Windows systems Archives

Winsage

May 14, 2026

Dell confirms its SupportAssist software causes Windows BSOD crashes

Dell's SupportAssist software is causing blue-screen crashes on certain Windows systems, attributed to a recent update to the SupportAssist Remediation service, specifically version 5.5.16.0. Users experiencing these crashes are advised to uninstall or disable the service to resolve the issue. Dell has acknowledged the problem and is working on a solution. Uninstalling the service may result in the loss of system repair points created by Dell OS SupportAssist Recovery. Users still facing issues after uninstallation should contact Dell support. This incident follows previous software challenges faced by Dell, including blue screens from earlier SupportAssist versions and BIOS updates that prevented some laptops from booting. Additionally, vulnerabilities have been identified in the BIOSConnect feature of Dell SupportAssist, posing security risks.

Winsage

May 14, 2026

Windows on ARM Security: How to Protect ARM-Based Windows Devices Without Gaps

The transition to Windows on ARM devices is increasing across various sectors, with organizations drawn to their performance, efficiency, and battery life. However, there are concerns about securing these devices without introducing vulnerabilities. Windows on ARM security involves safeguarding ARM64-based Windows devices with endpoint security solutions optimized for ARM architecture. The lack of native ARM64 endpoint protection can leave devices vulnerable. Windows on ARM devices operate on ARM64 architecture, differing from traditional x86/x64 systems, which can lead to incomplete protection, performance issues, and compatibility challenges with legacy security tools. This creates security gaps, making ARM-based devices attractive targets for threats like ransomware. To secure ARM-based Windows endpoints effectively, organizations need native ARM64 endpoint protection that ensures optimal performance, consistent protection across all devices, and centralized policy management. Morphisec offers native ARM64 endpoint protection, focusing on preventing threats before execution and providing seamless deployment and management. Without native support, organizations risk fragmented security tools, an expanded attack surface, and operational inefficiencies. Implementing native ARM64 endpoint protection allows for standardized security, simplified processes, and enhanced resilience against advanced threats.

Winsage

May 13, 2026

Disgruntled researcher releases two more Microsoft zero-days

An anonymous researcher known as Nightmare-Eclipse has revealed two new vulnerabilities affecting Windows systems, named YellowKey and GreenPlasma, shortly after Microsoft's latest Patch Tuesday update. YellowKey is a "BitLocker bypass" that allows attackers with physical access to gain unrestricted shell access to protected machines. Experts have expressed concerns about YellowKey's potential to transform laptop theft into a serious breach notification scenario, and suggested mitigations such as implementing a BitLocker PIN and a BIOS password lock. Nightmare-Eclipse has also hinted that YellowKey could function as a backdoor allegedly introduced by Microsoft, although this claim remains unsubstantiated. GreenPlasma is a privilege escalation flaw for which partial exploit code has been released, but it currently triggers a User Account Control (UAC) consent prompt, requiring attackers to invest time in weaponizing it. There is no known mitigation for GreenPlasma, making it crucial for organizations to patch their systems promptly once Microsoft addresses the issue. Nightmare-Eclipse has previously disclosed five zero-day vulnerabilities this year, including BlueHammer, and has characterized their actions as a response to a perceived violation of trust. The researcher has indicated the existence of a "dead man's switch," suggesting that more disclosures could follow if their demands are not met.

Winsage

May 12, 2026

Hackers Can Hide Malware Inside Images to Hack Windows

Researchers at Cyfirma have identified a cyberattack campaign named Operation SilentCanvas that targets Windows systems using deceptive JPEG files to infiltrate devices. The attack begins with victims receiving a file named sysupdate.jpeg, which contains a PowerShell script instead of an image. This script establishes staging environments and downloads additional malicious components while avoiding detection. The malware reconstructs command strings at runtime and downloads a secondary payload called access.jpeg, executed in memory. It exploits Microsoft's .NET compiler to create a custom launcher named uds.exe on infected machines. The malware takes control of a registry key to create a hidden desktop environment for undetected execution of malicious tools and installs a persistent Windows service, OneDriveServers, to maintain activity after reboots. Additionally, it can intercept usernames and passwords at the Windows login screen and create hidden local administrator accounts for long-term access. Security teams are advised to monitor the execution of commonly abused Windows binaries like csc.exe and ComputerDefaults.exe to mitigate risks.

Winsage

May 10, 2026

Microsoft Confirms KB5083769 Breaks Macrium and Acronis Backups

Microsoft's April 2026 Windows security update, KB5083769, may disrupt image-mount operations for backup applications such as Macrium Reflect, Acronis Cyber Protect Cloud, UrBackup Server, and NinjaOne Backup due to the addition of the psmounterex.sys kernel driver to its Vulnerable Driver Blocklist. This action was taken to address a high-severity buffer overflow vulnerability, CVE-2023-43896. The inclusion of this driver in the blocklist has rendered several backup products inoperable, and Microsoft will not retract the block for security reasons. Administrators can use Event ID 3077 in the Code Integrity log to confirm that the blocklist is causing the failures. Microsoft advises updating backup applications to versions that include necessary driver protections instead of uninstalling or pausing the security patch. Additionally, the April updates have caused other issues, such as failures in Windows Server installations and devices booting into BitLocker recovery mode.

Winsage

May 9, 2026

‘Faster, Free’—Google Offers Windows Users A PC Upgrade

Microsoft's Secure Boot certificates, in use since 2011, will begin to expire in June, potentially leaving many Windows 10 users without essential updates. As Windows 10 approaches its end of support in October 2025, Microsoft is offering a complimentary year of extended support, which includes new Secure Boot certificates, but users must enroll to receive these updates. For those who do not enroll, Google offers a free upgrade option to ChromeOS Flex, which allows users to repurpose old laptops into efficient machines. ChromeOS Flex is lightweight, requires less hardware power, and provides regular security updates, making it a safer alternative to unsupported Windows systems. Google has made ChromeOS Flex available on a reusable USB stick, although it is often in short supply.

Winsage

May 7, 2026

Upwind expands runtime protection to Windows Server VMs

Upwind has expanded its runtime protection and visibility offerings to include Windows Server virtual machines (VMs) on major cloud platforms such as Amazon Web Services, Google Cloud, and Microsoft Azure. This integration applies to Windows Server 2016 and later versions and enhances runtime monitoring and detection workflows. Upwind's Windows Sensor provides visibility into host activities, including process executions, network connections, and DNS requests, while also conducting continuous assessments for vulnerabilities and configuration issues. The telemetry collected aids in real-time detection of potential security threats and supports ongoing vulnerability scanning. The integration of Windows Server VMs into Upwind's Runtime Map, Detections, and Sensor components allows for unified monitoring and risk prioritization across cloud environments. This expansion aims to address the critical need for runtime behavior insights in cloud security, particularly for businesses relying on Windows Server for essential applications.

Winsage

May 6, 2026

New Trojan attacks Windows and steals data from smartphones via Phone Link

Cisco Talos experts have discovered a trojan that has been operational since at least January 2026, which installs the CloudZ RAT (Remote Access Tool) on Windows systems along with the Pheno plugin. The attack starts with an undisclosed initial access vector and involves executing a counterfeit SmartConnect update to deploy the CloudZ RAT. This RAT establishes an encrypted connection to its command and control (C2) server, allowing attackers to extract sensitive information. The CloudZ RAT assists in harvesting credentials from web browsers and downloads the Pheno plugin, which accesses Phone Link app data and transmits it to the C2 server. The Phone Link feature synchronizes critical data, including SMS messages with one-time passwords and account login details, which are the primary targets of the attackers.

BetaBeacon

May 5, 2026

ScarCruft hackers push BirdCall Android malware via game platform

APT37, also known as ScarCruft and Ricochet Chollima, has developed an Android version of the backdoor BirdCall, which serves as spyware in addition to a backdoor. The malware was delivered through a Chinese website that hosts games for Android, iOS, and Windows, targeting only Android and Windows systems. The Android variant of BirdCall has capabilities such as extracting IP geolocation information, collecting contact lists, call logs, SMS data, device information, taking screenshots, recording audio, and exfiltrating files. Users are advised to download software only from official marketplaces and trusted publisher sites to protect against malware infections.

Tech Optimizer

May 4, 2026

Microsoft Defender wrongly flags DigiCert certs as Trojan:Win32/Cerdigent.A!dha

Microsoft Defender mistakenly flagged legitimate DigiCert root certificates as Trojan:Win32/Cerdigent.A!dha, leading to their removal from Windows systems globally. This issue arose after a Defender signature update on April 30th, with affected certificates including 0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 and DDFB16CD4931C973A2037D3FC83A4D7D775D05E4. The certificates were removed from the AuthRoot store under the Registry key HKLMSOFTWAREMicrosoftSystemCertificatesAuthRootCertificates. Microsoft has addressed the issue in Security Intelligence update version 1.449.430.0, which also restored the removed certificates. The false positives were linked to detections related to a recent DigiCert breach, where threat actors obtained valid code-signing certificates used for signing malware. DigiCert revoked 60 code-signing certificates, including those linked to the "Zhong Stealer" malware campaign. The malware utilized certificates issued to companies like Lenovo and Kingston, but the certificates flagged by Microsoft Defender are root certificates and do not correspond to the revoked code-signing certificates.