Other noteworthy stories that might have slipped under the radar: Jones Day hacked, Internet Bug Bounty program paused due to AI, new Mac stealer malware. The post In Other News: Cyberattack Stings Stryker, Windows Zero-Day, China Supercomputer Hack appeared first on SecurityWeek .
Two malicious versions of the popular SDK were uploaded to the PyPI registry, targeting Windows, macOS, and Linux. The post Telnyx Targeted in Growing TeamPCP Supply Chain Attack appeared first on SecurityWeek .
Insikt Group identified five distinct clusters using the ClickFix social engineering technique for initial access. These clusters impersonate various services like Intuit QuickBooks and Booking.com, demonstrating operational variance but similar core techniques. ClickFix manipulates victims into executing malicious commands within native system tools, bypassing traditional security controls. The methodology has become a standardized template for cybercriminals and APT groups. Campaigns target diverse sectors and use sophisticated obfuscation and living-off-the-land tactics. Defenders are advised to implement aggressive behavioral hardening and user awareness training to mitigate these threats.
A recent cybercrime campaign uses compromised WordPress websites to distribute the Vidar infostealer malware to Windows users. The attack employs fake CAPTCHA pages that trick victims into running malicious commands. The infection chain involves an HTA script, which downloads and executes a malicious MSI installer. This installer then deploys a GoLang loader that ultimately decrypts and loads the Vidar infostealer into memory. The campaign targets users in multiple countries, including Italy, France, the United States, the United Kingdom, and Brazil. The attackers inject malicious code into WordPress sites, which filters visitors and displays the fake CAPTCHA page to Windows desktop users.
Fake CAPTCHA pages instruct victims to paste malicious commands in the Windows Terminal instead of the Run dialog. The post ClickFix Attack Uses Windows Terminal to Evade Detection appeared first on SecurityWeek .
Explaining how the browser-in-the-browser phishing technique works, why fake login windows look just like the real thing, and the red flags that can help you identify a scam page.
Using Windows shortcut files, the APT deployed a new implant, a loader, a propagation tool, and two backdoors. The post North Korean APT Targets Air-Gapped Systems in Recent Campaign appeared first on SecurityWeek .
A malicious npm package named "ambar-src" reached 50,000 downloads in days before being removed from the registry. It uses a preinstall script to execute malicious code during installation, targeting Windows, Linux, and macOS systems. The package employs detection evasion techniques and deploys powerful open-source malware variants. It abuses npm's preinstall script hook to trigger the payload without explicit invocation. The malware fetches additional payloads from remote servers and uses Yandex Cloud for command and control. Affected systems should be considered fully compromised, requiring immediate incident response actions. The attack highlights the speed at which supply chain risks can propagate and confirms that npm install is a high-risk action.
Trend Micro has released patches addressing eight critical and high-severity vulnerabilities in its Apex One endpoint security products for Windows and macOS. These vulnerabilities could potentially allow attackers to compromise endpoint systems, impacting confidentiality, integrity, and availability. Although no known exploits are currently reported in the wild, the critical severity indicates a significant risk if left unpatched. Organizations using Apex One on Windows and macOS should prioritize applying these patches promptly to mitigate potential attacks. The threat primarily affects environments where Trend Micro Apex One is deployed, which includes enterprises globally. Due to the critical nature and the broad deployment of these endpoint products, the risk spans multiple sectors and regions. Immediate remediation is essential to prevent exploitation that could lead to unauthorized access or disruption of endpoint security functions.
This analysis examines the GetProcessHandleFromHwnd API in Windows, focusing on its implementation changes and security implications. Originally introduced in Windows Vista, the API attempts to obtain a handle to a process owning a specified window handle (HWND). Early versions used a windows hook technique to duplicate process handles, but modern Windows 11 implementations use a kernel-mode function to open process handles directly. The API's documented security properties contain inaccuracies, particularly regarding UIAccess requirements and user integrity levels. The analysis highlights that the API can be used in certain UAC bypass scenarios, such as with Quick Assist, even when processes run under different user contexts.
A malicious fork of the MacOS app Triton was discovered on GitHub, containing Windows-targeted malware disguised as the legitimate application. The attacker modified the repository, redirecting download links to a ZIP file hosting the malware. Analysis revealed sophisticated evasion techniques, anti-analysis features, and potential cryptocurrency functionality. The low detection rate and peculiar implementation suggest either an amateur attempt or a possible AI-generated attack. The incident highlights broader concerns about GitHub's security practices and Microsoft's priorities, prompting a call for developers to consider alternative code hosting platforms that better align with open-source values and user privacy.
In 2022 (time flies!), I wrote a diary about the 32-bits VS.64-bits malware landscape[1]. It demonstrated that, despite the growing number of 64-bits computers, the "old-architecture" remained the standard. In the SANS malware reversing training (FOR610[2]), we quickly cover the main differences between the two architectures. One of the conclusions is that 32-bits code is still popular because it acts like a comme denominator and allows threat actors to target more Windows computers. Yes, Microsoft Windows can smoothly execute 32-bits code on 64-bits computers. It is still the case in 2026? Did the situation evolved?
LockBit 5.0, the latest version of the notorious ransomware, has been released with support for Windows, Linux, and ESXi systems. This update brings improved defense evasion, faster encryption, and enhanced modularity. The Windows variant employs extensive anti-analysis techniques, while Linux and ESXi versions remain unpacked. All variants share a common encryption scheme using XChaCha20 and Curve25519. LockBit 5.0 demonstrates a focus on enterprise and infrastructure targets, including explicit support for Proxmox virtualization. The group's data leak site reveals a primary focus on the U.S.business sector, with victims spanning various industries. LockBit's infrastructure has shown connections to SmokeLoader, suggesting possible cooperation or infrastructure reuse among malware operators.
Windows will have runtime safeguards enabled by default, ensuring that only properly signed software runs. The post Microsoft to Enable ‘Windows Baseline Security’ With New Runtime Integrity Safeguards appeared first on SecurityWeek .
WSL or “Windows Subsystem Linux”[1] is a feature in the Microsoft Windows ecosystem that allows users to run a real Linux environment directly inside Windows without needing a traditional virtual machine or dual boot setup. The latest version, WSL2, runs a lightweight virtualized Linux kernel for better compatibility and performance, making it especially useful for development, DevOps, and cybersecurity workflows where Linux tooling is essential but Windows remains the primary operating system. It was introduced a few years ago (2016) as part of Windows 10.
After a decade and a half of service, the current certificates will expire, and new ones will be rolled out. The post Microsoft to Refresh Windows Secure Boot Certificates in June 2026 appeared first on SecurityWeek .
The next major Windows Server and Windows releases will have the deprecated authentication protocol disabled by default. The post Microsoft Moves Closer to Disabling NTLM appeared first on SecurityWeek .
