End Point Security News and Articles

“Requiring prior administrative or code execution access, its installer injects the extension directly into Chrome/Edge profiles, bypassing Web Store checks and user prompts by forging Chromium’s own Secure Preferences integrity values,” SOCRadar said . Cybersecurity researchers have disclosed details of a complex Chromium-based post-exploitation toolkit called PEEP that masquerades as a bookmarks extension for the web browser. In Formula 1 speed is of the essence and team members need secure, but swift, access to data at all times. How the Anubis ransomware group stole and leaked an Italian Adriatic port authority’s data

Cybersecurity researchers have flagged two new malware families called WordlistLoader and SynkLoader that’s used to deliver next-stage payloads and likely sell access to ransomware groups. Cybersecurity researchers have found that several websites are still actively distributing a malware family known as Weedhack to gamers by masquerading as Minecraft clients. NemoClaw is NVIDIA’s open source reference stack for running agents such as OpenClaw inside its OpenShell sandboxes, and Ollama is one of its supported local inference backends. It impersonates Microsoft’s dpapi.dll, exporting the same seven data protection functions as the genuine system library, and carries a version resource copied from ESET Management Agent.

Jiří Vinopal, a threat researcher and reverse engineer at Check Point Research, presented the findings as a main-stage briefing at Black Hat USA 2026 and DEF CON 34 in Las Vegas and published the accompanying research paper alongside a proof-of-concept tool, BTR_CLI, on August 20, 2026. “The actor leveraged publicly disclosed vulnerabilities to gain initial access at scale,” Cisco Talos said in a two-part report published last week. Present within the VHD file is a Windows Shortcut (LNK) that mimics a PDF document. Two subsequent artifacts, each detected in June and July 2026, make use of a Virtual Hard Disk (VHD) file that activates the infection chain. Cybersecurity researchers have flagged a cyber espionage campaign targeting Myanmar that uses graduation ceremony invitation lures to deliver a Go backdoor called QUICAgent.

WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords

Microsoft did not disclose a victim count or attribute the activity to a named threat actor in the report published Tuesday. The tech giant said it required multiple endpoint and network behaviors to align before treating a domain as connected, including process ancestry, command-line patterns, request paths, headers, and upload parameters. “What makes SilkParasite interesting is the traces of AI-assisted development running through otherwise expert code, which is a different thing from AI-generated malware,” Bitdefender Labs said in a technical report shared with The Hacker News. A previously unreported cyber espionage operation dubbed SilkParasite has been observed targeting government bodies in Central Asia. Check Point Research said it found no evidence the technique has been used in real-world attacks.

Browse other Network Security topics

• “So if you want to test, you either have to add it to the exclusions or obfuscate the PoC and change the DLL load technique.” The PoC, the researcher added, works in a fully updated Windows 11 25H2 machine or Windows Server 2025 with CrowdStrike Falcon.
• The tech giant said it required multiple endpoint and network behaviors to align before treating a domain as connected, including process ancestry, command-line patterns, request paths, headers, and upload parameters.
• “The investigation also confirmed active data exfiltration, not just beaconing,” the company said.
• Russian cybersecurity vendor Kaspersky said it identified victims in Myanmar, Mongolia, Pakistan, and Russia, including confirmed government entities, with CoolClient consistently deployed as a secondary backdoor following a PlugX infection.
• The stealthy toolkit embeds a backdoor in HAProxy and targets automotive and media organizations in South Korea for long-term surveillance.
• Nothing malicious was installed, because nothing malicious was needed.

Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk. Security teams must treat autonomous agents as highly privileged identities. Catch promises the capabilities of a trusted executive assistant, with https://power-at-work.com/exploring-the-potential-of-blockchain-technology-in-ensuring-transparency-in-construction-equipment-maintenance/ built-in controls governing what data and systems it can access. The attacks rely on backdoored ScreenConnect instances to transfer and execute payloads to newly connected clients.

• Kaspersky has also published file hashes, paths, and C2 domains as indicators of compromise (IoCs).
• The threat actor known as HoneyMyte (aka Mustang Panda ) has been observed deploying an updated version of the CoolClient backdoor with a signed Windows kernel-mode rootkit that can hide and protect malicious processes, files, registry objects, and command-and-control (C2) network information.
• They account for 68.6% of the AI agents Token Security discovers in customer environments, and they often inherit the employee’s credentials, network position, and permissions.
• Microsoft did not disclose a victim count or attribute the activity to a named threat actor in the report published Tuesday.
• Cybersecurity researchers have disclosed details of a complex Chromium-based post-exploitation toolkit called PEEP that masquerades as a bookmarks extension for the web browser.

• According to the analysis , observed execution began from an interactive zsh Terminal session consistent with ClickFix social engineering, followed by curl retrieving attacker-controlled content over a recurring /curl/ path and na…
• NemoClaw is NVIDIA’s open source reference stack for running agents such as OpenClaw inside its OpenShell sandboxes, and Ollama is one of its supported local inference backends.
• Once installed, ValleyRAT (also tracked as Winos 4.0) hands the operator full control of the compromised machine.
• The technique assumes that an operator already has code execution on the Windows host and does not involve exploiting a Chrome or Edge security vulnerability.
• “Requiring prior administrative or code execution access, its installer injects the extension directly into Chrome/Edge profiles, bypassing Web Store checks and user prompts by forging Chromium’s own Secure Preferences integrity values,” SOCRadar said .

Google’s Chrome 152 security update resolves 12 vulnerabilities, including https://wapreview.mobi/computer-network-security-tutorial a high-severity type confusion flaw in the V8 engine. Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop. The designation applies when a model can independently find and exploit zero-day vulnerabilities across many well-defended systems. The StyleSmuggler zero-day allows attackers to execute code and deploy a stealthy backdoor on Adobe Commerce and Magento stores.