During August 2026, multiple APT campaigns targeted South Korean entities primarily through spear phishing attacks utilizing LNK files. Six distinct attack types were identified, employing various techniques including PowerShell scripts, AutoIt programs, and DLL side-loading. Type A used HEX data extraction with PubNub command and control, while Type B leveraged curl.exe to download HTA files from GitHub and Google Drive, deploying infostealers and keyloggers. Type C distributed XenoRAT malware via GitHub repositories. Type D used resume-themed lures with VBS, BAT, and PowerShell scripts for backdoor injection. Type E employed Python-based backdoors through disguised pythonw.exe executables. Type F exploited Hangul documents with embedded OLE objects for malicious DLL loading. Attacks focused on information theft, system control hijacking, and additional malware deployment.
Microsoft has released general availability of Linux container support in Windows Subsystem for Linux (WSL), enabling users to build, run, and deploy Linux containers directly on Windows. This new feature includes a command-line tool (wslc.exe) and an API for programmatic container management. It integrates with Microsoft Defender for Endpoint for enhanced security monitoring and with Microsoft Intune for administrative control over container usage. Additional features such as container restart, file copying, health checks, and network commands are now supported. Docker Compose-style support is in development. This release is a feature enhancement rather than a security vulnerability.
CVE-2026-102937 is an OS command injection vulnerability in pypa virtualenv versions prior to 21.7.12. The issue arises because BatchActivator.quote() returns prompt text unchanged before it is inserted into a Windows cmd.exe set command. An attacker who can influence the --prompt, VIRTUALENV_PROMPT, or related configuration can inject a double quote to break out of the intended assignment and execute arbitrary commands when the user activates the virtual environment. This vulnerability is fixed in version 21.7.12.
A vulnerability was found in FastStone Image Viewer up to 8.3. This affects an unknown function of the file FSViewer.exe of the component TGA Image Handler. The manipulation results in out-of-bounds read. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
The npm package chalk-figlet version 1.2.0 contains malicious code that executes during installation. It runs a postinstall script that downloads a binary named RuntimeBroker.exe from an untrusted HTTP source and executes it on the host system. The package masquerades as a harmless chalk and figlet wrapper but performs unauthorized code execution.
The npm package 'native-runner' contains malicious code that, upon import, silently waits for and executes a hidden binary named node_runtime_helper.exe from a Windows system-like directory. This behavior occurs as a side effect of requiring the package, without any explicit API call. The package depends on 'img-to-native', which places the malicious binary on the system. This drop-and-execute chain can lead to full system compromise, and removal of the package does not guarantee eradication of the malware.
The Psychedelic Stealer is an active malware campaign targeting Ukrainian small-business websites as of September 2026. It uses a fake Cloudflare CAPTCHA page to trick victims into manually running msiexec.exe commands, which install malware that steals browser credentials, session tokens, and cryptocurrency wallet data from wallets like MetaMask and Trust Wallet. The malware maintains persistence through browser extensions with native messaging and scheduled tasks, and communicates with a REST API for further commands. It employs signed Microsoft binaries and avoids encoded PowerShell scripts to evade detection. The campaign is financially motivated and specifically targets Ukrainian victims.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (ac3bbe97b41f8d8d1a74e9f369318620c08d648365a4e78d49d1da31d085531d)
package.json declares a postinstall lifecycle hook `wscript.exe 4444.vbs` that auto-runs on `npm install` on Windows. The bundled 4444.vbs is a ~674KB script containing large opaque base64 blobs and an AES key/IV pair (`stateFKK`, `manifestGCP`) which it uses at runtime to decrypt an embedded payload via `CreateDecryptor().TransformFinalBlock` and hand it to `C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe` for execution. After staging, the script self-cleans with `cmd.exe /c ping 127.0.0.1 -n 8 >nul & del /f /q... & rmdir /s /q...` to remove its own artifacts. Cover-story comments label the script a `Sync Agent — diagnostic telemetry collector` from a fictitious `Wingtip Toys Corporation`, but the code performs no telemetry-shaped behavior — it decrypts and executes an opaque payload. The package ships no other functionality; installing it on Windows results in arbitrary attacker code running under the installer's user account.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (5cb86188f9853b34c6dc3cf9c8259a789920326e8ddf4ae4cd3566385bba3ea1)
The package presents itself as a dotenv-style environment loader but ships a Windows dropper that fires automatically on module load and on CLI invocation. Both dist/index.cjs (the package main) and dist/cli.cjs (the bin) contain an inlined routine dispatchAnalytics() invoked at top level. That routine reads dist/stest.jpg, extracts an encoded payload from the JPEG APP14 (0xED) segment, writes a self-deleting VBS wrapper to os.tmpdir(), and launches it via wscript.exe to run powershell.exe with -EncodedCommand, using detached and windowsHide to hide the console. The strings 'powershell.exe', 'wscript.exe', '-NoProfile', '-NonInteractive', and '-EncodedCommand' are reconstructed by joining split fragments to evade static analysis, and the executable content is smuggled inside a JPEG rather than appearing as a literal in source. Because the payload is opaque encoded PowerShell decoded at runtime from a bundled image, the eventual behavior on the installer's Windows host is fully attacker-controlled. Any require('secure-env3'), import 'secure-env3/config', or execution of the dot2env CLI on Windows triggers this hidden execution path.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (43eddaf152e2aa60b9f823513a2d9b11fc424a5cff4bb3c031f6823a48dc2f4e)
package.json declares a postinstall hook `wscript.exe 4444.vbs` that fires automatically on `npm install`. The shipped 4444.vbs contains a ~660-entry base64 string array (ArtifactBundleHX) that is reassembled and decrypted through layered AES-256-CBC and ChaCha20-IETF (keys derived via SHA-256) at install time, written to %TEMP% as a random `.dat` file, and passed to powershell.exe as a two-tier loader for in-memory execution / process hollowing. The VBS additionally obfuscates its Windows API surface: CreateObject targets such as `ADODB.Stream` and `Msxml2.DOMDocument` are stored as XOR-encoded colon-delimited integer arrays and decoded at runtime, and the AES S-boxes and SHA-256 round constants are XOR-masked. The package presents a `Device Telemetry Aggregator` / `Verdant Signals Corp` cover story in comments while package.json ships empty author and description fields. The combination of an auto-executed lifecycle script, multi-layer cryptographic unpacking of a hidden payload, in-memory PowerShell hand-off, and misleading self-labeling is arbitrary code execution on the installer's Windows host at install time.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (f996c75c75423a57a64c1c89b04f2e1ba87674973dba2dd359df5b0937ffe3cf)
The package is a dotenv typosquat that runs a hidden Windows loader on every require() and on CLI startup. dist/index.cjs and dist/cli.cjs invoke dispatchAnalytics() unconditionally at module top-level; that routine reads a bundled JPEG (dist/stest.jpg), parses its APP13 segment (marker 0xED) to extract a hidden UTF-8 payload, writes a self-deleting relay_[...].vbs into os.tmpdir(), and spawns wscript.exe detached with windowsHide:true to launch powershell.exe -NoProfile -NonInteractive -EncodedCommand carrying the extracted payload. Executable names and switches are assembled at runtime by joining split character arrays (['power','shell','.exe'].join(''), ['-No','Profile'], ['-Non','Interactive'], ['-Encoded','Command'], ['wscript','.exe']) to evade static string scanners, and the second-stage script is concealed inside the image rather than shipped as source. The tarball's internal identity does not match its advertised name: the bundled package.json inside dist/cli.cjs declares name:'node-env-buffer' version 2.2.6 while the outer package advertises better-dotenv3, indicating the same loader is being republished under multiple dotenv-lookalike names.
MemGuard is a lightweight, open-source Python tool designed to detect and mitigate unauthorized LSASS memory access and credential dumping attempts on Windows endpoints. It audits handle tables to identify processes with suspicious access rights to lsass.exe, inspects process command lines for known LOLBin dumping techniques, and can freeze suspect processes to preserve forensic artifacts. The tool operates without dependencies, using native Windows APIs and kernel structures. It targets the MITRE ATT&CK technique T1003.001 (OS Credential Dumping via LSASS memory).
A threat actor exploited a path traversal vulnerability (CVE-2025-4632) in Samsung MagicINFO 9 Server to gain unauthorized access to endpoints. They deployed a rogue AnyDesk remote access tool, created a local administrator account, and disabled Microsoft Defender protections. Instead of deploying a pre-compiled cryptominer, the actor compiled a Monero cryptominer directly on the compromised endpoint using multiple compilers and utilities. The miner connected to the C3Pool mining service and ran under explorer.exe with suspicious arguments. This on-endpoint compilation generated significant endpoint detection and response (EDR) telemetry, increasing detectability despite attempts at stealth.
PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed instead, cscript.exe raises a 'Type mismatch' runtime error that includes the offending parameter value in plaintext. PRTG provides a documented placeholder variable, %windowspassword, which resolves to the configured Windows/domain password used by PRTG and can be passed as a sensor parameter.
Any PRTG user who is not restricted to read-only access and is permitted to create sensors (the default for non-read-only users) can pass %windowspassword as an argument to the demo VBScript sensor, triggering the type-mismatch error and causing PRTG to display the plaintext password in the sensor's error output.
This analysis covers infostealer distribution trends during August 2026, focusing on distribution channels, detection rates, and disguise techniques. Primary infostealers identified include Remus, Vidar, LummaC2, and ACRStealer, distributed through crack software disguises, SEO poisoning, and file-hosting platforms like Mega and Mediafire. Malware disguised itself as legitimate companies, with Microsoft Corporation being the most frequently impersonated. Distribution methods included DLL side-loading using python37.dll and python36.dll, and exploitation of Renpy game development tool. Email campaigns delivered Formbook disguised as Turkish bank statements and AgentTesla as business quote requests from Indian companies. EXE files constituted 97.3% of execution types. The stolen information poses risks for dark web trading and secondary attacks, emphasizing the need for cautious handling of untrusted links, avoiding illegal software, enabling two-factor authentication, and maintaining updated security soluti...
An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote attacker to execute arbitrary code via the biz_helper.exe component
Threat actors exploited trusted brands and cloud services in a sophisticated web campaign combining fraudulent DocuSign workflows, Florida healthcare screening lures, and deceptive cloud infrastructure to deploy ConnectWise ScreenConnect Access clients. The attack utilized Cloudflare Pages hosting with fake Cloudflare verification workflows to establish legitimacy. Victims were socially engineered to download a ZIP archive containing a malicious HTA file that employed Base64-encoded VBScript, fake Adobe interfaces, UAC privilege escalation, and Microsoft Defender SmartScreen registry modifications. The attack leveraged living-off-the-land techniques using native Windows tools like mshta.exe, curl.exe, and msiexec.exe for silent ScreenConnect installation, ultimately providing unauthorized remote access. The campaign was classified as Zero Hour Fraudulent and blocked at the web entry point before payload delivery could occur.
Cisco Talos disclosed a complex WebDAV infection chain linked to a Russian threat actor (UAT-10820) targeting a Ukrainian government organization. The campaign delivers the Amatera stealer along with secondary payloads such as ZigCryptoStealer and NetSupport Manager. This operation appears opportunistic and broad-based, focusing on cryptocurrency and credential theft rather than a highly targeted attack. Attackers use creative delivery and evasion techniques, including abusing legitimate infrastructure like the BNB Smart Chain for bulletproof hosting and fake CAPTCHA prompts to bypass web filters. Secondary payloads include a vulnerable driver to terminate endpoint detection and response (EDR) software and unauthorized remote access tools, enabling persistent control over infected systems. Security teams are advised to monitor for unusual WebDAV activity and suspicious DLL execution via rundll32.exe ordinal calls, educate users about fake verification prompts, and ensure endpoint solutions have robust memory scanning capabilities. No patch information is provided for this threat. The disclosure also includes a broader discussion on cybersecurity workforce mental health but is unrelated to the technical threat.
In June 2026, a new malware family named SloppyRAT was identified, likely used by ransomware-related threat actors to establish footholds for lateral movement. Delivered through multi-stage ClickFix infection chains, the malware features encrypted code blocks, EtherHiding for command-and-control resolution via Polygon JSON-RPC protocol, and multiple anti-analysis techniques including junk code and indirect system calls. SloppyRAT implements certificate pinning to prevent TLS traffic inspection and includes 47 built-in PowerShell-like commands for remote access. The infection chain uses finger.exe, IronPython, and deploys CastleLoader and CastleRAT components before installing SloppyRAT. Despite sophisticated capabilities, the codebase contains numerous software bugs affecting persistence mechanisms and other features, suggesting active development.
