! and GBA.emu utilize cores derived from VisualBoyAdvance (VBA), while John GBAC uses a custom core, and RetroArch and Lemuroid rely on the mGBA core. In terms of features, all apps support save states, but My Boy! offers multiple named slots with thumbnail previews, while RetroArch has a more complex system. Cheat code support is available across the board, with My Boy! and GBA.emu accepting GameShark and CodeBreaker formats, and RetroArch providing a built-in cheat database. My Boy! stands out for its link-cable emulation, allowing local multiplayer connections, whereas RetroArch's netplay is designed for online gaming. All apps support external controllers, but RetroArch excels in visual enhancements with its extensive shader options. The setup process for all five apps is similar and typically takes under ten minutes. GBA ROMs are small, ranging from 4MB to 32MB, making them easy to store on modern devices without significant battery drain. Common issues include save files not loading, audio problems, and cheat codes failing to apply, with solutions often involving file management and settings adjustments. Users can migrate save files between emulators by ensuring the correct file naming and directory structure. Pros and cons of each app include: - My Boy!: Ad-free, strong multiplayer support, but lower rating and closed-source. - GBA.emu: High rating and broad support, but outdated and lacks a free trial. - John GBAC: Free and recently updated, but lower rating and ad-supported. - RetroArch: Free and feature-rich, but complex setup. - Lemuroid: User-friendly and actively maintained, but limited shader options. All five apps are legally available on Google Play, as they do not distribute copyrighted ROM files. Users are advised to source their ROMs legally, ideally by dumping from their own physical cartridges. GBA emulation remains an accessible entry point into retro gaming on Android, especially compared to more demanding systems like the PS2 or GameCube.

Winsage

August 24, 2026

You don’t want this Sleepwalker backdoor on your Windows machine

Malware researcher Dominik Reichel has discovered a sophisticated Windows backdoor named Sleepwalker, which remains dormant in memory until activated by a specially crafted network packet. Sleepwalker uses a 23-instruction command language to execute tasks, including running code in memory and exfiltrating data. It activates through a proprietary activation packet that does not contain readable commands. The malware targets a VMware VMCI and disguises itself as Microsoft's dpapi.dll, mimicking its functions while redirecting calls to a non-existent file. Once it confirms its host process as ERAAgent.exe, it enters a dormant state to evade detection. Sleepwalker monitors for a specific pattern known as a magic packet to decrypt and interpret commands. Commands sent to it are encrypted with AES-256-CCM and must be read in a specific order. The backdoor includes functionalities for sending and concealing data, receiving tasks, and executing programs. Reichel has developed a toolkit to decode Sleepwalker’s bytecode and a mitigation guide for affected users. However, there are significant gaps in knowledge regarding the initial access method, victim identification, and the malware's operator.

AppWizard

August 22, 2026

PC Game With 96/100 Rating Is 100% Free on Steam

A new free PC game on Steam has received a rating of 96 out of 100 based on nearly 1,000 user reviews, earning it an “Overwhelmingly Positive” designation. Out of 986 reviews, 965 are positive. The game's compatibility with the Steam Deck is currently listed as “Unknown.” Developed by Zzangdol Games and published by Jungle Game Lab, the game is titled "No Results Found," which involves players investigating a case related to the Church of the Nine-Tentacled Octopus after a tragic incident where 227 church affiliates drowned. The game has been praised for its immersive storytelling and engaging deduction mechanics, though some reviews mention its complexity and the use of AI in development.

AppWizard

August 18, 2026

Minecraft workshops build understanding of cityscapes before atomic bombings

A graduate student from the University of Tokyo, Misaki Katayama, has been leading two-day workshops since 2023 that allow fourth- to sixth-grade elementary school students to explore the historical landscapes of Hiroshima and Nagasaki before the atomic bombings of August 1945. Using Minecraft, students reconstruct the cities with the help of historical maps, photographs, and video footage, fostering engagement, creativity, and reflection on the impact of nuclear warfare.

Winsage

August 16, 2026

Microsoft threatened legal action, and this researcher just dropped a new Windows bug anyway

Microsoft has faced legal warnings regarding the disclosure of vulnerabilities, but security researcher Nightmare Eclipse has revealed a new exploit called ShieldBreak that targets Windows Defender. This vulnerability allows attackers to escalate privileges from a low-level user account to full system access on Windows 10, Windows 11, and Windows Server 2025. The proof of concept for ShieldBreak is available as a downloadable application, requiring execution to activate the exploit. Security expert Will Dormann confirmed that Windows Defender must be activated for the attack to succeed. ShieldBreak builds upon a previous exploit named RoguePlanet, which Microsoft patched inadequately, allowing ShieldBreak to bypass the fix. Microsoft is currently investigating the reported vulnerability, but no patch has been released yet.

Winsage

August 13, 2026

Nightmare Eclipse Drops Windows Zero-Day Exploit ‘ShieldBreak’

Security researcher Nightmare Eclipse has released a zero-day exploit named ShieldBreak that allows privilege escalation on Windows by targeting a vulnerability in Microsoft Defender. This exploit, designated as CVE-2026-50656, is categorized as a race condition vulnerability and affects the latest versions of Windows 11 and Windows Server 2025, with potential impacts on Windows 10. The exploit was disclosed on June 9, 2026, and Microsoft acknowledged the issue on June 16, rolling out fixes by July 9. The mechanics of ShieldBreak involve manipulating Defender’s scan path and executing a scheduled task to gain System-level privileges. Experts have noted differences between ShieldBreak and the previously known RoguePlanet exploit, emphasizing that ShieldBreak requires Defender to be active to function.

Winsage

August 13, 2026

Researcher threatened by Microsoft finds new critical bug in Windows | Researcher had accused Microsoft of mistreatment

A vulnerability in Microsoft Defender, named ShieldBreak, has been revealed by security researcher Nightmare Eclipse, allowing malicious actors to gain complete system-level access to a user's device. Microsoft has previously warned against public disclosure of vulnerabilities and suggested potential legal repercussions for researchers who do so outside its protocols. Users of Microsoft Defender are advised to remain vigilant regarding this vulnerability.

Winsage

August 12, 2026

After Microsoft threatened legal action, a security researcher publishes a new Windows zero-day bug

A security researcher named Nightmare Eclipse has discovered a vulnerability in Windows, called ShieldBreak, which allows hackers to gain system-wide access to users' devices and sensitive data by exploiting a flaw in Windows Defender. The vulnerability affects Windows 10, Windows 11 (including version 25H2), and Windows Server 2025. A proof-of-concept exploit has been provided, requiring users to run a Windows application to trigger the vulnerability. Security researcher Will Dormann confirmed that Windows Defender must be enabled for the exploit to work. Microsoft has not yet released a patch for ShieldBreak, which is classified as a zero-day vulnerability. This discovery follows previous vulnerabilities disclosed by Nightmare Eclipse, including RoguePlanet, for which Microsoft issued an inadequate patch. The situation has heightened tensions between the researcher and Microsoft regarding the handling of bug reports, especially after Microsoft threatened legal action against researchers disclosing zero-days outside established protocols. The disclosure of ShieldBreak occurred shortly after Microsoft's monthly security patch releases, which have been increasing in number.