Kaspersky finds NetamLoader in Windows update files on Asian government systems
One malicious Resources.resx starts layered XAML that bypasses AMSI and beacons to openaigpt4v[.]com after a long delay.
72
Product
Windows
- Mentions · 7d20
- Mentions · 30d101
- All mentions220
- First seenAug 11, 2026
- Last mentioned8h ago
Timeline
220 articles · newest firstUnreleased Claude built exploit chains for Chrome, Safari, and major OSes
Anthropic says the model made five exploits, including Android data theft and Linux root code execution; vendors have patched.
74
Five-bug chain escapes Edge sandbox without memory corruption, earns $175,000 at Pwn2Own
Orange Tsai combined logical flaws in Edge and Windows features to gain code execution from an ordinary web page with no clicks; patch status is unconfirmed.
55
Edge exploit chain uses five logic bugs to escape the sandbox
Orange Tsai’s Pwn2Own Berlin chain turns a malicious page into Windows code via UXSS and a writable protocol config, without memory corruption.
74
Fake Cloudflare checks on hacked sites push ClickFix commands
SANS could not retrieve the Windows or macOS payload after test fetches returned HTTP 403 or failed to resolve.
58
Anthropic says unreleased Claude built Chrome, Android and Linux exploits
Vendors were notified first; Chrome 156 fixed 62 CVEs, and the Linux root flaw is CVE-2026-98432.
82
Microsoft revokes trust in compromised eMudhra certificates
An October 26 Windows update drops seven certificates after weak key generation exposed eight eMudhra intermediate keys.
78
Unreleased Claude model wrote Chrome, Linux and Android exploit chains
Anthropic says the lab-only chains were reported first and fixed, including Chrome 156, with no real-world incidents.
74
Microsoft emergency updates block compromised eMudhra certificates
Eight recoverable intermediate keys could forge TLS or code-signing certificates; Microsoft says its own systems were not affected.
73
Anthropic's unreleased model chained flaws into patched OS exploits
Lab proofs, not live attacks, covered Chrome 156, iOS 26.5.2, Windows CVE-2026-33096, and Linux CVE-2026-98432.
74
Anthropic says Claude built critical exploit chains in Chrome, Safari and Android
Google assigned 62 critical or high Chrome CVEs, patched as of Chrome 156; Apple and Google say the Safari and Android issues are fixed.
76
Fake FedEx invoices install Sirius Backdoor through blank PDFs
A Korean-language lure claims 217,740 KRW is due; the PDF launches PowerShell that loads the backdoor only in memory.
62
Sirius backdoor variant delivered by Korean FedEx-themed PDF emails
Trellix says a weaponized PDF launches fileless loaders that inject Sirius into suspended Windows processes after the victim approves a prompt.
64
Microsoft ships Windows trust-list update after eMudhra key compromise
The October 26 update removes seven eMudhra-related certificates for devices that do not get automatic CTL updates.
68
Essay argues 1990s Windows software was worse than today
A longtime user recalls blue screens, unsaved work, weak screensaver locks, and adware as the normal 1990s Windows experience.
8
BlackX bootkit bypasses Windows Secure Boot in Central Asia attacks
Securelist says fully patched PCs stayed exposed because boot-certificate revocations were incomplete; the APT41 link is only medium confidence.
73
winevdm runs 16-bit Windows apps on 64-bit Windows
A Hacker News post links to the winevdm project for Windows 1.x through 3.1 applications.
4
BlackX UEFI bootkit found on fully patched Windows PCs in Central Asia
Kaspersky says the Secure Boot revocation that would block Baton Drop stays off unless an admin enables KB5025885 by hand.
74
Microsoft offers voluntary buyouts to up to 60,000 employees
Staff in the US, UK, Canada and India can take the offer, including many AI and Xbox teams but not security.
40
BlackX bootkit uses Baton Drop to bypass Secure Boot
Kaspersky says fully patched Windows stayed exposed unless admins manually applied Secure Boot certificate revocations.
76
BlackX UEFI bootkit bypasses Secure Boot where DBX revocations are missing
Kaspersky says suspected APT41 used the BlackLotus-like bootkit on diplomats in three Central Asian countries after gaining administrator access.
74
StealC seller returns with Stadia remote access trojan
Varonis says the October 16 offering adds hidden desktop, command execution and loaders on top of StealC 3.5.0 theft.
72
BlackX bootkit uses Baton Drop to bypass Secure Boot
Securelist says infected diplomatic systems had Windows updates but not the certificate revocation that blocks CVE-2022-21894.
74
Suspected APT41 uses BlackX bootkit against Central Asian diplomats
Kaspersky says BlackX abuses unrevoked CVE-2022-21894 components on patched Windows when Secure Boot DBX updates are not applied.
76
APT41-linked BlackX bootkit hits Central Asian diplomatic agencies
After gaining admin rights, attackers exploit CVE-2022-21894 to load a kernel driver and a cloud-backed RAT.
76
Gentlemen ransomware disables Defender, deletes backups and spreads
Acronis describes a Go-based RaaS from 2025 that also targets Linux, NAS and BSD, with more than 800 claimed victims.
74
ClickFix campaign uses Windows finger to install Lumma
A sponsored Google result for “amazon business” opens a fake login and CAPTCHA that launches finger.exe and NetSupport.
64
Amazon-themed ClickFix uses finger.exe to deliver stealers
Huntress tied the chain to at least three customers; a macOS script URL was offline during research.
66
BRONZE SANDCASTLE steals Active Directory databases via hidden backdoors
Sophos traced victims in five countries and likely South Korea from August 2025 through August 2026.
72
Terra says GitHub patch-failure share rose from 0.2% to 2.3%
Fixes later bypassed were about four times as likely to appear on CISA's KEV list as other bugs from the same vendors.
56
Check Point weekly brief: utility and app breaches, exploited zero-days
CenterPoint says more than 1 million Texans were exposed, while Burger King Japan cites about 11.18 million members.
64
SideCopy Hackers Target Indian Organizations With ReverseRAT Malware to Steal Data
SideCopy is spear-phishing Indian organizations with malicious shortcuts to deploy in-memory ReverseRAT for data theft.
58
Networking problems after the October 2026 Windows update? NTLM might be to blame
October 2026 Windows update blocks NTLMv1 single sign-on by default, which can break Wi-Fi, Ethernet, and VPN logins.
60
Hackers Use ClickFix and Python Tunnels to Prepare Systems for Ransomware Attacks
Forescout says ClickFix installed Lorem Ipsum Loader and a Python tunnel before suspected ransomware was stopped.
64
How Windows is being optimized for Nvidia’s RTX Spark laptops
Microsoft tuned Windows on Arm for Nvidia RTX Spark laptops, including local AI agents and Prism emulation.
46
KGB RAT trojan packs webcam spying, password theft and a “fun” menu to terrorize victims
Group-IB says KGB RAT, an NjRAT-based Windows trojan sold from $150 monthly, steals passwords, spies via webcam, and includes ransomware.
62
CikaBika Bot RAT Uses Discord for C&C
Darktrace reports CikaBika, a Rust RAT using Discord for C2, delivered by phishing PDFs and LNK loaders.
58
Citizen Lab says governments are abusing online ads to hack people with ‘zero-click’ spyware
Citizen Lab says Candiru and Bindecy used Discover-Tech ads to deliver zero-click spyware, including against Al Jazeera.
82
Multiple Active Directory Vulnerabilities Let Attackers Bypass Security Feature Remotely
Microsoft disclosed three remote Active Directory security-feature bypass flaws, with no evidence of active exploitation.
68
U.S. CISA adds Microsoft Windows Shell flaw to its Known Exploited Vulnerabilities catalog
CISA added actively exploited Windows Shell flaw CVE-2026-96951 to the KEV catalog.
82
Related CVEs
by mentions- CVE-2026-85880<1%7.8Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
- CVE-2026-81963<1%7.8Local Privilege Escalation via Link Following in Windows Update Stack
- CVE-2026-9695110%8.8Windows Shell command injection bypasses a security feature
- CVE-2026-68820<1%7.0Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver
- Untrusted search path in Microsoft .NET Framework
- CVE-2022-218947%4.4Secure Boot Security Feature Bypass Vulnerability
- CVE-2026-850462%8.8Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046)
- CVE-2026-697301%9.8Use-After-Free RCE in Windows DNS Server
- CVE-2026-69857<1%8.8Authorization Bypass Through User-Controlled Key in Microsoft Azure Cosmos DB
- Network stack buffer overflow RCE in Microsoft Exchange
Appears with
- Microsoftvendor · 189
- Microsoftorganization · 50
- Googlevendor · 27
- CISAorganization · 21
- Microsoft Defenderproduct · 16
- Chromeproduct · 14
- Zero Day Initiativeorganization · 14
- Applevendor · 14
- Androidproduct · 13
- Microsoft Officeproduct · 13
- Azureproduct · 12
- Microsoft Edgeproduct · 12
- Zero Day Initiativevendor · 11
- Exchange Serverproduct · 11
- PowerShellproduct · 10
- Cisco Talosorganization · 10
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.