60
60
60
ClearFake Deploys Crypto Stealer That Uses Vulnerable Driver to Kill EDR Security Tools
Cisco Talos details ClearFake's fake-CAPTCHA chain deploying ZigCryptoStealer with a BYOVD attack that kills EDR processes, observed at a Ukrainian government organization in April 2026.
ClearFake compromises websites, injects JavaScript via a malicious Cloudflare Worker, retrieves instructions from BNB Smart Chain contracts (EtherHiding), and presents a fake Google CAPTCHA that tricks Windows users into pasting a command that loads a remote library over WebDAV via rundll32. The crypto-stealer branch uses DLL side-loading with a signed Chrome component to launch ZigCryptoStealer, which hijacks clipboard cryptocurrency addresses, alongside a signed but vulnerable Windows driver used in a BYOVD attack to terminate EDR processes. A parallel branch delivers Amatera secondary payloads that install a hidden remote-access client providing operator desktop control, with Cisco Talos tracking the remote-loader activity as UAT-10820. Talos observed unusual remote library execution at a Ukrainian government organization in April 2026 and assesses the attacks are part of a broader theft operation rather than a single targeted campaign.
62
Microsoft fixes actively exploited zero-day reported by the NSA (CVE-2022-24521)
60
60
Experts released VMware vRealize Log RCE exploit
60
60
60
Vulnerability landscape analysis for Q4 2024
60
60
60
60
Philippine Nuclear and Naval Targets Hit by Suspected Chinese Operator
Suspected Chinese-speaking operator breached Philippine nuclear research and naval supplier systems via ownCloud CVE-2023-49103 and WordPress CVE-2024-28000.
Hunt.io found an exposed staging server containing custom Python scripts, logs, and stolen data documenting intrusions against a Philippine nuclear research body and a marine engineering company serving the Philippine Navy. The actor exploited an ownCloud authentication bypass (CVE-2023-49103) using empty-secret pre-signed WebDAV URLs and a LiteSpeed Cache plugin flaw (CVE-2024-28000) to gain WordPress admin access, also guessing passwords against XML-RPC with rockyou.txt. Roughly 9 GB was referenced as stolen from the nuclear agency, including reactor databases, radiation-safety records, and staff passport data; Simplified Chinese labels suggest a Chinese-speaking operator.
72
60
60
60
Microsoft Issues Security Update Fixing 118 Flaws, Two Actively Exploited in the Wild
60
Microsoft Patch Tuesday for March 2023 — Snort rules and prominent vulnerabilities
60
Microsoft Patch Tuesday for January 2023 fixed actively exploited zero
60
Microsoft plugs actively exploited zero-day hole (CVE-2023-21674)
60
NSA Discovers New Vulnerabilities Affecting Microsoft Exchange Servers
60
60
Microsoft Patch Tuesday, January 2021 Edition
60
60
60
60
60
60
60
April 2026 CVE Landscape
60
Microsoft Patch Tuesday for April 2026
60
60
⚡ Weekly Recap: BadCam Attack, WinRAR 0-Day, EDR Killer, NVIDIA Flaws, Ransomware Attacks & More
60
Largest Patch Tuesday since July includes two exploited in the wild, three critical vulnerabilities
60
Microsoft Patches Two Zero Days This Month
60
Over 100 CVEs Addressed in First Patch Tuesday of 2023
60
Microsoft Releases Fix for New Zero
60
Microsoft Partch Tuesday for April 2022 fixed 10 critical vulnerabilities
60
60