The cybersecurity industry's giving Chicken Little a run for his money. Companies have been quick to proclaim that AI will fundamentally change the security landscape, which means every new capability added to a large language model (LLM) can be made into a "the sky is falling" moment, with the latest example being the development of AI malware that can successfully work around Microsoft Defender.

Dark Reading reported Wednesday that researchers from Outflank plan to show off this new AI malware at Black Hat 2025 in August. But don't throw away Windows Defender just yet.

According to its website, Outflank is a "highly skilled red team composed of experienced professionals" who "specialize in assessing resilience against advanced threats and training security teams for enhanced incident response." Its principal offensive specialist lead, Kyle Avery, told Dark Reading that he spent three months and approximately $1,500 training the open-source Qwen 2.5 LLM to bypass Microsoft Defender. That's a fairly steep but not insurmountable upfront cost for this capability.

But here's the rub: the report said Avery's "model was able to generate malware capable of totally bypassing Microsoft Defender for Endpoint about 8% of the time." That compares favorably to other models—he told Dark Reading that "Anthropic's AI could do the same less than 1% of the time, and DeepSeek's less than 0.5% of the time," which means his model is significantly more effective at this task—but it's hardly the kind of plug-and-play performance most script kiddies would expect.

Models like this are expected to get better over time. Apparently, the chatbot barons have discovered reinforcement learning, a technique used by machine learning researchers to improve the performance of their models since the '90s, so they could theoretically be flogged enough to improve their ability to meet this task. An enterprising cybercriminal with a surplus of GPUs on hand might be willing to devote more time and money to this task.

Which leaves us with two questions: Are we sure there isn't an upper bound on these capabilities, and what happens when Microsoft Defender is improved to compensate? Microsoft isn't exactly known for keeping its software up-to-date with bleeding-edge features, but even Notepad supports Markdown now.

None of this is to belittle Outflank's findings. This research is a somewhat proficient proof of concept for all the doom-saying the security industry's been doing since it hitched its wagon to the AI hype caravan. But I'd be more worried about leaked red teaming tools being used to deploy malware, the fact that one person falling for a social engineering attack is still enough to disrupt a company's operations, and the ability for hackers to piggyback off the surveillance state than about vibe hacking

Yesterday, Microsoft published an official blog post detailing its changes to Microsoft Defender for Individuals. The post focused on improving public Wi-Fi security and functionality through its mobile app's VPN (Virtual Private Network) functionality. The "Privacy protection" functionality in Microsoft Defender now reflects whether your Wi-Fi is considered secure and enables a helpful "VPN on" toggle for when you are on public or unsecured Wi-Fi and wish to anonymize your traffic.

For those unfamiliar with VPNs, here's what you need to know. VPNs anonymize your browsing traffic, or at least obfuscate precisely what's happening between your PC, access point, and the Internet before you do whatever identifiable actions you are doing online. Paid VPN plans are a top choice among privacy enthusiasts, but options like the Tor Browser, specific extensions, and/or better browsing habits can also help you stay secure online.

So, what's the catch of the Microsoft Defender VPN functionality? Well, there are a few catches. For one, while Defender itself, with its Privacy protection VPN, is available on Windows, Mac OS, Android, and iOS, it isn't on Linux. The insecure Wi-Fi detection feature also doesn't yet work on Mac OS but does work on the rest of the targeted platforms. The "suspicious Wi-Fi detection" feature is also exclusive to the two mobile platforms. Additionally, only Germans, Canadians, US users, and UK users get access to the VPN functionality— and anyone who does use it long-term will need to pay for a Microsoft 365 subscription.

Regarding what's new, Microsoft announced that Microsoft Defender's VPN features will soon be available in ten additional countries in Europe, Asia, and Latin America. Additionally, the ability to automatically enable a VPN on public (and presumably unsecured) Wi-Fi will be "coming soon" to the Defender app across platforms. At the same time, the enhanced suspicious Wi-Fi detection is also listed as "coming soon" to the desktop versions of the Defender App.

Hopefully, Microsoft can iron out these last few compatibility hiccups to provide a more definitive security solution for its users. For now, a Microsoft 365 subscription will at least earn most Defender users 50 GB a month from Microsoft's VPN server before throttling occurs.

A high-severity vulnerability in Microsoft Defender SmartScreen is being used to deliver information-stealing malware in Spain, Thailand, and the U.S., security researchers say. The researchers discovered the stealer campaign using booby-trapped files to exploit the vulnerability and deliver information stealers such as ACR Stealer, Lumma, and Meduza.

Fortinet FortiGuard Labs observed the latest stealer campaign spreading multiple files that can sidestep Microsoft Defender’s SmartScreen to download malicious software to target computers. The security vulnerability was addressed in CVE-2024-21412.

Since Microsoft closed this security hole with an update released in February 2024, the news underscores the importance of installing security updates promptly. The disclosure comes on the heels of the CrowdStrike outage, which is also being leveraged to deliver malware: CrowdStrike revealed that threat actors are delivering a fake recovery manual that delivers a previously undocumented stealer called Daolpu.

Security researcher Cara Lin said (via The Hacker News) that the attackers “lure victims into clicking a crafted link to a URL file designed to download an LNK file.” Once downloaded and opened, the LNK file downloads an executable file containing an HTML Application (HTA) script.

Next, the HTA decodes and decrypts obfuscated PowerShell code that retrieves decoy PDF files along with a shell code injector. This shell code injector then deploys and launches the malicious software. The malware transmits information from web browsers, crypto wallets, messaging apps, FTP and email clients, VPN services, and password managers through a dead drop resolver on the Steam community website, a popular gaming service.

ACR Stealer targets a wide variety of popular applications. These include multiple versions of Google Chrome, Epic Privacy Browser, Vivaldi, Microsoft Edge, Opera, and Mozilla Firefox, to name a few. It also targets messenger apps including Telegram, Pidgin, Signal, Tox, Psi, Psi+, and WhatsApp, along with numerous FTP clients.

VPN services NordVPN and AzireVPN have also been targeted, as have password managers Bitwarden, NordPass, 1Password, and RoboForm. While the hijacked data from a password manager should be encrypted, there remains some risk of sensitive data being pulled from them. Fortinet has a complete list of known targeted software in its analysis of the stealer campaign.

Again, the Microsoft Defender SmartScreen vulnerability was patched in a February 2024 security update. However, if an organization doesn’t install such updates regularly, it remains vulnerable to the threat.

Microsoft Defender, Windows’ built-in antivirus tool, is widely considered robust enough to mean that an average user no longer needs a third-party antivirus or security suite. However, a bug brought to light by Twitter/X user yappy shows that there are times when Microsoft Defender can be extremely overzealous in its attempts to defend your computer.

A false positive can be observed when you type ‘This content is no longer available.’ or ‘This content is no longer available!’ in Notepad and save it as a text file on your PC. When you do so, Microsoft Defender will instantly flag it as a Trojan file and delete it from your system - no matter what file name you use, ostensibly protecting you from a potential 'severe threat.'

Upon first investigation, yappy and some other Tweet/Xers concluded that the cause of the false positive was an SHA-256 collision. However, the astronomical odds against such a clash rung true, as most commenters now agree the headlining text string was used in several previous threats, and thus raises a red flag in the Windows Defender detection engine.

This head-scratching bug isn’t the first time Microsoft has had issues with its Defender antivirus. Microsoft actually broke it in 2020 with a faulty update, while it patched a serious bug in 2019 that prevented the antivirus app from operating properly. But aside from these missteps, we still consider Microsoft Defender as a pretty good antivirus.

Thankfully, this bug isn’t as serious as those issues, as the text line doesn’t pose any actual threat to Windows 11. Furthermore, if you add other text to it (like changing punctuation or adding an extra space at the end), the false detection goes away. However, in the unlikely event that you must have this exact text string saved on a text file on your computer, you need to exclude the folder where you’re saving it from scans, otherwise, it’ll be gone the moment you hit Ctrl + S.

Hopefully, Microsoft can fix this silly bug soon. This isn’t a threat to the security of Windows 11 and we don't think anyone will want to temporarily disable Microsoft Defender and install another antivirus program waiting for a fix. Meanwhile, Kaspersky has recently become even less attractive as an alternative, as Washington has just sanctioned it.

A performance-sapping conflict between Mozilla Firefox and Microsoft Defender was first discussed on Bugzilla half a decade ago. However, Firefox users can now rejoice, as Mozilla devs and Microsoft worked together to release an update to MsMpEng.exe (a core process of Windows Defender), which is currently being rolled out. Troubled users should notice a significant improvement after the update, with "a ~75% improvement in CPU usage from MsMpEng.exe when browsing with Firefox," according to senior Mozilla software engineer Yannis Juglaret.

So, what has been happening, and why was there an awful interaction between Firefox and Microsoft Defender? Microsoft acknowledged a problem with MsMpEng.exe using too much CPU time when Windows Defender's real-time Protection feature is spurred into action. This change has helped cut the CPU usage observed by Firefox users significantly.

The Firefox app was particularly hard hit by the Microsoft bug, as the browser is said to generate up to 7x more Event Tracing for Windows (ETW) events compared to competitors (Edge, Chrome etc). It sends these ‘VirtualProtect’ calls to the antivirus / anti-malware provider to try and keep the browser safe from harm as it roams the web.

Though Microsoft’s patch of MsMpEng.exe helps a lot, as you can see from the above-quoted figures, Mozilla devs acknowledge that “We should try to reduce the number of events that Firefox generates, which will reduce the CPU usage from [all] AV software.” 

With this in mind, it is also worth noting that other AV solutions, like those from Norton, will also consume a lot of CPU time due to the numerous (7x) Firefox calls for monitoring VirtualProtect. Thus, any program that calls VirtualProtect will benefit from Microsoft’s new MsMpEng.exe, not just Firefox.

An “Explosive” Waste of Time

Mozilla’s Juglaret summed up the prior situation most succinctly when he wrote, “This problem has two sides: Microsoft was doing a lot of useless computations upon each event; and we are generating a lot of events.” He then underlined the impact, “The combination is explosive.”

Using more processing power than necessary is a common irritation for computer users. Those using laptops away from a power outlet will want to avoid CPU-eating applications when there are more efficient alternatives. Meanwhile, if the problem is widespread enough and runs long enough, the math is also scary for desktop users. For example, Hacker News forum members have estimated the energy wasted by Microsoft’s MsMpEng.exe, and the 300M+ users of Firefox could have easily eaten up the entire output of an average coal-fired power plant every day...

Microsoft Defender is an essential security tool preinstalled on the Windows 11 operating system. The security suite is fully baked into the operating system to protect your system from malware, but not everyone likes it. Would you prefer to install an alternative antivirus/antispyware to kick Microsoft Defender to the curb? We have two options: temporarily disable the real-time scanning component of the security suite or disable the entire suite long-term in favor of a competing app.

Temporarily Disable Microsoft Defender Real-time Antivirus Protection

If you want a relatively easy way to disable Microsoft Defender’s real-time scanning engine, we have you covered with the following steps:

1. Click on the Start menu and search for the Windows Security app.

2. Once in the Windows Security app, click on Virus & threat protection.

3. Select Manage settings under Virus & threat and protection settings.

4. You'll see a button for Real-time protection; turn it off.

5. Turning off Real-time protection will present a red X and a warning message about your computer being vulnerable to attacks.

Remember, this only temporarily disables real-time antivirus protection. Microsoft warns that potentially harmful apps and files downloaded from the Internet are not scanned when real-time protection is disabled. However, scans already scheduled for your system will continue unabated.

Disable Microsoft Defender by Installing Another Antivirus Program

There's another way to disable Microsoft Defender once and for all, and not just the real-time antivirus function. Installing a third-party antivirus security suite will automatically put Microsoft Defender on the back burner.

Let’s use AVG Antivirus Free as an example. It’s a free, no-frills Microsoft Defender alternative that has been around for two decades. Although our example uses AVG Antivirus Free, installing any credible antivirus program will have the same effect in disabling Microsoft Defender.

1. Install your preferred antivirus software (in this case, AVG Antivirus Free). This action will automatically disable Microsoft Defender.

2. Once your software is installed, open the Windows Security app.

You should now see that Windows 11 now recognizes AVG Antivirus (or your preferred antivirus app) protecting your computer.

At this point, your installed antivirus software has complete control over real-time scanning and manual scans of your computer with no intervention from Microsoft Defender. However, if you want increased protection, you can click on Microsoft Defender Antivirus options.

Here, you can turn on Periodic scanning to have the software occasionally scan for threats in the background.

We should caution that, while it is possible to disable Microsoft Defender in varying degrees, it is not advisable (in most instances) to run without real-time protection on an internet-connected computer for an extended period. 

Microsoft is beta testing, in a bit of a secretive way, an app called PC Manager that fills the niche currently populated by CCleaner and Huawei’s PC Manager. It scans your PC for unwanted files, can free up RAM, and ties into Windows Defender to block malicious apps. Unfortunately, it also nags you to change your browser to Microsoft Edge.

We first learned about the app in a tweet from Aggiornamenti Lumia, which led to a story on XDA Developers. The pcmanager.microsoft.com site was found to be active but in Chinese. Eventually, with the app not appearing on the Microsoft Store, a download link for an .exe file was discovered, and people could start trying it out for themselves.

The app is a simple one that loads at startup, then sits in the system tray. When invoked, it scans your storage to discover any cruft it deems worthy of being swept away. There's a RAM boost feature that increased the amount of free RAM on our test machine by about 10% A process inspector performs its best Task Manager impression by allowing you to end unused programs, and it can tell you about the effect other startup apps are having on the performance of your machine - something already in the OS via the Startup Apps page of Settings.

It also duplicates some Windows Defender functionality, with a Scan button for threats, and checks Windows Update. It also has a few less welcome abilities: nagging us to change our default browser from Chrome to Edge (we're old-fashioned, ok) and recommending we turn off Malwarebytes.

While the app is still clearly in beta - it's displayed at the top at all times - it's a welcome addition to Windows, bringing together some disparate but related tools in one place.

You spend a lot of money on your computer. You buy the best graphics Card and best CPU for your budget and enjoy creating and gaming with your rig. Everything is running smoothly, until you notice your performance is suddenly lacking.

When did you last run Windows Update, empty the wastebasket or run a virus scan? Could it be a corrupt configuration file causing your grief? 

We’ve put together a few tips and tricks to help keep your rig running smooth.

Keeping the PC Updated and Secure

Your PC runs better when it has the latest updates. These updates can fix issues and bugs, often introducing improved drivers and software for your components.

1. Check for the latest OS updates. Search for Update via the Start menu and click on Check for updates.

2. Click on Check for updates.

3. If any updates are required, download and install. These can also be scheduled to take place when you are not using your computer.

4. Move unused files from the Desktop into folders. Find your files faster, use a system to keep your important files ready for use. Old downloads, updates, videos etc can be stored on an external drive.

5. Empty your trash! The recycle bin can store Gigabytes of data, data that we had thought was long since deleted.

6. Reduce how much trash you can recycle. Right click on your Recycle Bin and select Properties.

7. Set the maximum size to a few gigabytes for your drives, click OK to save. Note that each drive has to be selected, and the custom size set individually.

Running A Virus Scan

Malware and viruses can bring misery to any user. Removing them is often time consuming, and can be expensive. The adage that “prevention is better than cure” applies here. To keep yourself and your system protected you should run regular scans.

1. Click on the Start menu and search for Windows Security. Click on the icon to load.

2. Select Virus and threat protection.

3. Click on Quick scan to perform a scan of your main drive. The process can take some time to complete.

4. Click on Scan options.

5. Select Full scan and then click Scan now to run a full deep scan of your system. This process can take approximately one hour to complete.

Running a Scan for Malware

To remove malware we need to perform a full scan with the system offline.

1. Click on the Start menu and search for Windows Security. Click on the icon to load.

2. Select Virus and threat protection.

3. Click on Scan options.

4. Select Microsoft Defender Offline scan, and then click scan now. Note that this will restart your computer and perform an automated scan that will prevent you from using the computer.

Repairing Files

Configuration files can sometimes become corrupt and cause issues. Broken configuration files can introduce bugs / issues that cause your system to work harder. Scanning for issues should be a routine task, but we often leave this until we encounter an issue.

To scan your drive for issues.

1. Open Windows Explorer and right click on C: drive. Select Properties.

2. Under Tools, look for Error checking and click check.

3. Select Scan drive and wait for the task to complete.

4. If prompted, take action to correct any issues. If there are none, click Close.

Staying on top

We’ve taken the steps to keep our PC running, but remember that we need to keep on top of our systems. To keep them ticking over, and to prevent issues from ruining our day. As we said earlier, this is by far the most exciting task, but it is an essential one.

Windows 11’s newest security feature comes with a sting in the tail: if you’ve upgraded to the newest version of Microsoft’s operating system, rather than bought a new PC with it installed, you’ll need to reset it if you want Smart App Control. The news broke in a blog post from David Weston, vice president of OS security and enterprise at Microsoft, subsequently reported on by PCWorld.

“In a future release of Windows 11 you’re going to see significant security updates that add even more protection from the chip to the cloud by combining modern hardware and software,” writes Weston in his post, which sounds fine, as enhanced security was one of the reasons we have Windows 11 in the first place. 

One of these major enhancements is Smart App Control, which appeared in a recent Windows 11 insider build, and blocks malicious, untrusted and potentially unwanted apps. The first set are flagged by Microsoft, but the ‘smart’ part of the system kicks in for the others, taking into account digital signatures, app usage, and Microsoft's cloud-based security service. There doesn’t seem to be a way of whitelisting apps, or unblocking them in any way once they’re blocked.

It also acts in a new and strange way, according to German news site Ghacks. Once installed, Smart App Control enters evaluation mode, learning whether it can assist you but not blocking anything, until it automatically turns on. It can be manually turned on or off from the Windows Security app. The strange thing is that, if turned off, it cannot be turned back on without a full reset of the PC and a clean install of Windows 11.

The need for a clean installation if you want Smart App Control on your existing Windows 11 PC is detailed in Weston’s blog post: “Devices running previous versions of Windows 11 will have to be reset and have a clean installation of Windows 11 to take advantage of this feature,” he writes.

Microsoft’s security splurge is dressed in the language of hybrid working and zero trust, as the Redmond software giant attempts to push its Pluton platform. Smart App Control, and the promotion of Microsoft SmartScreen to a part of the OS instead of a security app, is part of a drive to protect critical business machines used at home from phishing, ransomware, and other unwanted nasties, and it’s up to company IT departments to decide whether to deploy it. Home users with Microsoft Defender switched on are unlikely to need it urgently, so the need for a clean install, while annoying, might not affect many users after all.

Trouble is brewing in the fallout from the Nvidia hack attack, which we first reported on in late February. Two code-signing certificates were among the purported 1TB of data obtained, which compromised hardware schematics, firmware, drivers, employee information, and more. The significance of the certificates getting into any hackers' grubby hands is that threat actors can repurpose them to sign their (mal)wares, reports Bleeping Computer.

Just ahead of the weekend, computer security specialist Bill Demirkapi highlighted the two leaked Nvidia Corporation certificates, as issued by VeriSign. You can see from the screenshots above that one of them expired in 2014 and the other in 2018. Despite the certificates so clearly being expired, Demirkapi says that " Windows still allows them to be used for driver signing purposes."

Proof of the danger from these certificates being made public came to light just a few hours later. Security researcher Florian Roth took to Twitter to provide links to malware spotted in the wild, signed as if they were genuine, unaltered Nvidia code. Of course, these weren't links to the malware, but rather to virus scanning databases reporting on their existence.

A long list of malware seems to have been seeded, now certified as genuine Nvidia code. Among the suspicious packages, many seem to be infected with Mimikatz, a program used to extract passwords, PINs, and similar from a computer's memory that falls victim to it.

Other common "Nvidia signed" malware in the online detection database listings were for KDU – a rootkit malware, and for cryptomining malware – software that will try and sneakily eat up your system's computing resources, given a chance.

Why Doesn't Windows Block the Installation of Apps With Expired Certificates?

New malware can now be digitally signed to "verify" that Nvidia was the file's developer and that a third party hasn't modified it. The certificate expiry dates don't particularly impede malware writers' deceit because Windows will accept them on some occasions.

Interestingly, the certificate that expired in 2014 is the most problematic leak of the two. This was the one used by all the malware spotted in the wild, due to a loophole. In 2015, Microsoft purposely allowed pre-July 29, 2015 certificated drivers to run for the sake of backward compatibility with old devices.

Computer administrators can block code signed by the rogue certificates from running on machines using Windows Defender Application Control policies to control what Nvidia drivers can be loaded. However, this is an advanced configuration process, so it is hoped Microsoft will provide user updates to revoke the stolen certificates. However, such a sweeping action by Microsoft might block some older, legitimate Nvidia drivers from working on Windows 10 and 11.

There's no official way to watch "Spider-Man: No Way Home" from the comforts of your humble abode. Some people looking to watch the movie without making a trip to the theater have resorted to downloading pirated copies of the film—and they may have accidentally installed cryptocurrency mining malware in the process.

ReasonLabs said it discovered malware used to mine the Monero cryptocurrency in a file called "spiderman_net_putidomoi.torrent.exe," which the company translated from Russian to "spiderman_no_wayhome.torrent.exe," leading it to believe that "the origin of the file is most likely from a Russian torrenting website."

This type of malware spreads by taking advantage of people's desire to engage with popular media. "Spider-Man: No Way Home" is the first movie to gross more than $1 billion at the box office (during the COVID-19 era) even though it's theater-exclusive and the Omicron variant of COVID-19 is rapidly spreading. So, of course, people are going to try to pirate it.

The company said this malware derives from the SilentXMRMiner open source project that anyone can download from GitHub. The project offers a point-and-click interface that allows wannabe malware distributors to create a new miner compatible with numerous cryptocurrencies without much effort on their part.

ReasonLabs said that after it's installed, the malware "adds exclusions to Windows Defender, creates persistence, and spawns a watchdog process to maintain its activity," all of which is enabled via the SilentXMRMiner project. It then devotes the victim's compute power to mining Monero for whoever created it.

"Although this malware does not compromise personal information (which is what most users are afraid of when thinking about a virus on their computer)," ReasonLabs said. "The damage that a miner causes can be seen in the user's electricity bill. This is real money that they have to pay, given that the miner runs for long periods. Additionally, the damage can be felt on a user's device as often miners require high CPU usage, which causes the computer to slow down drastically."

Unfortunately, pirates can't necessarily rely on antivirus solutions to defend against malware like this. ReasonLabs said it "encountered various compiled versions of this project, some more obfuscated than others," which can help the malware evade signature-based detection systems. (Read: Most traditional antivirus software.)

The company proved its point by submitting the malware to VirusTotal, which analyzes files and URLs with more than 70 different security tools. Unfortunately, ReasonLabs said the malware wasn't flagged as malicious by VirusTotal when it wrote its report, so the vast majority of popular antivirus solutions wouldn't have protected anyone.

The simplest way to avoid falling victim to this malware is to refrain from pirating "Spider-Man: No Way Home." Barring that, ReasonLabs said those who choose to sail the black seas ought to double-check what kind of file they're downloading. There's no reason for a movie, pirated or not, to be distributed as an executable file.

Intel and Microsoft are collaborating on a new project to help enterprise and small business customers avoid security issues that may involve others using PCs on your network to mine cryptocurrencies, known as cryptojacking.

The protection will be built into Microsoft Defender for Endpoint on systems using 6th Gen or later Intel vPro and Intel Core processors. Specifically, it uses Intel Threat Detection Technology, or TDT to take advantage of the CPU for machine learning to detect cryptomining.

In a press release, Intel stated that the rise of cryptocurrencies in the mainstream and their increase in value means that "cybercriminals [will] shift their focus from ransomware to cryptojacking." Intel claims that there was a 53% increase in mining malware attacks in the fourth quarter of 2020 compared to the quarter before it.

Cryptojacking, just like normal cryptomining, weighs heavily on a computer's resources and sends the crypto back to a wallet. This could drastically slow a computer. Intel suggests some cryptojackers can also spread over a network, where large businesses could have hundreds or thousands of devices.

Intel's TDT technology will use its machine learning and telemetry to "fingerprint" the suspicious activities, some of which it can offload to the integrated GPU. The cryptojacking threats will appear in Windows Defender to people using their devices, just like any other threat.

In a separate release, Microsoft's Karthik Selvaraj, principal research manager on the Microsoft 365 Defender research team wrote that "[e]ven though we have enabled this technology specifically for cryptocurrency mining, it expands the horizons for detecting more aggressive threats like side-channel attacks and ransomware."

At the moment, this appears to only be available on 6th Gen or later Intel vPro (and some Core) platforms running Microsoft's enterprise security suite. It's unclear if there are plans to further expand the program to general users or other silicon.

It's starting to seem like Microsoft can't update anything without breaking it. Windows Latest reported yesterday that Windows Defender, the built-in antivirus tool for Windows 10, stopped functioning properly after it was updated recently.

The report indicated that Windows Defender--which is set to be renamed Microsoft Defender as it expands to additional platforms--has shown an error message to multiple Windows 10 users. Windows 7 and 8 users don't appear to be affected.

That error message reads: "Items skipped during scan. The Windows Defender Antivirus scan skipped an item due to exclusion or network scanning settings." Either those scans are failing, or the error message is being shown when it shouldn't be.

Failed scans could potentially expose Windows 10 users to security risks. An incorrect error message could also erode trust in Windows Defender, though, which might lead Windows 10 users to install antivirus software they probably don't need.

Luckily it seems like Windows Defender's offline scans are working as intended, so Windows 10 users should probably use that option until this problem is resolved. Microsoft explained how to use Windows Defender offline in a support article.

Microsoft Defender, the security tool formerly known as Windows Defender, received a new feature yesterday with the release of Tamper Protection, which Microsoft started testing in December 2018. Now, Tamper Protection is enabled by default, though it can still be disabled by going into the Windows Security page in the Settings app.

So what does Tamper Protection do? It stops anyone without the proper authorization from changing Microsoft Defender settings to undermine Windows 10's security. For most people that's supposed to stop malware from making them vulnerable to other attacks, but Microsoft's enterprise customers can also use the feature to stop non-administrators from weakening a system's defenses.

Tamper Protection technically debuted with the Windows 10 May 2019 Update, but it had to be manually activated and was originally available only to certain users. Making it available to everyone running the most recent version of Windows 10 (the second annual update won't debut until November) and enabling it by default should greatly increase the number of systems protected by the new feature.

Microsoft said in yesterday's announcement that it "will continue working on this feature, including building support for older Windows versions," moving forward. In the meantime, it believes that "it’s critical for customers, across home users and commercial customers, to turn on tamper protection to ensure that essential security solutions are not circumvented." 

In the latest “Patch Tuesday” security fixes bundle, Microsoft included patches for two new critical Remote Code Execution (RCE) vulnerabilities (CVE-2019-1181 and CVE-2019-1182) in the Windows Remote Desktop Services.

Following the May disclosure of BlueKeep, after the company’s security team attempted to harden the Remote Desktop Services feature in Windows, Microsoft’s engineers found two other wormable bugs that attackers could exploit. 

The two vulnerabilities are part of 93 security vulnerabilities Microsoft and affect Windows 7 SP1, Windows Server 2008 R2 SP1, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, as well as all versions of Windows 10, including the server ones. According to Microsoft, Windows XP, Windows Server 2003 and Windows Server 2008 and Remote Desktop Protocol itself are not affected by the vulnerabilities.

In a blog post this week, Microsoft said that it doesn’t believe that the vulnerabilities were being exploited in the wild by attackers. However, the company still urges everyone to update their systems immediately, as the bugs are every bit as dangerous as BlueKeep. 

Microsoft Patches 93 Vulnerabilities In Latest Windows Update

System administrators will have their hands full in the second part of this month, as Microsoft has released a batch of 93 security fixes, covering software, including Windows operating systems, Internet Explorer, Edge, ChakraCore, Microsoft Office, Microsoft Office Services and Web Apps, Azure DevOps Server, Visual Studio, Online Services and Microsoft Dynamics. Of the 93 bugs, about a third (29) are critical, while the other 64 are rated Important in severity.

Microsoft has recently complained that more than two-thirds of its Windows bugs are due to memory safety issues. The company said that it will experiment with replacing some parts of Windows code with code written in the Mozilla-sponsored Rust memory-safe programming language. In the meantime, the Microsoft Defender solution seems to be doing quite well in antivirus tests lately.

This week's news comes on the heels of the revelation of BlueKeep, a pre-authentication wormable RCE into the Windows Remote Desktop Protocol (RDP), Microsoft issued multiple warnings to users and organizations to patch immediately, as attackers could wreak havoc with such a security flaw. At the time, Microsoft believed that over 1 million systems were vulnerable to the BlueKeep bug. Due to the nature of a how a worm (a type of malicious software that can replicate itself) jumps from one computer network to the next, computers inside private networks not normally exposed to the Internet could have also been compromised.

Microsoft announced this week that its Microsoft Defender ATP software (previously known as Windows Defender ATP) is now available to preview for businesses using computers running macOS. Apple has claimed for many years that its macOS devices didn’t need antivirus software, but as more businesses adopt Macs, the number of threats has also increased. Defender ATP customers are now able to apply for a preview of the macOS client, Microsoft's announcement said. 

Defender ATP Comes to macOS

Microsoft announced that businesses using both Windows and macOS devices will be able to use the new cross-platform Defender ATP solution to protect their devices and networks. The new client application will support macOS Mojave, macOS High Sierra, or macOS Sierra.

People using the Defender ATP client for macOS will be able to configure advanced settings such as:

• Disabling or enabling real-time protection, cloud-delivered protection and automatic sample submission
• Adding exclusions for files and paths
• Managing notifications when threats are found
• Manually checking for security intelligence updates

Along with the Defender ATP client, an auto-update service is also installed. This service ensures that the application has the latest features and security patches and also keeps the client constantly connected to the cloud. 

Microsoft Defender ATP for Enterprises

Microsoft Defender ATP is Microsoft’s security service for companies that want not just anti-malware protection but also a detailed overview of their devices’ security, as well as the threats these companies may experience at any given moment.

Besides using existing security features built into Windows 10 Enterprise, such as Microsoft’s Defender antivirus, Device Guard and AppLocker, Defender ATP also uses big data analysis to provide IT professionals with insight on how to best respond to the existing threats. It also offers security professionals forensics data to see how a previous attack happened.

To provide all of these insights, Microsoft mines data from over 1 billion Windows computers, 2.5 trillion web URLs and over 1 million suspicious files it discovers every day. The company promises not to use all of this data for advertising purposes or any other purpose beyond Defender ATP’s intended goal of protecting devices against attacks.

Microsoft released Windows 10 Insider Preview Build 17713 to Windows Insiders in the Fast Ring. The new version brings some notable security-related enhancements, as well as other improvements.

Windows Defender Application Guard

Windows Defender Application Guard, the sandboxing technology that can put applications (only the Edge browser for now) inside a virtual machine running another minimal instance of Windows, now comes with a new interface inside the Windows Security dashboard. 

Users will be able to fully configure the Application Guard without messing with Registry key settings, and those whose computers are managed by enterprise policies will also be able to check what configurations their IT administration has made for their machines.

All of the new Application Guard settings will appear in the Windows Security dashboard, as long as the devices meet certain hardware requirements. Currently, Application Guard is also only supported on Windows 10 Enterprise build 1709 or newer, or Windows 10 Professional build 1803 or newer.

Microsoft Edge Improvements

Besides the isolated browsing offered by Application Guard, Edge also received several other improvements in build 17713. One of them is per-site media controls, which allows users to control autoplay permission on a per-site basis under the “Website permission” section of the Website Identification pane.

However, from the looks of it, autoplaying will remain on by default for websites, so you'll have to turn-off autoplay manually for each website that annoys you with autoplaying ads or videos.

You can now also look up definitions for words in Reading View, Books, and PDFs, and you can also choose to have the words read aloud in order to hear the correct pronunciation. Microsoft said that it also improved the PDF reader performance, which should open pages more quickly as you scroll through them, as well as as the PDF toolbar, which is now easier to use.

New Sign-in Methods & Biometric Authentication

In Windows 10 Insider Preview Build 17713, Microsoft also enabled biometric authentication for remote desktop sessions via Windows Hello for Business. This feature doesn’t seem to support “convenience PINs,” presumably because the company knows how easily PINs can be broken by modern password cracking tools.

Microsoft also introduced “Web Sign-in,” a new form fo authentication for Azure customers, as well as Fast Sign-in, which will enable multiple users to sign-in to a shared PC more quickly.

Microsoft said that it’s now getting closer to releasing “Redstone 5” (RS5) build of Windows 10. RS5 has already been forked into its own build and the company will now focus on the stabilization of the code.

A Google Project Zero security researcher discovered a way to exploit how Windows Defender scans RAR archive files. All Windows versions are vulnerable to this bug.

An UnRAR Bug In Windows Defender

Project Zero researcher Thomas Dullien inspected Windows Defender’s mpengine.dll and discovered that the code responsible for processing RAR archive files was based on a modified version of the open source UnRAR software. Microsoft’s fork appears to be a version older than or equal to UnRAR 4.2.4, which is more than five years old.

According to Dullien, Microsoft’s modifications to the code turned all signed variables into unsigned, which introduced a severe memory corruption vulnerability that allows attackers to exploit the host operating system.

The Windows Defender bug seems to be related to a bug in a 2012 version of UnRAR that likely remained unfixed as Microsoft ported it to its antivirus engine. The same bug should affect other third-party software with old UnRAR code integrated.

Last year, Dullien alerted the RAR Labs developers about the bug found in UnRAR, and the RAR developers fixed the issue in UnRAR version 5.5.5. However, as Microsoft has continued to use an older version of UnRAR, its antivirus remained affected.

Windows Defender Users Must Update

Attackers who have known about the UnRAR bug since 2012 could have been exploiting Windows users all this time. Users with Windows Defender real-time protection enabled could have been exploited via specially crafted web pages or email attachments and cloud-hosted files.

Microsoft advised users to verify that they have the latest Windows updates. The Microsoft Malware Protection Engine version needs to be 1.1.13704.0 or later.