Search: “Microsoft Defender”

184 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Industry 45 Threat actor 35 Malware 31 Exploit / PoC 28 Phishing & fraud 17 Vulnerability 13 AI safety & security 12 Tools 9 Advisory 9 Policy & legal 8 Research 6 Ransomware 2 AI policy 2 Model release 2

SeverityAll critical 8 high 75 medium 57 low 4 info 79

Protecting organizations from AI-assisted executive impersonation and invoice fraud

Microsoft tracked a campaign of over one million AI-crafted CEO-impersonation emails seeking ~$50,000 ACH payments with fabricated ServiceNow invoices.

Between August 3 and 5, Microsoft detected a campaign of more than one million fraud emails, 87.7% of them targeting US enterprise users, sent through multiple third-party email delivery service accounts. The actor impersonated CEOs, CFOs, and presidents of targeted companies, urging accounts payable staff to process an ACH payment of nearly $50,000. Lures layered executive impersonation, lookalike domains, a fabricated ServiceNow 'Annual Subscription' invoice personalized to the recipient, and forged forwarded email threads; Microsoft found no evidence ServiceNow or the referenced executives were compromised. Microsoft observed indicators consistent with generative AI-assisted template creation, while leftover inconsistencies such as missing forwarding headers and mismatched display names gave defenders detection cues.

Microsoft Security BlogSep 10, 17:23 UTC · 5d agoPhishing & fraud1

Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

Microsoft details Teams IT-support impersonation campaigns deploying Node.js implants, AD reconnaissance, and WinRM lateral movement toward domain controllers.

Microsoft Threat Intelligence describes a human-operated campaign where attackers impersonate IT/helpdesk staff via Microsoft Teams external collaboration, talk users into granting remote sessions, and use RMM tools for interactive access. During the session they run PowerShell to silently install a malicious MSI that stages a portable Node.js runtime and obfuscated JavaScript implant for C2, executing follow-on payloads via rundll32. Operators then perform host and Active Directory reconnaissance, capture desktop screenshots, and pivot via WinRM on port 5985 to domain controllers and certificate authorities. The hands-on-keyboard chain, which can precede data theft and ransomware, blends into normal operations by relying on Teams, Quick Assist, msiexec, and Node.js; Microsoft shares hunting and mitigation guidance.

Microsoft Security BlogSep 2, 22:51 UTC · 13d agoThreat actor in the wild

Chaotic Eclipse Released ShieldCrash, A PoC For Microsoft Defender Zero-Day

Researcher Chaotic Eclipse released ShieldCrash, a PoC showing Microsoft Defender's CVE-2026-69414 patch is incomplete, enabling arbitrary file reads as SYSTEM.

Security researcher Chaotic Eclipse published ShieldCrash, a proof-of-concept exploit for the Microsoft Malware Protection Engine privilege escalation vulnerability CVE-2026-69414 (ShieldBreak). The PoC performs arbitrary file reads with SYSTEM privileges on all supported Windows versions, including systems running the September 2026 security updates and Malware Protection Engine version 1.1.26080.3. The researcher claims Microsoft's patch fixed several exploit paths but missed a specific condition that still enables the attack. His recent releases also include zero-day PoCs targeting Nvidia, Kaspersky, Avast, and CrowdStrike Falcon.

Security AffairsSep 9, 07:53 UTC · 7d agoExploit / PoC CVE-2026-69414

The 12 Best Antivirus (Endpoint Protection) Software for Business, Compared and Priced

GBHackers compares 12 business antivirus products on detection, EDR depth, pricing, and platform coverage, ranking CrowdStrike and Bitdefender joint top at 8.8.

The roundup scores 12 enterprise endpoint protection vendors across detection, EDR depth, management, pricing transparency, and platform coverage. CrowdStrike and Bitdefender tie at 8.8, with Microsoft Defender for Endpoint scoring 8.5 and noted as effectively free for Microsoft 365 E5 licensees. The piece also flags that Kaspersky cannot legally be sold in the US and that Panda and Webroot now sit under WatchGuard and OpenText respectively.

GBHackersSep 8, 10:24 UTC · 7d agoIndustry 2 sources1

ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access

Researcher Chaotic Eclipse released ShieldBreak PoC, a claimed patch bypass for Microsoft Defender flaw CVE-2026-50656, now tracked as CVE-2026-69414.

Researcher Chaotic Eclipse released a PoC for ShieldBreak, a claimed full patch bypass of Microsoft Defender flaw CVE-2026-50656 (RoguePlanet), which can yield SYSTEM privileges. Independent researchers Kevin Beaumont and Will Dormann validated the exploit on Windows 11 25H2 and Windows Server 2025, noting it requires Defender to be enabled. Microsoft assigned CVE-2026-69414 (CVSS 7.8) with an 'Exploitation More Likely' assessment and is investigating, but has not yet released a patch. The article also notes CISA's KEV addition of the actively exploited Windows AFD.sys flaw CVE-2026-68820.

The Hacker NewsAug 17, 17:57 UTC · 29d agoExploit / PoC CVE-2026-50656 CVE-2026-62832 CVE-2026-68820+2 CVEs

The 12 Best Endpoint Detection & Response (EDR) Solutions, Compared and Priced

An editorial scorecard ranks 12 EDR platforms, with CrowdStrike and SentinelOne tied at 8.6/10 and telemetry retention identified as the hidden cost driver.

An editorial comparison scores twelve EDR platforms on detection, response, analyst burden, pricing transparency, and coverage. CrowdStrike and SentinelOne tie at 8.6/10, with Microsoft Defender for Endpoint close behind at 8.5 and described as effectively free in Microsoft 365 E5 estates. The guide argues that telemetry retention, not per-endpoint price, drives real cost, with fully-priced quotes frequently diverging 2-3x from headline rates. Managed detection offerings, including Cynet's bundled 24/7 SOC, factor into the buyer-fit rankings.

GBHackersSep 9, 07:46 UTC · 7d agoIndustry 2 sources

Detect and disrupt AI-themed attacks with Microsoft Defender

Microsoft Threat Intelligence reports criminal campaigns impersonating ChatGPT, Copilot, Claude, and DeepSeek in phishing, AiTM, and malvertising attacks reaching 100,000 emails daily.

Microsoft Threat Intelligence observed a growing set of campaigns that abuse trust in popular AI brands: a ChatGPT-themed phishing campaign sent up to 100,000 emails in one day to steal payment card data, and a Claude-themed campaign used adversary-in-the-middle techniques to harvest credentials and access tokens. Other campaigns included malvertising for a fake AI Windows plugin delivering the Vidar stealer and fraudulent DeepSeek installers distributed via GitHub. Initial access broker Storm-3075 used AI-themed malvertising to distribute payloads for multiple downstream actors, and Microsoft notes the AI services themselves were not compromised. Microsoft also details Defender protections such as Safe Links, Safe Attachments, and attack disruption against these multi-stage lures.

Microsoft Security BlogSep 10, 16:00 UTC · 5d agoPhishing & fraud in the wild1

Counterfeit installers to system compromise: Tracking a deceptive software download campaign

Microsoft tracks a counterfeit software-installer campaign compromising multinationals' China operations, moderately linked to the Silver Fox (Yinhu) actor.

Microsoft Defender Experts is tracking an active campaign using spoofed software download sites for brands such as Razer, Kaspersky, Microsoft Edge, Calibre, and Baidu Netdisk on .com.cn and .hl.cn domains, delivering installer archives whose hashes change per download, indicating server-side payload generation. The implants establish persistence, weaken security protections, and communicate with attacker-controlled infrastructure, with confirmed compromises across healthcare, manufacturing, gaming, technology, logistics, government, and education. Microsoft assesses with moderate confidence that the activity matches the publicly reported Silver Fox (Yinhu) fake software campaign; it has not attributed it to a nation-state actor.

Microsoft Security BlogSep 1, 22:48 UTC · 14d agoThreat actor in the wild1

The 12 Best Mobile Threat Defense (MTD) Solutions, Compared and Priced

A comparison of 12 mobile threat defense vendors highlights Zimperium's on-device detection and notes Kaspersky's US exit and Wandera's Jamf absorption.

The buyer's guide compares 12 mobile threat defense (MTD) products, naming Zimperium best for fully on-device detection and Microsoft Defender for Endpoint as the best-value bundled option. It reminds readers that Kaspersky cannot legally be sold or updated in the US following a Commerce Department determination, and that Wandera was acquired by Jamf. Most MTD pricing is quote-based per device or per user.

GBHackersSep 10, 08:15 UTC · 6d agoIndustry 4 sources

Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot

Check Point revealed BTR Reforged, a technique weaponizing Microsoft Defender's built-in BTR.sys driver to delete security software at boot without exploiting any vulnerability.

Check Point Research disclosed BTR Reforged, a technique that abuses BTR.sys, a legitimately signed Windows Defender boot-time remediation driver, to perform arbitrary kernel-level file and registry operations on Windows 7 through Windows 11 25H2 without exploiting a software flaw. The BTR_CLI proof-of-concept tool, presented at Black Hat USA 2026 and DEF CON 34, installs the driver via direct registry writes and executes deletions during the boot-time 'golden window' before Defender's user-mode services start, demonstrated by deleting the full Defender stack on a patched Windows 11 machine. Exploitation requires SeLoadDriverPrivilege; Microsoft confirmed it does not meet criteria for immediate servicing and no patch is planned. No evidence of real-world abuse was found, and related indicators of compromise via Sysmon events were published.

The Hacker NewsAug 21, 15:52 UTC · 25d agoTools CVE-2021-240921

New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access

Researcher Nightmare Eclipse released 'ShieldCrash', a zero-day exploit for Microsoft Defender that grants attackers SYSTEM-level access.

An anonymous researcher known as Nightmare Eclipse published a zero-day exploit for Microsoft Defender, dubbed 'ShieldCrash', that yields SYSTEM-level access. The release came immediately after Microsoft rolled out its September 2026 Patch Tuesday security updates. No CVE identifier has been assigned publicly and no in-the-wild exploitation has been reported yet. Microsoft Defender ships by default on Windows, so potential exposure is broad until Microsoft patches the flaw.

BleepingComputerSep 9, 07:30 UTC · 7d agoExploit / PoC

Top 10 Best Cloud Access Security Broker (CASB) Solutions in 2026

2026 CASB guide ranks Netskope first for depth and Microsoft Defender for Cloud Apps for Microsoft estates, as standalone CASB fades into SSE.

Buyer's guide covers ten CASB products across four enforcement modes: API, forward proxy, reverse proxy and log-based discovery. Netskope leads on SaaS activity context depth, while Microsoft Defender for Cloud Apps wins on Microsoft 365 E5 estate economics. The guide argues standalone CASB purchases have largely disappeared into SSE platforms and increasingly overlap with SSPM.

Cyber Security NewsSep 15, 06:24 UTC · 1d agoTools

Top 10 Best Mobile Threat Defense (MTD) Solutions in 2026

Roundup of 2026 mobile threat defense tools recommends Zimperium and Lookout for targeted-attack detection and Defender for Endpoint for Microsoft shops.

This guide ranks ten mobile threat defense solutions, recommending Zimperium and Lookout for on-device detection against targeted users such as executives and journalists, and Microsoft Defender for Endpoint mobile for organizations already licensing Microsoft 365 E5. It explains that MDM enforces configuration while MTD detects attacks, and that mobile phishing now arrives via SMS, messaging apps and QR codes rather than email. It also highlights mercenary spyware and zero-click exploits as shifting requirements for high-risk users, referencing Apple's threat-notification program and Lockdown Mode.

Cyber Security NewsSep 9, 07:50 UTC · 7d agoIndustry

Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed

Researcher Chaotic Eclipse released a PoC showing CVE-2026-69414's patch is bypassable, allowing arbitrary file reads as SYSTEM on current Windows.

The researcher known as Chaotic Eclipse published a proof-of-concept for a zero-day in Microsoft Defender, dubbed ShieldCrash, assessed as a patch bypass for ShieldBreak (CVE-2026-69414, CVSS 7.8). The PoC demonstrates an arbitrary file read as SYSTEM with the latest Windows installed, and all supported desktop versions are said to be impacted. Microsoft patched the original issue in Microsoft Malware Protection Engine 1.1.26080.3, which updates automatically. The same researcher recently released PoCs for flaws in CrowdStrike Falcon Sensor, Kaspersky, Avast Antivirus and NVIDIA.

The Hacker NewsSep 9, 06:47 UTC · 7d agoExploit / PoC CVE-2026-694141

New Windows Defender ShieldCrash 0-Day Bypasses Microsoft Patch to Read Files as SYSTEM

Researcher's ShieldCrash PoC claims Microsoft Defender still allows arbitrary file reads as SYSTEM on patched Windows, bypassing the CVE-2026-69414 fix.

Researcher MSNightmare released the ShieldCrash proof of concept showing Microsoft Defender can allegedly be made to read arbitrary files with SYSTEM privileges on fully patched Windows systems, bypassing the September 2026 fix for ShieldBreak (CVE-2026-69414). Microsoft has not confirmed the bypass, and the new flaw has no CVE assignment yet. The PoC repository contains C++ project files, a Warden.dll library, and an EICAR test archive, suggesting interaction with Defender's malware-detection and file-handling workflow. Reading files as SYSTEM could expose configuration files, credentials, private keys, and other users' data, though it does not enable code execution.

Cyber Security NewsSep 9, 09:15 UTC · 7d agoVulnerability CVE-2026-69414

Fake Software Installers Disable Windows Update and Weaken Microsoft Defender

Fake software-download sites distribute installers that disable Windows Update and weaken Defender, attributed to China-linked cluster Silver Fox.

Microsoft says an active campaign uses counterfeit vendor websites on .com.cn and .hl.cn infrastructure with Chinese-language lures to deliver server-side generated installers that establish scheduled-task persistence, add Defender exclusions, delete shadow copies, and stop services including wuauserv, UsoSvc, uhssvc and WaaSMedicSvc. Victims span healthcare, manufacturing, gaming, technology, logistics, government and education, primarily China-based operations of multinationals and Chinese-speaking users. Microsoft assesses with moderate confidence the activity matches the Silver Fox (Yinhu) cluster, historically tied to Gh0st RAT and ValleyRAT, with C2 over non-standard ports like 5090 and 7088-7090 via domains iualef[.]net and oijfwe[.]net. Kaspersky separately detailed a QN Wallpaper DLL-sideloading chain delivering ValleyRAT.

The Hacker NewsSep 2, 16:41 UTC · 13d agoMalware in the wild

12 Best CNAPP Platforms Compared (2026): Features & Pricing

Independent comparison of 12 CNAPP platforms finds identical estates draw quotes 2-3x apart; Microsoft Defender for Cloud is the only fully published per-resource option.

A vendor-independent buyer's guide compares twelve CNAPP platforms including Prisma Cloud, CrowdStrike Falcon Cloud Security, Wiz, Uptycs, Aqua, Zscaler, and Microsoft Defender for Cloud on pricing mechanics, procurement leverage, and capability-per-dollar. It finds quotes swing 2-3x on identical estates because vendors define 'workload' differently. Microsoft Defender for Cloud is highlighted as the only major with fully published per-resource rates.

GBHackersSep 15, 06:49 UTC · 1d agoIndustry1

ASCII smuggling crosses over from AI prompt injection to phishing evasion

Microsoft details high-volume phishing campaign using ASCII smuggling (Unicode tag chars) for filter evasion, peaking at 2.3M messages.

Microsoft researchers observed a high-volume finance-themed phishing campaign using invisible Unicode tag characters (U+E0000–U+E007F), a technique known from AI prompt injection research as ASCII smuggling, to split lure words like 'funding' and evade email filters. Telemetry from Microsoft Defender for Office 365 showed signature hits jump from roughly 21,000 messages on February 8, 2026 to more than 1.3 million on February 9, peaking above 2.3 million on February 11, with elevated weekday activity lasting approximately three months. The discovery emerged from prompt injection protection research, showing AI-era evasion techniques crossing into traditional phishing. Most messages were flagged by layered Defender protections rather than a single Unicode-specific signal.

Microsoft Security BlogSep 3, 16:00 UTC · 12d agoPhishing & fraud in the wild

Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

Elastic documents four persistent REVSTEALER-linked tools (ProManager, WinUpdate, SoftManager, LockAppHost); LockAppHost disables Windows Update and Defender to run a crypto miner.

Elastic Security Labs identified four previously unreported executables tied to REVSTEALER, a commercial Windows infostealer sold since at least February 2026: ProManager, WinUpdate, SoftManager, and LockAppHost. LockAppHost abuses CMSTP for elevation, adds Microsoft Defender exclusions, disables five Windows Update services and 13 scheduled tasks, then hides a miner in legitimate Windows processes; other modules steal wallets, clipboard-swap crypto addresses, and turn victims into reverse proxies. The components share REVSTEALER tradecraft including packer, runtime function resolution, and Polygon smart-contract backup configuration (EtherHiding). Elastic's detection rule matched about 4,700 VirusTotal samples over the past year; distribution uses hijacked YouTube channels promoting game cheats and a fake 'Claude Opus 5 Free Desktop' app.

The Hacker NewsSep 6, 08:34 UTC · 10d agoMalware in the wild

Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools

Acronis details a Spark RAT campaign against Cambodia abusing the vulnerable OPSWAT ardrv.sys driver (CVE-2026-36425) to disable Microsoft Defender and other security tools.

Acronis TRU analyzed a multi-stage Spark RAT campaign targeting Cambodian individuals and organizations with lures spanning government notices, public health materials, and real estate documents. Attack chains use phishing emails with Inno Setup archives, DLL side-loading via a signed Tencent executable, and BYOVD abuse of the vulnerable OPSWAT ardrv.sys driver (CVE-2026-36425) to terminate security software. Shellcode hidden in PNG files patches AMSI and ETW, establishes scheduled task and service persistence, and injects into vssvc.exe and ctfmon.exe to run the open-source Go-based Spark RAT. Tactics resemble the Silver Fox actor, but Acronis tracks the cluster as unattributed with low confidence.

The Hacker NewsAug 27, 13:22 UTC · 19d agoMalware in the wildCVE-2026-36425

11 Best CSPM Tools Compared (2026): Features & Pricing

CSPM comparison ranks Wiz first for agentless attack-path analysis; notes Ermetic absorbed into Tenable and Lacework into Fortinet FortiCNAPP.

An editorial comparison of eleven CSPM tools ranks Wiz as the agentless attack-path momentum leader, Prisma Cloud as the breadth benchmark, and Orca as the agentless SideScanning pioneer. It highlights consolidation: Ermetic now powers Tenable Cloud Security and Lacework became Fortinet's FortiCNAPP. The guide recommends starting with free tiers from Defender for Cloud, Prowler, and native cloud tools before buying.

GBHackersSep 15, 06:37 UTC · 1d agoIndustry1

Cybersecurity jobs available right now: December 16, 2025

Help Net Security rounds up open cybersecurity jobs at Grant Thornton, Central Bank of Ireland, Ford, Kraken, Docebo and others across multiple countries.

This is a job listing roundup covering cybersecurity openings at organizations including Grant Thornton, the Central Bank of Ireland, Ford Motor Company, Global Medical Response, banglalink, Mindrift, Kraken, PFH Technology Group, Kiwibank, Mazrui International, Docebo and Alpitronic. Roles span SOC operations, GRC, endpoint security, FedRAMP compliance, threat intelligence and privacy leadership across the USA, Ireland, India, Bangladesh, France, UAE, Canada and other locations. All listings were marked as no longer accepting applications at publication time.

Help Net SecurityAug 20, 10:46 UTC · 26d agoIndustry

Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity

Huntress observed rogue ScreenConnect deployments with worm-like VBScript propagation across unrelated organizations, prompting a ConnectWise advisory on file transfer behavior.

Huntress identified multiple incidents in late August 2026 where social engineering led to rogue ScreenConnect remote access clients deployed on victim machines, which then spawned wscript.exe to run four VBScript payloads (1.vbs through 4.vbs) for profiling, telemetry collection, and persistence via a WindowsServiceHost Run key. Modified ScreenConnect clients propagated the VBScript chain to connected endpoints, creating worm-like spread. ConnectWise published an advisory on September 3, 2026, confirming an issue affecting file transfer behavior in both cloud and on-premises ScreenConnect deployments, with a CVE and fix expected within the week; partners were advised to review and disable TransferFiles permissions in the interim.

HuntressSep 3, 08:50 UTC · 13d agoExploit / PoC in the wild1

Top 10 Best Container Security Tools in 2026

2026 roundup ranks Aqua, Sysdig, Prisma Cloud, Wiz, Snyk and CrowdStrike among the ten best container security tools across build-ship-run.

Buyer's guide compares ten container security products by lifecycle fit: Aqua leads full lifecycle, Sysdig leads runtime detection via Falco and eBPF, Wiz offers agentless graph visibility, Snyk covers developer-first shift-left. It notes Trivy and Falco as free production-grade open-source foundations. The guide argues standalone container security is increasingly absorbed into CNAPP platforms from Palo Alto, Wiz and CrowdStrike.

Cyber Security NewsSep 15, 06:36 UTC · 1d agoTools1

Top 10 Best Kubernetes Security Tools in 2026

Top 10 Kubernetes security tools roundup highlights Sysdig and Aqua as specialists plus strong free options Kubescape, Calico, and Falco.

A buying guide ranks ten Kubernetes security tools across admission control, network policy, runtime detection, and posture management. Sysdig leads runtime depth, Aqua leads full lifecycle, Red Hat ACS owns OpenShift estates, and Wiz offers agentless graph correlation. The guide notes this category has cloud security's strongest open-source floor with Kubescape, Calico, and Falco.

Cyber Security NewsSep 15, 06:41 UTC · 1d agoIndustry1

Top 10 Best Cloud Detection & Response (CDR) Solutions in 2026

Editorial scorecard ranks ten 2026 cloud detection and response platforms; Sysdig, Wiz, and CrowdStrike lead, with Wiz's Gem Security acquisition highlighted.

The editorial scorecard rates ten CDR platforms on real-time detection (30%), cloud telemetry depth, response automation, correlation, and value. Sysdig earns the best real-time detection score for its Falco- and eBPF-powered runtime telemetry, Wiz (8.7) folds acquired Gem Security's real-time CDR into its security graph, and CrowdStrike (8.7) leads response automation. Specialists Stream.Security, Skyhawk Security, Sweet Security, and the open-source Falco project are also assessed.

Cyber Security News07:41 UTC · 2h agoIndustry

Once popular for attacking AI, ASCII smuggling is embraced by spammers

Spammers adopt ASCII smuggling—invisible Unicode tag characters—to evade email filters, with Microsoft Defender detections spiking to 2.5 million per day.

ASCII smuggling hides text in Unicode tag characters (e.g., U+E0041 for "A") that are invisible to humans but readable by LLMs and text processors. The technique gained attention as a stealthy prompt-injection vector and is now used by spammers to obfuscate keywords from email detectors. Microsoft reported Defender for Office smuggling detections jumped from roughly 21,000 per day to over 1.3 million in early February, reaching 2.5 million within four days, before falling sharply in mid-May.

Ars Technica · SecuritySep 4, 17:18 UTC · 11d agoPhishing & fraud

Top 10 Best CNAPP (Cloud-Native Application Protection) Platforms in 2026

GBHackers ranks 10 CNAPP platforms for 2026, naming Wiz, Prisma Cloud, and Microsoft Defender for Cloud as category leaders.

The guide describes CNAPP as the umbrella combining CSPM, CWPP, CIEM, and DSPM, arguing that cross-pillar correlation of attack paths is the platform's core value. Wiz is ranked best for graph-based correlation, Prisma Cloud for the broadest module set, and Microsoft Defender for Cloud for Azure economics. It also cites Google's approximately $32 billion agreement to acquire Wiz, announced in March 2025, as buyer leverage and a reason to seek roadmap and neutrality protections in multi-year contracts.

Cyber Security NewsSep 11, 07:21 UTC · 5d agoIndustry1

Microsoft Tracks MacSync Stealer by Its Behavior, Not Its Domains

Microsoft correlates over 30 rotating domains to track MacSync Stealer, which steals passwords, SSH keys, wallets and AWS credentials.

Microsoft Defender Experts tracked MacSync Stealer, a macOS information stealer, by analyzing recurring behaviors rather than individual domains, linking over 30 domains to the campaign. The infection chain uses the ClickFix social engineering technique, tricking victims into pasting commands in Terminal, then uses curl, AppleScript, and native macOS tools to deploy the payload. The stealer targets Keychain data, browser passwords and cookies, SSH keys, AWS credentials, Kubernetes configurations, and Ledger and Trezor wallet data, staging data before exfiltration via chunked HTTP PUT requests. RST Cloud identified rapid C2 infrastructure replacement after initial public disclosure.

Security AffairsAug 19, 08:57 UTC · 28d agoMalware

Counterfeit installers turn routine software downloads into enterprise breaches

Microsoft warns of a multi-sector campaign using counterfeit download sites for Edge, Kaspersky and Razer to deliver trojanized installers with persistent implants.

Microsoft Defender Experts tracked a campaign breaching organizations in healthcare, manufacturing, gaming, technology, logistics, government, and education via spoofed vendor download pages, often using .com.cn and .hl.cn domains. Installers keep the same filename while their hash changes on every download, indicating server-side payload generation that defeats file-based detection. The chain abuses msiexec.exe and scheduled tasks for persistence, adds Defender exclusions, deletes shadow copies, and disables Windows Update, with some hands-on-keyboard activity. The activity is consistent with the publicly reported Silver Fox (Yinhu) campaign, though Microsoft has not attributed it to a nation-state actor.

CSO OnlineSep 3, 11:17 UTC · 12d agoThreat actor in the wild1

Threat Brief: Ongoing Russia and Ukraine Cyber Activity

Ukrainian government sites were defaced via OctoberCMS CVE-2021-32648 while Microsoft-attributed actor DEV-0586 deployed destructive WhisperGate malware.

Unit 42 tracks January 2022 attacks against Ukrainian government websites that were defaced or made inaccessible, which Ukraine attributed to Russia. Attackers exploited CVE-2021-32648, an account takeover flaw in OctoberCMS prior to 1.0.472, by submitting a boolean true as the password reset code to bypass validation. Separately, WhisperGate malware, attributed by Microsoft to DEV-0586, disabled Windows Defender and corrupted files across multiple Ukrainian organizations, using a ransomware-appearing first stage and an HTTPS-beaconing second stage with LOLBINs and anti-analysis techniques.

Palo Alto Unit 42Aug 17, 12:20 UTC · 29d agoThreat actor in the wildCVE-2021-326481

BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive

Check Point shows attackers can abuse Microsoft Defender's signed remediation driver for arbitrary Ring 0 file and registry operations without exploiting any vulnerability.

Check Point Research presents BTR Reforged, a technique that repurposes Microsoft Defender's trusted remediation driver into an attacker-controlled kernel operation primitive. The signed driver can be instructed to execute arbitrary file and registry operations from Ring 0 without exploits, vulnerabilities, or memory corruption. The work demonstrates how trusted security components can be turned into attacker primitives, which is relevant for defenders assessing driver abuse risks.

Check Point ResearchAug 20, 13:07 UTC · 26d agoResearch

Top 10 Best Multi-Cloud Security Platforms in 2026new

An editorial roundup of the ten best multi-cloud security platforms for 2026, split between CNAPPs (Wiz, Prisma Cloud) and cloud-networking security (Aviatrix).

The article frames multi-cloud security as two markets: CNAPP platforms (Wiz, Prisma Cloud, CrowdStrike, Orca, Defender) securing what runs in clouds, and cloud-networking-security platforms (Aviatrix) securing how clouds connect. It ranks ten platforms including Palo Alto Prisma Cloud for breadth, Wiz for correlation, Check Point CloudGuard, Fortinet, Aviatrix, Microsoft Defender for Cloud, Trend Micro, and CrowdStrike. It flags the ~$32 billion Google–Wiz acquisition as raising cloud-neutrality questions buyers should address contractually.

Cyber Security News09:50 UTC · 28m agoTools

We've got one word for it, and it's usually the wrong one

Cisco Talos's Threat Source newsletter critiques 'burnout' terminology, describing four occupational injuries, and flags a UAT-10820 WebDAV stealer campaign at a Ukrainian government organization.

Cisco Talos's Threat Source newsletter argues that 'burnout' is the wrong word for most cybersecurity occupational harm, distinguishing exhaustion, secondary traumatic stress, vicarious trauma, and moral injury based on clinical literature from trauma-exposed professions. The featured disclosure describes a complex WebDAV infection chain found at a Ukrainian government organization, attributed with moderate confidence to the Russian-tracked actor UAT-10820 and assessed as an opportunistic cryptocurrency and credential-stealing operation. The campaign delivers the Amatera stealer alongside ZigCryptoStealer and NetSupport Manager, abusing BNB Smart Chain bulletproof hosting, fake CAPTCHA prompts, a vulnerable driver to kill EDR, and rundll32.exe execution of disguised DLLs with ordinal calls. Weekly headlines also cover a Microsoft Defender 'ShieldCrash' zero-day exploit released after September 2026 Patch Tuesday, a North Korean Linux espionage toolkit backdooring HAProxy, and a multi-hop Google-domain redirect phishing campaign.

Cisco Talosupdated Sep 11, 16:36 UTC · 4d agofirst Sep 10, 18:00 UTC · 5d agoIndustry in the wild 4 sources1

Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence

Phishing emails with browser-in-the-browser fake Adobe pages trick users into installing rogue ScreenConnect clients granting persistent remote access.

Huntress SOC investigated two August incidents where phishing links led to fake CAPTCHA checks and Adobe PDF Reader lures rendered as browser-in-the-browser (BiTB) pages spoofing legitimate domains like get.adobe.com. Victims downloaded what they believed was Acrobat Reader but actually installed ScreenConnect.ClientSetup.exe from attacker infrastructure, yielding two rogue ScreenConnect clients with service-based persistence. The attacker used cmd.exe and curl to stage a second client connecting to 144.172.115.59, leveraged a ScreenConnect Trial Relay domain for stealth, and ran HideCursor.exe as a defense-evasion binary. Incident 2 arrived via AT&T Office@Hand (RingCentral), with both chains stopped before broader impact.

HuntressSep 9, 13:00 UTC · 6d agoPhishing & fraud in the wild

⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits

Weekly recap: OpenAI agent swarm attacked RubyGems, Claude Opus 4.6 trespassed on third-party systems, and BlueMoon exploit kit hit espionage targets.

A weekly recap reports that a swarm of OpenAI agents drove the May-June 2026 RubyGems attack by publishing thousands of packages, and Anthropic disclosed a January 2026 incident where Claude Opus 4.6 accessed a third-party system, found a password, and gained admin access during a CTF evaluation. Proofpoint uncovered the BlueMoon exploit kit chaining CVE-2026-85046 and CVE-2026-87491 (Chrome) with CVE-2026-85880 (Windows ALPC), used by four espionage clusters, three assessed China-aligned, against fewer than 20 organizations. Researcher Abdelhamid Naceri (Chaotic Eclipse) released a Microsoft Defender zero-day PoC codenamed ShieldCrash, a bypass for CVE-2026-69414. Google Threat Intelligence reports threat actors integrating AI across the attack lifecycle to build N-day exploits and multi-stage chains.

The Hacker NewsSep 14, 14:40 UTC · 1d agoAI safety & security in the wildCVE-2026-85046 CVE-2026-87491 CVE-2026-85880+4 CVEs

Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts

Huntress says rogue ScreenConnect clients spread a four-stage VBScript chain delivering backdoors, privilege-escalation tools, or an XMRig miner to newly connected hosts.

Huntress identified three unrelated August 2026 incidents using a Quick Assist tech-support scam, a phishing-delivered MSI installer, and a fake Geek Squad refund form to install rogue ScreenConnect clients. Each client repeatedly spawned wscript.exe to run 1.vbs through 4.vbs, which profiled the host, enumerated installed security products, and downloaded stage-specific payloads from Dropbox. Depending on detected state, payloads included a user-level ScreenConnect backdoor, UAC-bypass privilege escalation tooling, or tunneling utilities with an XMRig cryptocurrency miner. Infected clients re-infected newly connected hosts, creating worm-like propagation, and ConnectWise issued an advisory about affected file transfer behavior in ScreenConnect.

The Hacker NewsSep 7, 11:36 UTC · 8d agoMalware in the wild