surveillance Archives

AppWizard

July 13, 2026

EU sanctions target Russian state-backed messaging app

Moscow is promoting Max, a super-app that consolidates various digital services, while cracking down on messaging platforms WhatsApp and Telegram. The Russian government has required civil servants and state-owned enterprises to use Max for communications. The EU has imposed sanctions on VK, the media conglomerate behind Max, due to concerns that the app is monitored by the FSB and has surveillance capabilities that suppress dissent regarding Russia's actions in Ukraine. Max, which is compared to China's WeChat, integrates social media, messaging, and access to government services. President Putin has called Max a "secure" alternative, but EU officials have expressed skepticism, seeing it as part of a strategy to create a "digital iron curtain" in Russia amidst ongoing international sanctions.

AppWizard

July 13, 2026

EU Sanctions VK for Developing Messenger App Max

The European Union has imposed sanctions on Russian tech giant VK and its subsidiary, Communication Platform LLC, due to their involvement in the development of the Kremlin-backed messaging app, Max. The development of Max was overseen by the Federal Security Service (FSB), and it has been criticized for its surveillance capabilities. These sanctions are part of a broader strategy by the EU and the UK to target entities linked to Russian cyberattacks. The EU and UK also announced additional sanctions against individuals and entities involved in Russian cyber operations, including targeting leaders of Russia's GRU military intelligence and individuals linked to the FSB’s Center 16. Apple removed VK platforms and the Max app from its App Store last month, citing compliance with sanctions. The EU plans to introduce its 21st package of sanctions against Russia soon.

Winsage

July 12, 2026

Microsoft Confirms Windows GDID Device Identifier That Cannot Be Disabled, Documented in FBI Case Filing

Microsoft has confirmed the existence of the Global Device Identifier (GDID), a unique identifier assigned to Windows installations, in a federal complaint against an alleged member of the Scattered Spider hacking group. The GDID is generated when a Windows system is set up with a Microsoft Account and remains active through various Windows updates. Disabling the GDID could disrupt Windows activation and access to Microsoft Store applications. The GDID is described as "a persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device." It is created during the provisioning of Windows with a Microsoft Account and is stored in the Windows registry under HKCUSOFTWAREMicrosoftIdentityCRLExtendedProperties. The GDID remains persistent through Windows updates but is not retained after a clean reinstall. A single user can possess multiple GDIDs linked through their account, OneDrive, and activation history. The FBI used the GDID to track Peter Stokes, an alleged member of the Scattered Spider group, across various VPN connections and proxy servers. The GDID was recorded visiting specific websites and was linked to Stokes's accounts on platforms like Snapchat and Facebook. Concerns have been raised regarding user privacy, as the GDID is assigned without user consent and cannot be disabled without compromising essential Windows features. Microsoft has not committed to providing user-facing controls or comprehensive documentation for everyday users regarding the GDID. Legal requests can compel Microsoft to disclose GDID activity data to law enforcement. The GDID is linked to the Microsoft Account rather than the device itself, meaning reinstalling the operating system does not sever this connection.

Winsage

July 10, 2026

Windows 11 Has a Hidden Tracker – Here’s How to Limit It

Peter Stokes is involved in a breach with a luxury retailer, using tactics like VPNs and rotating IP addresses to hide his digital activity. The FBI discovered a Global Device Identifier (GDID) linked to his Windows installation, which is a persistent device-level identifier that uniquely identifies Windows installations. GDID remains unchanged through operating system updates but resets with a full reinstallation. Disabling GDID is not possible, as attempts to do so would disrupt Windows activation. Users can minimize data linked to GDID by using a local account, reducing diagnostic telemetry, disabling Activity history, and carefully managing reinstalls. VPNs do not prevent Microsoft from logging GDID, IP address, and URL data. Privacy researchers view GDID as a covert tracking mechanism, and Windows lacks user-facing options to reset this identifier, unlike Apple and Google.

Winsage

July 10, 2026

You can’t fully disable Microsoft’s GDID Windows 11 tracker, but these settings limit what it captures

A 19-year-old named Peter Stokes was detained at Helsinki airport in April 2026 while traveling to Japan, carrying two 2TB hard drives. He was subject to an Interpol Red Notice and faced a federal complaint from U.S. prosecutors by July for his alleged involvement in the Scattered Spider hacking group, which breached a U.S. luxury jewelry retailer in May 2025, leading to a ransom demand. The Global Device Identifier (GDID), developed by Microsoft, is a persistent identifier that uniquely identifies a Windows installation on a device. It links online activities back to a single identity, which law enforcement can use to trace a device's owner. The GDID is generated when a user signs into Windows with a Microsoft Account and remains through updates but does not survive a clean reinstall. Stokes' use of the same Windows device allowed investigators to trace his activities through the GDID, which linked him to the hacking incident. Privacy advocates have raised concerns about the lack of consent for GDID assignment and the potential for surveillance.

Winsage

July 10, 2026

Microsoft Warns of GigaWiper Backdoor Built to Destroy Windows PCs

Microsoft has unveiled a destructive Windows backdoor named GigaWiper, which allows operators remote control over compromised systems to execute irreversible damage. GigaWiper originated from cyberattacks in October 2025 and is a composite of code from at least three malware families. It maintains its presence through a scheduled task disguised as “OneDrive Update,” executing at startup and every minute. GigaWiper can obliterate partition information, overwrite physical drives, and restart systems. It also mimics ransomware by encrypting files with the .candy extension, using randomly generated keys that are not stored, making recovery impossible. The malware has connections to the Crucio ransomware and resembles FlockWiper, with rewritten code in Go. GigaWiper features 20 command codes for various functions, including executing PowerShell instructions, managing processes, capturing screenshots, and remote access similar to VNC. It can remain on a system for surveillance until its destructive functions are activated. Microsoft Defender includes detection capabilities for GigaWiper, and users are advised to enable tamper protection and monitor for suspicious activities.

AppWizard

July 9, 2026

MindsEye developers protest against a fan event their own studio is hosting

MindsEye, an action game from Build a Rocket Boy, is set to have a playtest at the studio's Edinburgh headquarters, inviting community members and covering their travel costs. This comes after significant layoffs that affected over 400 employees, leading to protests organized by the Independent Workers Union of Great Britain, which criticizes the studio for spending on the playtest while having recently laid off staff. The union also alleges the studio has engaged in questionable practices, including employee surveillance. The playtest is seen as a strategy to regain favor with fans amid concerns about the studio's management and treatment of its workforce.

Winsage

July 8, 2026

Arrest and extradition of Scattered Spider hacker shines light on how Windows telemetry GDIDs can identify and track users — Microsoft device identifier is just one digital fingerprint in a software world rife with them

Peter Stokes, a 19-year-old from Estonia, was arrested and extradited to the United States on charges related to digital crimes, with the FBI using telemetry logs from Microsoft Windows to trace his online activities. These logs included his Global Device Identifier (GDID) and records of websites he visited. Stokes likely had his telemetry settings configured to Optional/Full, which allowed the transmission of URL data. The FBI connected Stokes to his ngrok account and linked his travel records to a New York IP address and a rental at the Empire Hotel, aided by photos he shared. Google and Apple assisted in the investigation by tracing Stokes' phishing phone number back to the same IP address used for his ngrok account. Stokes attempted to obscure his digital footprint using a VPN and other services, but modern digital identification methods made it difficult to remain anonymous.

AppWizard

July 7, 2026

Chat Control 1.0: EU Council forces messenger scans via fast-track

Member states of the European Union are seeking to reinstate a previously expired regulation concerning the monitoring of encrypted communications, known as Chat Control 2.0, which mandates suspicionless scanning of encrypted messages. The Council of Ministers has proposed to reactivate a transitional regulation that allowed voluntary monitoring by technology companies, which lapsed on April 3. This move aims to close a legal gap and pressure Members of the European Parliament (MEPs) to act quickly. The expiration of the previous regulation is viewed as untenable, as it is deemed crucial for identifying at-risk children and combating illegal content online. Critics argue that the approach undermines democratic oversight and lacks transparency. The draft regulation is set to be discussed as an urgent matter just before the summer recess, with potential voting occurring when many MEPs may be absent. The regulation requires that any processed content and traffic data be deleted within twelve months unless a specific suspicion is confirmed.

Winsage

July 1, 2026

Steve Ballmer once trashed Linux as “a cancer” — now it’s saving Windows 10 holdouts

In 2001, Steve Ballmer, then CEO of Microsoft, referred to Linux as a "cancer" threatening Microsoft's intellectual property and likened its users to "communist thieves." By 2016, after Microsoft ported SQL Server to Linux, Ballmer expressed enthusiasm for the change and acknowledged that the conflict with open-source had benefited Microsoft's financial success. In 2020, Microsoft President Brad Smith admitted the company had been on the wrong side of history regarding open source and noted the need for change. Microsoft has since embraced open-source technologies, introducing products like Azure Linux 4.0, built on Fedora. As Windows 11's transition becomes difficult for users, advocacy groups have criticized Microsoft for ending support for Windows 10, which could lead to millions of discarded computers. Microsoft extended Windows 10's life through an Extended Security Updates program until October 14, 2026, with a recent announcement pushing it to 2027. Rising hardware costs and design flaws in Windows 11 have led some users to consider alternatives like Linux. A survey revealed that 30% of PCs are still running Windows 10, and a poll showed that 68% of respondents plan to stick with Windows 10 through 2027.