A sophisticated malvertising campaign has been uncovered targeting unsuspecting users through “dangling commits” in a legitimate GitHub repository. Attackers are injecting promotional content for a counterfeit GitHub Desktop installer into popular development and open-source projects. When users download what appears to be the genuine client, the installer quietly delivers malicious payloads in the background, compromising […]
A new kernel address leak vulnerability has been discovered in the latest versions of Windows 11 (24H2) and Windows Server 2022 (24H2).
The flaw, identified as CVE-2025-53136, was ironically introduced by a Microsoft patch intended to fix a separate vulnerability, CVE-2024-43511.
According to Crowdfense, the new bug undermines recent security enhancements in Windows, providing a reliable method for attackers to bypass Kernel Address Space Layout Randomization (KASLR), a critical defense mechanism.
In recent updates, particularly starting with the 24H2 versions of Windows 11 and Windows Server 2022, Microsoft took significant steps to harden the operating system kernel against attacks.
The company restricted access to kernel base addresses by limiting functions like NtQuerySystemInformation().
This change meant that only highly privileged processes could retrieve this information, effectively neutralizing a common technique used by attackers to bypass KASLR and making it much harder to exploit kernel vulnerabilities.
However, analysis of the October 2024 patch for CVE-2024-43511, a Time-of-check Time-of-use (TOCTOU) race condition vulnerability, revealed a critical error.
In fixing the original bug, developers modified the RtlSidHashInitialize() function. The new code temporarily writes a sensitive kernel pointer from the TOKEN structure into a user-controlled buffer.
Although the pointer is quickly removed, it creates a small but exploitable time window for an attacker to read it.
Exploiting The Race Condition
An attacker can trigger this vulnerability by making a specific system call (NtQueryInformationToken() with the TokenAccessInformation class) while simultaneously running a separate thread to read the memory location where the kernel address is briefly leaked.
Despite being a race condition, the time window is reportedly wide enough to make the exploit highly reliable. A proof-of-concept demonstrates that the leaked TOKEN address can be obtained almost every time the exploit is run, Crowdfense added.
The impact is significant because this leak works on the latest, fully patched versions of Windows 11 and can be executed from low-privilege environments, including sandboxed AppContainer applications. While the vulnerability itself only leaks information, it serves as a powerful primitive.
When chained with a separate bug, such as a “write-what-where” condition, an attacker could achieve a full Local Privilege Escalation (LPE) by overwriting the Privileges field of the TOKEN object.
This discovery highlights a common challenge in software security: fixing one vulnerability can sometimes inadvertently create another. The researcher who discovered the flaw followed a responsible disclosure process, which began on April 8, 2025.
After some initial confusion where the report was mistakenly closed as a duplicate, Microsoft eventually acknowledged the new, valid bug on April 25 and assigned it CVE-2025-53136 in August.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical security flaw impacting Dassault Systèmes DELMIA Apriso Manufacturing Operations Management (MOM) software to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
The vulnerability, tracked as CVE-2025-5086, carries a CVSS score of 9.0 out of 10.0. According to
Backdoor malware is a covert type of malicious software designed to bypass standard authentication mechanisms and provide persistent, unauthorized access to compromised systems. Unlike conventional malware that prioritizes immediate damage or data theft, backdoors focus on stealth and longevity, enabling attackers to control infected endpoints remotely, deploy additional payloads, exfiltrate sensitive information, and move laterally […]
A new, sophisticated malware campaign has been uncovered that leverages Microsoft’s Azure Functions for its command-and-control (C2) infrastructure, a novel technique that complicates detection and takedown efforts.
According to the Dmpdump report, the malware, first identified from a file uploaded to VirusTotal on August 28, 2025, from Malaysia, employs a multi-stage infection process involving DLL side-loading and in-memory payload execution to remain hidden.
The attack begins with a disk image file named Servicenow-BNM-Verify.iso. This ISO contains four files: a legitimate Palo Alto Networks executable (PanGpHip.exe), a shortcut file (servicenow-bnm-verify.lnk), and two hidden dynamic-link libraries (DLLs), libeay32.dll and the malicious libwaapi.dll.
virustotal infection
When the user clicks the shortcut file, it executes the legitimate PanGpHip.exe. However, this executable is vulnerable to DLL side-loading, causing it to load the malicious libwaapi.dll from the same directory.
loading a malicious file
This technique allows the malware to run under the guise of a trusted application, bypassing initial security checks.
Metadata from the shortcut file reveals it was created on August 25, 2025, three days before its upload, on a machine named “desktop-rbg1pik” by a user “john.GIB,” offering a glimpse into the threat actor’s development environment.
Payload Injection And Obfuscation
Once loaded, the malicious libwaapi.dll initiates a complex payload injection sequence. It first hides its console window and creates a mutex to ensure only one instance of the malware runs on the victim’s machine.
It then injects its main payload into the memory of chakra.dll, a legitimate Windows component. This process involves several layers of decryption and obfuscation.
The malware calculates an RC4 key by hashing the string “rdfY*&689uuaijs” and uses it to decrypt the payload. The injected payload is an obfuscated shellcode that decompresses the final DLL implant using the LZNT1 algorithm.
This final payload is heavily obfuscated, with analysis suggesting it implements module unhooking to evade detection from security software.
Its functionality is contained within the DllUnload exported function, a less common choice for housing malicious code.
export function
The most significant aspect of this malware is its use of Azure Functions for C2 communications. The final payload sends victim data via a POST request to logsapi.azurewebsites[.]net/api/logs.
By hosting its C2 on a legitimate serverless platform like Azure, the malware makes it difficult for network defenders to block the malicious traffic without impacting access to legitimate Microsoft services, according to the Dmpdump report.
The exfiltrated data is sent in an XML format, containing detailed information about the compromised system. This includes the computer and user names, OS version, system uptime, and the processes from which the malware and its parent process are running.
A related malware sample with the same import hash was uploaded from Singapore on September 5, 2025, suggesting the campaign may be more widespread.
Security researchers are continuing to analyze the final payload to understand its full capabilities.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
Recent threat campaigns have revealed an evolving use of BAT-based loaders to deliver Remote Access Trojans (RATs), including XWorm and Remcos. These campaigns typically begin with a ZIP archive—often hosted on seemingly legitimate platforms such as ImgKit—designed to entice user interaction by mimicking benign content. Once opened, the archive unpacks a highly obfuscated BAT script […]
Microsoft has addressed four elevation of privilege vulnerabilities in its Windows Defender Firewall service, all rated as “Important” in severity.
The security flaws were detailed in Microsoft’s September 9, 2025, security update release. If exploited, these vulnerabilities could allow an authenticated attacker to gain higher privileges on an affected system.
The four vulnerabilities are tracked as CVE-2025-53808, CVE-2025-54104, CVE-2025-54109, and CVE-2025-54915. All four enable a local attacker to escalate their privileges, posing a significant risk to system integrity.
At the time of disclosure, Microsoft stated that none of the vulnerabilities had been publicly disclosed or actively exploited in the wild.
Nature Of The Firewall Vulnerabilities
Three of the four vulnerabilities (CVE-2025-54104, CVE-2025-54109, and CVE-2025-54915) are caused by a “type confusion” flaw within the Windows Defender Firewall Service.
Type confusion is a common class of memory safety bug where a program attempts to access a resource with an incompatible type, leading to unexpected and often insecure behavior.
In this case, it allows an authorized attacker to trigger a condition that leads to local privilege escalation.
The fourth vulnerability, CVE-2025-53808, is also a service elevation of privilege flaw, though Microsoft’s advisory does not specify it as a type confusion bug.
The common thread among all four is the potential outcome: a low-privileged user gaining elevated system rights.
Understanding The Attack Scenario
To exploit any of these vulnerabilities, an attacker must first have authenticated access to the target machine. Furthermore, exploitation requires the attacker’s account to be a member of a specific, restricted user group.
This high prerequisite is reflected in the CVSS metric “Privileges Required: High (PR:H),” indicating that a casual or unauthenticated attacker cannot leverage these flaws.
A successful exploit would allow the attacker to elevate their privileges from a “Medium Integrity Level” to “Local Service.”
While not full system or administrator-level control, gaining Local Service privileges provides significant capabilities, allowing an attacker to access and manipulate a wide range of system resources, install malicious software, or further compromise the affected host.
Microsoft’s Assessment And Mitigation
Microsoft’s exploitability assessment indicates that an attack is “Less Likely” for CVE-2025-53808, CVE-2025-54104, and CVE-2025-54109.
For CVE-2025-54915, the assessment is even lower, at “Exploitation Unlikely.” This analysis is based on the high privileges required for an attacker to be in a position to exploit the flaws.
Despite the low likelihood of exploitation, the “Important” severity rating underscores the potential danger if an attacker meets the necessary prerequisites.
Microsoft has released security updates to patch these vulnerabilities across all affected versions of Windows.
System administrators and users are strongly advised to apply the September 2025 security updates promptly to protect their systems and mitigate the risk of potential privilege escalation attacks.
In a striking evolution of its tactics, the Sidewinder advanced persistent threat (APT) group—also known as APT-C-24 or “Rattlesnake”—has adopted a novel delivery mechanism leveraging Windows shortcut (LNK) files to orchestrate complex, multi-stage intrusions across South Asia. Active since at least 2012 and targeting governments, energy utilities, military installations, and mining operations in Pakistan, Afghanistan, […]
A critical security vulnerability has been discovered in the popular Axios HTTP client library that allows attackers to crash Node.js applications through malicious data URL handling. The flaw, tracked as CVE-2025-58754, affects all versions of Axios before 1.11.0 and has been assigned a CVSS 3.1 score of 7.5, indicating high severity. Vulnerability Mechanics The vulnerability stems […]
Microsoft has officially announced a multi-phase plan to deprecate VBScript in Windows, a move that signals a significant shift for developers, particularly those working with Visual Basic for Applications (VBA).
The change, first detailed in May 2024, will gradually phase out the legacy scripting language, requiring developers to adapt their projects to ensure future compatibility.
This decision primarily impacts VBA applications that rely on VBScript for functionalities like executing external scripts or utilizing reference libraries, such as the widely used VBScript.RegExp for handling regular expressions.
As Windows evolves, developers are being urged to prepare for a future without VBScript.
The Three-Phase Deprecation Timeline
Microsoft has outlined a clear, three-stage process for retiring VBScript. The first phase, currently active and expected to last until at least 2026, treats VBScript as a “Feature on Demand” (FOD), meaning it remains enabled by default, and existing VBA projects will continue to function without interruption.
In the second phase, projected to begin around 2027, the VBScript FOD will be disabled by default. While administrators will still have the option to re-enable it, this marks a critical point where un-updated applications may begin to fail.
The final phase, with a yet-to-be-determined date, will see VBScript completely removed from all future Windows releases, making any remaining dependencies obsolete.
The deprecation will affect VBA projects in two primary ways. First, any code that calls and executes external .vbs files will no longer be supported once VBScript is disabled or removed.
Second, and more critically for many, references to the VBScript type library for regular expressions will break.
This has been a common method for developers to implement pattern matching and text manipulation within Office applications like Excel, Word, and Access.
Without proactive changes, these essential functions will cease to operate in newer Windows environments, potentially crippling complex macros and automated workflows that depend on them.
Future-Proofing With Integrated RegExp
To address this, Microsoft has integrated RegExp classes directly into the VBA runtime library, starting with Microsoft 365 Version 2508 (Build 19127.20154).
This update allows developers to use regular expressions natively without referencing the external vbscript.dll.
The new implementation supports both early binding (Dim regEx As RegExp) and late binding (CreateObject("VBScript.RegExp")), ensuring that updated Office versions can run scripts seamlessly, even on future Windows versions where VBScript is absent.
Microsoft strongly recommends that developers upgrade to the latest Office build, begin using the new integrated RegExp classes in their macros, and thoroughly test existing projects to identify and resolve any lingering VBScript dependencies.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
