shell Archives

Winsage

April 14, 2026

This fake Windows 11 24H2 update looks perfect, until it avoids antivirus and steals your passwords

Cybercriminals are using sophisticated tactics to deceive users, particularly with a counterfeit website posing as a legitimate Windows 11 update. This site operates under the domain microsoft-update[.]support and is designed to trick individuals into downloading malware that compromises sensitive information. The site is written in French and mimics a genuine cumulative update for Windows 11, version 24H2, featuring a convincing KB article number and a blue download button. The malware is packaged as a Windows update using the WiX Toolset 4.0.0.5512 and is labeled "WindowsUpdate 1.0.0.msi," with properties that suggest it is from Microsoft. At the time of analysis, VirusTotal showed no detections for the malware, which conceals its harmful code within an Electron shell, making it difficult to identify. Users are advised to download updates directly through the Windows Settings app or from Microsoft's official support hub.

Tech Optimizer

April 13, 2026

Fake Windows 11 support site offers ‘update’ that steals data and evades antiviruses

Malwarebytes has discovered a counterfeit Windows support site offering a fake "cumulative update" for Windows 11 24H2. Users who click the "Download Update" button download an 83MB package designed to compromise sensitive information, including passwords and payment details. The file, named WindowsUpdate 1.0.0.msi, falsely lists Microsoft as the author and is created using WiX Toolset 4.0.0.5512. VirusTotal reported zero detections for the main executable and VBS launcher, highlighting the malware's architecture designed to evade detection. The malicious website's address includes "microsoft-update.support," differing from the legitimate support site. Malwarebytes has added the malicious site to its detection service database.

Winsage

April 10, 2026

Windows Zero-Day Published on Github as Microsoft Fails to Act

A security researcher named Chaotic Eclipse published a working exploit for a Windows zero-day vulnerability, called BlueHammer, on GitHub on April 2. The exploit allows attackers to gain SYSTEM-level privileges by exploiting a race condition in Windows Defender’s signature update mechanism. The exploit has gained significant attention, with over 100 forks and nearly 300 stars on GitHub. Will Dormann, a principal vulnerability analyst, confirmed that while BlueHammer is functional, it may not always operate reliably. Microsoft has not issued a patch for this vulnerability. The exploit targets the Windows Defender signature update process, allowing low-privilege attackers to manipulate a file path during operation, leading to access to the Security Account Manager (SAM) database. Currently, only 8 out of 72 cybersecurity vendors on VirusTotal flag the exploit file as malicious, which raises concerns about detection coverage. Microsoft reiterated its commitment to coordinated vulnerability disclosure but did not address the communication issues regarding the BlueHammer report.

Winsage

April 9, 2026

This fake Windows support website delivers password-stealing malware

A phishing campaign has been identified that uses a counterfeit Microsoft support website, microsoft-update[.]support, to trick users into downloading a malicious Windows update disguised as WindowsUpdate 1.0.0.msi. This file, created on April 4, 2026, appears legitimate but contains malware designed to steal sensitive information. The campaign targets French-speaking users, leveraging recent data breaches in France to create convincing scams. The malware, once executed, installs an Electron application that runs a Python interpreter, which then deploys various data theft tools. It employs two persistence mechanisms: modifying the Windows registry and creating a shortcut in the Startup folder. The malware connects to external sites for reconnaissance and data exfiltration, using domains like datawebsync-lvmv.onrender[.]com and store8.gofile[.]io. The malware's components have evaded detection by antivirus tools, with VirusTotal reporting zero detections for the main executable and its launcher. Users are advised to check their registry, remove suspicious files, change passwords, and run a full system scan if they suspect installation of the malicious update. Safe updating practices include using the built-in Windows update feature and being cautious of phishing attempts. Indicators of compromise include specific file hashes, domains associated with the phishing campaign, and file system artifacts related to the malware's installation.

Winsage

April 9, 2026

Windows 11’s ‘Send to’ menu is a mess. Fix it in seconds

In Windows 11, the context menu can become cluttered with unnecessary "Send to" entries. To clean it up, right-click on a file or folder in File Explorer, select “Show more options,” and then use the “Send to” feature. To remove unwanted entries, press Windows + R to open the “Run” dialog, type shell:sendto, and hit Enter. This will take you to the folder where “Send to” shortcuts are stored, allowing you to delete any that are no longer needed.

Winsage

April 8, 2026

Microsoft rolls out fix for broken Windows Start Menu search

Microsoft has implemented a server-side remedy for an issue affecting the Windows Start Menu search functionality on select Windows 11 23H2 devices, which began impacting users on April 6. The problem was linked to a server-side Bing update aimed at improving search performance. Microsoft has rolled back the problematic Bing update and expects search issues to decrease as the fix is deployed. Users have reported blank search results in the Start Menu, but options remain clickable. Microsoft confirmed that the issue will resolve automatically with the rollout of the fix, provided devices are connected to the internet and Web Search is enabled. Additionally, there have been previous Start Menu-related issues, including crashes and error messages, with Microsoft working on permanent solutions for these problems.

AppWizard

April 7, 2026

SteelSeries tested its new gaming mouse with a car and dishwasher, but I just played games with it

The SteelSeries Aerox 3 Wireless Gen 2 is a gaming mouse featuring a TrueMove 26K optical sensor with a maximum sensitivity of 26,000 DPI, six buttons, and a switch lifespan of 80 million clicks. It weighs 68g and offers connections via Lightspeed 2.4GHz wireless and USB-C, with a polling rate of up to 4kHz wirelessly and 1kHz wired. The battery lasts up to 120 hours at 1kHz polling rate and up to 200 hours via Bluetooth. It has an IP54 waterproof rating and comes with RGB lighting, a USB-C wireless dongle, a USB-A to USB-C cable, a USB-C to USB-C adapter, and Bluetooth connectivity. The price is .99 / £99.99. The mouse features a unique translucent shell design, water and dust resistance, and impressive battery longevity, but has a shape that may not suit everyone, a slippery shell material, and side buttons that may be overly long.

Tech Optimizer

April 6, 2026

36 Malicious npm Packages Exploited Redis, PostgreSQL to Deploy Persistent Implants

Cybersecurity researchers have discovered 36 malicious packages in the npm registry that impersonate Strapi CMS plugins. These packages exploit Redis and PostgreSQL, deploy reverse shells, harvest credentials, and establish persistent implants. Each package consists of three files—package.json, index.js, and postinstall.js—without descriptions or repositories, and all use version 3.6.8 to mimic legitimate Strapi plugins. The malicious packages follow a naming convention starting with "strapi-plugin-" and were uploaded by four accounts within 13 hours. The identified packages include names like strapi-plugin-cron, strapi-plugin-database, and strapi-plugin-server. The malicious code is embedded in the postinstall script, executing automatically upon installation with the same privileges as the user. The payloads evolve from exploiting Redis for remote code execution to attempting direct PostgreSQL database exploitation and deploying persistent implants for remote access. The campaign appears to target cryptocurrency platforms, as indicated by the focus on credential theft and digital assets. Users of these packages are advised to assume compromise and rotate credentials. This incident reflects a broader trend of supply chain attacks in the open-source ecosystem, with recent examples including credential exfiltration payloads in GitHub repositories and compromised GitHub Actions workflows. Group-IB reported that software supply chain attacks are increasingly reshaping the cyber threat landscape, targeting trusted vendors and open-source software to gain access to downstream organizations.

AppWizard

April 1, 2026

‘NoVoice’ Android malware on Google Play infected 2.3 million devices

A new Android malware called NoVoice has been found in over 50 applications on Google Play, with more than 2.3 million downloads. The malware targets older Android versions, specifically those patched between 2016 and 2021, and attempts to gain root access by exploiting vulnerabilities. It conceals malicious components within the com.facebook.utils package and uses steganography to hide an encrypted payload within a PNG image file. NoVoice avoids infecting devices in certain regions and has checks to detect emulators and VPNs. Once activated, the malware contacts its command-and-control server to gather device information and polls it every 60 seconds for tailored exploits aimed at rooting the device. It can exploit 22 vulnerabilities, including kernel bugs, and establishes persistence by replacing key system libraries and installing recovery scripts. The malware injects code into applications, particularly targeting WhatsApp to extract sensitive data for session replication, which is then exfiltrated to the C2 server. The malicious apps containing NoVoice have been removed from Google Play, but users who installed them should consider their devices compromised. Upgrading to devices with later security patches is recommended to mitigate the threat.

Winsage

April 1, 2026

After years of complaints, Microsoft is finally working to improve Windows 11 Search

Microsoft is implementing significant enhancements to Windows 11, including major revisions to File Explorer and a reduction in Copilot integration. A dedicated team is being formed to transition web applications to native Windows 11 apps. Tali Roth, head of Windows Shell, has acknowledged user frustrations with Windows Search and confirmed that improvements are forthcoming to simplify the search experience and refine search rankers. These adjustments aim to prioritize relevant results, ensuring users find the correct applications, such as directing searches for "Terminal" to the Windows Terminal. The updates also include changes to the Start Menu, contributing to a more intuitive and user-friendly platform.