A vulnerability in Fortinet's fortimon3_74.sys kernel driver allows any local administrator to terminate protected processes, including Windows Defender and lsass.exe, by sending an 8-byte message to an unauthenticated communication port. This bypasses Protected Process Light (PPL) protections without requiring complex exploitation techniques. Additionally, a handle leak issue may enable credential theft by duplicating a handle to a protected process. The vulnerability requires local administrator privileges and affects the FortiClient anti-exploit minifilter driver.
Two sophisticated phishing campaigns employed browser-in-the-browser (BiTB) techniques to deceive victims into installing rogue ScreenConnect remote management tools. Attackers sent phishing messages with malicious links redirecting targets to fake Adobe Reader update pages. The BiTB technique created convincing fake browser windows within webpages, displaying legitimate-looking Adobe URLs to bypass user awareness training. Victims were tricked into downloading ScreenConnect installers disguised as Adobe software updates. Each incident resulted in deployment of multiple rogue ScreenConnect instances for redundant persistence, followed by execution of defense-evasion binaries (HideCursor.exe and HideUL.exe) designed to hide attacker activities. The attacks established service-based persistence through Windows services, enabling continued remote access. Both campaigns were intercepted before further damage occurred, demonstrating how threat actors combine social engineering throughout the entire attack chain...
This analysis examines a sophisticated Vidar infostealer variant that employs a custom virtual machine to obfuscate its malicious code through proprietary bytecode interpretation. The malware implements extensive anti-analysis measures including debugger detection via NtQueryInformationProcess and RDTSC timing checks, sandbox evasion by identifying antivirus processes and checking system resources, and environment fingerprinting. Vidar targets credentials from web browsers including Chromium and Gecko-based extensions, Azure authentication tokens, FileZilla FTP credentials, and captures screenshots. It utilizes SeDebugPrivilege for elevated access, creates hidden desktops for browser automation, and exfiltrates stolen data through Telegram channels. The malware performs cleanup operations to remove execution artifacts and proxies DLL execution through rundll32.exe to blend with legitimate Windows processes.
An issue in Actions Semiconductor Co. Ltd Tool- Media Player Utilities v.4.46 allows a physically proximate attacker execute arbitrary code via the Production.dll and RdiskUpgrade.exe components
The August 2026 Microsoft security update may cause recurring application errors (0xc0000409) on Windows Server 2016 systems where the Compatibility Appraiser diagnostic service is enabled. This issue affects both physical and virtual machines, including VMware and Azure environments. The CompatTelRunner.exe process crashes, generating event log warnings, but device functionality is not impacted. Microsoft acknowledges this as a known issue and recommends dismissing the event log warnings temporarily until a fix is released in a future update.
Acunetix 25.11.251107123 for Windows contains a local privilege escalation vulnerability in the Web Vulnerability Scanning Engine (wvsc.exe) that allows low-privileged local attackers to execute arbitrary code as SYSTEM by exploiting a missing hardcoded directory path for OpenSSL-related files. Attackers can create the missing directory, place a malicious file at the expected path, and cause the SYSTEM-level wvsc.exe process to load and execute it, resulting in full privilege escalation.
Since February 2026, there has been a resurgence of attacks abusing Node.js, targeting government, technology, and hospitality sectors. Attackers use the legitimate, signed node.exe binary to execute malicious JavaScript payloads, bypassing signature-based detection. Notable incidents include compromises of an Asian technology company and a U.S. fintech firm, involving advanced techniques such as EtherHiding and deployment of Rust-based backdoors linked to ransomware operations. Multiple attacks involve ModeloRAT, associated with initial access broker Woodgnat, connected to various ransomware families. Attackers combine living-off-the-land tactics with commodity malware and employ ClickFix techniques for initial access.
The npm package 'element-guci-util' is a malicious utility library that contains harmful code triggered on or after October 1, 2026. When imported, it executes code that fabricates a synthetic .exe file download, opens a malicious website, reloads the page repeatedly, and exhausts CPU and memory resources. The package metadata is suspicious, with placeholder author and repository fields and a self-referential dependency version mismatch that alters install resolution. Applications bundling this package will deliver the malicious payload to end users after the trigger date, resulting in forced downloads and redirects to attacker-controlled domains.
UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault data from process memory even after the application has been locked. Attackers can use the PROCESS_VM_READ permission to read the memory space of UpSignOn.exe and extract sensitive fields including entry names, URLs, usernames, passwords, TOTP secrets, and notes.
UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vault contents by reading a retained backup key from the process memory of UpSignOn.exe, even after the vault has been re-locked. Attackers can extract the backup key from process memory to decrypt the encrypted master password backup stored in v6-vault1.DATA.txt, then use the recovered master password to decrypt the main vault and export all password manager entries in cleartext.
A security issue exists within the Redundancy Module Configuration Tool. The RMConfigTool.exe binary searches directories in the system path for a required DLL, and one or more of these directories may be writable by standard (non-administrator) users due to incorrect default permissions. If a local attacker places a malicious DLL in such a directory and an administrator subsequently runs the tool, the malicious DLL is loaded into the elevated process and executes with Administrator/SYSTEM privileges.
A security issue exists within the Redundancy Module Configuration Tool. The RM3ConfigTool.exe binary searches directories in the system path for a required DLL, and one or more of these directories may be writable by standard (non-administrator) users due to incorrect default permissions. If a local attacker places a malicious DLL in such a directory and an administrator subsequently runs the tool, the malicious DLL is loaded into the elevated process and executes with Administrator/SYSTEM privileges.
SiYuan Windows installer before version 3.8.1 (affected versions >= 2.0.14) contains an uncontrolled search path element vulnerability in its NSIS installer, which invokes system executables such as TASKKILL by name rather than by absolute path. Because NSIS nsExec::Exec resolves these calls using a search path that includes the installer's own launch directory ahead of System32, an attacker who plants a malicious executable (e.g., a renamed TASKKILL.exe) in that directory can have it executed when the installer runs. These calls occur in electron-builder's preInit hook before the license page is displayed, and with an all-users (elevated) install the planted binary executes with an elevated token, resulting in local privilege escalation.
In July 2026, multiple APT campaigns targeted South Korean entities using spear phishing emails with malicious LNK files. Seven distinct attack types employed various techniques such as PowerShell scripts, AutoIt programs, DLL side-loading, and curl.exe downloads. Malware was distributed via platforms like GitHub, Google Drive, and Dropbox, disguised as legitimate documents or resumes. The campaigns deployed backdoors, infostealers, keyloggers, and XenoRAT malware to exfiltrate sensitive information and maintain persistence through Task Scheduler entries. Communication with command and control servers used PubNub channels with Base64-encoded data. The attacks focused on deceiving victims with work-related content to execute malicious payloads.
PaperCut has released an emergency patch for a zero-day vulnerability actively exploited in the wild affecting its NG and MF print management solutions. The vulnerability allows unauthenticated attackers to gain remote control over PaperCut's trusted configuration and execute arbitrary Java code within the application process. PaperCut urges users to install the emergency patches and implement mitigations such as disconnecting the application server from the internet and restricting access to trusted IPs. Indicators of compromise include suspicious activity related to pc-app.exe and truncated or deleted server.log files, suggesting attackers may attempt to cover their tracks. The vulnerability has been assigned CVE identifiers CVE-2026-81578 and CVE-2026-82078. The investigation is ongoing, and the attacker identity remains unknown. Approximately 1,000 PaperCut instances remain exposed to the internet, primarily in North America and Europe.
CodeMeter Runtime versions 8.40 up to but not including 8.41a and 9.00 up to but not including 9.10 contain a vulnerability where the cmu.exe process creates a predictable temporary file under C:\CM-Stick without properly checking for NTFS reparse points such as junctions or symbolic links. This improper link resolution can allow a local attacker to create a junction pointing to an arbitrary system path, potentially causing deletion of arbitrary files with System privileges and enabling local privilege escalation.
An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <= 3.5.0.173 allows a remote attacker to execute arbitrary code via the updater.exe for windows, PT.updd on MacOS components
The npm package chalk-util@1.0.0 is a typosquatting malicious package that executes harmful code during installation. Its postinstall script decodes and downloads a binary from an attacker-controlled URL, saving it as main.exe on Windows or executing it via PowerShell on Linux. It also sends a beacon with platform information to a hardcoded IP address over unencrypted HTTP. The package exports an empty object, with all malicious activity triggered by the postinstall lifecycle hook.
