Alerts

Windows 11 January Security Update Triggers System Lockups and Black Screens

Zero Day Wire

— 1 min read
Windows 11 January Security Update Triggers System Lockups and Black Screens

Microsoft's January 2026 cumulative update for Windows 11 is causing widespread system stability issues, with users reporting full lockups, black screens, and application failures that have forced many to uninstall the security patches.

KB5074109, released on Patch Tuesday January 13, targets Windows 11 versions 24H2 and 25H2, delivering over 100 security fixes including three actively exploited zero-days. However, the update has introduced regressions severe enough that affected users are removing it entirely—leaving their systems exposed to critical vulnerabilities.

Graphics Stack Regressions

Users report complete system lockups without blue screens, particularly in graphics-intensive applications. The hangs appear to stem from DirectX and GPU driver regressions triggered by kernel or graphics stack changes in the update.

Black screens are affecting both Nvidia and AMD GPU systems post-install. Graphics applications like BforArtists 5.0, a Blender fork, trigger freezes when switching viewport shading modes.

Enterprise Impact

Microsoft has confirmed credential prompt failures affecting Azure Virtual Desktop and Windows 365 environments using the Windows App. Remote RDP connections fail with error 0x80080005. An out-of-band fix (KB5077744) was released January 17 to address this specific issue.

Outlook Classic freezes on POP and SMTP accounts, displaying "Not Responding" or refusing to launch due to lingering processes. Broader cloud storage integration issues cause applications to hang when saving to OneDrive or Dropbox.

Workarounds

Affected users can uninstall KB5074109 via Settings → Windows Update → Update history → Uninstall updates. GPU vendors recommend installing the latest WHQL drivers or rolling back to previous versions if issues persist.

For Azure Virtual Desktop credential failures, Microsoft recommends using the Remote Desktop client or web client as an interim solution. Enterprise administrators can deploy Known Issue Rollback (KIR) via Group Policy for select regressions.

Security Tradeoff

The situation creates a difficult choice for security-conscious administrators. The update patches critical zero-day vulnerabilities, but the stability regressions disrupt production workflows. Organizations in high-risk environments may need to accept instability while awaiting driver updates and additional fixes from Microsoft.

Microsoft's release health dashboard acknowledges ongoing issues with cloud-backed storage applications and recommends affected developers contact support.

Read more

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

Elastic Security Labs has disclosed a new ClickFix campaign that leverages compromised legitimate websites as delivery infrastructure to deploy a previously undocumented remote access trojan dubbed MIMICRAT (also tracked as AstarionRAT). The campaign, discovered earlier this month, demonstrates significant operational sophistication — from multi-stage PowerShell chains that bypass Windows security controls

By Zero Day Wire
ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

A new wave of attacks is combining voice phishing (vishing) with OAuth 2.0 device authorization abuse to compromise Microsoft Entra accounts at technology, manufacturing, and financial organizations — bypassing traditional phishing infrastructure entirely. Sources told BleepingComputer they believe the ShinyHunters extortion gang is behind the campaigns, which the threat actors

By Zero Day Wire