Windows

An independent malware researcher documented SLEEPWALKER, a previously unreported Windows backdoor. This sample is an unsigned 64-bit DLL that remains inert in memory until it receives a specifically crafted network packet. Once triggered, the backdoor executes commands written in its own unique 23-instruction language.

Cybersecurity researchers disclosed details of UAT-10147, a Chinese-speaking cybercrime group that targets Windows and Linux web servers globally. The attacks span multiple sectors including education, media, technology, and gaming. The vast majority of the targeted systems are located in Brazil, Bolivia, China, Canada, and Vietnam.

Minneapolis police are investigating a series of at least 87 car break-ins that took place across the city on Friday morning. These incidents involved smashed windows and affected multiple neighborhoods throughout Minneapolis.

Threat actors are currently abusing FTP server banners to conceal commands. This method is used to deliver two previously undocumented types of malware, namely the remote access trojans E4del and PINHOLE, which target Windows.

CISA warned that hackers are actively exploiting a critical-severity remote code execution (RCE) flaw. This vulnerability resides within the Windows Internet Key Exchange (IKE) Service Extensions component.

Cybersecurity researchers flagged a new typosquatting campaign targeting RubyGems users using a Windows-based information stealer. This campaign steals browser credentials and crypto wallets. OpenSourceMalware discovered the threat, which is currently being tracked under the moniker StubMaker.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are actively exploiting a high-severity flaw. This vulnerability concerns Windows Task Host, which had previously been flagged as being exploited in April.

A user reported encountering a "You're invited" Punchbowl scam link first on a Samsung phone and then on their PC. The link reportedly required viewing from a Windows machine and caused alarms when opened on the desktop. After shutting down the PC and changing their email password using another device, the user is concerned about potential compromise of both phones and PCs even without having logged in.

A new Russian loader-as-a-service named DOUBLECUP uses ClickFix attacks to hide malicious code in PNG images cached by victims' browsers, delivering CountLoader to Windows and macOS devices and a new remote access trojan named DeviceManager to Windows systems.

The article highlights a Windows promotion offering a significantly discounted price of $11.23 (valid until August 9) compared to the standard $199 cost. The phrase 'open a Windows' is used metaphorically to encourage taking advantage of the deal.

Malwarebytes for Windows is now available on the Microsoft Store, offering users a trusted method to install the full version of the security software. The Microsoft Store version includes the same real-time protection, Windows integration, and features as the website version, with no limitations or compromises.

An Australian reader with many flies in their area attempts to address the recurring question of why flies repeatedly collide with windows. The article continues a discussion that has intrigued multiple readers.

The Framework Laptop 13 Pro is a high-end Windows laptop praised for being repairable and top-performing, though it is currently considered overpriced.

Collabora is working on porting the RADV Vulkan driver to Windows, aiming to improve cross-platform compatibility for developers. The effort focuses on enabling RADV's open-source Vulkan implementation to run on Win32 systems.

A recently disclosed Windows zero-day flaw, LegacyHive, allows attackers to escalate privileges on updated Windows systems. Free, unofficial patches are now available for this vulnerability.

A new Intel Itanium (IA-64) emulator has been developed that can boot Windows. The article links to a blog post and Hacker News comments discussing the emulator.

A security researcher named Nightmare Eclipse has disclosed a Windows zero-day exploit called LegacyHive, enabling attackers to escalate privileges on updated Windows systems. The exploit grants hackers administrative access to these systems.

Sandworm hackers are using a CAPTCHA trick targeting Ukrainians. Instead of verifying human users, the CAPTCHA instructs users to copy and paste a PowerShell command into their Windows computers.

A vulnerability in Cursor allows malicious cloned repositories to trigger Windows code execution by running a file named git.exe in the project root without user prompts or warnings. The binary executes with the user's privileges and continues running as long as the project remains open.

Cybersecurity researchers identified a new Rust-based remote access trojan (LabubaRAT) that disguises itself as NVIDIA software to control Windows hosts. The malware creates a reusable foothold for hands-on activity, according to Blackpoint Cyber researchers Sam Decker and Nevan Beal.

Scientists claim applying yogurt to the outside of windows can cool homes by up to 3.5°C. The method involves using yogurt as a cooling solution for reducing indoor temperatures.

The jscrambler 8.14.0 npm package included a malicious preinstall hook that deploys a Rust-based infostealer for Windows, macOS, and Linux during installation. The compromised version was published on July 11, 2026, and automatically executes the malware without requiring additional commands or imports. Security firm Socket detected and flagged the release six minutes after publication.

U.S. prosecutors used a persistent Windows device ID to link an alleged Scattered Spider hacker to a May 2025 intrusion at a luxury jewelry retailer. Microsoft records connected the ID to an account used during the attack and to online accounts tied to 19-year-old Peter Stokes.

Cybersecurity researchers have identified QuimaRAT, a Java-based remote access trojan (RAT) capable of targeting Windows, Linux, and macOS systems. The malware is offered as a malware-as-a-service (MaaS) model with subscription tiers ranging from $150 per month to $1,200 for lifetime access.

Microsoft has resolved a bug causing the Copilot Chat or Copilot buttons in Classic Outlook to disappear for Windows users with the Copilot Chat (Basic) license.

A researcher analyzed 3,000 Live ClickFix payloads, revealing API-driven servers distribute malware through disguised commands on fake 'prove you're human' pages. A new delivery method was identified to bypass Windows' script scanning.

Dell and HP computer users experienced reboot loops caused by problematic software and firmware updates. Dell's SupportAssist update and HP's BIOS update triggered system crashes and BitLocker recovery loops, respectively. Solutions include checking for manufacturer updates or disconnecting hardware.

Cryptographic keys securing computer boot sequences for Windows and Linux systems will begin expiring on June 24. This deadline affects the security mechanisms protecting these operating systems during startup.

Microsoft confirmed a bug in its June 2026 Windows updates that causes incorrect filenames to display in the Recycle Bin deletion confirmation dialog. The issue disrupts user expectations by showing mismatched names during file deletion.

Microsoft used an internal tool called Basic Block Tool (BBT), nicknamed 'Microsoft Lego', to optimize Windows binaries by rearranging code for better performance. The tool addressed issues like fragmented code in large binaries, improving system responsiveness on limited hardware. Similar techniques like BOLT and HP's Dynamo later emerged, highlighting the ongoing relevance of code locality in software optimization.

Microsoft is investigating an issue where third-party applications cannot launch Microsoft Office applications or open documents on updated Windows systems. The problem emerged after June updates to Windows systems.

A Blue Screen of Death (BSOD) caused by a DRIVER_POWER_STATE_FAILURE occurred at Worcestershire County Cricket Club, humorously compared to cricket terms. Microsoft's Windows operating system was involved, with CEO Satya Nadella's interest in cricket adding context.

The Logitech MX Master 3S wireless mouse is discounted to $89.99 at Amazon, featuring a second scroll wheel, cross-platform compatibility, and customizable buttons. It is praised for comfort and functionality, with a newer MX Master 4 model available at a higher price.

Nvidia is proposing a high-performance CPU system for Windows PCs. The article links to a Twitter post and Hacker News discussion with 32 points and 52 comments.

WSL 2 is receiving improvements to enhance Windows file system access speed. The update introduces per-device swiotlb pools for virtiofs and virtioproxy to optimize performance.

Microsoft CEO Satya Nadella highlighted Windows during a Build keynote, unveiling the Surface RTX Spark Dev Kit as a 'dream machine.' The event coincided with Nvidia's return to Windows on Arm through its new RTX Spark chips, which both companies position as a new era for PCs driven by local AI workloads.

Microsoft addressed an issue where some Windows devices installed driver updates without notice, despite policies set to prevent automatic updates. The problem was attributed to a caching issue and was fixed by Microsoft.

Microsoft has released coreutils, a Rust-built multi-call binary for Windows that includes over 75 Unix commands like grep, ls, and cat, aiming to standardize user commands across platforms. The tool, derived from the MIT-licensed uutils project, allows Linux commands to function in Windows CMD and PowerShell, benefiting developers and Linux users.

Microsoft announced the release of Coreutils for Windows at its Build 2026 developer conference, bringing commonly used Linux command-line utilities to Windows as native applications.

Microsoft is transforming OpenClaw into an enterprise AI agent named Scout, leveraging its 1.4 billion Windows users to drive adoption.