60
60
60
57
60
60
60
47
Microsoft Patch Tuesday for June 2023 fixes 6 critical flaws
60
60
55
42
Update Microsoft Windows Systems to Patch 99 New Security Flaws
60
60
60
Microsoft Patch Tuesday for March 2025 — Snort rules and prominent vulnerabilities
60
57
60
60
42
57
Microsoft Issues Patches for Actively Exploited Excel, Exchange Server 0
60
55
Microsoft Patch Tuesday for December 2024 contains four critical vulnerabilities
60
ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager
Cisco Talos details ClearFake WebDAV chains delivering Amatera stealer to a Ukrainian government organization, with cryptocurrency and credential theft payloads.
Cisco Talos investigated DLL executions named 'verification.google' via WebDAV UNC paths at a Ukrainian government organization, tracking the actor as UAT-10820 and assessing with moderate confidence the activity is Russian and opportunistic rather than targeted. The infection chain uses ClearFake JavaScript injected via a Cloudflare Worker, EtherHiding storage on BNB Smart Chain contracts, and a ClickFix fake Google CAPTCHA prompt to deliver Amatera stealer. Secondary payloads differ by C2: one loader deploys ZigCryptoStealer with a Go reverse TCP proxy and a vulnerable driver that kills EDR, while the other installs an unauthorized NetSupport Manager with a Russia-based C2. Similar Amatera chains were separately documented by Malwarebytes and Blackpoint Cyber, but with no shared infrastructure.
55
Microsoft fixes two zero-days exploited by attackers (CVE-2024-38080, CVE-2024-38112)
60
60
60
Microsoft Patch Tuesday for August 2021 — Snort rules and prominent vulnerabilities
60
60
45
Microsoft Patch Tuesday for May 2026 fix 138 bugs, some of them are alarming
60
47
55
60
55
55
57
42
Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
Huntress observed rogue ScreenConnect deployments with worm-like VBScript propagation across unrelated organizations, prompting a ConnectWise advisory on file transfer behavior.
Huntress identified multiple incidents in late August 2026 where social engineering led to rogue ScreenConnect remote access clients deployed on victim machines, which then spawned wscript.exe to run four VBScript payloads (1.vbs through 4.vbs) for profiling, telemetry collection, and persistence via a WindowsServiceHost Run key. Modified ScreenConnect clients propagated the VBScript chain to connected endpoints, creating worm-like spread. ConnectWise published an advisory on September 3, 2026, confirming an issue affecting file transfer behavior in both cloud and on-premises ScreenConnect deployments, with a CVE and fix expected within the week; partners were advised to review and disable TransferFiles permissions in the interim.
78