AI Weekly Malaysia

A parody site at definitelynotwindows.com presents a fake "Windows 11½" desktop that lampoons modern OS bloat: a boot message reading "Preparing your ad experience…", a recommended-apps row containing Temu and a monetized Solitaire, an entry labelled "Your actual file — We buried the useful thing under recommendations", a "Local Account (for now)" option, and update choices estimated at 4 minutes. It includes Clippy 365, Copilot, Recall, and OneDrive icons, plus a note that the system sounds are "suspiciously original" so lawyers can relax, and an explicit disclaimer that it is unaffiliated with Microsoft. The site assigns each browser a random anonymous visitor number via browser storage, no name, email, password, or fingerprint required.

Why: Read it as a labelled catalogue of dark patterns rather than a joke: it names the exact moves that make users distrust a product — burying the core action under recommendations, upselling a subscription to people already paying, offering "Local Account (for now)", and forcing 4-minute update cycles. If you ship a consumer or SaaS product, use the list as a design review checklist and check whether any of your screens has a direct equivalent; the parody's own anonymous-ID-in-browser-storage mechanic is also a useful example of client-side identity you can inspect in devtools.

Microsoft says Russia's Star Blizzard ran at least 13 larger phishing campaigns since January against 100+ organizations tied to Ukraine, mostly in the U.S. and U.K., with at least one machine confirmed infected. The lures impersonate think tanks and NGOs such as Chatham House and the Atlantic Council, and the first email carries no attachment: only if the target replies does the group send a password-protected RAR or ZIP with the password shown in an image. Delivery this year uses a method Microsoft calls RedFlick, which abuses Windows scheduled tasks to install a backdoor named CosmicPulse, replacing 2025's ClickFix fake-CAPTCHA approach, and since March the emails have come from compromised WordPress and cPanel site accounts instead of free services like Proton.

Why: The reply-gated, password-in-an-image archive is a concrete gap: nothing malicious arrives in the first message, so attachment sandboxing and link scanners see a clean email. If your team's playbook says 'no attachment, no risk,' it needs a rule about replying to unexpected event or conference invitations. The WordPress/cPanel detail also matters locally — if you or a client run mail on shared cPanel hosting, a compromised mailbox there can be repurposed to send these lures, so check outbound mail logs and scheduled tasks, not just inbound filters.

Symantec and Carbon Black's Threat Hunter Team report that the actor tracked as Warlock (also Longlegs, Gold Salem, Storm-2603) is still exploiting Microsoft SharePoint Server flaws to attack on-premises deployments, hitting at least four organizations in two months — two critical infrastructure operators (a water utility and a telco), a regional government body, and a university — all in Portuguese- and Spanish-speaking countries. In one intrusion the attackers disabled security software on at least 40 hosts in about two hours, then deployed ransomware to at least 33 hosts by staging the payload in the domain's SYSVOL share so ordinary domain replication delivered it. Entry relies on web shells that harvest the SharePoint farm's ASP.NET machine keys, which are then used to forge a validly signed payload and get remote code execution inside the SharePoint application pool, alongside BYOVD and legitimate tools like Velociraptor for command-and-control.

Why: If your organization runs SharePoint Server on-premises — still common in enterprise and government environments — this is a concrete reason to check patch status and, more importantly, treat ASP.NET machine keys as compromised material: stealing them lets an attacker forge signed payloads and execute code in the SharePoint app pool, so patching alone may not evict them. The SYSVOL staging detail also means your normal AD replication is the delivery mechanism, so watching for unusual file writes to SYSVOL and unexpected security-tool service stops is more useful than another perimeter alert. For everyone else, this is enterprise Windows infrastructure, not something most builders ship with — there is no Malaysia-specific detail in the source, and no stated impact on Malaysian organizations, cloud, payments, or startup tooling.