Paramount has been one of the biggest names in the movie industry for a long time, and they have utilized that legacy to give us a strong streaming service with a pretty vast library. What I find so appealing about their platform is their catalog of movies, with hits from just about every era and genre ready to satisfy whatever craving I happen to have each week.
It's the final week of October, which means spooky season is coming to an end. There are plenty of horror movies to watch on Netflix, including Friday the 13th and The Texas Chain Saw Massacre. This week's list of movies heading to streaming is not made up entirely of horror movies, but there are some tense thrillers, including a wild documentary on Paramount+.
October is slowly coming to an end, but Halloween is still a top priority for Netflix. The streamer has plenty of horror hits for spooky season, including The Black Phone and Fear Street. I don't mind watching something that can scare me, but I prefer to stream thrillers.
Get caught up on the latest technology and startup news from the past week. Here are the most popular stories on GeekWire for the week of Oct. 18, 2026.
Sign up to receive these updates every Sunday in your inbox by subscribing to our GeekWire Weekly email newsletter.
Rosie, founded by two Amazon veterans, sells monthly memberships that families use to book vetted caregivers for childcare and household work. The company says it reached seven-figure annual recurring revenue within eight months of launch. Read More … Read More
A University of Washington task force recommends splitting the Allen School of Computer Science & Engineering from the College of Engineering. UW leaders will decide in spring 2027. Read More … Read More
Microsoft is winding down The Garage, the 17-year-old program behind its Global Hackathon and employee maker spaces, according to an internal FAQ. Some Garage spaces could be restricted to employees as early as Friday, and Microsoft says the hackathon team is reimagining the event. Read More … Read More
Microsoft has nominated Stripe co-founder and President John Collison to its board, according to the company’s annual proxy statement, filed Wednesday. The proxy also shows that Disney CFO Hugh Johnston, chair of the board’s audit committee, won’t seek re-election, joining LinkedIn co-founder Reid Hoffman in leaving the board in December. Read More … Read More
Two former Amazon real estate managers have resolved their six-year legal fight with the company, acknowledging they received personal payments tied to data center deals they handled and apologizing for violating its ethical standards. Amazon’s case against the developer accused of paying the kickbacks continues. Read More … Read More
Satellite communications company Kymeta added a former CIA deputy director to its C-suite; Alaska Airlines named its first chief information technology officer; and Microsoft saw three departure and the return of a former leader. Read More … Read More
New features in Microsoft 365 E7 and Project Perception will assess each agent’s risk, with the ability to block it from making changes, require human intervention or shut it down. Read More … Read More
Seattle’s prosperity isn’t guaranteed. As the region confronts economic uncertainty and the next wave of tech growth shifts toward AI, Cleveland offers a cautionary tale — and a reminder that the city’s future depends on attracting people, retaining talent and creating room for the next generation of business builders. Read More … Read More
The company did not disclose the total number of layoffs, but confirmed that the cuts affected employees across multiple departments both in the U.S. and internationally. Read More … Read More
UW’s Institute for Protein Design and Nvidia have released their first jointly developed AI model for creating proteins with specific jobs. The release follows a computing grant from Nvidia CEO Jensen Huang’s foundation that IPD director and Nobel laureate David Baker says has been “transformational” for the institute’s work. Read More … Read More
We're getting closer to Halloween by the day, and it is the perfect time for some content that will bring the thrills. While horror movies are great, some people prefer something a little more psychological, which is where the picks on this list come in. They might not feature the supernatural, but they will still haunt you long after you've switched off your TV.
What should you watch this weekend? If you're staying home to watch something on streaming, NBC has a sitcom about a newly married couple that might suit your interests. On Hulu, an intriguing mystery comedy premiered earlier this week and has already attracted attention.
Who's up for some brilliant documentaries? At the moment, there are a few fresh Netflix documentaries trending in the Top 10. One of those is Tyson, a limited series about one of the "baddest men on the planet," Mike Tyson. On the comedy side, Norm Macdonald's documentary is winning over viewers thanks to the late comedian's indelible humor.
While many undertake ESP32-based electronics projects for fun, because they find building rewarding, or to learn, saving money is another valid reason to DIY a solution. It could be argued your own time has a price too, but if you find the build enjoyable, then you’re probably not going to mind the time commitment.
With so many new releases coming to Netflix every week, it’s easy to miss some of the older movies in its catalog. I like going back through them for these award-winning picks, and this week, there are a few interesting titles worth adding to your watchlist.
Minecraft_’s blocky, pixelated aesthetic transfers surprisingly well to 3D printing. You don’t need to worry about making models look realistic or be concerned with curves if you’re a Minecraft_ fan who wants to bring Mojang’s intoxicating world to life.
HBO Max is always producing quality content. I recently enjoyed Lanterns, the DC Universe show that played like a season of True Detective. The streamer also has some riveting documentaries, including A Killer Story, one of the best docs released in September.
The Netflix machine keeps on pumping out shows. One of the streamer's notable advantages over its competition is its ability to turn licensed shows into hits. Look at what happened with Suits, a show that soared to new popularity in 2023 on Netflix despite having concluded its run on the USA Network in 2019.
Building a smart home can be an expensive business. Some devices, such as cheap Zigbee sensors, can cost just a few bucks, but other devices can run to hundreds of dollars. The good news is that it's often possible to build your own smart home devices, and the total cost can sometimes work out far less than buying a ready-made product.
Get caught up on the latest technology and startup news from the past week. Here are the most popular stories on GeekWire for the week of Oct. 11, 2026.
Sign up to receive these updates every Sunday in your inbox by subscribing to our GeekWire Weekly email newsletter.
Peter Lee, the longtime Microsoft Research leader, plans to join the Mercedes Formula 1 team in a newly created AI advisor role. He’ll work on physics problems for the team’s car, predictive models and how F1’s regulators might govern AI. Read More … Read More
Microsoft committed $10 million to President Trump’s White House ballroom project, and Amazon and T-Mobile each committed $5 million, according to a donor list obtained by the Washington Post. The donations aren’t subject to campaign finance limits or disclosure requirements, raising concerns that companies could be buying influence or feeling pressured to give. Read More … Read More
Booking Holdings is launching a new Seattle-based travel startup called Vayo, led by serial entrepreneur Mike Fridgen, betting that AI agents built for travel can do a better job of planning and managing trips than general-purpose assistants from the likes of OpenAI and Meta. Read More … Read More
An autonomous, camera-laden robot named Tally is scanning shelves — and triggering a mix of Jetsons-esque wonder, anxiety about job losses, and some customer privacy fears. Read More … Read More
Apple’s $299 HomeView smart display goes up against the Echo Show, and new LG-made cameras, a video doorbell and a smart lock compete with Amazon-owned Ring. Apple has 7% of U.S. smart speaker owners, compared with about two-thirds for Amazon. Read More … Read More
Amazon is in talks to buy Decart for around $7 billion, The Wall Street Journal reported. The startup makes software that helps AI models run faster on different kinds of chips, including Amazon’s Trainium, and has already worked with AWS on its newest chip. Read More … Read More
Led by Nobel laureate David Baker, researchers at UW Medicine’s Institute for Protein Design have used AI to engineer reusable molecular “scissors” capable of repeatedly destroying target proteins linked to diseases like Alzheimer’s and ALS. Because these proteases chop up targets repeatedly instead of clinging to just one, they could treat complex conditions at far lower doses. Read More … Read More
Microsoft says its homegrown Maia chips will handle most of the AI work behind Copilot and its other products, with the new Maia 300 rolling out in 2027. The company says the new chip does more AI work with the same amount of electricity than the GPU-based systems that power most AI today. Read More … Read More
Someone “failed to inform the vice president accurately about our numbers” before blocking Microsoft from sponsoring foreign workers for permanent residency, asserts Brad Smith, the company’s president and vice chair, in an interview with Politico. Read More … Read More
LinkedIn’s list of Seattle’s hottest startups includes companies headquartered in California and Texas. We did a little digging and found a geography problem hiding in plain sight. Read More … Read More
Get caught up on the latest technology and startup news from the past week. Here are the most popular stories on GeekWire for the week of Oct. 4, 2026.
Sign up to receive these updates every Sunday in your inbox by subscribing to our GeekWire Weekly email newsletter.
Customer service, selling partner support and retail engineering teams were among those hit in Amazon’s latest layoffs. The cuts came during Prime Big Deal Days, which ran Tuesday and Wednesday. Read More … Read More
Microsoft’s Satya Nadella followed the path from a temporary work visa to permanent residency to U.S. citizenship. On Thursday, President Trump honored him with a national medal, hours after the administration blocked Microsoft from sponsoring its foreign workers for permanent residency. Here’s how the programs work, and what the numbers show about Microsoft’s practices. Read More … Read More
Opinion: Venture capitalist Matt McIlwain of Madrona urges Washington voters to pass Initiative 645 and repeal the state’s new income tax. He argues the tax is written to expand beyond high earners and that employers and residents are already leaving. Read More … Read More
The Labor Department suspended Microsoft from the federal program it uses to help foreign workers stay in the U.S. permanently, and won’t process the company’s pending applications. The announcement came hours before President Trump was scheduled to give Microsoft CEO Satya Nadella the National Medal of Technology and Innovation. Read More … Read More
Microsoft CVP Ravi Vedula retires; former Amazon SVP Rohit Prasad is now the CEO of Boston Dynamics; and Qualtrics, Overland AI and Fred Hutch name new executives. Read More … Read More
Seattle Mayor Katie Wilson has assembled a new task force of business, labor and industry leaders to tackle the city’s economic challenges, with a focus on diversifying the economy, attracting and retaining companies, and making it easier to do business in Seattle. Read More … Read More
A new joint report from the Downtown Seattle Association and the Seattle Metro Chamber shows city tax collections nearly tripling since 2013, surging far past population and job growth as the tax burden shifts heavily onto a small pool of major employers. Read More … Read More
Pedram Rezaei, a 20-year Microsoft veteran, will work on the Kiro coding tool and the Quick workplace assistant at AWS. He’s the latest Microsoft executive to make the move this year. Read More … Read More
Wizards of the Coast plans to revisit the Star Wars universe as its next big cross-company collaboration for Dungeons & Dragons. … Read More
Former tech leader Sally Revell has launched The SWELL, a downtown Seattle hub designed to give female entrepreneurs an in-person community, flexible programming, and support tailored for bootstrapping. Operating out of SURF Incubator, the new community has signed up 53 members in less than 10 weeks. Read More … Read More
Get caught up on the latest technology and startup news from the past week. Here are the most popular stories on GeekWire for the week of Sept. 27, 2026.
Sign up to receive these updates every Sunday in your inbox by subscribing to our GeekWire Weekly email newsletter.
X-BAT at a Glance: Measuring 26 feet long with a 1,000-nautical-mile combat radius, Shield AI’s autonomous strike fighter is designed to launch vertically from highways or naval decks—bypassing traditional runways entirely. Here is a detailed look at the aircraft’s specs, timeline, and capabilities as production sets to begin in Des Moines, Wash. Read More … Read More
Two top Microsoft executives shared this week that they’re leaving the Redmond, Wash., tech giant: Peter Lee, the former head of Microsoft Research, and Ryan Roslansky, Microsoft executive vice president overseeing both LinkedIn and Microsoft Office. Read More … Read More
Amazon unveiled the Kindle Click, a $34.99 Bluetooth remote for turning pages, alongside a redesigned lineup of Kindle e-readers with flush screens, optional aluminum housings and user-replaceable batteries. Read More … Read More
Defense tech upstart Shield AI has selected the Puget Sound region as the manufacturing hub for X-BAT, bringing AI-piloted fighter production to the region and promising 4,000 jobs by the early 2030s. Read More … Read More
Stoke Space CEO Andy Lapsa, whose company is building a fully reusable rocket, told a Seattle audience he isn’t sure he’d start the company in Washington state today. Read More … Read More
The site, kolmo.io/permits, serves as an un-gated database designed to answer the questions that usually send homeowners into a spiral of municipal PDFs. The AI-powered tool covers 457 verified rules across 80 jurisdictions in King, Pierce, and Snohomish counties, linking each rule directly to specific city source pages and exact wording rather than forcing users to rely on rough guesses and Google searches. Read More … Read More
Seattle lost 18,000 jobs between 2024 and 2025—with 70% concentrated downtown—while Bellevue added over 5,300, according to new Downtown Seattle Association data. Amid business claims that the JumpStart payroll tax is driving tech across the lake, Mayor Katie Wilson has moved to freeze tax rates in her new budget to give employers stability amid broader industry shifts. Read More … Read More
The Emerald City landed at No. 4 overall in the newly released Oxford Economics Global Cities Index 2026, which scored 1,000 major urban centers across economics, human capital, quality of life, environment, and governance. Read More … Read More
Amazon says it will spend more than $1 billion over five years on community college, job training and other programs in the U.S. communities that host its data centers. The move responds to a growing backlash that AWS CEO Matt Garman says threatens the country’s lead in AI. Read More … Read More
The University of Washington broke ground on a $231.1 million Chemical Sciences Building set to open in 2029, featuring 104,500 square feet of state-of-the-art labs for instruction and research in quantum science, sustainable chemistry, and human health. The new five-story facility will replace the old Chemistry Library Building and pave the way for a full renovation of historic Bagley Hall. Read More … Read More
Get caught up on the latest technology and startup news from the past week. Here are the most popular stories on GeekWire for the week of Sept. 20, 2026.
Sign up to receive these updates every Sunday in your inbox by subscribing to our GeekWire Weekly email newsletter.
Amazon says it has cut off Meta’s new Muse personal AI agent from shopping on Amazon.com, citing data security and other concerns. It’s part of a larger industry fight over who controls the shopping experience and customer relationship in agentic commerce. Read More … Read More
Microsoft is moving communications out of its marketing group and under Vice Chair and President Brad Smith, as CEO Satya Nadella calls for a fundamentally new approach that makes employees a bigger part of how the company tells its story. Read More … Read More
The cuts total about 600 globally, including about 300 in Washington state, and 268 worldwide in Xbox Game Studios. The restructuring folds some existing studios under Activision, Bethesda and King, and leaves Ninja Theory, the studio behind the Hellblade series, facing a potential closure. Read More … Read More
Former Seattle City Council President Sara Nelson has launched CivicTide, a website that tracks City Council legislation, publishes policy briefs and opinion pieces, and gives readers tools to contact councilmembers. The site runs on a custom AI-powered system built by Seattle tech communications executive Viet Nguyen. Read More … Read More
Microsoft’s revamped Copilot app adds AI coding, always-on agents and full versions of Word, Excel and PowerPoint as the company competes with OpenAI and Anthropic and shifts more of its AI pricing to usage-based billing. Read More … Read More
Impacted positions span across technology, product, and corporate roles — including data scientists, software engineers, finance managers, and senior leadership. Read More … Read More
Amazon announced new AI tools for its independent sellers, led by a plugin that lets them run their Amazon businesses from Anthropic’s Claude or Amazon’s own Quick assistant. Read More … Read More
Bungie, the Bellevue-Wash.-based video game studio behind Destiny and Marathon, began its week with an apology from its new studio head, as it tries to win back its audience after several recent missteps. Read More … Read More
Shankar Sundaram, a former Boeing engineer and enterprise sales leader, said the ultimate goal of East West Club is to create a “third place” in the city that’s centered around genuine connection rather than corporate networking or status. Read More … Read More
Mayor Katie Wilson’s proposed budget closes a $175 million deficit through spending cuts and leaves the JumpStart payroll tax untouched, offering big tech employers a period of tax stability. Read More … Read More
Get caught up on the latest technology and startup news from the past week. Here are the most popular stories on GeekWire for the week of Sept. 13, 2026.
Sign up to receive these updates every Sunday in your inbox by subscribing to our GeekWire Weekly email newsletter.
Neuramill is building software that captures how experienced machinists decide to make a part, then applies that knowledge to new jobs at aerospace and defense machine shops. The company was founded last year by two engineers in their 20s who started their careers in Seattle. Read More … Read More
Providence will receive $1.1 billion from Nike co-founder Phil Knight and his wife, Penny — one of the largest gifts ever pledged to a U.S. healthcare institution — to build Oregon’s first women’s hospital and expand cardiovascular services. The funds, directed to Portland’s Providence St. Vincent Medical Center and Providence Heart Institute, build on the Knights’ prior $200 million gift to the heart institute. Read More … Read More
Several years after leaving Seattle’s startup scene to build a “tech outpost” in the Alaskan wilderness, serial entrepreneurs and twin brothers Lee and Lucas Brown, founders of Tune, have set their sights on a new frontier: replacing the traditional newsroom with artificial intelligence. Read More … Read More
Silvia Candiani has been promoted to CVP of the recently launched Microsoft Frontier Company, while Microsoft Elevate has hired a former UNICEF leader as VP. Amazon Web Services has promoted Alexis Bateman to director of global sustainability. Gradial has added a CMO, and Yoodli and Kestra have each named a VP. Read More … Read More
The cuts are part of broader nationwide layoffs at the enterprise software giant and heavily impact technical engineering and management roles. Read More … Read More
Software engineer Jeff Kohler is asking the U.S. Supreme Court to clarify the Alice patent standard after courts invalidated his patent and dismissed his infringement case against Google without examining the C++ source code he submitted. IP law experts and federal judges have called for the Supreme Court to revisit how the standard is applied to software inventions. Read More … Read More
Truveta co-founders Jay Nanduri and Ryan Ahern will serve as interim co-CEOs of the health data company, which Myerson helped build from a pandemic-era idea into a business with 500 employees and 30 member health systems. Read More … Read More
It caps a significant growth stretch for the Bellevue-based open-source platform, whose annualized revenue run rate recently surpassed $250 million — growing over 200% year-over-year. Read More … Read More
Agility Robotics, which is preparing to go public through a SPAC merger, unveiled Digit 5, a humanoid robot it says can work safely alongside people in warehouses and factories. The company says the new robot can lift 50 pounds, reach shelves 7.2 feet high and work more than 20 hours a day. Read More … Read More
Helion Energy added $35 million to its latest funding round, bringing the round to $500 million and its total war chest to more than $1.5 billion. The capital supports the fusion startup’s effort to power a Microsoft data center by 2028 despite timeline and technical skepticism. Read More … Read More
Get caught up on the latest technology and startup news from the past week. Here are the most popular stories on GeekWire for the week of Sept. 6, 2026.
Sign up to receive these updates every Sunday in your inbox by subscribing to our GeekWire Weekly email newsletter.
Nine years after setting out to tackle unsheltered homelessness with rapidly deployable, hard-panel micro-shelters, Everett, Wash.-based social purpose corporation Pallet is closing its business. Read More … Read More
The Seattle-based video game developer behind the award-winning virtual reality adventure Moss has closed its doors. Read More … Read More
Helion Energy has opened a downtown Seattle office as its headcount hits 800 employees, adding to its five-building Everett headquarters and its Malaga, Wash., site, where the fusion startup is building its Orion generator facility. The company, which has raised more than $1.5 billion, is racing to get Orion operational within two years to meet a contract to supply fusion energy to a Microsoft data center. Read More … Read More
The 43,000-square-foot space at West8 in the Denny Triangle neighborhood will bring together employees across digital products, AV, IT, HR, marketing, and other teams. Read More … Read More
Jacob Colker argues that Seattle has a branding problem, not a lack of talent, ambition or accomplishments. He lays out a five-step plan for the region’s tech community to start telling its own story. Read More … Read More
Amazon has named Kevin Mandia, the founder of breach-investigation firm Mandiant, to its board of directors, adding security expertise a few months after former NSA director Keith Alexander stepped down. Mandia now runs Armadin, a startup that uses AI to run attacks against corporate networks as a way of testing their defenses. Read More … Read More
T-Mobile named Jessica Uhl as CFO-designate, succeeding Peter Osvaldik as CFO come February. Microsoft and Blue Origin saw the departure of vice presidents, while startups AZX and Caddi added leaders, among other tech personnel changes. Read More … Read More
An independent study commissioned by the City of Seattle says the city should protect the big tech employers it has while building a more diverse economy on top of them. The 127-page report also says Seattle’s tax structure is unique among its peers in penalizing the hiring of senior, high-compensation workers. Read More … Read More
Seattle-area startup targets early 2027 for first Pathfinder launch, with bigger Nova Block 2 due for 2029 debut. Read More … Read More
It’s the end of an era at Microsoft: Frank X. Shaw, the executive who oversaw the tech giant’s communications for nearly three decades, first at an external agency and for the last 17 years as one of its senior leaders, is leaving at the end of the year. Read More … Read More
Operation Jackal IV, coordinated by INTERPOL across 22 nations, has led to the arrest of 58 individuals and the identification of over 200 suspects linked to West African cybercrime networks. The joint action successfully dismantled elements of the Black Axe syndicate, which orchestrates global romance, investment, and business email compromise (BEC) scams. Law enforcement agencies across South Africa, Argentina, and Romania also disrupted major Crime-as-a-Service (CaaS) providers, freezing millions of dollars in illicit financial assets.
The FBI, collaborating with the DoJ, have disrupted the global QScan and QTRouter hacking platforms operated by Chinese state-sponsored threat actors. The group QTFY, which maintains direct ties to China’s military and intelligence services, used these compromised IoT botnets to mask cyber espionage traffic targeting critical U.S. networks, including the Federal Reserve and NASA. Law enforcement successfully seized the core command-and-control (C2) domains hardcoded within the malicious frameworks.
From the U.S. Treasury is a new operation dubbed Economic Outcast, imposing sweeping sanctions on five Mabna Institute members and nearly 60 Iran-linked entities. Under the direction of Iran’s Ministry of Intelligence and Security (MOIS), the attackers breached multiple American critical infrastructure organizations, state governments, and defense contractors. These state-sponsored actors then exfiltrated datasets, executed high-value cryptocurrency heists, and now face federal indictments alongside a $10 million dollar reward for information leading to their arrest.
The Australian Federal Police (AFP) have arrested and charged two individuals for principal roles in TeamPCP, a cybercrime syndicate. The group systematically compromised trusted open-source projects, including Trivy, Checkmarx KICS, and LiteLLM, by stealing developer credentials and distributing backdoored software updates across major ecosystem release channels. This massive software supply chain campaign potentially compromised organizations worldwide and facilitated the unauthorized theft of hundreds of thousands of credentials.
Security researchers have disclosed details of NovaCookies, a subscription-based phishing platform that systematically targets corporate networks to steal authenticated Microsoft 365 sessions. Operating as an Adversary-in-the-Middle (AitM) proxy, this malicious toolkit is advertised on Telegram for $320 monthly. The campaigns actively compromise hundreds of organizations across several nations, including the U.S., the U.K., Germany, and the U.A.E.
To establish a foothold, attackers distribute counterfeit document-sharing lures within genuine DocuSign notifications. Styled as a share notice, the decoy claims an accounting department shared a remittance-advice PDF and invites the recipient to open it. Since these notifications originate from legitimate servers, they bypass standard sender-authentication checks and reputation filters. The malicious link is embedded inside the shared document, below the inspection layer of most security gateways. Once clicked, the attack uses an OAuth error-redirect technique to guide the browser through legitimate Microsoft or Google endpoints before routing traffic to the phishing infrastructure. This transition ensures every intermediate step appears trustworthy until the user reaches the proxy.
NovaCookies is a variant of the Sneaky2FA platform, which operates on a centrally managed model where the operator hosts the infrastructure rather than individual affiliates. The kit offers customized flows targeting common identity providers. Affiliates register landing pages on .vu domains, utilizing deceptive, alternating-case subdomains like PwPt-sHaRe to masquerade as legitimate Microsoft portals. While these checks obscure the landing pages, the proxy relays credentials and multi-factor authentication (MFA) codes in real time to Microsoft. Because each individual hop of the attack chain appears legitimate, security analysts emphasize that the browser remains the critical intersection where these events converge.
The Ugly | Threat Actors Deploy Spark RAT to Target Cambodian Organizations
A recently uncovered campaign is targeting both individuals and organizations in Cambodia with Spark RAT, which functions as a Go-based, open-source remote access trojan. Distributing compressed archives through targeted phishing emails, the threat actors deploy diverse lures, including Cambodian government notices, public health announcements, and dental records. The multi-stage attack sequence begins when a victim executes an Inno Setup installer, which initiates a dynamic link library side-loading chain using a signed Tencent application to deliver intermediate payloads.
To guarantee execution, the DLL loader performs timing-based anti-sandbox checks to detect virtual environment delays and scans running processes in an attempt to weaken its permissions. The loader then decrypts shellcode hidden within an embedded PNG file to run a second stager that determines whether the malware operates with SYSTEM privileges. If these elevated rights are present, the malware proceeds directly to inject mode. Otherwise, it configures a Windows service for local persistence. Ultimately, the stager injects malicious shellcode into the legitimate vssvc.exe process, monitoring execution to re-inject the payload if terminated.
The intrusion chain utilizes the Bring Your Own Vulnerable Driver (BYOVD) technique that abuses a legitimate but vulnerable OPSWAT AppRemover driver, ardrv.sys, to escalate privileges and neutralize security programs. Operating under CVE-2026-36425, this driver enables the malware to terminate active security processes, including Microsoft Defender, Huorong Internet Security, and Tencent PC Manager. The program also patches Antimalware Scan Interface and Event Tracing for Windows, executes user-mode termination of security tools, and injects Spark RAT into ctfmon.exe. Although operational tactics and driver usage closely mirror the Chinese-speaking Silver Fox syndicate, analysts classify the campaign as an unattributed cluster due to the absence of shared infrastructure, certificates, or code reuse.
Login