microsoft Archives

Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR

22Sep

By RBNo Comments

News

Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR

Researchers at LastPass and Delphos Labs reported on September 17 that a phony LastPass Authenticator installer available on GitHub installs a Windows kernel driver that, if a victim downloads and runs it, turns off antivirus and other protection applications before a password stealer runs. The driver was signed by Microsoft's own hardware-compatibility program, did not appear on Microsoft's list of prohibited drivers, and received zero detections on VirusTotal when researchers examined it in August. LastPass claims that the attackers simply used its name and that none of its own systems, services, or customer vaults were compromised. A phony GitHub page (github.com/LastPass-Authenticator) that appears to be an authentic LastPass product page and appears in search results for terms ...

Microsoft warns of TerminalFix attacks deploying reverse tunnels

1Sep

By RBNo Comments

News

Microsoft warns of TerminalFix attacks deploying reverse tunnels

Using phony Cloudflare CAPTCHA prompts on hacked websites, a new ClickFix variation known as TerminalFix deceives victims into running malicious PowerShell instructions in Windows Terminal. This campaign employs a multi-stage intrusion chain that eventually provides attackers with a reverse tunnel into the victim's internal network, in contrast to standard ClickFix attacks that frequently result in infostealer malware infections. In contrast to standard ClickFix attacks, TerminalFix points users to Windows Terminal or PowerShell, which allows more complicated, multi-line scripts to be successfully executed. Microsoft did not see any hands-on activity, but they were aware of the attacks in the wild. The researchers caution that access gained in this manner may be used for ransomwa...

Microsoft Says New Cybersecurity AI Model Helps MDASH Score 95.95% at Half the Cost

28Jul

By RBNo Comments

News

Microsoft Says New Cybersecurity AI Model Helps MDASH Score 95.95% at Half the Cost

Microsoft's multi-model vulnerability discovery and repair harness, MDASH, has introduced its first cybersecurity-specific model. According to the firm, MDASH achieved 95.95% on CyberGym utilizing MAI-Cyber-1-Flash and GPT-5.4. Additionally, it states that the setup is 50% less expensive than its best MDASH combination of GPT-5.4, GPT-5.4 small, and GPT-5.3 Codex. Only authorized MDASH clients have access via an Azure AI Foundry private preview. Up to 90% of MDASH tasks can be handled by MAI-Cyber-1-Flash, with GPT-5.4 reserved for the most difficult 10%. It is solely accessible within MDASH; it is neither a general-purpose application programming interface nor a stand-alone public model. The headline score does not belong to the new model alone, but rather to MDASH using MAI-Cyb...

Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data Theft Across Three Paths

14Jul

By RBNo Comments

News

Microsoft Maps Year-Long ShinyHunters-Linked Salesforce Data Theft Across Three Paths

Attackers who use techniques similar to those of the data-extortion group For the past year, ShinyHunters have entered corporate Salesforce settings without taking use of any platform vulnerabilities. The organization's prior trust, typically through the OAuth connections that link Salesforce to the apps and outside vendors surrounding it, has been the entry point. Microsoft mapped the advertisements, which ran from mid-2025 to mid-2026, to three different strategies in a study released on July 13. In order to address the activity authentication logs miss, it also collaborated with Salesforce to implement additional detection and governance tools. It is difficult to catch because of this. The traffic appears as usual use and is hardly detected by sign-in and authentication monito...

Microsoft Removes 119 Edge Extensions That Hid Malware in Images and Fonts

29Jun

By RBNo Comments

News

Microsoft Removes 119 Edge Extensions That Hid Malware in Images and Fonts

A long-running malicious extension operation on the Edge Add-ons store that concealed its payloads inside regular image and font files before waking up days after installation to steal passwords and do ad fraud has been shut down by Microsoft. The business refers to it as StegoAd, a combination of adware and steganography, and links 119 extensions to a single threat actor that it claims has been operating since at least 2021. Ad blockers, VPNs, movie downloaders, and translators were among the extensions that consumers installed mindlessly. They all performed well and received praise. The harmful code remained dormant for years in the store until the extension passed a series of evasion checks. Up to 2.6 million people had installed all 119 extensions combined. Microsoft is adama...

Microsoft Warns of Photo ZIP Phishing Campaign Targeting Hotels with Node.js Implant

26Jun

By RBNo Comments

News

Microsoft Warns of Photo ZIP Phishing Campaign Targeting Hotels with Node.js Implant

Since April 2026, hotels and other hospitality establishments around Europe and Asia have been the target of an ongoing phishing campaign that uses photo-themed ZIP files to insert a Node.js implant and compromise front desk computers, according to Microsoft. The operators' ultimate objective is still unknown, and the company has not linked the action to a recognized threat actor. The attraction is based on how hotels operate. Phishing emails with the display name "Booking Manager (via Calendly)" mention health inspections, room questions, bedbug infestations, guest complaints, and stay reviews. Japanese lures were the most prevalent, followed by Danish and Dutch lures. The lack of a recipient or property name in the subject line indicates high-volume, list-driven transmission as...

Microsoft Confirms RoguePlanet Defender Zero-Day, Says Patch is in Development

18Jun

By RBNo Comments

News

Microsoft Confirms RoguePlanet Defender Zero-Day, Says Patch is in Development

Microsoft has officially revealed that it is developing a solution to fix the RoguePlanet Defender zero-day. The tech giant has designated the vulnerability as a privilege escalation problem and assigned it the CVE identification CVE-2026-50656 (CVSS score: 7.8). Microsoft stated that it is aware of a privilege escalation in Microsoft Defender's Microsoft Malware Protection Engine, sometimes known as "RoguePlanet." We're working to fix this vulnerability with a top-notch security update. Nearly a week has passed since the release of RoguePlanet by security researcher Chaotic Eclipse (also known as Nightmare-Eclipse), who described the vulnerability as an instance of a race situation that gives attackers a shell with SYSTEM-level privileges. The researcher pointed out that beca...

Microsoft Slams Public Zero-Day Disclosures Amid GitHub Researcher Account Removal

29May

By RBNo Comments

News

Microsoft Slams Public Zero-Day Disclosures Amid GitHub Researcher Account Removal

Microsoft has made a strong case for Coordinated Vulnerability Disclosure (CVD), calling on researchers to share their findings and provide impacted businesses with a chance to better understand the implications and take corrective action before they are made public. This comes after a researcher by the name of Chaotic Eclipse (also known as Nightmare-Eclipse) revealed information about several zero-day vulnerabilities that have affected several Windows components over the past month, including Defender and BitLocker. The researcher claimed that Microsoft's handling of the vulnerability disclosure process had broken down. Numerous zero-day vulnerabilities have been made public in recent weeks, according to the tech giant. "The disclosures put our users at needless risk, and Microsof...

Microsoft Releases Mitigation for YellowKey BitLocker Bypass CVE-2026-45585 Exploit

20May

By RBNo Comments

News

Microsoft Releases Mitigation for YellowKey BitLocker Bypass CVE-2026-45585 Exploit

YellowKey, a BitLocker bypass issue that was made public last week, was mitigated by Microsoft on Tuesday. The zero-day vulnerability has a CVSS score of 6.8 and is being tracked as CVE-2026-45585. It has been referred to as a workaround for the BitLocker security mechanism. The tech giant stated in an alert that it is aware of a security feature bypass vulnerability in Windows known as "YellowKey." This vulnerability's proof of concept has been made public, which is against coordinated vulnerability best practices. The problem affects Windows Server 2025, Windows Server 2025 (Server Core installation), Windows 11 version 26H1 for x64-based systems, Windows 11 version 24H2 for x64-based systems, and Windows 11 version 25H2 for x64-based systems. Chaotic Eclipse, sometimes know...

Microsoft Warns of WhatsApp-Delivered VBS Malware Hijacking Windows via UAC Bypass

2Apr

By RBNo Comments

News

Microsoft Warns of WhatsApp-Delivered VBS Malware Hijacking Windows via UAC Bypass

Microsoft is drawing attention to a recent campaign that spreads dangerous Visual Basic Script (VBS) files via WhatsApp messaging. These scripts are used in the activity, which started in late February 2026, to start a multi-stage infection chain that establishes persistence and permits remote access. The lures used by threat actors to fool users into running the scripts are presently unknown. According to the Microsoft Defender Security Research Team, the campaign uses a mix of living-off-the-land and social engineering strategies. It installs malicious Microsoft Installer (MSI) packages to keep control of the system, retrieves payloads from reliable cloud providers like AWS, Tencent Cloud, and Backblaze B2, and leverages renamed Windows utilities to blend in with regular system ac...