Threats Tagged 'windows'

Microsoft's August 2026 Patch Tuesday addresses 421 vulnerabilities across multiple products, including 62 critical issues. Among these, one vulnerability (CVE-2026-68820) has been exploited in the wild and involves an elevation of privilege via a Use After Free in the Windows Ancillary Function Driver for WinSock. The update also includes several high-severity remote code execution vulnerabilities affecting Windows Deployment Services, SharePoint Server, DHCP Server, Microsoft Excel, Microsoft Office, and others. Some elevation of privilege vulnerabilities affect Azure services. Microsoft has released patches for these issues as part of the monthly update.

A use-after-free in the afd.sys Windows kernel-mode driver has been exploited to gain SYSTEM privileges. The post August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day appeared first on SecurityWeek .

Microsoft released the Windows 10 KB5120249 cumulative update for versions 22H2 and 21H2 as part of the August 2026 Patch Tuesday. The update addresses security vulnerabilities and bugs, including a fix for File History backup failures to network shares due to invalid credentials and expands the rollout of new Secure Boot certificates. This update is mandatory and improves device security by increasing coverage for Secure Boot certificate deployment. No new issues have been reported with this update so far.

This month we got patches for 418 vulnerabilities. Of these, 62 are critical, 1 is being exploited in the wild, and 2 were publicly disclosed as zero-days. Notable fixes include Windows privilege escalation, container tampering, and critical QUIC and DNS Server remote code execution bugs.

Microsoft released cumulative updates KB5121003 and KB5120240 for Windows 11 versions 25H2/24H2 and 23H2 as part of the August 2026 Patch Tuesday. These updates address security vulnerabilities, fix bugs, and introduce new features and improvements across various components such as File Explorer, Windows Search, Voice Access, Widgets, and Windows Hello. The updates include security patches for approximately 400 vulnerabilities discovered in previous months. No known exploits in the wild have been reported for these vulnerabilities. Users are encouraged to install the updates via Windows Update or manually from the Microsoft Update Catalog.

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Files built with the polyglot technique have been showing up more and more in cyberattacks in recent years. They let attackers slip malware past email filters and file scanners, deceive victims in phishing attacks, and complicate incident investigations. To pull this off, attackers deliberately construct a file that a system can interpret as different formats depending on which application opens it. A classic example is a file that can be handled as a PNG image or a ZIP archive. All it takes is changing the file’s extension, or simply using one or another application to open it. Let’s take a look at why it’s even possible to create files like this, which format combinations have turned up in real-world attacks, and how organizations can protect themselves from this threat. Why polyglot files are possible The data formats behind polyglot files are seldom exotic. It all comes down to a clever combination of common formats that happen to be structurally compatible. Polyglots exploit at least one of the following quirks in certain file formats: Most file formats need decoding from the very first byte, but some require to read them from the end. The clearest example is a ZIP archive: a corrupted or missing beginning doesn’t stop applications from reading the file, because all the needed headers actually sit at the end. This lets attackers simply glue two files together — in the example above, a PNG and a ZIP. The beginning reads as a valid PNG image, while the end reads as a valid ZIP archive. Many formats work like Russian matryoshka nesting dolls: despite outwardly having a specific extension matching its intended usage, inside the file is essentially a ZIP archive containing the necessary data. This group includes modern office documents (DOCX/XLSX/PPTX), Android installation packages (APK), Java library files (JAR), and many others. Some formats have no strict structural requirements — or their requirements are loose enough that the application that’s processing the file can locate the fragment it needs even when that fragment isn’t at the beginning. The Polydet GitHub repository describes numerous examples of possible file combinations for building a polyglot. Under the MITRE classification, this technique falls under the Masquerading category ( T1036.008 , Masquerade File Type). Examples of polyglot files in known cyberattacks Publicly available malware campaign analyses reveal all kinds of polyglots. Attackers adapt the entire attack scenario to fit a specific file type combination. The Head Mare group delivered the PhantomPyramid malware as a ZIP attachment. The file consisted of Windows executable code (EXE) with a small ZIP archive glued onto the end. When the victim opened the archive, it contained a file with the extension PDF.LNK, which would then launch that same polyglot attachment — this time as an executable file. In the attack documented by JPCERT , attackers created a file that started as a PDF and was detected as a PDF by most scanners but carried a DOC extension and opened in Office applications as a valid DOC file containing malicious macros. The attacks spreading the StrRAT and Ratty Trojans used a polyglot built from a signed Windows installer package (MSI) with malicious Java code (JAR) tacked onto the end. The StrelaStealer attacks used a polyglot with an HTML extension: a Windows library (DLL) with a decoy HTML document glued onto the end. A shortcut in the archive launched the file twice: once via the start command (the equivalent of a double-click, which opened a browser showing the HTML document), and once via rundll32 (which launched the malicious DLL). In a simulated but elegant attack, researchers joined two ordinary ZIP files together and found that different popular archive tools displayed the combined file differently: some showed only the first archive, some only the second, and some showed both at once as if it were a single archive with shared contents. If the attacker is familiar with the vic…

The installer for LINE for Windows provided by LY Corporation insecurely loads Dynamic Link Libraries.

Have you ever tried to open an “encrypted” email or an urgent document, only to realize with horror that your usual DOCX attachment is actually a file with the extension .docx.exe? Or maybe you received an email supposedly with an invoice, contract, or internal memo attached — only for the file to prove something entirely different from what it claimed to be? If so, you were likely targeted in a malware infection attempt. Cybercriminals routinely disguise malicious files as harmless documents and archives, banking on recipients blindly clicking without checking the extension. Kaspersky experts analyzed the file formats most frequently deployed in malicious email blasts to reveal what really lurks behind these extensions — and how attackers weaponize them in their campaigns. Important note: the extensions we’ll be discussing here are routinely used for completely legitimate files. For example, Windows executables normally end in .exe. However, we’re focusing specifically on scenarios where attackers disguise or spoof a file’s extension to pass it off as a totally different type of file. What extensions are most commonly found in malware? Our experts analyzed malicious email blasts from the beginning of 2026 to pinpoint the 15 most common dangerous file extensions. .exe .js .html .dll .bat .vbs .xls .pdf .jse .au3 .docx .htm .wsf .scr .lnk The top 15 file extensions used in malicious email blasts Let’s take a look at what files with these extensions actually do under the hood. Executable files An executable file is a compiled computer program that’s ready to run. Once launched, a malicious executable can download additional payloads, alter system settings, steal user data, connect your device to external attacker-controlled servers, and much more. These are the most common executable extensions found in malicious email campaigns: .exe .dll .com .scr .exe The classic Windows executable extension. It powers every program you use daily, from web browsers and games to office suites and software installers. By the way, attackers often wrap EXE malware in double extensions: invoice.docx.exe, report.pdf.exe, or even photo.jpg.exe. They take advantage of a default Windows setting: hiding extensions for known file types. Because this setting is turned on by default, users only see the first part of the file name — invoice.docx, report.pdf, or photo.jpg — and assume it’s just a normal document or image. But the second you open this trap file, the malware fires up. .dll Another common extension abused in malicious campaigns is .dll (dynamic-link library). These libraries hold functions that Windows programs frequently require while running, such as printing a document. This modular architecture prevents redundant code by letting multiple applications call on the exact same library for specific tasks. However, if an attacker replaces a legitimate library with an infected one, running any normal program that calls on it can trigger malicious code. .com While files with the .com extension have absolutely nothing to do with the web domain of the same name, cybercriminals likely count on victims mistaking these files for links in an unusual format. In reality, it’s a legacy Windows executable format. While modern versions of Windows no longer rely on this file type, the operating system can still run and execute it, which makes opening one a very bad idea. .scr SCR files are screensavers — those idle Windows screen animations featuring abstract patterns, the iconic bouncing logo, or whatever else. Despite their harmless reputation, screensavers are essentially executables just like EXE files: once opened, they can install extra components or alter system settings all the same. In malicious campaigns, these files routinely masquerade as images, screenshots, or documents. Scripts Scripts are text files containing a sequence of commands that a computer runs automatically in order. They can download files, install and launch programs, modify securi…

In this article What is device isolation? Case study: QNET Attack chain overview MITRE ATT&CK techniques observed References Learn more Microsoft Defender’s attack disruption now includes device isolation, a new response action that extends autonomous protection directly to compromised endpoints. At QNET, an attacker initiated a multi-stage attack using a legitimate Windows tool on a compromised endpoint to retrieve a malicious remote payload–a classic living-off-the-land (LOL) technique that often evades traditional containment. By automatically enforcing the new device isolation action on the compromised endpoint, Defender attack disruption stopped the attack dead in its tracks. From the first high-severity alert to completed isolation, after only 128 seconds, Defender cut off the attack chain before the second-stage payload could establish persistence or move beyond the host. The growing threat: when the endpoint is the blast radius Attack disruption has proven highly effective at stopping multistage, cross-domain attacks by disrupting the attacker’s ability to move across the environment. In many identity-driven attack scenarios, containing the compromised user is enough to shut down the attack chain, preventing lateral movement and limiting the attacker’s ability to access additional systems, identities, and resources. However, we are increasingly seeing a different class of high-severity incidents that begin with initial access directly on the device. Once adversaries establish a foothold on an endpoint, they can plant multiple persistence mechanisms and continue operating locally on the machine. This means that acting against the user’s identity alone is no longer enough to dismantle the threat. In these scenarios, the attacker has multiple ways to communicate and operate on the device beyond the user entity; the malicious code is already executing locally on the machine. The attacker doesn’t have to move laterally immediately; they can establish persistence, steal credentials, inject into processes, and prepare follow-on stages directly from the compromised endpoint itself. Previously, stopping these attacks required manual triage and response, giving attackers time to advance. Device isolation closes this gap by automatically correlating signals, assessing the threat, and isolating the compromised device within seconds. Traditional response approaches often depend on static playbooks triggered by individual alerts and maintained through manual tuning. Attack disruption instead uses AI-driven correlation and real-time analysis to identify multi-stage attacks by connecting signals across the environment before taking action. Device isolation is enforced only when the disruption pipeline reaches a high-confidence verdict—a threshold maintained at 99% precision. What is device isolation? When Microsoft Defender determines with high confidence that an endpoint is compromised, it isolates the device to immediately stop attacker activity and reduce the risk of further impact, such as data exfiltration and lateral movement. What happens during device Isolation When a device is isolated, all external network connectivity is blocked while maintaining access to required security services like Microsoft Defender for Endpoint. Selective isolation is supported, allowing customer-defined services or exclusions to continue functioning. Automatic device isolation is scoped to the affected device (supported today on onboarded MDE workstations), time-limited, and operator-controlled. Security teams can review context, take follow-up actions, and manually release isolation when it’s safe to do so. Why it matters Device isolation is a powerful containment control because it disrupts the attack regardless of how the device was compromised or what the attacker planned to do next. A single action cuts off network access, breaking lateral movement, command and control, credential theft, and rapid encryption–effectively stopping hands-on activ…