Search: “Windows”

26 stories in the last 24h

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 9 Threat actor 9 Phishing & fraud 4 Advisory 3 Vulnerability 3 Research 2 Industry 2 Policy & legal 1 Ransomware 1 Data breach 1 Tools 1

SeverityAll critical 0 high 15 medium 14 low 0 info 7

Microsoft shares workaround for Windows domain login issues

Microsoft confirms September 2026 Windows updates trigger domain trust failures via Machine Identity Isolation and shares a workaround for Windows 11 enterprises.

Microsoft confirmed the September 2026 security updates (KB5124008 for Windows 11 24H2/25H2, KB5124012 for 26H1) cause Windows to honor Machine Identity Isolation enforcement settings, breaking domain trust on systems not connected to Windows Server 2025 domain controllers. Admins report valid credentials failing with domain trust and credential errors. The workaround requires disabling Machine Identity Isolation via the same management method that enabled it (Intune, group policy, or registry) and resetting the secure channel with Test-ComputerSecureChannel. Microsoft previously shipped out-of-band fixes for Remote Desktop, Hyper-V, and USB audio issues from the same updates.

BleepingComputer08:24 UTC · 2h agoAdvisory

Windows 11 KB5124008 update breaks domain trust for some users

Microsoft is investigating Windows 11 KB5124008 breaking Active Directory domain trust, leaving some users unable to log in with valid credentials.

Administrators report the Windows 11 KB5124008 security update breaks the secure channel between domain-joined machines and Active Directory, causing login failures on Windows 11 25H2 systems after reboot. The failures are linked to the Machine Identity Isolation feature, which in enforcement mode moves machine account secrets into Credential Guard and removes the LSA copy; one admin saw 11 of roughly 256 devices affected. Workarounds include setting MachineIdentityIsolation to 0 and repairing the secure channel with Test-ComputerSecureChannel, though Microsoft has confirmed no root cause or official fix and warns disabling the feature can also break domain authentication.

BleepingComputerupdated 00:29 UTC · 10h agofirst Sep 16, 20:39 UTC · 14h agoVulnerability 2 sources

Hackers Can Rent VectraRAT for $250 a Month to Take Control of Windows PCs

SOCRadar uncovered VectraRAT, a previously undocumented $250-per-month Windows RAT rental service delivered via Amadey and ClickFix lures.

SOCRadar's Threat Research Unit identified VectraRAT, a rental-only remote access trojan sold by a developer known as Vectra (formerly Nyxel), after an exposed online directory revealed samples, licenses, and operator logs across ten-plus servers. The toolkit includes a Linux control server, Windows implant, payload builder, and VectraHub panel, enabling hidden desktop access, keylogging, command execution, credential theft, file transfer, proxying, and silent privilege escalation. Of victims with OS data, 48 percent ran corporate Windows editions, and researchers recorded 38 genuine victim sessions in under a week, including file theft from business systems. Distribution occurs through the Amadey loader and ClickFix pages impersonating TurboTax, with custom TCP-based C2 over non-standard ports.

Cyber Security NewsSep 16, 14:36 UTC · 20h agoMalware in the wild 3 sources

Chinese-Speaking Hackers Use Noodle RAT Backdoor to Spy on Windows and Linux Systems

Chinese-speaking actors use cross-platform Noodle RAT backdoor to maintain covert access to Windows and Linux systems across Asia-Pacific.

Noodle RAT (also ANGYREBEL/Nood RAT) has been active since at least mid-2016 and was long misidentified as Gh0st RAT or Rekoobe variants until Trend Micro and Cyberint classified it as a distinct multi-platform family. The Windows build (Win.NOODLERAT) is an in-memory modular shellcode backdoor delivered via MULTIDROP and MICROLOAD loaders, while the Linux build supports reverse shells, SOCKS tunneling, and cron persistence after web shell or public-facing service exploitation. It has appeared in intrusions in Thailand, India, Japan, Malaysia, and Taiwan and is linked to Iron Tiger, Calypso APT, Rocke, and Cloud Snooper campaigns spanning espionage and cybercrime. Recently discovered Linux builders 1.0.1 and 1.0.2 indicate the toolkit remains actively maintained.

GBHackersupdated Sep 16, 14:03 UTC · 20h agofirst Sep 16, 12:28 UTC · 22h agoMalware in the wild 2 sources1

Iranian hackers use CHOSEN BRICK Windows malware to spy on targets

Iranian state-linked hackers use CHOSEN BRICK Windows malware, spread via Telegram and WhatsApp social engineering, to spy on dissidents and journalists worldwide.

US, UK, and Dutch cyber agencies with the FBI issued a joint advisory on Iranian state-linked hackers deploying a Windows malware strain called CHOSEN BRICK against dissidents, activists, and journalists, primarily in the US, UK, and Netherlands. Attacks begin with messages on WhatsApp or Telegram impersonating trusted contacts or technical support, tricking victims into running malicious files disguised as apps such as Pictory, RunwayML, Norton Antivirus, Telegram, and KeePass. The malware persists via Registry Run keys, adds Microsoft Defender exclusions, and uses a per-victim Telegram bot for command-and-control while stealing email, Telegram and WhatsApp data, screenshots, and audio. Stolen data is exfiltrated via Telegram or cloud services like VultrObjects and StorjShare, and sometimes appears on pro-Iranian leak sites, increasing physical risk for dissidents abroad.

BleepingComputerupdated 07:25 UTC · 3h agofirst Sep 16, 20:24 UTC · 14h agoThreat actor in the wild 7 sources

BambooToken: The Malware That Speaks MQTT to Stay Under the Radar

Lumen's Black Lotus Labs uncovered BambooToken, a Windows and Linux malware family using MQTT broker-based C2 and DLL sideloading across Asia since February 2023.

Lumen Black Lotus Labs identified BambooToken, a multiplatform malware family that exchanges commands through MQTT brokers so infected hosts never contact the C2 server directly, active from at least February 2023 through July 2026. The Windows variant sideloads via Tendyron's OnKey hardware-token software used in Chinese banking and government, or impersonates Kingsoft Office, without either vendor's signing certificate being compromised; a Linux build appeared by December 2025 with shell, file transfer, and system information commands. Victims include MikroTik and DrayTek routers in Singapore, Cambodia, and Vietnam reached after internet-wide SNMP scanning, and Lumen cannot attribute the family to any known actor.

Security AffairsSep 16, 20:20 UTC · 14h agoMalware in the wild1

Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers

Kaspersky details NightEagle, Hacking Cat, and Toy Ghouls targeting Russian enterprises with Exchange backdoors, Gorilla RAT, and destructive Monkey ransomware.

Kaspersky reports three threat clusters targeting Russian enterprises: NightEagle (APT-Q-95), the pro-Ukrainian hacktivist group Hacking Cat, and Toy Ghouls. NightEagle uses compromised VPN credentials and the GhostContainer modular backdoor to fully compromise Microsoft Exchange servers, chaining CVE-2020-0688 exploitation, BlueKeep (CVE-2019-0708), Active Directory vulnerabilities, and DCSync to seize domain controllers. Hacking Cat exploits Exchange flaws including CVE-2021-26855 and CVE-2026-42897 to deliver the Gorilla RAT and multiple Monkey ransomware variants written in Rust, .NET, C++, and Golang targeting Windows, Linux, and VMware ESXi, with some variants acting as wipers that never store the encryption key.

The Hacker Newsupdated 07:55 UTC · 2h agofirst Sep 16, 15:27 UTC · 19h agoThreat actor in the wild 5 sources CVE-2020-0688 CVE-2019-0708 CVE-2021-26855+1 CVEs1

Chinese hackers use SparroWocky malware in govt espionage attacks

ESET reports China-linked FamousSparrow deployed a new modular backdoor, SparroWocky, in year-long espionage attacks on Latin American government organizations.

ESET researchers observed FamousSparrow using SparroWocky, a modular C++ backdoor replacing the earlier SparrowDoor tool, against government targets in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. Deployed via DLL side-loading with an RC4-encrypted payload mapped in memory, it captures screenshots, acts as a TCP proxy, and hooks CreateThread so malicious threads appear as AnimateWindow. Persistence uses a ProcAuditManager Windows service or SnapCart registry key; ESET tracked at least 18 C2 addresses and published IoCs.

BleepingComputer09:00 UTC · 1h agoThreat actor in the wild

Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI usenew

Cisco Talos reports 90 ransomware incidents hit Japanese organizations in H1 2026, led by The Gentlemen, with Qilin using AI for efficiency.

Cisco Talos observed 90 ransomware incidents against Japanese organizations from January to July 2026, up about 4.7% year over year, with manufacturing accounting for 34% of victims. The Gentlemen was the most active group with 14 incidents; its leak-site listings grew from 48 in January to 105 in July. Qilin and SafePay followed with seven incidents each, and Talos notes Qilin is leveraging AI to improve operational efficiency.

Cisco Talos10:00 UTC · 53m agoRansomware in the wild

PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks

PAPERMILL phishing campaign abuses a signed Notepad++ copy and tax-audit lures to deploy VenomRAT against targets in India.

JUMPSEC tracks PAPERMILL as an emerging cluster whose emails pass SPF, DKIM, and DMARC and deliver tax-audit themed disk images. The mounted image pairs a legitimately signed, renamed executable with a rogue libcurl.dll for DLL sideloading, then uses a Donut shellcode loader to run VenomRAT 6.0.3 in memory with hidden VNC, data-stealing, and file-grabbing capabilities. The loader includes anti-analysis checks and RunOnce persistence, and lures plus China-connected infrastructure overlap with the Silver Fox ecosystem, though attribution remains unconfirmed.

Cyber Security NewsSep 16, 12:23 UTC · 22h agoPhishing & fraud in the wild 2 sources

APT36 Uses USB-Spreading Malware to Reach Air-Gapped Government Networksnew

Zscaler attributes the RapidRust campaign by Pakistan-linked APT36 to USB-propagating Rust malware targeting air-gapped government networks in India and Afghanistan.

Zscaler identified in August 2026 a campaign tracked as RapidRust in which APT36 uses infected removable drives to reach air-gapped government environments in India and Afghanistan. RUSTYMOVE, a Rust USB-spreading utility, copies a fake-PDF shortcut and the RUSTYSHADE backdoor to removable media; RUSTYSHADE uses attacker-controlled private GitHub repositories for C2, running shell commands, capturing screenshots and webcam images, while PSNATCH and BASHNATCH steal files. Operators enumerated users, shares, and remote administrative shares to expand beyond initial victims, with payloads staged on lookalike domains mimicking Indian media outlets and Backblaze B2 storage.

Cyber Security News10:17 UTC · 36m agoThreat actor in the wild 3 sources

Why APAC Enterprises Need Real-Time Threat Intelligence as Singapore, Malaysia, and Thailand Tighten Cyber Compliance in 2026new

Singapore, Malaysia, and Thailand all tightened cyber compliance in 2026, mandating continuous monitoring and rapid incident reporting for critical infrastructure.

Singapore's CSA issued the Cybersecurity Code of Practice 2026 for Critical Information Infrastructure on 29 July 2026, adding board cyber-resilience duties, annual training, and controls on Interconnected Systems, with most obligations effective by 29 July 2027. Malaysia's Cyber Security Act 2024 requires NACSA-licensed providers, audits, and fast incident notification, with fines up to RM500,000 and up to ten years' imprisonment. Thailand's NCSA cloud security standard has been enforced since 10 September 2026, with a Website Security Standard effective 16 September 2026. The vendor article argues detection speed has become a compliance metric driving demand for real-time threat intelligence.

Cyble09:57 UTC · 56m agoPolicy & legal

When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts

Cloudflare's Page Shield ML uncovered four malicious JavaScript campaigns on storefronts, including affiliate fraud and a remote-backdoor script, that VirusTotal and URLScan missed.

Cloudflare's Page Shield ML detected four client-side JavaScript operations (eight payloads) in live traffic on online storefronts, enabling affiliate commission hijacking, clickless affiliate theft via hidden iframes, user tracking with a remote-code backdoor, and cloaking of paid mobile visitors. Seven of the eight payloads were absent from VirusTotal and URLScan returned no malicious verdict for any, including a Lnkr-family payload indexed unclassified for roughly 2.5 years. Detection relies on a graph neural network over JavaScript syntax trees, an LLM second opinion on Workers AI, and a frontier-model ensemble voting across benign, magecart, other malware, and cryptomining labels.

Cloudflare BlogSep 16, 20:06 UTC · 14h agoMalware in the wild

Hackers reveal how Flock cameras really track cars and people

Hackers tore down a Flock Safety camera, dumped its storage, recovered an encryption key, and revealed its software detects people as well as vehicles.

Hackers from a collective calling itself stegan0gram removed a Flock Safety camera from service, made a near-complete copy of its storage, and recovered an encryption key stored on the device that unlocked thousands of vehicle-detection videos, sharing the files with 404 Media, WIRED, and Distributed Denial of Secrets. Analysis of about 21 days of logs shows more than a million images, roughly 28 photos per passing vehicle, and Flock-built apps that detect people, bicycles, and even bumper stickers, while plate inference happens on Flock's servers. Flock had previously downplayed early-2025 root-access research by Jon Gaines, and records from Alpharetta, Georgia were searchable by over 2,000 agencies via Flock's national network.

Ars Technica · Security09:43 UTC · 1h agoData breach in the wild 4 sources

Adversary simulation: what you need to know

UK NCSC publishes guidance on adversary simulation, comparing full spectrum and assumed breach approaches across prerequisites, testing, and reporting phases.

NCSC guidance describes two adversary simulation approaches: full spectrum, starting outside the network with an end-to-end attack, and assumed breach, starting from an internal foothold. The preferred methodology spans three phases - prerequisites (scoping, passive reconnaissance, preparation), testing (active reconnaissance, initial access, internal phase, cleanup), and reporting. The document distinguishes adversary simulation from penetration testing and stresses customer-defined objectives and minimal information sharing.

NCSC UKupdated 09:09 UTC · 1h agofirst 08:29 UTC · 2h agoAdvisory 2 sources

Fake AI trading agent steals crypto wallet passwords

Fake AI crypto trading agent sites deliver Needle Stealer, which replaces browser wallet extensions to steal wallet passwords, HP reports.

HP researchers tracked campaigns between April and June 2026 in which a fake AI trading agent site, tradingclaw[.]pro, distributed a Microsoft-signed OLEView executable that DLL side-loads a malicious iviewers.dll and launches Needle Stealer via process hollowing. Needle replaces one of seven browser wallet extensions, including MetaMask, Coinbase Wallet, and Phantom, to capture wallet passwords. Related campaigns used QR-code invoice phishing leading to fake OneDrive pages, Phantom Stealer sold as a penetration testing tool with VBScript-to-PowerShell steganographic loaders, and image-hidden payloads delivering XWorm, PureLogs Stealer, and Formbook; a perceptual-hash VirusTotal search found about 400 distinct rigged images.

Help Net Security08:00 UTC · 2h agoMalware in the wild1

Tuskira Vector brings autonomous red teaming to attack surface validation

Tuskira launched Vector, an autonomous red teaming agent that validates exploitable external attack surface against deployed controls using a Security Data Fabric digital twin.

Tuskira announced Vector, an agentic autonomous red teaming capability that simulates attacker behavior from outside an organization to identify its exploitable attack surface. Findings are validated against deployed compensating controls, internal risk data, and application/infrastructure topology via Tuskira's Security Data Fabric, which normalizes third-party tool signals into a live digital twin. The release extends Kairo (introduced May 2026), adding red team sensors and an agentic defense loop spanning agents Kairo, Lattice, Quell, and Iris. Tuskira claims Kairo has deprioritized up to 99% of scanner findings as unreachable and recomputes breach-path maps in minutes.

Help Net Security06:01 UTC · 4h agoTools

CASHEWS: Source Preprocessor for LLM-based Malicious Package Detection

CASHEWS preprocessor boosts LLM-based malicious npm package detection, raising coverage to 98.8-100% and cutting false negatives by up to 18.6 points.

Researchers present CASHEWS, a JavaScript preprocessor for LLM-based malicious package detection that deobfuscates code iteratively, extracts bundled modules and dynamically executed code, identifies malicious sinks, and computes backward slices to produce compact detector input. Threat actors evade LLM detectors by exploiting limited context windows with high token-density obfuscation and by bundling malicious code with benign packages, as seen in supply-chain attacks such as Shai-Hulud. Across 512 large package files, two scanner types, and three LLMs, CASHEWS raised analysis coverage from 69.1-85.7% to 98.8-100% and reduced false-negative rates by up to 18.6 percentage points. Median preprocessing time is 30 seconds while net analysis cost drops 34.6%.

arXiv cs.CRSep 16, 16:00 UTC · 18h agoResearch

German Manufacturer Shrinks Security Alert Response While Protecting 10,000 Endpoints

Vendor case study: a German manufacturer's five-person SOC cut alert triage time using ANY.RUN's cloud sandbox across 10,000 endpoints.

ANY.RUN published a case study in which a five-person security team at an unnamed German manufacturer replaced an air-gapped forensic laptop with its cloud-managed interactive sandbox, protecting roughly 10,000 endpoints and 10,000 users. The vendor claims a median 15 minutes saved per alert, 20-40 daily tasks processed, a 2.5-minute alert-to-isolation target, and a 95% agreement rate between analyst and sandbox verdicts; all figures are vendor-supplied with the customer identity withheld. The writeup also describes detonating a multi-stage phishing chain from a PDF link to a password-protected ZIP to malware execution.

Cyber Security Newsupdated 08:15 UTC · 2h agofirst Sep 16, 15:12 UTC · 19h agoIndustry 3 sources

The sexy AI-powered dating app scams are here

Anthropic exposed a network of roughly 28 AI-driven dating apps using autonomous personas and gig workers to defraud paying users.

Anthropic threat intelligence uncovered a fraud network of around 28 dating apps after a prepaid account sent over 100,000 Claude API requests daily, with most chats run by autonomous AI personas and no human agent. Researchers Matthew Gore-Kormanik and Anthropic's Chris Cronbaugh documented apps including Dora, Romi, and Doni, which monetize conversations via coins; gig workers were hired only to pass liveness checks and select pregenerated replies. An operations manual written in Chinese was found inside the Doni app, and Anthropic published findings in its September 2026 AI misuse report.

The Verge · AISep 16, 14:45 UTC · 20h agoPhishing & fraud in the wild

The true cost of a ransomware attack, with and without BCDR

Ransomware's true cost averages $5.08 million per incident versus a $139,875 median ransom, and mature BCDR strategies with immutable backups cut downtime and recovery expenses.

IBM's Cost of a Data Breach Report 2025 puts the average ransomware incident at $5.08 million, far above the $139,875 median ransom payment cited in Verizon's 2026 DBIR. Datto's State of BCDR Report 2025 found 60% of organizations believed they could recover within a day, but only 35% actually did. The Datto-sponsored piece argues mature BCDR with immutable WORM backups shortens downtime, citing a Techify case that restored 19 TB and returned a client to operations in under two hours without paying a ransom. It also flags compliance deadlines such as GDPR's 72-hour breach notification and the SEC's four-business-day disclosure rule.

BleepingComputerSep 16, 14:00 UTC · 20h agoIndustry

GhostCode Abuses Microsoft Entra Device Enrollment to Maintain Access After Token Revocation

eSentire exposes GhostCode, a device-code phishing kit that abuses Microsoft Entra device enrollment to persist even after stolen tokens are revoked.

eSentire's Threat Response Unit observed GhostCode campaigns in late August 2026, using BEC-style social engineering that impersonated procurement staff, including BJ's Wholesale Club, via Salesforce contact forms. Victims received password-protected HTML lures disguised as a FlipBook document portal, with junk-data padding, HTML comment injection, and AES-256-GCM encrypted redirects gated by anti-bot checks. The kit exploits the OAuth 2.0 device authorization grant, prompting victims to approve real Microsoft device-code sign-ins with MFA. Within 78 seconds of approval, attackers registered three Entra devices and obtained a Primary Refresh Token, so rogue device registrations persist even after session token revocation.

GBHackersSep 16, 13:41 UTC · 21h agoPhishing & fraud in the wild2

Smishing Hackers Can Watch Every Keystroke as Victims Enter Card Details and OTPs

Group-IB details the JWR smishing kit, used by the Outsider cluster, that streams keystrokes and OTPs to fraudsters in real time via WebSocket.

Group-IB linked the JWR phishing kit to an operator cluster it tracks as Outsider within the broader Smishing Triad ecosystem. Fake toll, parcel, and delivery messages lead to live phishing pages that capture card numbers, passwords, and one-time passcodes before victims submit forms. The kit supports up to 32 guided pages, AES-256-CTR wrapped traffic with keys embedded per message, rotating short links and domains, and WordPress or Shopify integration markers, enabling account takeover and unauthorized payments.

Cyber Security NewsSep 16, 13:39 UTC · 21h agoPhishing & fraud in the wild 2 sources

Parallels Desktop Flaw Lets Non-Admin Mac Users Gain Root, but Intel Macs Can't Install Fix

JFrog disclosed CVE-2026-90894, a 7.8-rated local privilege escalation in Parallels Desktop for Mac, patched only in version 27, which Intel Macs cannot install.

JFrog researcher Yuval Moravchick disclosed CVE-2026-90894 (dubbed ParaShells, CVSS 7.8), a local privilege escalation in Parallels Desktop for Mac that lets non-admin users run code as root. The root-level prl_disp_service listens on a world-writable socket, and argument injection into a tar command via QProcess::splitCommand and the --use-compress-program option yields code execution as root, demonstrated on Parallels Desktop 26.4.0 build 57513 on Apple silicon. The fix appears in version 27.0.0, but Parallels Desktop 27 requires Apple silicon, leaving Intel Macs on the 26.x line with no build JFrog describes as fixed. No exploitation in the wild has been reported and Parallels has not published a statement.

The Hacker NewsSep 16, 13:14 UTC · 21h agoVulnerability 4 sources CVE-2026-90894

Oracle Critical Security Update – 673 Vulnerabilities Patched Across Product Families

Oracle's September 2026 Critical Patch Update ships 673 patches across 17 product families, including 100+ critical and 240+ remotely exploitable flaws.

Oracle's September 2026 Critical Security Patch Update ships 673 patches covering 672 unique CVEs, with more than 130 additional CVEs resolved through bundled fixes, pushing the effective total past 800. Over 100 flaws are critical severity and more than 240 are remotely exploitable without authentication. Oracle E-Business Suite received 159 fixes, Fusion Middleware 153 (78 unauthenticated and network-exploitable), and Hyperion 102. No in-the-wild exploitation of these specific flaws is reported, but Oracle cites CISA's earlier 72-hour remediation order for actively exploited CVE-2026-21962 (CVSS 10.0).

Cyber Security Newsupdated Sep 16, 19:29 UTC · 15h agofirst Sep 16, 13:03 UTC · 21h agoAdvisory 3 sources CVE-2026-219621

A Global Readiness and Sovereignty Capability Model for Post-Quantum Cryptography Migration

Researchers propose a Readiness-Sovereignty Capability Model scoring 57 countries on post-quantum cryptography readiness and sovereignty.

The RSCM model decomposes cryptographic sovereignty into indigenous capacity, indigenous post-quantum control, and external dependency, with a gate requiring demonstrated creation in at least one core layer. Applied to 57 documented cryptographic actors, 20 countries clear the maker gate (15 full-stack, 5 research makers), 11 hold strong general capacity without post-quantum control, and 25 are dependent. Readiness correlates with independent cyber indices up to rank correlation 0.70, while post-quantum creation shows no significant correlation with commitment (0.22).

arXiv cs.CRSep 16, 11:10 UTC · 23h agoResearch