Enforcement action launched after evidence suggests child sexual abuse material being shared on Telegram and teen chat sites being used by predators to groom children

Ofcom has launched an investigation into Telegram under the UK’s Online Safety Act, to examine whether it is complying with its duties to prevent child sexual abuse material being shared.

The UK’s online safety watchdog has also opened investigations into Teen Chat and Chat Avenue to examine whether they are meeting their duties to prevent children from the risk of being groomed by predators.

Additionally, we have provided updates on file-sharing services that are now either using hash-matching technology to detect and swiftly remove child sexual abuse material (CSAM) or have taken steps to prevent people in the UK from accessing their sites. 

Suzanne Cater, Director of Enforcement at Ofcom, said: “Child sexual exploitation and abuse causes devastating harm to victims, and making sure sites and apps tackle this is one of our highest priorities. It’s why we work so closely with partners in law enforcement and child protection organisations to identify where these harms are occurring and hold providers to account where they’re failing to meet their obligations.

“Progress has undeniably been made, particularly with file-sharing services, which are too often used to share horrific child sexual abuse imagery. But this problem extends to big platforms too, and teen-focused chat services are too easily being used by predators to groom children. These firms must do more to protect children, or face serious consequences under the Online Safety Act.”

CSAM on Telegram

It is illegal in the UK to share or be in possession of CSAM. Under the UK’s Online Safety Act, providers of ‘user-to-user’ services are required to assess and mitigate the risk of this horrific crime being perpetrated on their platforms.[1]

We work closely with law enforcement agencies and other organisations to identify platforms that are particularly susceptible to being used by offenders for the sharing of image-based CSAM.

We received evidence from the Canadian Centre for Child Protection regarding the alleged presence and sharing of child sexual abuse material on Telegram, and carried out our own assessment of the platform. In light of this, we have decided to open an investigation to examine whether Telegram has failed, or is failing, to comply with its duties in relation to illegal content. 

Grooming on teen chat sites

The sexual exploitation and abuse of children online has devastating consequences for those affected. Online grooming crimes against children can include coercing a child to send sexual images of themselves, sexual extortion, and arranging in-person sexual abuse of a child.

Ofcom works with child protection agencies to identify services that present particular risks of grooming. This work has raised concerns about the risk to children on two chat services called Teen Chat and Chat Avenue, which have open chatrooms, private messaging, profile creation and media sharing functionalities.

Ofcom has engaged with representatives of the providers of these services to try and address these concerns. However, we remain unsatisfied as to whether they are providing adequate protection to UK children from the risk of grooming.

We have therefore opened investigations into whether the providers of Teen Chat and Chat Avenue are taking appropriate steps to assess and mitigate the risk of UK users encountering illegal content and activity, including grooming. The investigation into Chat Avenue will also consider whether the provider is taking adequate steps to prevent children from encountering harmful content, including pornography, on the site.

CSAM is being tackled on file-sharing services

When duties under the Act came into effect last year, we immediately launched enforcement action to assess the safety measures being taken by file-sharing providers to prevent offenders from disseminating CSAM on their services.

As part of this work, we became concerned that the provider of file-sharing service [color=blue[Pixeldrain[/color] had not taken appropriate measures to assess and mitigate this risk.

In response to us raising our concerns with them, the provider of Pixeldrain made material improvements to its Illegal Content Risk Assessment and implemented perceptual hash matching – an automated tool that can detect and swiftly remove CSAM.

We have also today closed our investigation into file-sharing service Yolobit, which has taken steps to make itself unavailable to people in the UK.

This follows on from five other file-sharing providers taking steps to make their services unavailable to UK users after we launched enforcement proceedings against them, and two other services deploying hash matching as a direct result of our action.

Ofcom’s investigation process

The Online Safety Act sets out the process Ofcom must follow when investigating a company and deciding whether it has failed to comply with its legal obligations.[2]

Our first step is to gather and analyse evidence to determine whether a breach has occurred. If, based on that evidence, we consider that a compliance failure has taken place, we will issue a provisional decision to the company, who will then have an opportunity to respond to our findings in full, as required by the Act, before we make our final decision.

We will provide updates on our investigations as soon as possible.

Enforcement powers

If we find that a company has broken the law, we can require it to take specific steps to come into compliance or to remedy harm caused by the breach. We can also impose fines of up to £18 million or 10% of qualifying worldwide revenue, whichever is greater.

In the most serious cases of ongoing non-compliance, we can make an application to a court for ‘business disruption measures’, through which a court could impose an order requiring payment providers or advertisers to withdraw their services from a platform, or requiring internet service providers to block access to a site in the UK.

UK jurisdiction

As in other industries, companies that provide an online service to people in the UK must comply with UK laws. The Online Safety Act is concerned with protecting people in the UK. It does not require platforms to restrict what people in other countries can see.



1. User-to-user services are where people may encounter content – including images, videos, messages or comments – that has been generated, uploaded or shared by other users. Schedule 6 of the Online Safety Act explains the child sexual exploitation and abuse offences that are priority offences under the Act.

2.    Our Online Safety Enforcement Guidance can be found here.

3.    More information on jurisdiction is available here.

source

Windows never had a consistent design language. It’s largely due to how it’s built, but also because Microsoft doesn’t really stick to one idea or even a framework. However, things might soon get better, as Microsoft confirmed it’s going after every design element in the OS, including the “Installing Windows 11” screen, which rarely appears.

If you can’t recall the “Installing Windows 11” screen, take a look at the screenshot below.



The above “Installing Windows 11” screen appears only when you try to reinstall the operating system using the Media Creation Tool or setup.exe found in an ISO file. Now, the interface isn’t necessarily bad, and it’s actually a non-issue, but it’s one of the UIs that doesn’t align with Windows 11’s overall design direction.

Microsoft has already confirmed that it’s focused on the design aspect of Windows 11 and is going after all UI elements. But you wouldn’t expect the company to address less-used UI surfaces like the “Installing Windows 11” screen, right? Well, to my surprise, Microsoft’s design director says the company also has plans to redesign the Windows installation screen.

“This screen is on our craft list. It’s very rarely seen, so we’ve prioritized other UI craft projects above it, but we’ll get there,” March wrote in a post on X.

It might not sound like a big deal, but it’s actually a very interesting move. Microsoft has never truly cared about the design of core components, let alone less-used UI surfaces like the “Installing Windows 11” screen.

Windows 11 still has a lot of legacy UI features

Windows 11’s design has definitely gotten better over time, but you can still run into legacy components. For example, you can come across a Windows 8-era interface on the lock screen or inside Windows Settings. In fact, you might also end up in a Windows 3.1-era dialog if you use Control Panel.


Windows 3.1 UI in Windows 11

Of course, the biggest problem is that most of the advanced features depend on Control Panel and legacy dialogs, so until Microsoft figures out a plan to ditch Control Panel, we’re not really moving forward.

Microsoft previously confirmed that it’s looking into fixing various design elements of Windows Settings before removing Control Panel. Also, it’s not just about the design, but also the user experience. It takes fewer clicks in Control Panel to perform the same task as Windows Settings, and Microsoft is aware of the problem.


Microsoft confirms it’s migrating all Control Panel settings to the Windows 11 Settings app, but there
are roadblocks

Another issue is that Microsoft can’t upset power users by removing Control Panel when Settings is not in the best shape.

For example, the Control Panel includes many network and printer drivers and settings that haven’t been migrated to Windows Settings yet. This is because Microsoft is being careful, as it fears the migration process could break multiple features and disrupt the experience for power users, especially enterprises or developers using old endpoints.

“We’re doing it carefully because there are a lot of different network and printer devices & drivers we need to make sure we don’t break in the process,” says the Microsoft Design lead.

Either way, I’m hopeful that Microsoft can turn things around and finally bring a more consistent design to Windows 11. What do you want Microsoft to fix in Windows 11 UI? Let me know in the comments below, and we’ll forward it to Microsoft.

source

The malicious 24H2 update download website is able to evade detection from anti-virus and other boot-time security on Windows 11.

Neowin readers are well aware of how legit Windows 11 updates can break important features and functions like Start menu Search and PC reset option; however, malicious forged ones can be even more deadly. One such fake Microsoft support website has been tricking users into installing a malicious “Windows update” that silently steals sensitive data, according to new research published by Malwarebytes.

The cybersecurity firm notes that the campaign is being carried out by a convincing phishing site hosted on a typosquatted domain designed to mimic official Microsoft support pages. The attack targets Windows users mainly in France by offering what appears to be a legitimate cumulative update for Windows 11 24H2. Coincidentally, the French government just decided to dump Windows in favor of Linux, and although likely unrelated, we wonder if that has any connection.

According to the researchers, the site "microsoft-update[.]support" presents a familiar UI and color scheme, complete with a fake knowledge base (KB) reference and a prominent "Download the update" button. Users who click it receive an 83MB installer file labeled “WindowsUpdate 1.0.0.msi,” that appears indeed authentic at first glance. Observant ones will notice in the image below, that the update being delivered, "KB5034765", was actually released back in February 2024 for Windows 11 23H2 and 22H2, not for 24H2.

The attack also uses trustworthy technologies to mask the real intent. The installer is built using WiX Toolset, a widely used open-source framework, and deploys an Electron-based app, effectively a Chromium browser shell, to execute the payload. This layered approach helps the malware evade antivirus detection. Malwarebytes notes zero detections recorded across dozens of security engines at the time of analysis as the executable itself is clean.

Once executed, the installer launches a Visual Basic script that triggers the Electron app, which in turn spawns a disguised Python process. This process installs multiple packages commonly associated with data theft, including tools for encryption, system inspection, and deep Windows API access. The malware then begins harvesting sensitive data as Malwarebytes found it can extract browser-stored credentials, Discord tokens, and capture payment-related information.

To maintain persistence, the malware has devised several things in its favor including a registry entry disguised as an actual Windows security component and a startup shortcut pretending to be a Spotify app .lnk launcher. This approach ensures the malware survives system reboots with minimal suspicion.

Users are advised to install updates only through official Windows Update settings or trusted Microsoft domains. You can also follow Neowin as we cover these updates and link to official, secure Microsoft sites only, or reputable third-party apps. Any standalone update downloads from an unfamiliar website should be treated as suspicious and with extreme caution. You can find more technical details in the original blog post here on Malwarebytes' website.

source

Microsoft confirms Office LTSC 2021 support ends October 2026, urging businesses to move to Microsoft 365 or LTSC 2024.



Microsoft is shutting down several of its products this year, including, but not limited to, the Access Database Compare tool, Publisher, and Outlook Lite on Android. Now, Microsoft has reminded customers that another suite of apps is set to retire this year, and also suggested an alternative.

Office LTSC 2021 suite and the standalone applications that it comprises of are facing the chopping block on October 13, 2026. As is common in these scenarios, these pieces of software will continue to function but they will not receive any security fixes, patches for bugs, or technical support from Microsoft. What this also means is that if you face any sort of issue, such as a break in compatibility, you are not guaranteed any assistance from Microsoft.

The Redmond tech giant has suggested multiple upgrade paths for small businesses and large enterprise organizations. For the former entities, those with fewer than 300 seats, the following are viable alternatives as long as you are OK with being connected to the cloud:

   • Microsoft 365 Business Premium

   • Microsoft 365 Business Standard

   • Microsoft 365 Apps for business

Meanwhile, larger organizations should consider the following:

   • Microsoft 365 E3

   • Office 365 E3

   • Microsoft 365 Apps for enterprise


These Microsoft 365-powered versions of Office applications offer better security, management capabilities, and compliance. In addition, it also includes Copilot integration, can be installed on multiple devices per user, and dynamic updates that keep you always updated.

However, for those who are more comfortable with the on-premises variant of Office and want to continue down that path, Office LTSC 2024 is still an option. This is the most recent version of on-prem Office for commercial LTSC customers and also includes new versions of Visio and Project. Do choose your migration path carefully though, because Office LTSC 2024 will reach end of support on October 9, 2029.

source

Windows app development shifted from a single stable model to multiple frameworks

When WhatsApp made the universally hated decision to switch its native Windows app to a web wrapper, most of the criticism was directed at Meta. And rightly so. It felt lazy, it was a clear, RAM-hogging downgrade, and it removed what little “native” experience the app had on Windows.

But the reality is a bit more uncomfortable.

Even Meta didn’t have much incentive to stick with a native Windows app. The company barely updated it, didn’t bring feature parity, and eventually defaulted to the web version instead. The main reason is probably for the fact that web apps are cheaper to build and maintain. But the actual issue is that Microsoft hasn’t given developers a UI framework they can commit to in the long term. Web apps don’t have that problem.



We recently heard from a long-time Windows Latest reader, Alexander Ovchinnikov, who also happens to be a developer. His points echo what a lot of developers already feel.

Unlike macOS, which always gets native apps, despite having a much smaller user base, developers’ attitude toward pushing web apps just for Windows isn’t about convenience. It’s about trust, or rather, the lack of it.

Over the years, Microsoft has introduced multiple “future” frameworks, only to move away from them later. From WPF and Silverlight to UWP and now WinUI 3, the company hasn’t changed this pattern. As Alexander puts it, many developers now assume that whatever Microsoft is pushing today might not last long enough to justify building on it.

Microsoft hasn’t had a clear GUI strategy in decades, and Windows now offers too many frameworks without a definitive answer on what developers should actually use.

Knowing this changes the outlook I had on web apps for Windows. They’re a fallback option when the platform itself feels uncertain. However, Microsoft’s recent love for making 100% native apps for Windows may turn things around.

Windows went from one clear development path to too many confusing choices

There was a time when building a Windows app didn’t require a mental debate. Early Windows development revolved around a single, well-understood approach. Win32 was the answer. One API, one mental model, and a clear way to get things done.

Charles Petzold’s “Programming Windows”, which was universally regarded as the “Bible” of Windows development, made it accessible, and developers could invest their time knowing the platform wasn’t going to shift under their feet. That stability created trust, and trust made the ecosystem grow.

However, instead of evolving Win32 into something more modern, Microsoft kept introducing new layers and alternatives. First came MFC as a C++ wrapper. Then WinForms for .NET developers. WPF followed with XAML and hardware-accelerated rendering. Silverlight showed up as a cross-platform bet. Then came WinRT and UWP during the Windows 8 and Windows 10 era. And now we have WinUI 3 with the Windows App SDK, alongside MAUI for cross-platform development.

Each of these was announced with a strong pitch about being the future of Windows development. Each one asked developers to invest time, learn new patterns, and build on top of it.

The issue wasn’t that these technologies were bad. Many of them were genuinely ahead of their time. The problem was that the “future” kept getting replaced before it could fully settle. Instead of a single evolving platform, developers were left chasing moving targets.

Jeffrey Snover’s detailed blog points out that Windows stopped having a clear answer to a simple question: how should you build a Windows app?

WPF was supposed to be the future, until Silverlight came along, which looked promising, until Microsoft pivoted to HTML5. UWP was pushed as the unified platform for everything, but never gained full adoption, even internally. WinUI 3 is now positioned as the modern solution, but its roadmap hasn’t inspired the same level of confidence developers had in earlier eras.

When Microsoft introduces a new framework with a clear direction, developers will start adopting it. Then the strategy would shift, and attention would move elsewhere. The previous framework wouldn’t always be officially killed, but it would slowly lose relevance. This cycle repeated enough times that developers stopped fully committing.

As Alexander told us, the sentiment today is, if Microsoft couldn’t stick with previous frameworks, why assume the current one will be any different?

That’s how things look today. Ask a developer what they should use for a Windows app, and the answer depends on who you ask. Some will still recommend Win32. Others prefer WPF because it’s stable. WinUI 3 is positioned as modern, but not universally trusted yet. MAUI exists for cross-platform use. Then there’s the web route with Electron or PWAs. On top of that, third-party frameworks like Avalonia and Qt are gaining traction.

This isn’t the kind of choice developers were asking for. It’s total uncertainty.

Why developers are choosing web apps instead of native

Some of the most popular Windows apps are not truly native. WhatsApp, Spotify, Discord, Slack, Notion, Zoom, and even parts of Microsoft’s own ecosystem…Microsoft Teams (before its rewrite), Clipchamp, and several first-party experiences use WebView2.


Microsoft Clipchamp

Of course, it has become so easy to build a web app once and ship everywhere. It can run on Windows, macOS, Linux, and even inside a browser without maintaining separate codebases. Frameworks like Electron, Chromium-based WebView, and Progressive Web Apps have made distribution simpler, updates faster, and development costs lower. Companies find it hard to ignore.

Microsoft’s pivot to WebView2 embeds the Edge (Chromium) engine inside apps. It works well for consistency, but it also means many “desktop” apps are just web pages running in a container.

And the obvious downside is that these apps consume more RAM, feel less responsive, and don’t integrate as deeply with the OS. Running multiple Electron apps at the same time can easily eat through system resources, something native apps traditionally handled much better.


“WhatsApp” is new version and “WhatsApp Beta” is old UPW/WinUI in the screenshot

On macOS and iOS, developers still prioritize native apps. Even companies that have web technologies elsewhere build native versions for Apple devices. That’s because Apple has maintained a much clearer development path. Frameworks like Cocoa, AppKit, and now SwiftUI have been consistently supported and evolved. Developers know what to use, and more importantly, they know it will still be relevant years later.

Windows doesn’t have that same clarity, and developers respond accordingly.
So instead of betting on a framework that might change direction again, many choose the web. It’s not perfect, and in many cases, it’s objectively worse for desktop performance. But it removes the bigger risk of depending on Microsoft’s next decision.

Microsoft is trying to fix this, but it may be too late

There are signs that Microsoft is aware of the problem. Recent efforts suggest them moving toward improving performance, reducing reliance on web-based components, and building more native experiences across Windows. Rudy Huyn’s X post welcoming Windows developers to build 100% native apps has been looked upon in a positive light.
But fixing the apps themselves is only one part of the equation.

Even if Microsoft delivers better native apps going forward, developers are still going to hesitate. The hesitation doesn’t come from what WinUI 3 can or cannot do today. It comes from what happened to everything that came before it. Years of shifting priorities have made developers cautious, and that kind of hesitation doesn’t disappear overnight.

If Microsoft wants to change that, it should fully commit to one framework and communicate it well to developers. That also means sticking with a framework long enough for it to mature, making its direction clear, and supporting it. Developers need a roadmap they can trust, along with clear migration paths when changes do happen.

The real problem isn’t technology, it’s consistency

Microsoft doesn’t lack capability. The company has some of the best engineering talent in the industry and a long history of building powerful development tools. Many of the frameworks it introduced were genuinely strong from a technical standpoint.

What’s missing was and is consistency.



Rebecca Sutter’s analysis mentioned that the issue isn’t technical failure, but a pattern of internal decisions that repeatedly shift direction.

These have repeatedly translated into uncertainty for developers. From the outside, it doesn’t matter why those changes happened. What matters is the result. Developers were left with multiple paths, none of which felt guaranteed to last.

That’s why the situation looks the way it does today. The problem isn’t that Windows has too few options. It’s that none of them feels definitive. Developers are not asking for more frameworks. They’re asking for one they can trust.

Web apps are a symptom, not the problem

Web apps are not taking over Windows because they’re better suited for desktop computing. In many cases, they aren’t. They’re taking over because they offer reliability to developers who no longer want to invest in the Windows platform.

Developers can’t be blamed for making a calculated decision based on past experience.

If Microsoft wants to improve the quality of apps on Windows, the solution isn’t just committing to fix Windows 11 and build native first-party apps, but rebuilding trust with developers and proving that this time, the platform (WinUI3, I hope) will stay consistent.

source