Microsoft has released security advisories for four newly discovered vulnerabilities in its Windows Defender Firewall Service that could enable attackers to elevate privileges on affected Windows systems. The flaws, tracked as CVE-2025-53808, CVE-2025-54104, CVE-2025-54109, and CVE-2025-54915, were all disclosed on September 9, 2025, and share similar characteristics. While exploitation requires local access, successful attacks could […]
EvilAI, a new malware family tracked by Trend™ Research, has emerged in recent weeks disguised as legitimate AI-driven utilities. These trojans sport professional user interfaces, valid code signatures, and functional features, allowing them to slip past both corporate and personal defenses undetected. Leveraging lightweight installers and AI-generated code, EvilAI rapidly establishes persistent footholds while masquerading […]
In 2025, the cybersecurity landscape is defined by its complexity and the speed of modern threats. Security teams are overwhelmed by a fragmented array of security controls and a lack of clear visibility into what’s actually working. Breach and Attack Simulation (BAS) platforms solve this problem by continuously and safely validating security defenses against real-world […]
Cybersecurity researchers have discovered a new ransomware strain dubbed HybridPetya that resembles the notorious Petya/NotPetya malware, while also incorporating the ability to bypass the Secure Boot mechanism in Unified Extensible Firmware Interface (UEFI) systems using a now-patched vulnerability disclosed earlier this year.
Slovakian cybersecurity company ESET said the samples were uploaded
The Cybersecuritynews researcher team uncovered a sophisticated social engineering campaign that is exploiting the public’s need for free internet access, using deceptive Wi-Fi portals to trick users into downloading and executing PowerShell-based malware.
Dubbed the “Clickfix” attack, this method turns a user’s own browser actions against them to compromise their system under the guise of a simple human verification step.
The attack targets on individuals in public spaces like airports, where the promise of “Free Wi-Fi” is a powerful lure. Unsuspecting users attempting to connect are redirected to a professionally designed but fake captive portal.
These pages, often hosted on insecure IP addresses rather than legitimate domains, mimic real network login screens, complete with logos and a CAPTCHA prompt to “prove you are not a robot,” a feature intended to build a false sense of security.
Deceptive Verification Process
The core of the Clickfix attack lies in its clever manipulation of user behavior. After a user interacts with the fake CAPTCHA, a pop-up window appears with a set of “Verification Steps.”
Instead of a simple click, the instructions guide the user through a specific sequence of keyboard shortcuts: press Ctrl+S to save the web page, navigate to the browser’s downloads window, and press Enter to open the file, the Cybersecuritynews researcher team said.
This sequence is a social engineering trick designed to bypass standard browser security warnings about downloading executable files.
By instructing the user to save the page and run the file themselves, the attackers effectively get consent to execute malicious code. The downloaded file is not an image or document but a script that initiates the infection.
Once the user unwittingly executes the downloaded file, a malicious PowerShell script is launched.
Analysis of the attack chain with ANY.RUN Sandbox reveals that this script acts as a downloader, establishing a connection to a command-and-control server to fetch the primary malware payload. In this campaign, the payload has been identified as a network trojan.
PowerShell is a powerful tool for attackers because it is integrated into Windows and can execute commands, scripts, and payloads directly in memory, often evading detection by traditional antivirus solutions.
This type of fileless malware can be used for a wide range of malicious activities, including stealing sensitive information, deploying ransomware, or providing a persistent backdoor for remote access to the compromised device.
To safeguard against this threat, users should stay alert when connecting to public Wi-Fi, carefully examine the URLs of login pages, and be very cautious of any website that requires unusual keyboard commands for verification.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
A malicious ISO image named Servicenow-BNM-Verify.iso was uploaded to VirusTotal from Malaysia with almost no detections. The image contains four files—two openly visible and two hidden. The visible files include a Windows shortcut, servicenow-bnm-verify.lnk, which launches PanGpHip.exe, a legitimate Palo Alto Networks binary. Hidden in the same ISO are libeay32.dll, a genuine OpenSSL library, and […]
A sophisticated malvertising campaign has been uncovered targeting unsuspecting users through “dangling commits” in a legitimate GitHub repository. Attackers are injecting promotional content for a counterfeit GitHub Desktop installer into popular development and open-source projects. When users download what appears to be the genuine client, the installer quietly delivers malicious payloads in the background, compromising […]
A new kernel address leak vulnerability has been discovered in the latest versions of Windows 11 (24H2) and Windows Server 2022 (24H2).
The flaw, identified as CVE-2025-53136, was ironically introduced by a Microsoft patch intended to fix a separate vulnerability, CVE-2024-43511.
According to Crowdfense, the new bug undermines recent security enhancements in Windows, providing a reliable method for attackers to bypass Kernel Address Space Layout Randomization (KASLR), a critical defense mechanism.
In recent updates, particularly starting with the 24H2 versions of Windows 11 and Windows Server 2022, Microsoft took significant steps to harden the operating system kernel against attacks.
The company restricted access to kernel base addresses by limiting functions like NtQuerySystemInformation().
This change meant that only highly privileged processes could retrieve this information, effectively neutralizing a common technique used by attackers to bypass KASLR and making it much harder to exploit kernel vulnerabilities.
However, analysis of the October 2024 patch for CVE-2024-43511, a Time-of-check Time-of-use (TOCTOU) race condition vulnerability, revealed a critical error.
In fixing the original bug, developers modified the RtlSidHashInitialize() function. The new code temporarily writes a sensitive kernel pointer from the TOKEN structure into a user-controlled buffer.
Although the pointer is quickly removed, it creates a small but exploitable time window for an attacker to read it.
Exploiting The Race Condition
An attacker can trigger this vulnerability by making a specific system call (NtQueryInformationToken() with the TokenAccessInformation class) while simultaneously running a separate thread to read the memory location where the kernel address is briefly leaked.
Despite being a race condition, the time window is reportedly wide enough to make the exploit highly reliable. A proof-of-concept demonstrates that the leaked TOKEN address can be obtained almost every time the exploit is run, Crowdfense added.
The impact is significant because this leak works on the latest, fully patched versions of Windows 11 and can be executed from low-privilege environments, including sandboxed AppContainer applications. While the vulnerability itself only leaks information, it serves as a powerful primitive.
When chained with a separate bug, such as a “write-what-where” condition, an attacker could achieve a full Local Privilege Escalation (LPE) by overwriting the Privileges field of the TOKEN object.
This discovery highlights a common challenge in software security: fixing one vulnerability can sometimes inadvertently create another. The researcher who discovered the flaw followed a responsible disclosure process, which began on April 8, 2025.
After some initial confusion where the report was mistakenly closed as a duplicate, Microsoft eventually acknowledged the new, valid bug on April 25 and assigned it CVE-2025-53136 in August.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical security flaw impacting Dassault Systèmes DELMIA Apriso Manufacturing Operations Management (MOM) software to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
The vulnerability, tracked as CVE-2025-5086, carries a CVSS score of 9.0 out of 10.0. According to
Backdoor malware is a covert type of malicious software designed to bypass standard authentication mechanisms and provide persistent, unauthorized access to compromised systems. Unlike conventional malware that prioritizes immediate damage or data theft, backdoors focus on stealth and longevity, enabling attackers to control infected endpoints remotely, deploy additional payloads, exfiltrate sensitive information, and move laterally […]
