Search: “Defender”

10,744 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Ransomware 2280 Vulnerability 1852 Malware 1624 Exploit / PoC 1113 Policy & legal 923 Threat actor 889 Data breach 705 Phishing & fraud 596 Industry 584 Advisory 96 Research 89 Tools 57

SeverityAll critical 4981 high 2702 medium 1707 low 1220 info 198

H1 2026 Malware Vulnerability Trends

Recorded Future's H1 2026 report finds 215 actively exploited CVEs, RAT dominance, NFC payment fraud, and AI-augmented but not autonomous tradecraft.

Recorded Future's Insikt Group identified 215 actively exploited CVEs in H1 2026, up 34% from 161 in H1 2025, with the most impactful flaws combining network reachability, no authentication, and code execution. AsyncRAT was the top malware family, with AsyncRAT, Cobalt Strike, XWorm, Stealc, and REMCOS remaining top-ten staples; Android NFC malware like NFCShare and NGate enabled payment card theft and ATM cash-outs. AI-enabled attacks remained additive to established tradecraft, concentrated in Levels 1-3 of Recorded Future's AIM3 maturity model, with AI-assisted vulnerability research (e.g., Claude Mythos fixing 271 Firefox bugs in Firefox 150) inflating NVD disclosure volumes 43% above the prior six-month average. The report urges defenders to prioritize remotely exploitable RCE flaws, behavioral detection, developer credential security, and third-party oversight.

Recorded FutureSep 3, 00:00 UTC · 14d agoThreat actor in the wild1

Counterfeit installers to system compromise: Tracking a deceptive software download campaign

Microsoft tracks a counterfeit software-installer campaign compromising multinationals' China operations, moderately linked to the Silver Fox (Yinhu) actor.

Microsoft Defender Experts is tracking an active campaign using spoofed software download sites for brands such as Razer, Kaspersky, Microsoft Edge, Calibre, and Baidu Netdisk on .com.cn and .hl.cn domains, delivering installer archives whose hashes change per download, indicating server-side payload generation. The implants establish persistence, weaken security protections, and communicate with attacker-controlled infrastructure, with confirmed compromises across healthcare, manufacturing, gaming, technology, logistics, government, and education. Microsoft assesses with moderate confidence that the activity matches the publicly reported Silver Fox (Yinhu) fake software campaign; it has not attributed it to a nation-state actor.

Microsoft Security BlogSep 1, 22:48 UTC · 15d agoThreat actor in the wild1

GirlsDoPorn Victims Sue Major Payment Processors, Claiming They Enabled Sex Trafficking

404 MediaOct 16, 22:09 UTC · Oct 16, 2025Phishing & fraud

Java security: If you ain’t cheatin,’ you ain’t tryin’

CyberScoopFeb 19, 11:00 UTC · Feb 19, 2025Exploit / PoC in the wildCVE-2021-44228

Threat Roundup for June 9 to June 16

Cisco TalosJun 16, 20:44 UTC · Jun 16, 2023Ransomware

Threat Roundup for March 31 to April 7

Cisco TalosApr 7, 19:37 UTC · Apr 7, 2023Vulnerability

Threat Roundup for March 17 to March 24

Cisco TalosMar 24, 17:42 UTC · Mar 24, 2023Ransomware

Threat Roundup for March 10 to March 17

Cisco TalosMar 17, 19:52 UTC · Mar 17, 2023Ransomware

Threat Roundup for June 25 to July 2

Cisco TalosJul 2, 18:59 UTC · Jul 2, 2021Ransomware

Threat Roundup for February 14 to February 21

Cisco TalosFeb 21, 18:43 UTC · Feb 21, 2020Ransomware

Windows Defender ShieldCrash 0-Day Lets Attackers Read Arbitrary Files as SYSTEM

Unpatched Windows Defender zero-day 'ShieldCrash' PoC lets local attackers read arbitrary files as SYSTEM, apparently bypassing the CVE-2026-69414 patch.

Researcher MSNightmare published a skeleton proof-of-concept for 'ShieldCrash', an unpatched Microsoft Defender flaw enabling arbitrary file reads with SYSTEM privileges that reportedly persists on supported Windows versions after September 2026 updates. It appears to bypass the recent fix for the Malware Protection Engine elevation-of-privilege flaw CVE-2026-69414 (ShieldBreak), patched in engine version 1.1.26080.3. SYSTEM-level file disclosure could expose credentials, application secrets and registry hives and support post-compromise reconnaissance. No active exploitation is confirmed and Microsoft had issued no specific patch or mitigation at disclosure time.

GBHackersSep 9, 08:40 UTC · 7d agoExploit / PoC CVE-2026-694141

Chaotic Eclipse Released ShieldCrash, A PoC For Microsoft Defender Zero-Day

Researcher Chaotic Eclipse released ShieldCrash, a PoC showing Microsoft Defender's CVE-2026-69414 patch is incomplete, enabling arbitrary file reads as SYSTEM.

Security researcher Chaotic Eclipse published ShieldCrash, a proof-of-concept exploit for the Microsoft Malware Protection Engine privilege escalation vulnerability CVE-2026-69414 (ShieldBreak). The PoC performs arbitrary file reads with SYSTEM privileges on all supported Windows versions, including systems running the September 2026 security updates and Malware Protection Engine version 1.1.26080.3. The researcher claims Microsoft's patch fixed several exploit paths but missed a specific condition that still enables the attack. His recent releases also include zero-day PoCs targeting Nvidia, Kaspersky, Avast, and CrowdStrike Falcon.