surveillance Archives

Winsage

July 12, 2026

Microsoft Confirms Windows GDID Device Identifier That Cannot Be Disabled, Documented in FBI Case Filing

Microsoft has confirmed the existence of the Global Device Identifier (GDID), a unique identifier assigned to Windows installations, in a federal complaint against an alleged member of the Scattered Spider hacking group. The GDID is generated when a Windows system is set up with a Microsoft Account and remains active through various Windows updates. Disabling the GDID could disrupt Windows activation and access to Microsoft Store applications. The GDID is described as "a persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device." It is created during the provisioning of Windows with a Microsoft Account and is stored in the Windows registry under HKCUSOFTWAREMicrosoftIdentityCRLExtendedProperties. The GDID remains persistent through Windows updates but is not retained after a clean reinstall. A single user can possess multiple GDIDs linked through their account, OneDrive, and activation history. The FBI used the GDID to track Peter Stokes, an alleged member of the Scattered Spider group, across various VPN connections and proxy servers. The GDID was recorded visiting specific websites and was linked to Stokes's accounts on platforms like Snapchat and Facebook. Concerns have been raised regarding user privacy, as the GDID is assigned without user consent and cannot be disabled without compromising essential Windows features. Microsoft has not committed to providing user-facing controls or comprehensive documentation for everyday users regarding the GDID. Legal requests can compel Microsoft to disclose GDID activity data to law enforcement. The GDID is linked to the Microsoft Account rather than the device itself, meaning reinstalling the operating system does not sever this connection.

Winsage

July 10, 2026

Windows 11 Has a Hidden Tracker – Here’s How to Limit It

Peter Stokes is involved in a breach with a luxury retailer, using tactics like VPNs and rotating IP addresses to hide his digital activity. The FBI discovered a Global Device Identifier (GDID) linked to his Windows installation, which is a persistent device-level identifier that uniquely identifies Windows installations. GDID remains unchanged through operating system updates but resets with a full reinstallation. Disabling GDID is not possible, as attempts to do so would disrupt Windows activation. Users can minimize data linked to GDID by using a local account, reducing diagnostic telemetry, disabling Activity history, and carefully managing reinstalls. VPNs do not prevent Microsoft from logging GDID, IP address, and URL data. Privacy researchers view GDID as a covert tracking mechanism, and Windows lacks user-facing options to reset this identifier, unlike Apple and Google.

Winsage

July 10, 2026

You can’t fully disable Microsoft’s GDID Windows 11 tracker, but these settings limit what it captures

A 19-year-old named Peter Stokes was detained at Helsinki airport in April 2026 while traveling to Japan, carrying two 2TB hard drives. He was subject to an Interpol Red Notice and faced a federal complaint from U.S. prosecutors by July for his alleged involvement in the Scattered Spider hacking group, which breached a U.S. luxury jewelry retailer in May 2025, leading to a ransom demand. The Global Device Identifier (GDID), developed by Microsoft, is a persistent identifier that uniquely identifies a Windows installation on a device. It links online activities back to a single identity, which law enforcement can use to trace a device's owner. The GDID is generated when a user signs into Windows with a Microsoft Account and remains through updates but does not survive a clean reinstall. Stokes' use of the same Windows device allowed investigators to trace his activities through the GDID, which linked him to the hacking incident. Privacy advocates have raised concerns about the lack of consent for GDID assignment and the potential for surveillance.

Winsage

July 10, 2026

Microsoft Warns of GigaWiper Backdoor Built to Destroy Windows PCs

Microsoft has unveiled a destructive Windows backdoor named GigaWiper, which allows operators remote control over compromised systems to execute irreversible damage. GigaWiper originated from cyberattacks in October 2025 and is a composite of code from at least three malware families. It maintains its presence through a scheduled task disguised as “OneDrive Update,” executing at startup and every minute. GigaWiper can obliterate partition information, overwrite physical drives, and restart systems. It also mimics ransomware by encrypting files with the .candy extension, using randomly generated keys that are not stored, making recovery impossible. The malware has connections to the Crucio ransomware and resembles FlockWiper, with rewritten code in Go. GigaWiper features 20 command codes for various functions, including executing PowerShell instructions, managing processes, capturing screenshots, and remote access similar to VNC. It can remain on a system for surveillance until its destructive functions are activated. Microsoft Defender includes detection capabilities for GigaWiper, and users are advised to enable tamper protection and monitor for suspicious activities.

AppWizard

July 9, 2026

MindsEye developers protest against a fan event their own studio is hosting

MindsEye, an action game from Build a Rocket Boy, is set to have a playtest at the studio's Edinburgh headquarters, inviting community members and covering their travel costs. This comes after significant layoffs that affected over 400 employees, leading to protests organized by the Independent Workers Union of Great Britain, which criticizes the studio for spending on the playtest while having recently laid off staff. The union also alleges the studio has engaged in questionable practices, including employee surveillance. The playtest is seen as a strategy to regain favor with fans amid concerns about the studio's management and treatment of its workforce.

Winsage

July 8, 2026

Arrest and extradition of Scattered Spider hacker shines light on how Windows telemetry GDIDs can identify and track users — Microsoft device identifier is just one digital fingerprint in a software world rife with them

Peter Stokes, a 19-year-old from Estonia, was arrested and extradited to the United States on charges related to digital crimes, with the FBI using telemetry logs from Microsoft Windows to trace his online activities. These logs included his Global Device Identifier (GDID) and records of websites he visited. Stokes likely had his telemetry settings configured to Optional/Full, which allowed the transmission of URL data. The FBI connected Stokes to his ngrok account and linked his travel records to a New York IP address and a rental at the Empire Hotel, aided by photos he shared. Google and Apple assisted in the investigation by tracing Stokes' phishing phone number back to the same IP address used for his ngrok account. Stokes attempted to obscure his digital footprint using a VPN and other services, but modern digital identification methods made it difficult to remain anonymous.

AppWizard

July 7, 2026

Chat Control 1.0: EU Council forces messenger scans via fast-track

Member states of the European Union are seeking to reinstate a previously expired regulation concerning the monitoring of encrypted communications, known as Chat Control 2.0, which mandates suspicionless scanning of encrypted messages. The Council of Ministers has proposed to reactivate a transitional regulation that allowed voluntary monitoring by technology companies, which lapsed on April 3. This move aims to close a legal gap and pressure Members of the European Parliament (MEPs) to act quickly. The expiration of the previous regulation is viewed as untenable, as it is deemed crucial for identifying at-risk children and combating illegal content online. Critics argue that the approach undermines democratic oversight and lacks transparency. The draft regulation is set to be discussed as an urgent matter just before the summer recess, with potential voting occurring when many MEPs may be absent. The regulation requires that any processed content and traffic data be deleted within twelve months unless a specific suspicion is confirmed.

Winsage

July 1, 2026

Steve Ballmer once trashed Linux as “a cancer” — now it’s saving Windows 10 holdouts

In 2001, Steve Ballmer, then CEO of Microsoft, referred to Linux as a "cancer" threatening Microsoft's intellectual property and likened its users to "communist thieves." By 2016, after Microsoft ported SQL Server to Linux, Ballmer expressed enthusiasm for the change and acknowledged that the conflict with open-source had benefited Microsoft's financial success. In 2020, Microsoft President Brad Smith admitted the company had been on the wrong side of history regarding open source and noted the need for change. Microsoft has since embraced open-source technologies, introducing products like Azure Linux 4.0, built on Fedora. As Windows 11's transition becomes difficult for users, advocacy groups have criticized Microsoft for ending support for Windows 10, which could lead to millions of discarded computers. Microsoft extended Windows 10's life through an Extended Security Updates program until October 14, 2026, with a recent announcement pushing it to 2027. Rising hardware costs and design flaws in Windows 11 have led some users to consider alternatives like Linux. A survey revealed that 30% of PCs are still running Windows 10, and a poll showed that 68% of respondents plan to stick with Windows 10 through 2027.

AppWizard

July 1, 2026

South Korean trade watchdog alleges Google abused its position in Android app store

South Korea's antitrust regulator, the Korea Fair Trade Commission (KFTC), has raised concerns about Google's practices in the Android app marketplace, identifying potential abuses of market dominance that may have stifled competition. The KFTC's Market Surveillance Bureau reported that Google's actions have impacted approximately 14.16 trillion won (around billion) in revenue. The report focuses on Google's "Games/Google Velocity Program," which operated from July 2019 to March 2026, providing financial support to game developers in exchange for launching games on Google's app store under favorable terms compared to competitors. This program reportedly diminished developers' incentives to use rival app stores, effectively creating a state of exclusive dealing with Google. If found guilty of market abuse, Google could face a fine of up to 6% of the affected revenue, approximately 0 million. Google has eight weeks to respond to the report, and the KFTC will issue a final ruling thereafter.

Winsage

June 30, 2026

Steve Ballmer once called Linux a “cancer” — it’s funny Windows 10 holdouts may now see it as the cure for Windows 11’s hardware rules and the RAM crisis

Former Microsoft CEO Steve Ballmer initially described Linux as a "cancer" in 2001 but changed his perspective by 2016, supporting Microsoft's decision to port SQL Server to Linux. Microsoft President Brad Smith acknowledged the company's past underestimation of the open-source movement in 2020. Microsoft has integrated open-source solutions into its products, including PowerShell and Visual Studio Code, and launched Azure Linux 4.0. As Microsoft phases out support for Windows 10, critics argue this leads to programmed obsolescence, affecting up to 400 million PCs. Microsoft extended support for Windows 10 through its Extended Security Updates (ESU) program until October 14, 2026, with an additional extension through 2027. Rising hardware costs and stringent requirements for Windows 11 hinder many users' transitions. Advocacy groups are encouraging users to consider Linux, highlighting its advantages. Recent surveys show that 30% of HP PCs still run Windows 10, and a poll indicated that 68% of participants plan to stay with Windows 10 through 2027. There is a growing awareness among consumers regarding the potential shift to open-source alternatives like Linux.