Security
Quantum Deadline Looms, EtherRAT Calls, and Windows GDID Tracking Exposed
Microsoft pushes quantum readiness to 2029, Teams phishing drops EtherRAT, and a hacker arrest reveals Windows' persistent device ID.
Two-Click RCE in Meccha Chameleon Exploits Steam Workshop
Security researcher Khael Kugler disclosed a remote code execution vulnerability in Meccha Chameleon, an Unreal Engine 5 hide-and-seek game with 7 million downloads on Steam. The game allows custom maps via Steam Workshop as .pak files that can include Blueprint logic. A malicious map can call the LaunchURL Blueprint function, which triggers ShellExecuteW on Windows to launch any executable without argument control. An attacker uploads a benign map to obtain a Workshop ID, then adds a payload .bat file to the same folder and modifies the map’s BeginPlay event to call LaunchURL with the full path to the batch file. When a lobby host selects the map, other players are prompted to subscribe. Two clicks later, the batch file executes on the victim’s machine, granting arbitrary command execution. Steam accepts any file type for this game, and Workshop items auto-update, allowing a trusted map to push a payload to all subscribers silently. The vulnerability has been patched in the latest versions, but the custom Minecraft map alone had 2 million subscriptions.
2-Click Remote Code Execution in Meccha Chameleon →
Fake IT Support Calls on Microsoft Teams Deliver EtherRAT Malware
Threat actors are abusing Microsoft Teams voice calls by impersonating corporate IT support to trick employees into installing EtherRAT, a cross-platform Node.js remote access trojan. According to Palo Alto Networks’ Unit 42, the attack chain begins with a phishing email containing a malicious PDF. Shortly after the victim opens it, they receive a Teams voice call from an external account posing as a System Administrator, using the address [email protected]. The caller convinces the victim to grant remote control via Teams’ built-in screen-sharing, then guides them to install legitimate remote tools like HopToDesk and AnyDesk. With access established, the attacker downloads and runs a malicious MSI installer from camorreado.click. That MSI loads a legitimate Node.js runtime, decrypts embedded payloads, and launches EtherRAT. EtherRAT uses Ethereum smart contracts to retrieve its C2 server, making takedown difficult. The malware was previously used in state-sponsored attacks exploiting the React2Shell vulnerability and has since been adopted by other threat actors. Unit 42 found an open directory with multiple versions of the installer (v1 through v9), indicating active development.
Fake IT support calls on Microsoft Teams push EtherRAT malware →
Hacker Arrest Reveals Microsoft Windows Global Device ID Tracks Users
The arrest of 19-year-old Peter Stokes, extradited from Europe as an alleged member of the hacking group Scattered Spider, has exposed Microsoft’s ability to track Windows PCs through a persistent Global Device ID (GDID) with no easy opt-out. Stokes allegedly hacked a luxury jewelry retailer in May 2025 while using a VPN. A 39-page criminal complaint reveals the FBI obtained Microsoft records linking Stokes’s IP to a GDID: 6755467234350028. According to a Microsoft representative, the GDID is a persistent, device-level identifier that uniquely identifies a Windows installation across Microsoft services and can be associated with third-party services and timestamps for tracking online activity without cookies. Stokes was caught using ngrok to bypass network defenses; Microsoft records showed the GDID accessed the ngrok signup page and multiple sites from Tzulo servers. Cybersecurity expert Matthew Hickey called Windows surveillance software. A user can reset the GDID only by reinstalling Windows, and Microsoft could tie the new GDID to the old one via other identifiers like a Microsoft account login. Some users are exploring ways to scrub the GDID; researcher Costin Raiu suggested Linux or FreeBSD with VPNs for full anonymity.
A Hacker’s Arrest Reveals Microsoft Can Track Users Via a Windows Device ID →
Microsoft Accelerates Quantum Security Timeline to 2029
Microsoft has moved up its Quantum Safe Program (QSP) timeline, now aiming to be quantum-apocalypse-ready by 2029. In a blog post, the company stated that cryptographically relevant quantum computers could arrive sooner than previously expected, and that preparation requires significant effort starting now. Microsoft highlighted the harvest-now-decrypt-later threat, where adversaries collect encrypted data today to crack it when quantum computing matures. The QSP extends beyond cryptography to strengthen resilience across identity, infrastructure, data, and supply-chain security. Customers are urged to become aware of the accelerated timeline and begin implementing quantum-safe measures immediately.
Cloudflare Replaces Blanket AI Bot Block with Granular Controls
Cloudflare has introduced new tools that give all customers granular control over how AI bots access their websites, replacing the previous single-click block-all-AI-crawlers option launched in July 2024. The new controls categorize bots into three types: Search (for indexing), Training (for AI model training), and Agent (bots acting for users, like ChatGPT). Starting September 15, 2026, Training and Agent bots will be blocked by default on ad-carrying pages, as advertising indicates a site wants human visitors; Search crawlers will remain allowed. Multi-purpose crawlers like Googlebot will be subject to the strictest applicable rule. Cloudflare CEO Matthew Prince previously criticized Google for bundling search and AI crawlers; in June 2026, he noted that bot traffic surpassed human traffic on the internet for the first time. For enterprise customers, Cloudflare launched BotBase, a searchable bot database, and changed verified bot rules: a bot’s category now determines access rather than the Verified label alone, and operators must prove honest identification and no abuse of granted access.