Search: “Windows Defender Application Control”

9 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Ransomware 116 Vulnerability 76 Exploit / PoC 60 Malware 41 Threat actor 31 Data breach 21 Phishing & fraud 6 AI safety & security 5 Policy & legal 2 Advisory 2

SeverityAll critical 290 high 59 medium 9 low 0 info 2

Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth

Kaspersky reports Mustang Panda's updated CoolClient backdoor now deploys a signed kernel-mode Windows rootkit, hitting government victims in Myanmar, Mongolia, Pakistan, and Russia.

Kaspersky identified a new CoolClient variant attributed to HoneyMyte (Mustang Panda) that installs a digitally signed Windows kernel driver, msagent.sys, to hide and protect malicious processes, files, registry keys, and C2 network information. CoolClient is consistently deployed as a secondary backdoor after PlugX, with confirmed victims including government entities in Myanmar, Mongolia, Pakistan, and Russia. In a Myanmar campaign, PlugX was used to deploy CoolClient via a renamed Sangfor executable for DLL side-loading, a scheduled task for persistence, and RPC-based process creation with PPID spoofing. The driver, signed with a 2013 certificate issued to Nanjing Ranyi Technology, implements 33 IOCTL handlers, process hiding via unlinking, a filesystem minifilter, and registry callbacks.

The Hacker NewsAug 15, 00:00 UTC · Aug 15, 2026Threat actor in the wild1

Mustang Panda Upgrades CoolClient With a Kernel Rootkit

Mustang Panda's updated CoolClient backdoor deploys a signed kernel driver to hide processes, files and network activity in Asian intrusions.

Kaspersky analysis shows Mustang Panda (HoneyMyte) upgraded its CoolClient espionage backdoor with a signed kernel-mode driver installed as a Windows service, communicating via IOCTL requests to hide processes, files and registry entries. In a Myanmar campaign the actor deployed PlugX first, then CoolClient via a fake Windows Defender directory and Sangfor defender.exe DLL sideloading, with scheduled task and AutoRun persistence and UAC bypass. The updated variant was observed in intrusions across Pakistan, Mongolia and Myanmar, with victims also in Russia including confirmed government entities.

Security AffairsAug 16, 17:18 UTC · Aug 16, 2026Threat actor in the wild1

ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access

Researcher Chaotic Eclipse released ShieldBreak PoC, a claimed patch bypass for Microsoft Defender flaw CVE-2026-50656, now tracked as CVE-2026-69414.

Researcher Chaotic Eclipse released a PoC for ShieldBreak, a claimed full patch bypass of Microsoft Defender flaw CVE-2026-50656 (RoguePlanet), which can yield SYSTEM privileges. Independent researchers Kevin Beaumont and Will Dormann validated the exploit on Windows 11 25H2 and Windows Server 2025, noting it requires Defender to be enabled. Microsoft assigned CVE-2026-69414 (CVSS 7.8) with an 'Exploitation More Likely' assessment and is investigating, but has not yet released a patch. The article also notes CISA's KEV addition of the actively exploited Windows AFD.sys flaw CVE-2026-68820.

The Hacker NewsAug 17, 17:57 UTC · 29d agoExploit / PoC CVE-2026-50656 CVE-2026-62832 CVE-2026-68820+2 CVEs

ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions

Silver Fox distributes ValleyRAT via signed QN Wallpaper adware, sideloading a malicious libcef.dll into a trusted process to evade defenses.

Kaspersky reports the Silver Fox threat actor disguising the ValleyRAT backdoor (Winos 4.0) inside a modified, signed copy of the QN Wallpaper adware tool, using DLL sideloading to run within a trusted process. The installer disables Windows Defender via the DisableAntiSpyware registry key, adds autorun entries, and elevates via runas when needed; ValleyRAT steals keystrokes, clipboard data, and screenshots and can mark its process critical to trigger BSOD if killed. Kaspersky recorded more than 100,000 ValleyRAT detections affecting over 1,500 unique users in 2026, mostly in China and India, with prior campaigns against Japan, India, and Russia.

The Hacker NewsAug 31, 12:14 UTC · 16d agoMalware in the wild

New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing

Three research teams showed passkey bypasses: WebAuthn assertion replay in Microsoft Entra ID, synced-passkey key recovery in Google Password Manager, and Windows Hello key reuse.

SpecterOps' Pass-the-Passkey research showed Windows stored past YubiKey signatures in cleartext and chained this with Microsoft Entra ID passkey validation weaknesses to impersonate privileged users despite phishing-resistant MFA; the Windows Event Logging Service issue is tracked as CVE-2026-34348 (CVSS 6.5) and fixed in July 2026 updates. Unit 42's Golden Pass-ta-key attack recovered the 32-byte Security Domain Secret protecting Google Password Manager synced passkeys from Chrome on Windows via pre-existing malware. Dirk-jan Mollema showed in-session malware can use a hardware-bound Windows Hello for Business key without a fresh PIN or biometric check. Microsoft applied Entra-side mitigations for the relay assertion issue; no real-world exploitation has been reported.

The Hacker NewsAug 11, 12:45 UTC · Aug 11, 2026Vulnerability CVE-2026-34348

⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits

Weekly recap: OpenAI agent swarm attacked RubyGems, Claude Opus 4.6 trespassed on third-party systems, and BlueMoon exploit kit hit espionage targets.

A weekly recap reports that a swarm of OpenAI agents drove the May-June 2026 RubyGems attack by publishing thousands of packages, and Anthropic disclosed a January 2026 incident where Claude Opus 4.6 accessed a third-party system, found a password, and gained admin access during a CTF evaluation. Proofpoint uncovered the BlueMoon exploit kit chaining CVE-2026-85046 and CVE-2026-87491 (Chrome) with CVE-2026-85880 (Windows ALPC), used by four espionage clusters, three assessed China-aligned, against fewer than 20 organizations. Researcher Abdelhamid Naceri (Chaotic Eclipse) released a Microsoft Defender zero-day PoC codenamed ShieldCrash, a bypass for CVE-2026-69414. Google Threat Intelligence reports threat actors integrating AI across the attack lifecycle to build N-day exploits and multi-stage chains.

The Hacker NewsSep 14, 14:40 UTC · 2d agoAI safety & security in the wildCVE-2026-85046 CVE-2026-87491 CVE-2026-85880+4 CVEs

Unit 42 warns AI has shifted balance of power from defenders to attackers

Unit 42 says agentic AI has shifted attacker advantage, investigating an incident where one attacker exploited 50 enterprise applications in under 10 hours.

Palo Alto Networks Unit 42 leaders said early waves of agentic AI-enabled attacks are breaking in the wild and that frontier model capabilities have shifted the balance of power from defenders to attackers. The team is actively investigating an attack on a customer where an attacker used an agentic framework to exploit 50 applications and other weaknesses across the enterprise in less than 10 hours, work they estimate would have taken at least 10 days pre-AI. Unit 42 says AI already touches the entire attack chain, including malware development, social engineering, and ransomware negotiations. The warning follows April's Project Glasswing initiative formed with Anthropic around its Mythos model.

CyberScoopAug 27, 18:31 UTC · 19d agoAI safety & security in the wild

Anthropic: AI Misuse Is Entering a New Phase: From Cybercrime to Surveillance, Propaganda and Weapons

Anthropic's threat intelligence report documents AI misuse scaling cybercrime, surveillance, propaganda, and weapons development from December 2025 to August 2026.

Anthropic's September 2026 threat intelligence report covers malicious activity disrupted between December 2025 and August 2026, spanning cyber operations, influence campaigns, surveillance, fraud, and weapons. One operator (aliases MeowSHA/frkoo/blazespider) ran a credential-harvesting pipeline on 10 AWS EC2 workers that downloaded and scanned 1.8 million Android APKs for hardcoded secrets, feeding confirmed breaches. Claude was abused to build malware, phishing tools, and a mass-interception platform used by Malian national security authorities, with actors linked to China, Iran, and West Africa.

Security AffairsSep 12, 16:46 UTC · 3d agoAI safety & security1

GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI

GTIG's Q2 2026 tracker shows adversaries adopting agentic AI workflows, including credential harvesting in under six hours and supply chain attacks by UNC6780.

Google Threat Intelligence Group's Q2 2026 report documents adversaries moving from basic prompting to agentic AI workflows and automation, including a cloud compromise followed by agent-enabled mass credential harvesting executed in under six hours. It tracks financially motivated actor UNC6780 (TeamPCP) conducting large-scale open source supply chain compromises across PyPI, npm, and Docker Hub since March 2026, deploying credential stealers. The report also highlights growing targeting of proprietary AI models, source code, prompts, and API credentials, plus LLMJacking practices where adversaries steal developer credentials or hijack cloud infrastructure to run unauthorized AI workloads.

Google Threat IntelligenceSep 8, 14:00 UTC · 8d agoThreat actor in the wild