Microsoft on HackingPassion.com : root@HackingPassion.com-[~]

Microsoft Signed 11 Files That Bypass Secure Boot

Wed, 15 Jul 2026 13:29:52 +0200

Some malware loads before Windows even starts, before your antivirus exists. It survives a full reinstall, and 11 files signed by Microsoft are all it takes.

One check is supposed to make that impossible. These 11 get past it, on almost any PC.

ESET’s Martin Smolár published this on July 14. The files are old, some more than ten years old, and each one carries a valid Microsoft signature.

When you turn on your computer, something runs before Windows does. It is the firmware, the low-level code built into the machine, and its job is to load the thing that loads Windows. Secure Boot is the check that runs at that moment. It looks at each piece of startup code and asks one question: is this signed by someone I trust? If the answer is yes, it runs. If no, it stops.

Windows Hands Your Name to the Police Through One Hidden Number

Wed, 08 Jul 2026 11:29:27 +0200

You are completely anonymous and think no one can trace you. But Windows put a permanent number on your machine, it never turns off, and that number is where the police start when they want your name. That is exactly how the FBI just caught a 19-year-old hacker who thought he had covered every track.

On July 1, US prosecutors in Chicago made their case public against a 19-year-old named Peter Stokes, who holds both a US and an Estonian passport. They say he runs with Scattered Spider, one of the biggest crews in cybercrime, the kind that breaks into companies and then demands money to leave them alone. He has not been found guilty of anything, and under the law he stays innocent until a court says otherwise.

The Miasma Worm Hid in Microsoft's Code and Ran the Moment You Opened It

Thu, 11 Jun 2026 12:08:30 +0200

GitHub disabled 73 of Microsoft’s own repositories in 105 seconds, after a worm called Miasma planted a credential stealer inside Microsoft’s Azure code on GitHub.

The part that makes this different is how it ran. A developer did not need to build the project or install a package. Opening one of those repositories in an AI editor, VS Code, Claude Code, Cursor, or Gemini, was enough to set it off. 😱

RedSun and UnDefend: Two Unpatched Windows Defender Zero-Days

Sun, 19 Apr 2026 10:57:14 +0200

Two unpatched Windows Defender zero-days have been actively exploited since April 16th, and both of them work on fully patched Windows 10, Windows 11, and Server 2019 and later, including machines that installed this month’s Patch Tuesday updates. One of them makes Defender write the attacker’s payload into System32 by itself, then stands back and lets Windows run it as SYSTEM. The other blocks Defender from receiving any new virus definitions and lies to the EDR management console about it, showing green checkmarks on machines that are already fully compromised. 😏

Why It Took Microsoft 32 Years to Disable NTLM

Wed, 04 Feb 2026 11:31:37 +0100

32 years. That is how long it took Microsoft to disable NTLM, the protocol that handles Windows login authentication. A broken system linked to $10 billion in damages and some of the worst cyberattacks ever recorded. Hackers have been exploiting it since 2001. Here is the story of why it took this long.

On January 30, 2026, Microsoft announced they will finally disable NTLM by default in future Windows releases.

One Windows Update, Ten Problems, Two Emergency Patches

Wed, 28 Jan 2026 14:10:10 +0100

Microsoft pushed one security update. It broke at least 10 different things. 114 security fixes. Two emergency patches. PCs that won’t boot. Outlook that crashes. Remote Desktop that fails. Shutdown buttons that do nothing. And Microsoft is still investigating why some systems show a black screen and never start again. 🧐

A Windows and Microsoft story that keeps getting worse.

This was one of the largest Patch Tuesday releases in history. 114 vulnerabilities fixed, 8 rated Critical, 106 Important. The breakdown: 57 privilege escalation flaws, 22 remote code execution bugs, and 22 information disclosure vulnerabilities. Three zero-days in total, one actively exploited in the wild and two publicly known before Microsoft could patch them. In 2025 alone, Microsoft patched 1,130 CVEs across the year, 12% more than 2024.