user behavior Archives

Winsage

May 2, 2026

Microsoft tests modern Windows Run, says it’s faster than legacy dialog

Microsoft has introduced a modernized Run dialog in the latest preview build of Windows 11, version 26300.8346. This updated Run dialog features a sleek design, dark mode support, and improved performance, achieving a median response time of 94 milliseconds compared to the legacy version's 103 milliseconds. The Browse button has been removed due to low usage statistics, with less than 0.0038% of users engaging with it. New functionalities include support for the ~ command for quick access to the home directory and the addition of icons in the command list. Users can enable or disable the modern Run feature through the Advanced Settings menu. The update also includes improvements to the Windows Share UI for Azure Active Directory users and enhancements to the Magnifier tool, which now offers zoom levels ranging from 5% to 400%. The Windows 11 Build 26300.8346 is available for download from the Experimental Channel.

Winsage

May 1, 2026

Windows quality update: Progress we’ve made since March

The Windows Insider Program is undergoing changes to improve transparency and user control. Two main channels, Experimental and Beta, are being introduced, with the Beta channel eliminating controlled feature rollouts. Users will have the ability to select features in the Experimental channel and switch between channels more easily. Updates to the Feedback Hub are aimed at enhancing user experience. Windows updates will now be consolidated into a single monthly restart, providing users with more flexibility. AI features are being refined, with a focus on intentional integration. File Explorer is receiving architectural improvements for better performance, and there will be more control over widgets and notification settings. System performance enhancements include memory optimization and improved app launch responsiveness. Upcoming features include Taskbar customization, and the team is engaging with Insiders in various cities for feedback.

AppWizard

April 29, 2026

Are you still using Sign in with Google? Here’s why you should stop

Relying on a single Google account for access to various services poses significant vulnerabilities, including the risk of account lockout due to forgotten credentials, phishing attacks, or arbitrary bans. This centralized approach can lead to loss of access to critical data and services. Sophisticated phishing techniques, such as Adversary-in-the-Middle (AiTM) attacks, can compromise account security by mimicking legitimate login screens. Additionally, linking multiple services through a Google account contributes to a comprehensive digital footprint that Google can analyze, raising privacy concerns. To enhance digital security, users are advised to create standalone accounts for various services and utilize password managers like KeePass, Bitwarden, and 1Password to maintain unique credentials.

Winsage

April 13, 2026

Mozilla accuses Microsoft of running the old browser wars playbook to lock in AI dominance through Windows

Mozilla has accused Microsoft of using its dominance in the Windows operating system to marginalize competitors in the AI sector, particularly through the promotion of its Copilot feature. Mozilla claims that misleading update mechanisms are being used to push Copilot onto users and that system settings are being adjusted to hinder the performance of alternative browsers like Firefox. This situation is reminiscent of the 1990s browser wars when Microsoft bundled Internet Explorer with Windows to eliminate competition. In July 2025, Opera filed a formal antitrust complaint in Brazil against Microsoft, leading to an investigation into whether Microsoft was coercing hardware manufacturers to bundle Edge exclusively. A ruling against Microsoft could require a separation between the operating system and AI services. Microsoft's current strategy aims to control the AI inference layer, with each interaction through Copilot representing valuable data and monetization opportunities. Reports indicate that Microsoft is removing Copilot branding from standalone applications to further integrate it into the operating system. Despite Edge being the third most popular browser, Microsoft's tactics suggest a focus on securing AI infrastructure rather than just competing for browser market share. Regulatory scrutiny may increase due to ongoing antitrust challenges related to Microsoft's OpenAI investment and cloud AI bundling practices. The development of OEM relationships and potential resistance to Microsoft's requirements could significantly impact its integration strategy.

Winsage

April 6, 2026

ResokerRAT Hijacks Telegram API to Command Infected Windows PCs

A newly discovered Windows malware called ResokerRAT uses Telegram’s Bot API for its command-and-control operations, allowing it to monitor and manipulate infected systems without a conventional server. It obscures its communications by integrating with legitimate Telegram traffic, complicating detection. Upon execution, it creates a mutex to ensure only one instance runs and checks for debuggers to avoid analysis. It attempts to relaunch with elevated privileges and logs failures to its operator. ResokerRAT terminates known monitoring tools and installs a global keyboard hook to obstruct defensive key combinations. It operates through text-based commands sent via Telegram, allowing it to check processes, take screenshots, and modify system settings to evade detection. Persistence is achieved by adding itself to startup and altering UAC settings. The malware retrieves additional payloads from specified URLs and uses URL-encoded data for communication. Researchers have confirmed its Telegram traffic, and its behavior aligns with various MITRE ATT&CK techniques. Security teams are advised to monitor for unusual Telegram traffic and scrutinize registry keys related to startup and UAC.

AppWizard

April 3, 2026

Which messaging app takes the most limited approach to permissions on Android?

Messaging applications Messenger, Signal, and Telegram exhibit significant differences in permissions and operational behaviors that impact user privacy. Telegram has the fewest total permissions at 71, with 25 classified as dangerous; Signal requests 72 permissions, including 19 dangerous ones; and Messenger requests the most at 87, with 24 dangerous permissions. Messenger also has the highest number of vendor-specific unknown permissions. Access to sensitive resources is crucial for messaging functionalities, with permissions for contacts, camera, microphone, location, storage, and calendar being essential. Telegram and Messenger request additional system-level permissions, while Signal is more conservative and does not request certain permissions like phone-call control or overlay windows. The analysis, using the Mobile Security Framework (MobSF), indicates all three apps are in the medium risk category, with Messenger having more flagged issues. Telegram allows cleartext connections by default, potentially exposing traffic, while Signal uses encrypted connections by default and only permits limited cleartext traffic for certificate checks. Messenger's issues include world-writable files and remote debugging enabled in WebViews. Messenger uses third-party SDKs, while Signal and Telegram do not disclose third-party trackers. All three utilize Firebase Cloud Messaging for notifications without sensitive data leakage. Data exchange patterns show Messenger primarily routes traffic through North America, while Telegram and Signal focus on Europe with some additional connections in the U.S. and Asia.

Winsage

April 1, 2026

After years of complaints, Microsoft is finally working to improve Windows 11 Search

Microsoft is implementing significant enhancements to Windows 11, including major revisions to File Explorer and a reduction in Copilot integration. A dedicated team is being formed to transition web applications to native Windows 11 apps. Tali Roth, head of Windows Shell, has acknowledged user frustrations with Windows Search and confirmed that improvements are forthcoming to simplify the search experience and refine search rankers. These adjustments aim to prioritize relevant results, ensuring users find the correct applications, such as directing searches for "Terminal" to the Windows Terminal. The updates also include changes to the Start Menu, contributing to a more intuitive and user-friendly platform.

AppWizard

March 31, 2026

Free Antivirus for Android: Best Apps to Protect Your Smartphone

Smartphones are integral to daily life, storing emails, banking apps, and social media. The Android operating system is vulnerable to threats like viruses and ransomware. Free Android antivirus tools offer basic protection but have limitations compared to paid versions. Free antivirus solutions focus on malware scanning and threat detection. Bitdefender Mobile Security (Free Version) provides lightweight background operation, real-time scanning, and web protection but lacks anti-theft and VPN features. Norton Mobile Security (Free Tier) offers essential malware scanning, with advanced features available in premium subscriptions. Avast Mobile Security (Free) includes virus scanning, malware protection, and anti-theft tools, allowing users to lock apps and protect against malicious websites. AVG AntiVirus (Free) offers virus, malware, and spyware scanning, real-time updates, and a "Photo Vault" for securing images. Kaspersky Mobile Security (Free) provides basic virus protection and ranks high in malware detection, with additional features available in paid plans. Free antivirus tools detect malware and monitor real-time system activity, alerting users to phishing sites. They may scan files transferred via USB or Bluetooth and offer limited VPN services. Limitations of free antivirus include the absence of advanced features like unlimited VPN, application locking, and anti-theft capabilities. Many rely on ads for revenue, which can disrupt user experience. Choosing the right antivirus depends on usage habits and security concerns. Running multiple antivirus apps can cause conflicts and hinder performance. Upgrading to premium versions may be necessary for comprehensive protection, especially for sensitive tasks. User behavior is crucial for security; regularly updating the OS and applications, using strong passwords, and considering two-factor authentication can enhance protection. Free antivirus apps offer core threat protection but lack advanced features. Most are lightweight, with minimal impact on performance. Regular scans are recommended, and reputable sources should be used for downloads. Free antivirus apps can warn about phishing attempts but cannot eliminate the risk entirely. A built-in VPN is not essential for basic protection but is advisable for public Wi-Fi use.

AppWizard

March 21, 2026

Cyber actors linked to Russia target messaging app users, FBI warns

The United States has issued a warning about cyber actors linked to Russian intelligence targeting users of commercial messaging applications, particularly Signal, compromising thousands of accounts worldwide. The FBI and CISA released a public service announcement detailing the operation's focus on individuals of “high intelligence value,” including U.S. government officials, military personnel, political figures, and journalists. Attackers have not breached the encryption of these platforms but manipulate users into disclosing credentials or linking devices. Russian intelligence-linked actors often pose as official support accounts, creating urgency to obtain security codes. Dutch intelligence agencies also reported a similar campaign targeting Signal and WhatsApp accounts of dignitaries and military personnel. Users are urged to be cautious of suspicious messages and to avoid sharing personal information. Signal reaffirmed that its encryption remains intact, emphasizing that vulnerabilities arise from user behavior rather than technical flaws in the application itself.

Tech Optimizer

March 16, 2026

What Is a Crypto Miner Virus?

A crypto miner virus, or cryptojacking malware, secretly uses a device’s CPU or GPU to mine cryptocurrency for an attacker, leading to increased electricity costs and potential hardware damage for the victim. It typically infects devices through phishing emails, pirated software, compromised websites, and malicious browser extensions. Monero is the preferred cryptocurrency for mining due to its efficiency on standard CPUs and privacy features. Signs of infection include overheating, high CPU usage, and increased electricity bills. Detection involves monitoring system performance and running antivirus scans. Prevention includes using antivirus software, keeping systems updated, and avoiding pirated software. Notable incidents include attacks on a European water utility and the Los Angeles Times website.