All news with #defense evasion tag

🛡️ Varonis Threat Labs discovered AvisLoader, a new Windows loader found alongside a ClickFix lure and command center. The attack uses a Cloudflare-hosted lure that tricks victims into pasting and running a command which retrieves a Windows loader. AvisLoader embeds a Tox client for encrypted peer-to-peer C2, complicating domain-based takedowns and enabling operator mobility. Recovered artifacts show shortcut-based persistence, a UAC bypass helper, and process-hiding hooks, while the web-based Command Center supports tasking and file staging over Tox.

🔍 The author recounts timing an attacker who deployed a credential-harvesting operation in under 24 minutes, highlighting that defenders focus on blocking cheap, replaceable domains while attackers bear true cost at the server. Modern phishing kits act as adversary-in-the-middle proxies, relaying genuine MFA flows and hiding origins behind CDNs. The author describes how a cookie set by the proxy exposed the relay IP, which led to a mapped estate of related infrastructure and multiple impersonation campaigns. The piece argues defenders should hunt by server and hosting ranges, detect relay-origin sign-ins, and revoke sessions first to disrupt attackers effectively.

🛡️ Microsoft will add .msix and .msixbundle attachments to the default blocked file types in Outlook on the web and the new Outlook for Windows, starting with a rollout to Exchange Online in early November and GA by mid-November. These package formats are modern Windows installers and bundles used for multiple architectures. Once policies update, users will not be able to send, receive, open, or download these attachments by default, though admins can whitelist them if required. The change is part of ongoing efforts to reduce exploitation of Office and Windows features that attackers abuse.

🛡️ Ontinue details a four-stage attack chain distributing Psychedelic (LunexStealer) via compromised Ukrainian sites using ClickFix-like CAPTCHA lures. The chain uses bogus MSI installers to deploy LunexLoader, bypass UAC, and leverage a vulnerable AMD Radeon driver (PDFWKRNL.sys, CVE-2023-20598) for BYOVD-based defense evasion before installing a PowerShell-backed native messaging host. The stealer harvests browser credentials, cookies, and desktop and extension cryptocurrency wallets while persisting via registry, scheduled tasks, and a malicious Chrome extension.

🛡️ ClickFix is now the leading initial-access technique in enterprise telemetry, operating without exploits, attachments, or downloads. The attack uses malicious pages that copy a command to the clipboard and instruct users to paste it into native system interpreters, evading conventional detectors. Its infrastructure leverages on-chain resolution and distributed resolvers to survive takedown, and payload delivery is fingerprint-gated to evade sandboxes. Effective defenses focus on constraining clipboard writes and forcing interpreters through authenticated proxies.

🛡️ A proof-of-concept named BigDiskBuster was published on GitHub on September 19 and prevents Microsoft Defender from installing platform and signature updates by filling all available disk space. The tool's author, former Microsoft researcher Abdelhamid Naceri, previously disclosed other Defender exploits that were used in live attacks. No patch, CVE, or official Microsoft advisory exists for this technique; administrators should monitor update failures, free space, and hidden temporary files while restricting execution of unknown binaries.

🛡️ A security researcher, Abdelhamid Naceri (aka Nightmare Eclipse), released a proof-of-concept named BigDiskBuster that prevents Microsoft Defender from applying definition and platform updates while it runs in the background. The researcher says the tool affects all supported Windows versions and resembles prior PoCs like UnDefend, though it is described as somewhat buggy. Microsoft did not immediately comment on the report and some earlier flaws disclosed by the researcher remain unpatched.

🛡️ Sophos on September 7 detailed malware targeting F5 BIG-IP Access Policy Manager that injects a PHP web shell into memory rather than writing it to disk. The malware hooks Apache and libphp, rewrites file-handling calls, and places a web shell in-memory when specific .php3 scripts are loaded, evading file-based detection. Related installer components modify /usr/sbin/httpd and other binaries and may persist through install images, with links to CVE-2025-53521 and mitigation guidance.

🛡️ Microsoft Threat Intelligence observed a human-operated campaign abusing Microsoft Teams external collaboration to impersonate IT support and socially engineer users into granting interactive remote sessions. Attackers install a malicious MSI that stages a portable Node.js runtime and an obfuscated JavaScript implant to provide persistent C2-driven command execution. The operators perform extensive host and Active Directory reconnaissance and pivot enterprise-wide via WinRM, using legitimate tooling to blend into normal operations.

🛡️ Microsoft Defender Experts are tracking an active campaign that uses counterfeit software-download sites impersonating trusted vendors to distribute malicious installers. The campaign targets users seeking popular software and has caused compromises across multiple industries, with a concentration on China-based operations and Chinese-speaking users. The malicious installers establish persistence, evade defenses, and communicate with attacker infrastructure; Microsoft disrupted activity and recommends enabling protections such as SmartScreen, network protection, tamper protection, and Microsoft Defender XDR.

🔍 Microsoft and Bitdefender telemetry show attackers increasingly rely on simple, repeatable methods such as ClickFix and living-off-the-land techniques rather than bespoke exploits. These approaches scale because they are platform-agnostic, require no new tooling, and reuse built-in binaries and publicly released exploits. The result is higher throughput of incidents with falling per-victim returns, incentivizing low-cost, repeatable campaigns.

🛡️ Kaspersky attributes a campaign to Silver Fox that hides the ValleyRAT backdoor inside a legitimately signed Chinese adware installer, QN Wallpaper. The attackers use DLL sideloading to run a malicious libcef.dll within the signed QnWallpaper.exe, disable Windows Defender, add autorun entries, and escalate privileges with runas. ValleyRAT can steal keystrokes and screenshots, mark its process as critical to induce BSOD on termination, and contacts several C2 servers and domains.

🔎 This Talos blog post explains how obfuscated JavaScript transforms readable code into string arrays, encoded values, runtime decoders, and eval calls, making static reading ineffective. The author outlines common benign and malicious motivations for obfuscation and stresses safe handling: work on copies, avoid executing hostile scripts in useful environments, and use isolated analysis. The article introduces categories of techniques—string hiding, lookup tables, dynamic property access, dead code, runtime code generation, control-flow flattening, anti-analysis measures, and extreme forms like JSFuck—and offers practical counters like beautification, renaming, replacing execution sinks with logging, and using controlled runtime harnesses or headless browsers to recover payloads. It warns about automated obfuscators (npm packages) and Node-specific risks such as access to secrets, and emphasizes a structured, repeatable workflow that leverages tooling and AI on isolated snippets.

🛡️ Check Point Research found that Microsoft-signed Boot-Time Removal driver BTR.sys can be abused to perform kernel-level file and registry operations, potentially neutralizing security controls. The technique uses an undocumented encrypted transaction format rather than a conventional IOCTL interface and affects Windows versions from Windows 7 through Windows 11 25H2. CPR released a proof-of-concept tool, BTR_CLI, demonstrating extraction, transaction construction, and driver loading using the system's own copy of BTR.sys. Microsoft indicated the issue did not meet criteria for immediate servicing and noted the attack requires pre-existing privileges.

🛡️ KnowBe4 has identified a new Agent Tesla v4 campaign using emoji-based obfuscation and a JScript dropper to bypass detection and steal credentials. The lure leveraged a convincing BEC email spoofing a Philippine bank and instructing finance staff to open an attachment. The dropper embeds Unicode emoji characters to disrupt signature matching, then uses DonutLoader for reflective PE injection so the final binary never touches disk. Researchers advise updating email security and creating YARA rules that combine emoji patterns with JScript function calls to detect the threat.

🔍 Threat actors are embedding commands in FTP server banners to deliver two new remote access trojans, E4del and PINHOLE, observed in attacks since July 2026. The campaign begins with a ZIP archive and LNK-based infection chain, likely introduced via phishing, and uses FTP banners as dead-drop resolvers to retrieve PowerShell stagers. SOCRadar discovered the technique and highlights indicators of compromise to help defenders identify affected systems. E4del is a Node.js RAT masquerading as Discord, while PINHOLE uses Pinterest and SurveyMonkey for C2 resilience.

🛡️ Microsoft has removed the legacy Windows Management Instrumentation Command-line (WMIC) tool from Windows 11 24H2, 25H2 and recent beta builds as part of its planned deprecation. The company previously converted WMIC to a Feature on Demand and announced its eventual removal; WMI itself remains available. IT administrators are advised to migrate scripts to PowerShell, WMI COM APIs, .NET libraries or other modern tools. The change aims to reduce abuse of WMIC as a LOLBIN used by attackers for ransomware, evasion, and other malicious activities.

🛡️ Files created with the polyglot technique are increasingly used in cyberattacks to evade filters and confuse investigators. Attackers craft files that can be interpreted as multiple formats (for example, PNG or ZIP) so different applications or scanners see different contents. Real-world campaigns have used EXE/ZIP, PDF/DOC, MSI/JAR, DLL/HTML and multi-archive polyglots to deploy malware like PhantomPyramid, StrRAT, Ratty and IcedID. Defenses rely on consistent security hygiene and targeted testing of detection tools.

🔍 SOCRadar warns of a Russian loader-as-a-service called DOUBLECUP that uses ClickFix attacks to hide malicious code in PNG images cached by victims' browsers, delivering CountLoader and a new DeviceManager RAT. The service, active since June 2026, provides infrastructure and a Go-based builder while customers host phishing pages that trick users into pasting commands. The technique forces browsers to cache steganographic images, then extracts and executes payloads via clipboard-driven commands.

🛡️ Google is developing a Chrome security feature to block policy-installed extensions from hijacking the New Tab page or changing the default search engine on unmanaged consumer devices. The change, spotted in Chromium Gerrit, would enable a feature flag by default to prevent extensions forced by local policies from overriding the New Tab or search settings. Chrome would cancel such installations, record the extension ID as blocked, and avoid repeated download attempts, while allowing administrators an escape hatch policy when needed.