Microsoft Edge has identified and mitigated a critical threat exploiting its Internet Explorer (IE) compatibility mode, closing off high-risk entry points and reinforcing security for both individual and enterprise users. Although the web has largely embraced modern standards, many enterprise and government applications continue to rely on legacy technologies such as ActiveX controls and Flash. […]
A recent analysis from researcher Itamar Hällström has revealed the technical workings and forensic trail of “EDR-Freeze,” a proof-of-concept technique that temporarily disables security software.
By abusing legitimate Windows components, this method can place Endpoint Detection and Response (EDR) and antivirus (AV) processes into a temporary, reversible coma, allowing attackers to operate undetected.
How EDR-Freeze Pauses Security Tools
The EDR-Freeze technique cleverly misuses the Windows Error Reporting (WER) system to achieve its goal.
Unlike many evasion tools that rely on bringing a vulnerable driver (BYOVD) to gain kernel-level privileges, this method operates entirely from user mode.
The attack is initiated by the EDR-Freeze tool, which launches a legitimate, signed Microsoft executable, WerFaultSecure.exe. This helper process is instructed to generate a minidump of a target security process, such as Windows Defender’s MsMpEng.exe.
EDR Freeze Tool Targets Security Process
A key side effect of the minidump creation process, which leverages DbgHelp's MiniDumpWriteDump function, is that it suspends all threads in the target process.
The EDR-Freeze tool exploits this behavior, initiating the dump but holding it in a suspended state for a configurable period, effectively pausing the EDR without crashing it.
Once the specified time elapses, the operation is cleanly aborted, and the security process resumes normal function, leaving minimal traces in standard logs.
Uncovering The Forensic Artifacts
Despite its stealthy nature, the EDR-Freeze technique leaves behind distinct artifacts in a system’s memory. A forensic investigation of a memory image can uncover the entire chain of events.
Analysis tools can identify the suspended threads within the target EDR process and correlate their creation times with the activity of the WerFaultSecure.exe helper process. Investigators can also examine process handles, which act as permissions.
Forensic Artifacts
The WerFaultSecure.exe process will hold a handle to the EDR process with specific access rights, including PROCESS_SUSPEND_RESUME, which is a strong indicator of its purpose.
Command-line arguments also provide crucial evidence, showing the EDR-Freeze tool passing the target process ID (PID) to WerFaultSecure.exe.
Furthermore, the technique creates transient files, such as t.txt, during its operation. Although these files are deleted upon completion, their presence in a memory dump serves as a valuable forensic lead, Itamar Hällström said.
Detection Strategies
Defenders can proactively hunt for this activity using custom detection rules. YARA rules have been developed to identify both the EDR-Freeze binary itself and its behavioral patterns in memory.
A binary-focused rule can look for a combination of strings related to the WerFaultSecure.exe command-line flags and API imports for process manipulation, such as CreateFileW and CreateEventW.
A second, behavior-focused rule can scan system memory for a cluster of suspicious indicators, such as privilege escalation APIs and process suspension functions being used together.
This investigation highlights a critical evolution in attacker tradecraft: instead of killing security tools, they can simply pause them. This demonstrates that even Protected Process Light (PPL) processes can be manipulated, turning trusted system components into weapons.
Detecting these attacks requires defenders to move beyond endpoint alerts and incorporate memory forensics into their incident response workflows.
A significant security flaw has been discovered in Happy DOM, a popular JavaScript DOM implementation, affecting versions up to v19.
This vulnerability places systems at risk of Remote Code Execution (RCE) attacks, potentially impacting the package’s 2.7 million weekly users.
The flaw arises because the Node.js VM Context used by Happy DOM is not a completely isolated environment, which can allow untrusted code to escape and gain access to the underlying system’s functionalities.
The primary issue is that Happy DOM has JavaScript evaluation enabled by default, a detail that may not be apparent to all developers using the library.
This default configuration becomes a security risk when the environment executes untrusted code. An attacker can craft malicious JavaScript that traverses the constructor chain to access the process-level Function constructor.
This allows them to execute code outside the intended sandboxed environment, leading to a full VM escape.
The type of module system in use CommonJS or ESM determines the extent of the attacker’s control. In a CommonJS environment, an attacker can access the require() function, which allows them to load Node.js modules and perform unauthorized actions.
Potential Attack Scenarios
The implications of this vulnerability are far-reaching, especially for applications that use Server-Side Rendering (SSR) or testing frameworks that process external content.
An attacker could inject a malicious script into user-controlled HTML, which would then be executed on the server. Successful exploitation could lead to several damaging outcomes:
Data Exfiltration: Gaining access to sensitive information like environment variables, configuration files, and other secrets.
Lateral Movement: Using network access to connect to other internal systems. Although Happy DOM has some network protections, a compromised process could bypass them.
Code Execution: Obtaining child process access to run arbitrary commands on the server.
Persistence: Modifying the file system to maintain a long-term presence on the compromised system.
Mitigations
The developers of Happy DOM have released a patched version to address this vulnerability. Users are strongly advised to take immediate action to protect their systems.
The recommended course of action is to update to Happy DOM v20 or newer. This updated version disables JavaScript evaluation by default and includes a warning if it is enabled in what is considered an insecure environment.
For users who require JavaScript evaluation, it is crucial to run Node.js with the --disallow-code-generation-from-strings flag.
This setting prevents the use of eval() and Function() at the process level, closing the loophole that allows for the VM escape.
If an immediate update is not feasible, developers should disable JavaScript evaluation manually unless the content being processed is from a completely trusted source.
North Korean threat actors have escalated their Contagious Interview campaign, deploying 338 malicious npm packages with over 50,000 downloads to target cryptocurrency and blockchain developers through sophisticated social engineering tactics. The state-sponsored operation represents a significant evolution in supply chain attacks, utilizing more than 180 fake personas and a dozen command and control endpoints to […]
Malware campaigns distributing the RondoDox botnet have expanded their targeting focus to exploit more than 50 vulnerabilities across over 30 vendors.
The activity, described as akin to an “exploit shotgun” approach, has singled out a wide range of internet-exposed infrastructure, including routers, digital video recorders (DVRs), network video recorders (NVRs), CCTV systems, web servers, and
Microsoft said it has revamped the Internet Explorer (IE) mode in its Edge browser after receiving “credible reports” in August 2025 that unknown threat actors were abusing the backward compatibility feature to gain unauthorized access to users’ devices.
“Threat actors were leveraging basic social engineering techniques alongside unpatched (0-day) exploits in Internet Explorer’s JavaScript
A sophisticated new malware campaign targeting Windows systems has emerged, leveraging Node.js Single Executable Application (SEA) features to distribute malicious payloads while evading traditional detection mechanisms.
The Stealit malware represents a significant evolution in malware-as-a-service operations, combining advanced obfuscation techniques with extensive anti-analysis capabilities to establish persistent control over infected systems.
The campaign has been observed distributing disguised installers for popular software including games and VPN applications through file-sharing platforms like Mediafire and Discord.
These malicious packages utilize PyInstaller bundling and compressed archives to conceal their true nature, making initial detection challenging for users and security solutions.
Stealit homepage (Source – Fortinet)
The malware’s operators have established a commercial infrastructure complete with subscription pricing models, promotional channels, and customer support services.
Stealit subscription pricing (Source – Fortinet)
Fortinet analysts identified this active campaign following a spike in detections of Visual Basic scripts used for persistence mechanisms.
The threat represents a departure from earlier Stealit variants that relied on Electron frameworks, now adopting Node.js native SEA functionality to create standalone binaries that execute without requiring pre-installed Node.js runtimes or additional dependencies.
The malware demonstrates sophisticated evasion capabilities through multiple detection layers targeting virtual environments, debugging tools, and analysis platforms.
A promotional post on StealIt’s Telegram channel (Source – Fortinet)
These anti-analysis checks examine system specifications including memory allocation, CPU core counts, and hostname patterns to identify potential research environments.
The campaign operators maintain an active command-and-control infrastructure through domains like iloveanimals[.]shop, providing centralized management for compromised systems.
Technical Implementation and Execution Flow
The Stealit malware employs a multi-layered architecture beginning with an installer component that downloads additional modules from its command-and-control servers.
The initial payload utilizes Node.js SEA functionality to embed malicious scripts within seemingly legitimate executable files, with the core script stored as raw data resource NODE_SEA_BLOB containing both execution code and original development paths.
The installer implements extensive anti-analysis measures including virtual environment detection through system resource verification, timing analysis for mathematical operations, and process enumeration to identify debugging applications.
Registry checks examine locations like HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug for debugger configurations, while DLL injection analysis reviews loaded modules for analysis-related libraries.
Upon successful environment validation, the malware establishes persistence through multiple mechanisms including Visual Basic scripts placed in Windows startup folders and PowerShell commands to exclude directories from Windows Defender scanning.
The system downloads three core components: save_data.exe for privileged operations, stats_db.exe for data extraction, and game_cache.exe for command-and-control communication.
The save_data component deploys ChromElevator-based tools for extracting information from Chromium browsers, while stats_db.exe targets extensive application categories including gaming platforms like Steam and Minecraft, messaging services like WhatsApp and Telegram, and cryptocurrency wallets including Atomic and Exodus.
The game_cache module handles remote access trojan functionality including screen capture, webcam access, file manipulation, and command execution capabilities.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
Microsoft has successfully addressed one of Windows 11’s most frustrating issues with its latest preview builds, finally fixing the notorious “update and shut down” glitch that has plagued users since the operating system’s 2021 launch. This persistent bug tricked countless users into believing their computers were powering down when updates were pending, only to discover […]
A critical security vulnerability has been discovered in Happy DOM, a popular JavaScript library used for server-side rendering and testing frameworks. The flaw, tracked as CVE-2025-61927, enables attackers to escape the virtual machine context and execute arbitrary code on affected systems, potentially compromising millions of applications worldwide. Critical VM Context Escape Vulnerability Happy DOM versions 19 […]
Cybersecurity researchers have uncovered a sophisticated new campaign targeting WhatsApp users in Brazil with self-propagating malware designed to steal banking credentials and cryptocurrency exchange login information. The attack, first detected on September 29, 2025, represents a dangerous evolution in social engineering tactics that exploits users’ trust in familiar contacts to spread malicious payloads across messaging […]
.webp)
.webp)
.webp)