Graz University of Technology, Institute of Information Security

New Capabilities

As of September 2026: Disclosed the file-notification attacks and published the research paper

A process running without special permissions can track what you type, which websites you visit, and when you open or delete files. It can even overlay a fake password prompt on a legitimate one. The technique doesn't exploit a bug in file handling—it abuses the file-notification systems that Windows, Linux, Android and macOS have shipped for two decades.

Updated Sep 29