scattered spider member used a VPN,

@wassimcti

29.4K followers · usually 16.6K views a post

Views

58.7K

Likes

4.1K

Comments

235

Shares

338

Selling · SaaS › Other SaaS

Microsoft GDID

Why it worked

The video taps into a common concern about online privacy and data tracking by highlighting a specific, exploitable vulnerability in a widely used operating system. The narrative of a hacker being caught due to this tracking mechanism adds an element of intrigue and real-world consequence.

Summary

The video explains how Microsoft's Global Device Identifier (GDID), embedded in Windows, can be used to track users even when they use VPNs. It details how a hacker used this to steal data and extort a company, highlighting the lack of transparency and opt-out options for this tracking mechanism.

Structure

1Introduction to the hacker's methods
2Explanation of Microsoft's GDID
3How the hacker was caught using GDID
4Details of the data breach and extortion
5Discussion of privacy concerns and lack of transparency

Product placement

Microsoft: ACTS - provides the GDID (Global Device Identifier) which is a persistent device-level ID used for telemetry and licensing, baked into every Windows installation. It survives OS updates and IP changes. Removing it would change how Windows tracks users. GDID: ACTS - a persistent device-level ID used for telemetry and licensing, baked into every Windows installation. It survives OS updates and IP changes. Removing it would change how Windows tracks users.

Original caption

The FBI caught Peter Stokes through a hidden tracking ID Microsoft assigns to every Windows install. #cybersecurity #microsoft #windows #scatteredspider #infosec

More from @wassimcti

Their other posts in the index, biggest breakout first.

Call to action

Follow for more, Cyber News.

On-screen text

Microsoft Tracking every move with GDID

Transcript

scattered spider member used a VPN, tunneling tools and IP's across three countries and the FBI caught them anyway because of a tracking ID, Microsoft back into every Windows installed. Every Windows installation gets assigned something called a GID, global device identifier, persistent device level ID used for telemetry and licensing. It survives OS updates. Does not rotate when your IP changes. There's no opt-out setting. The only way to get a new one is through a fresh Windows installed. That's how Peter Stokes got caught. The 19 year old highlighted scattered spider member who is just extradited to the United States. May 2025 breach of a luxury jewelry retailer, the crew social engineer the IT help desk into resetting multi-factor authentication. Set up a tunnel to steal 77 GB of data before demanding $8 million. Stock did this all behind a VPN. Microsoft records show his GID hitting the sign-up page at the exact minute. Attacker account was created. In that same device kept surfacing IP's, TNL, New York, Thailand, right along sight is personal on Snapchat, matching his state department's travel records. VPN hit the network, but it never hit the machine. There's no published Microsoft policy when GDPR data gets shared with law enforcement. There's no consumer oversight. There's no transparency report that breaks it out. Most people learned about this identifier through a court filing. Fall for more, Cyber News.