NewApp Digest
search bot

system access

Disgruntled researcher drops “BlueHammer” Windows zero-day LPE exploit
Winsage
April 7, 2026

Disgruntled researcher drops “BlueHammer” Windows zero-day LPE exploit

A security researcher, known as "Nightmare-Eclipse," released proof-of-concept exploit code for a Windows zero-day vulnerability called "BlueHammer," which allows local privilege escalation (LPE). The exploit has been validated by another researcher, Will Dormann, who confirmed it can escalate privileges on Windows systems, allowing non-administrative users to gain SYSTEM-level access. The exploit's reliability varies across different Windows versions, with inconsistent success rates reported. Microsoft has not acknowledged the vulnerability or provided a patch, raising concerns about potential exploitation by threat actors. Users are advised to restrict local user access, monitor for suspicious activity, and enable advanced endpoint protection.
PoC Exploit Released for Windows Error Reporting ALPC Privilege Escalation
Winsage
March 3, 2026

PoC Exploit Released for Windows Error Reporting ALPC Privilege Escalation

A critical local privilege escalation vulnerability, tracked as CVE-2026-20817, affects Microsoft Windows through the Windows Error Reporting (WER) service. This flaw allows authenticated users with low-level privileges to execute arbitrary code with full SYSTEM privileges. The vulnerability resides in the SvcElevatedLaunch method (0x0D) and fails to validate user permissions, enabling attackers to launch WerFault.exe with malicious command-line parameters from a shared memory block. The exploit affects all versions of Windows 10 and Windows 11 prior to January 2026, as well as Windows Server 2019 and 2022. Microsoft addressed this vulnerability in the January 2026 Security Update. Organizations are advised to apply security patches and monitor for unusual WerFault.exe processes.
Not a virus: What it means and why antivirus flags it
Tech Optimizer
January 27, 2026

Not a virus: What it means and why antivirus flags it

The term “not a virus” is used by antivirus software to indicate that a file does not match known malware signatures but still triggers a detection. This means the file is not automatically blocked or confirmed as a threat; the alert highlights something unusual, leaving the decision to the user. Alerts typically arise when software exhibits behavior associated with increased risk, despite lacking clear evidence of malicious intent. Malware is specifically designed to inflict harm, while files labeled “not a virus” may perform actions that raise security concerns but are not classified as harmful. Antivirus programs identify threats through signature detection and heuristic behavior-based detection. Legitimate programs, such as system utilities, download managers, and game cheats, can inadvertently trigger “not a virus” alerts. Common types of detections include adware, riskware, and potentially unwanted applications (PUA). The primary security risk of “not a virus” files is exposure rather than direct attacks, and privacy concerns often arise from data collection by these programs. If an antivirus detects “not a virus,” users should identify the file, review recent changes, compare detections, and decide whether to keep or remove it. To reduce unwanted alerts, users should download from official sources, use custom installation options, and remove unused software.
New Albiriox MaaS Malware Targets 400+ Apps for On-Device Fraud and Screen Control
AppWizard
December 2, 2025

New Albiriox MaaS Malware Targets 400+ Apps for On-Device Fraud and Screen Control

A new Android malware named Albiriox has emerged, marketed as malware-as-a-service (MaaS). It features a hard-coded list of over 400 applications, including banking and cryptocurrency platforms, and is distributed through social engineering tactics using dropper applications. Initially advertised in late September 2025, it became a full MaaS offering by October, with Russian-speaking threat actors behind its development. Albiriox allows remote control of compromised devices via an unencrypted TCP socket connection and Virtual Network Computing (VNC), enabling attackers to extract sensitive information and perform overlay attacks for credential theft. One campaign targeted victims in Austria using German-language lures and counterfeit Google Play Store listings. Albiriox also utilizes Android's accessibility services to bypass security measures and employs a novel distribution strategy involving a counterfeit website that collects phone numbers. Additionally, another Android MaaS tool, RadzaRat, was introduced, masquerading as a file management utility while offering extensive surveillance and remote control capabilities. RadzaRat can log keystrokes and maintain persistence through specific permissions, highlighting a trend in the availability of sophisticated cybercrime tools.
CISA Issues Warning Over Microsoft Windows Vulnerability Actively Exploited by Attackers
Winsage
October 17, 2025

CISA Issues Warning Over Microsoft Windows Vulnerability Actively Exploited by Attackers

CVE-2025-59230 is a significant vulnerability affecting Microsoft Windows, classified as an improper access control flaw that allows authorized attackers to escalate their privileges on compromised systems. It is embedded within the Windows Remote Access Connection Manager and enables attackers to execute malicious code with elevated rights, access sensitive data, and move laterally across network segments. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on October 14, mandating federal civilian executive branch agencies to apply security patches by November 4, in accordance with Binding Operational Directive 22-01. Organizations are encouraged to apply Microsoft’s security updates promptly, follow BOD 22-01 guidance, and isolate affected systems if patches cannot be applied.
New IAmAntimalware Tool Injects Malicious Code Into Processes Of Popular Antiviruses
Tech Optimizer
October 14, 2025

New IAmAntimalware Tool Injects Malicious Code Into Processes Of Popular Antiviruses

A new tool called IAmAntimalware was released on October 11, 2025, by a developer known as Two Seven One Three on GitHub. It is designed to infiltrate antivirus software by injecting malicious code, exploiting vulnerabilities in Windows service cloning and digital signature manipulation. IAmAntimalware can clone legitimate antivirus services, allowing it to bypass antivirus self-protection mechanisms. It modifies the Windows Cryptography API registry to hijack the cryptographic provider and supports COM object CLSID manipulation for component loading. The tool relies on a companion tool named CertClone to duplicate valid Windows certificates, making injected DLLs appear legitimate. Demonstrations have shown its ability to inject code into processes like Bitdefender’s BDProtSrv, creating unauthorized files within antivirus folders. Although widespread exploitation has not yet occurred, its open-source nature and straightforward design could lead to increased adoption. Security analysts rate the technique as medium severity due to its reliance on system access and lack of zero-day exploits, highlighting vulnerabilities in antivirus trust models. Experts recommend monitoring unusual module loads and enforcing strict certificate trust policies to mitigate risks associated with IAmAntimalware.
Search