technique Archives

Tech Optimizer

September 3, 2026

Prolific Microsoft 0-day hunter drops CrowdStrike Falcon exploit PoC

Nightmare Eclipse, a security researcher known for identifying vulnerabilities in Microsoft products, has shifted focus to other vendors, revealing a zero-day vulnerability called FalconFlank that targets CrowdStrike’s Falcon endpoint security platform. FalconFlank is a privilege escalation vulnerability that exploits the Microsoft Office malicious macros remediation feature within CrowdStrike Falcon. CrowdStrike is investigating the claims and advises customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting while assuring them of continued protection through Cloud Anti-malware settings. The exploit works on fully updated Windows 11 25H2 and Windows Server 2025 systems running CrowdStrike Falcon with Optimal Protection enabled. Nightmare Eclipse has also discovered other vulnerabilities, including HardBreacher affecting Kaspersky’s endpoint antivirus and PrettyPrague in Gen Digital’s Avast antivirus, which allows attackers to dump the SAM database. Gen Digital is developing a patch for the Avast vulnerability, while Kaspersky has not commented. Additionally, Nightmare disclosed a memory corruption zero-day vulnerability in Nvidia, named GreenSection, which causes system crashes.

Winsage

September 1, 2026

Windows has been hiding these 4 powerful features in plain sight this whole time

Windows has several advanced features that can enhance productivity, including: - Clipboard History: Activated by pressing Windows+V, this feature stores the last 25 copied items and can be enabled through Settings > System > Clipboard. Users can pin frequently used items for easy access. - Virtual Desktops: Allows users to create multiple workspaces on a single monitor by pressing Windows+Ctrl+D. Users can switch between desktops using Windows+Ctrl+Left Arrow/Right Arrow or Windows+Tab. - Focus Sessions: A built-in Pomodoro timer in the Clock app that promotes productivity by working for 25 minutes followed by a 5-minute break. - Snipping Tool: Accessible via Windows+Shift+S, it allows users to capture screenshots and includes features like screen recording, a color picker, and a Text Extractor for converting text from images. - PowerToys: A suite of free and open-source tools from Microsoft that enhances Windows functionalities, including additional utilities and personalized templates.

AppWizard

August 29, 2026

Elden Ring players are hard at work putting the new Tarnished Edition DLC’s new gear to the test

The Tarnished Edition of Elden Ring has introduced new armor sets, weapons, and starting classes, prompting players to experiment with the game's mechanics. Notable player SaxSlaveGael demonstrated the effectiveness of a new sword's Muleta skill against the boss Gaius, while Ilamahradeys showcased the sword's power by nearly depleting the health of the Full-Grown Fallingstar Beast with a single jab. Players are also focusing on aesthetics, with the "fashion souls" concept thriving, as seen with admiration for a new chestpiece from the Idus starting class. Additionally, the heavy armor class introduced in the DLC has gained attention for its enhanced vigor and strength stats, beneficial for melee characters. The excitement for the Tarnished Edition reflects players' eagerness to explore the new content.

AppWizard

August 24, 2026

Legendary Mac Game Celebrates 40th Anniversary With PC Port

Dark Castle, a classic game from 1986, is being re-released as an official port to PC to celebrate its 40th anniversary. Originally developed for Macintosh, the game was notable for its innovative use of animations and gameplay mechanics, despite the platform's limitations in graphics. The game was created by Silicon Beach Software in collaboration with artist Mark Stephen Pierce and programmer Jonathan Gay, utilizing a technique called "page flipping" to enhance performance. Dark Castle is known for its challenging gameplay and has a sequel, Beyond Dark Castle. Both games are now available on Steam, providing a modern way to experience these titles.

AppWizard

August 23, 2026

Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices

A new Android malware threat, codenamed Manic, poses significant risks to Ukrainian banks, government services, and messaging applications, with a reach extending to Russian and European financial institutions, global fintech platforms, cryptocurrency services, and military communication channels. Manic combines Android banking malware and mobile spyware, targeting sensitive applications and enabling comprehensive device takeover. It features a novel Wi-Fi mesh technique for data relay through compromised devices and utilizes phishing sites and dropper apps. The malware originated in February 2026, with initial development leading to its first deployment by late May. It monitors 169 package IDs related to banks, payment services, and messaging applications, primarily affecting Ukrainian targets but also impacting applications in Russia and Europe. Manic can infiltrate commercial and military messaging apps, track locations, monitor notifications, and collect files. It exploits Android's accessibility services to capture sensitive data and employs a store-and-forward relay mechanism for data exfiltration through nearby compromised devices. Google has stated that no apps containing this malware are found on Google Play, and Android users are protected by Google Play Protect.

Winsage

August 22, 2026

Hackers abuse FTP server banners to deliver new Windows malware

Threat actors are exploiting FTP banners to conceal commands for deploying two undocumented remote access trojans (RATs), E4del and PINHOLE. This method was first observed by MalwareHunterTeam in July 2026, using shortcut files (.LNK) and FTP server banners as dead-drop resolvers to retrieve malicious commands. SOCRadar confirmed that this technique has been weaponized since early July 2026 and remains active, with new infrastructure identified as recently as August 2026. The attacks typically start with a ZIP archive leading to an LNK-based infection chain, likely initiated through phishing tactics. E4del is a Node.js-based RAT disguised within a digitally signed Electron application mimicking Discord, capable of executing commands, capturing screenshots, streaming desktops, and downloading additional payloads. It also includes a module for privilege escalation. PINHOLE retrieves its command and control configuration from Pinterest and SurveyMonkey, designed to leave a minimal footprint and employing shellcode fluctuation. It supports 14 commands, including file management and credential theft, but had only recorded 11 execution events at the time of analysis. SOCRadar notes that while using FTP banners is a novel approach, it is less stealthy than traditional web-based dead-drop resolvers. They provide indicators of compromise to help identify malicious infrastructure and infected machines.

Winsage

August 22, 2026

Researchers find way to weaponize Windows Defender’s own driver

Check Point Research revealed a technique that uses the boot-time remediation driver BTR.sys, part of Windows Defender, to execute kernel-level operations on Windows systems from Windows 7 to Windows 11 25H2. This method does not exploit software vulnerabilities but leverages BTR.sys, which is designed to remove locked malware components. Researchers reverse-engineered its undocumented protocol, leading to the creation of a proof-of-concept tool, BTR_CLI, that can install the driver as a service without standard management protocols. Once operational, BTR.sys can delete or move files, modify registry entries, and remove security binaries, including parts of Defender, during a specific period when the file system is writable. To exploit this technique, an attacker needs administrator privileges, specifically SeLoadDriverPrivilege. Although Microsoft does not consider this a critical issue due to the requirement of pre-existing administrative access, it highlights a significant potential vulnerability. There have been no documented real-world attacks using this technique.

AppWizard

August 20, 2026

Google is cracking down on Android apps that use too much memory

Google is implementing stricter memory management for Android applications, extending memory limits for individual apps introduced with Android 17 to devices with 4GB to over 16GB of RAM. The new strategy involves transferring app data into compressed memory (zRAM) when an app reaches its memory limit, which may slightly decrease performance. If an app continues to consume excessive memory, Android can terminate it. Google encourages developers to optimize their apps for these new constraints and is providing tools and resources to help identify high memory consumption issues. Users with limited RAM devices may experience fewer slowdowns, but apps that require substantial memory may face performance challenges or closure if not optimized.

Winsage

August 17, 2026

⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More

A suspected advanced persistent threat (APT) group linked to China exploited a newly patched vulnerability in VMware vCenter (CVE-2026-59310), which has a critical CVSS score of 9.8, allowing for arbitrary code execution and the deployment of Babuk-derived ransomware. A recently patched vulnerability in Apple macOS (CVE-2026-65400) has been exploited to deploy a cryptocurrency miner, granting unauthorized root access. The Lazarus Group from North Korea exploited a zero-day vulnerability in Microsoft Windows, targeting defense and aerospace sectors. GeoServer patched a critical SQL injection vulnerability that was actively exploited. A new macOS malware, Amnesia Stealer, targets users through ClickFix attacks, stealing data and allowing real-time access to authenticated sessions. A novel attack technique named GhostSplice can manipulate AI coding assistants. Research revealed a method exploiting Chromium's DevTools Protocol for data theft. Noteworthy CVEs this week include CVE-2026-68820, CVE-2026-58231, and multiple others across various platforms. A high-severity command injection flaw in FileRun allows remote code execution. An advanced ClickFix attack has been reported, deploying sophisticated malware. A heap overflow vulnerability in Citrix NetScaler was patched after indications of exploitation. A new malware loader targeting Portuguese-speaking users has been identified. A significant reduction in exposed Automatic Tank Gauge systems has been observed. A phishing campaign targeting Brazil has been detected, and an F.B.I. agent faces charges for unauthorized crypto withdrawals. Authorities in Ukraine dismantled fraudulent call centers, and a North Carolina man was sentenced for cyber extortion. Unauthorized access to sensitive data by the ExfilSquad group has been confirmed. LightSpy activity linked to China has been detected in over 13 countries. A supply chain attack exposed over 2,500 companies, and an Azure exfiltration campaign has exposed millions of enterprise records.

Winsage

August 14, 2026

Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth

The threat actor known as HoneyMyte, also referred to as Mustang Panda, has been deploying an upgraded version of the CoolClient backdoor, which includes a signed Windows kernel-mode rootkit. This rootkit enhances the malware's ability to conceal malicious processes, files, registry objects, and command-and-control (C2) network information. Victims have been identified in Myanmar, Mongolia, Pakistan, and Russia, with confirmed targets including government entities. The CoolClient backdoor is deployed as a secondary access layer following an initial PlugX infection. The kernel component activates when CoolClient gains full access to the Service Control Manager (SCM) and the SeTcbPrivilege privilege. If these conditions are not met, the malware bypasses driver deployment and advances to the final-stage implant. Kaspersky has provided indicators of compromise (IoCs), including file hashes, paths, and C2 domains. In a campaign targeting Myanmar, HoneyMyte used PlugX as the initial implant to deploy CoolClient, which involved creating Microsoft Defender exclusions and renaming a legitimate executable for DLL sideloading. Persistence is achieved through a scheduled task that executes the binary with SYSTEM privileges at startup. Execution begins when a legitimate application loads a malicious DLL, which then manages persistence, registry modifications, UAC bypass, process injection, driver deployment, and C2 communications. When privileges are granted, the malware extracts a kernel driver, writes it to disk, and establishes a driver service. The driver is digitally signed with a certificate from Nanjing Ranyi Technology Co., Ltd. The driver receives configuration data from the CoolClient user-mode component and utilizes specific IOCTL requests to register trusted processes and protect filesystem and registry paths. The rootkit can limit access rights to protected processes, hide processes by unlinking them from the active process list, and deny access to protected files and directories. It also filters C2 IPv4 addresses from network information. The driver incorporates 33 IOCTL handlers, but only three were observed in use during standard execution. Kaspersky shared several file hashes related to the malware, including those for the kernel driver and malicious DLLs. This follows earlier disclosures regarding a newer CoolClient variant and a different HoneyMyte kernel-mode rootkit documented in December 2025.