Windows

Ransomware Operators Hijack Active Directory via GPO to Lock Companies Without Encryption

Kaspersky researchers have uncovered a new extortion campaign called Payload that targets manufacturing companies by compromising privileged accounts and seizing control of Active Directory. Instead of deploying traditional ransomware encryptors, the attackers created a Group Policy Object named Payload linked to the domain root. This GPO automatically changed desktop wallpapers and lock screens across all systems, displayed ransom demands, and disabled administrative accounts after policy refresh. The group also exfiltrated valuable corporate data before the lockdown and later published it on the dark web to increase pressure on victims. Because the attack relied entirely on legitimate Windows mechanisms such as VPN access and Group Policy, conventional antivirus solutions proved ineffective. Experts recommend monitoring GPO changes, enforcing phishing-resistant MFA on VPN and admin systems, and applying least-privilege principles to limit the impact of credential compromise.

Microsoft Addresses 973 Vulnerabilities in September Security Update

Microsoft released its monthly security updates on September 8, 2026, fixing 973 vulnerabilities tracked by CVE identifiers. The release coincided with Patch Tuesday and also resolved four third-party software flaws. Affected products span Windows, Office, SQL Server, Azure, Microsoft Dynamics, SharePoint Server, and various development tools. Among the issues, 258 allow remote code execution and 438 enable privilege escalation. A total of 113 vulnerabilities received the highest severity rating of Critical, while the remaining 860 were rated Important. Several of the flaws have already been observed in active exploitation.

Zhou Hongyi Warns AI Tools Are Industrializing Vulnerability Discovery

At the Fourth Cyberspace Security Forum in Tianjin, 360 founder Zhou Hongyi stated that vulnerability mining is shifting from artisanal workshops to automated production lines, compressing discovery cycles from months or years down to hours. AI tools such as Mythos are standardizing and automating the process, enabling attackers to replicate elite hacker expertise at scale through distilled models and agent swarms. 360's own Tulongfeng platform has already discovered over 10,000 vulnerabilities since its June release, including long-hidden high-risk flaws in Windows, Office, OpenClaw, Flowise, and Codex. The emergence of multi-agent systems introduces new attack surfaces because compromised agents can autonomously collaborate and move laterally faster than human operators. Zhou described this as the "second one-way transparency," where offensive tradecraft becomes copy-pasteable via prompts and toolchains. Defenders are advised to adopt "model-versus-model" strategies, automate vulnerability intelligence workflows with SOAR, enforce strict agent permission audits, and integrate AI into their own code review and detection engineering processes.

Corporate Wi-Fi Passwords Stored in Plain Text on Every Connected Device

Many organizations continue to rely on a single shared password for corporate and guest Wi-Fi networks, creating long-term access risks after employees leave. On Windows systems, the netsh wlan show profile command reveals the password in clear text without requiring administrative rights. Linux distributions using NetworkManager store the PSK in readable files under /etc/NetworkManager/system-connections unless the keyring option is selected. macOS keeps passwords in the Keychain, which prompts for user confirmation before disclosure. The article explains why shared passwords cannot serve as effective access control and recommends WPA2/WPA3-Enterprise authentication or properly isolated guest networks instead. It also provides concrete commands for administrators to audit their own environments and highlights the consequences of infrequent password rotation.

Windscribe Releases Open-Source PowerShell Script to Remove Microsoft's Persistent Global Device Identifier from Windows

Windscribe has published an open-source PowerShell script called deGDID that removes Microsoft's Global Device Identifier (GDID) from Windows systems and prevents the creation of new identifiers. The persistent tracker survives IP address changes and operates below the VPN layer, allowing Microsoft to maintain device tracking even when users employ privacy tools. The script was developed after the FBI used GDID to identify a suspected hacker, raising concerns about undisclosed device fingerprinting. deGDID modifies registry access control lists and blocks the DeviceAdd interface to stop Windows from regenerating the identifiers after reboots or server contacts. While effective at disabling the tracking mechanism, the tool can break authentication to login.live.com and disrupt certain Microsoft cloud services. It is intended only for unmanaged consumer devices and will not run on domain-joined or corporate-managed systems. The project is described as experimental and cannot delete identifiers already transmitted to Microsoft servers.

Zero-Day Vulnerability CVE-2026-15682 in AnyDesk Enables Denial-of-Service Attacks on Affected Systems

A newly disclosed zero-day vulnerability in AnyDesk, tracked as CVE-2026-15682, allows attackers to trigger denial-of-service conditions on systems running the popular remote access tool. The flaw centers on a support information transmission feature that can be abused through Windows file system redirection mechanisms. An attacker with limited local access can manipulate these redirections to crash either the AnyDesk application or the underlying operating system. Because AnyDesk is widely deployed by support teams, managed service providers, and internal IT departments, the vulnerability poses a significant risk to remote assistance workflows and incident response operations. Until an official patch is released, organizations are advised to restrict code execution privileges, monitor for anomalous file system redirection activity, and apply updates as soon as they become available.

69% of Browsers Worldwide Vulnerable: How Chrome Sync Enables Stealth Surveillance Without Malware

Google Chrome's standard synchronization feature can be silently abused to turn any browser into a surveillance tool, requiring only brief physical access to a victim's device and the addition of an attacker's Google account. Security researchers at Certo highlighted the technique after multiple cases involving intimate partner surveillance, including one incident where a woman’s visits to a family lawyer and domestic abuse support sites were monitored in real time by her partner. Once sync is enabled, browsing history, bookmarks, open tabs, autofill data, and saved passwords are automatically transmitted to the attacker’s profile, which can be viewed from any device worldwide without needing the victim’s password or installing spyware. Chrome provides no prominent warnings about new profiles or active synchronization, and alerts about logins are sent only to the account owner rather than the device owner. With Chrome holding a 69.65% global market share according to StatCounter data from June 2026, the method potentially affects millions of users on Android, iOS, Windows, and macOS. Experts recommend regularly checking connected profiles in browser settings, using Incognito mode for sensitive activity, securing devices with strong passcodes and biometrics, and immediately removing unknown accounts while changing important passwords.

Secure Boot Bypassed for Over a Decade Through Unrevoked Vulnerable Shim Bootloaders, ESET Finds

ESET researchers have disclosed that Secure Boot, the UEFI mechanism designed to block malicious code before Windows or Linux starts, could be bypassed for more than ten years using old but still-trusted shim bootloader images signed by Microsoft. The 11 vulnerable shims, some dating back to 2013, were never added to revocation lists despite known vulnerabilities, allowing attackers to load unsigned or malicious code early in the boot process. The flaw affected both Linux distributions and Windows systems because UEFI firmware does not tie a Microsoft-signed shim to a specific operating system. After Microsoft finally revoked the images in its June updates following ESET’s disclosure, users were advised to check firmware policies and Linux Vendor Firmware Service for proper propagation of the new revocation data. The incident highlights systemic weaknesses in managing thousands of signed boot components and the central trust role played by Microsoft in the UEFI ecosystem.

Microsoft Patches Record 570 Windows Vulnerabilities in July Update, Including Three Actively Exploited Zero-Days

Microsoft released its largest Patch Tuesday update to date, addressing 570 vulnerabilities across Windows and related products. Among them are three zero-day flaws, two of which have already been exploited in real-world attacks. Fifty-nine issues were rated critical, with 48 enabling remote code execution. The company credited its use of AI for discovering more vulnerabilities in the Windows codebase. The update covers a wide range of components including .NET, Active Directory services, Microsoft Office, Azure services, and Microsoft Defender. Administrators are urged to apply the patches promptly to mitigate risks from privilege escalation, remote code execution, and information disclosure flaws.

WinFsp Vulnerability CVE-2026-3006 Allows Local Attackers to Escalate Privileges to SYSTEM via Race Condition in Kernel Driver

A critical vulnerability has been discovered in WinFsp, the open-source platform used to implement virtual disks, network file shares, and custom file systems on Windows. The flaw, tracked as CVE-2026-3006 with a CVSS 3.1 score of 7.0, affects version 2.1.25156 and all earlier releases, enabling a local attacker to trigger a race condition that leads to a memory overflow inside the kernel-mode driver. Successful exploitation grants full SYSTEM-level privileges, allowing modification of protected files, installation of services and drivers, disabling of security mechanisms, and creation of new accounts. The issue cannot be exploited remotely and requires the attacker to already have the ability to execute code on the target system, either through a compromised account or by running malicious software. WinFsp components are frequently bundled inside third-party virtualization and storage applications, significantly expanding the potential attack surface. Developers have released a fix in WinFsp 2.2B1, while Singapore’s Cyber Security Agency recommends immediate updates, restriction of local administrative rights, and monitoring for unexpected driver or service changes.

Windows Tracks Users Through Persistent GDID Identifier: How to Minimize Your Digital Footprint

A recent case involving a 19-year-old hacker identified through his Windows installation has highlighted how Microsoft’s GDID creates a permanent device fingerprint that survives VPNs and IP changes. GDID serves as a constant identifier across licensing, Microsoft Store, telemetry, and other services, making it difficult for users to stay anonymous even when changing networks. While there is no single button to disable this functionality completely, several practical steps can significantly reduce the amount of data Windows sends to Microsoft. These include switching to a local account instead of a Microsoft Account, disabling activity history, limiting optional diagnostic data, and turning off unused background services such as Phone Link and cloud synchronization. Experts note that simply reinstalling Windows does not erase the link if the same Microsoft Account is used afterward. The story underscores the ongoing trade-off between privacy and convenience in the Windows ecosystem.