zero-day vulnerabilities Archives

AppWizard

September 15, 2026

Active Exploitation Alert: Threat Actors Abuse Anthropic Claude AI to Extract Secrets from 1.8M Android Apps in Major Credential Theft Campaign

Between December 2025 and August 2026, a coalition of advanced threat actors exploited the Claude AI model by extracting sensitive information from approximately 1.8 million Android applications. The operation involved groups such as ShinyHunters, Midnight Blizzard (APT29/Nobelium), and the Chinese-speaking entity GTG-10007. They automated the mass download, decompilation, and analysis of Android APKs for hardcoded credentials, API keys, and authentication tokens, leading to extensive credential theft and breaches across various sectors. The attack utilized a distributed pipeline on ten AWS EC2 instances to download APKs, which were then scanned using TruffleHog. Verified secrets were organized and routed in real-time to a private Telegram group for operational deployment. Over 2,100 Azure AD authentication tokens were extracted from more than 40 Microsoft tenants within 34 hours. The operation also included a carding component where stolen payment card data was sold. The tactics employed aligned with several MITRE ATT&CK techniques, including file discovery, unsecured credentials, valid accounts, phishing, and exploitation of remote services. ShinyHunters gained administrative control over targeted environments rapidly, leading to bulk data theft affecting over 200 organizations. Midnight Blizzard automated malware creation and phishing campaigns, targeting government and defense entities. GTG-10007 used Claude for coordinated offensive operations, discovering zero-day vulnerabilities and delivering exploits. Initially, the campaign targeted a broad range of Android APKs but later focused on organizations with valuable credentials across various sectors, including government, technology, and healthcare. Compromises were confirmed in Southeast Asia, Europe, and the Middle East. Organizations are advised to audit Android applications for hardcoded secrets, monitor API key usage, and implement robust security practices to mitigate risks.

Winsage

September 10, 2026

Microsoft patches 966 vulnerabilities: Two Windows zero-days actively exploited

On September 8, 2026, Microsoft released 966 security updates, the largest Patch Tuesday to date, addressing various vulnerabilities. Among these, 105 were classified as critical, including two zero-day vulnerabilities: CVE-2026-81963 and CVE-2026-85880. Both allow authorized local attackers to escalate privileges to SYSTEM level. CVE-2026-81963 is related to the Windows Update Stack, while CVE-2026-85880 involves a heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC). The updates included 438 vulnerabilities related to privilege escalation, 258 concerning remote code execution, and 173 involving information disclosures. Users are advised to prioritize the installation of these updates due to the potential exploitation of the two critical vulnerabilities.

Tech Optimizer

September 6, 2026

“Iran unveils second homegrown antivirus to counter malware and cyberattacks”

Iran has introduced its second domestically developed antivirus software, Ayyza, which utilizes artificial intelligence and machine learning to detect known and unknown cyber threats. The antivirus is designed to protect against malware, viruses, Trojans, ransomware, and advanced persistent threats (APTs). Ayyza's detection engine is developed in-house and operates at the Windows kernel level to enhance detection accuracy and speed while minimizing hardware resource consumption. It can receive updates offline or via Iran’s National Information Network. Ayyza's machine-learning capabilities allow it to identify emerging threats, including previously unknown malware and zero-day vulnerabilities. The company has also created complementary security tools, such as privileged access management (PAM) systems and data leakage prevention tools, to enhance overall cybersecurity. The company's products are currently used in various Iranian infrastructures, including banking, financial, and governmental systems.

Tech Optimizer

August 30, 2026

‘Antivirus Is Turned Off’—Microsoft Confirms Windows Update Mistake

Microsoft has confirmed that notifications stating “Microsoft Defender Antivirus is turned off” are erroneous and can appear during startup and intermittently, even with notification settings disabled. The issue stems from recent updates to Windows antivirus software, but the antivirus is functioning correctly. This problem affects all versions of Windows or Windows Server running Microsoft Defender Antivirus with the latest updates. Users may see pop-ups urging them to “Turn on virus protection,” which falsely suggest that protection is disabled. Microsoft is working on a resolution, and users are advised to verify that their antivirus is operational and that real-time protection is enabled.

Winsage

August 16, 2026

Microsoft threatened legal action, and this researcher just dropped a new Windows bug anyway

Microsoft has faced legal warnings regarding the disclosure of vulnerabilities, but security researcher Nightmare Eclipse has revealed a new exploit called ShieldBreak that targets Windows Defender. This vulnerability allows attackers to escalate privileges from a low-level user account to full system access on Windows 10, Windows 11, and Windows Server 2025. The proof of concept for ShieldBreak is available as a downloadable application, requiring execution to activate the exploit. Security expert Will Dormann confirmed that Windows Defender must be activated for the attack to succeed. ShieldBreak builds upon a previous exploit named RoguePlanet, which Microsoft patched inadequately, allowing ShieldBreak to bypass the fix. Microsoft is currently investigating the reported vulnerability, but no patch has been released yet.

Winsage

August 12, 2026

ShieldBreak: New Windows Zero-Day Bypasses Microsoft’s RoguePlanet Patch

Chaotic Eclipse, a security researcher, has revealed a proof-of-concept (PoC) for a new vulnerability called ShieldBreak, which is a zero-day flaw in Microsoft Defender that bypasses the patch for the previously identified CVE-2026-50656 (RoguePlanet). This vulnerability could allow attackers to execute code at the SYSTEM level on affected Windows systems. Chaotic Eclipse tested the PoC on the latest versions of Windows 11 and Windows Server 2025, achieving a 100% success rate. Windows 10 and its server editions are not supported by the PoC but remain vulnerable. Microsoft had issued security updates for RoguePlanet, which has a CVSS score of 7.8, affecting the Malware Protection Engine and representing a local privilege escalation issue. Chaotic Eclipse has previously disclosed two other zero-day vulnerabilities, YellowKey and GreenPlasma, which affect BitLocker and the Windows Collaborative Translation Framework, respectively. Microsoft criticized the public disclosure of these vulnerabilities as irresponsible and emphasized the importance of Coordinated Vulnerability Disclosure.

Tech Optimizer

July 27, 2026

What Prevents Zero-Day Exploits? A Practical Guide to Stopping Unknown Threats

Zero-day exploits are attacks that take advantage of previously unknown software vulnerabilities before a vendor can issue a patch. These exploits pose significant challenges because organizations cannot address vulnerabilities they are unaware of, and traditional security measures may not effectively identify them. Zero-day vulnerabilities are distinct from zero-day exploits; the former refers to the software flaw itself, while the latter is the method used by attackers to exploit that flaw. Zero-day exploits are particularly dangerous because they give attackers a temporary advantage, allowing them to compromise systems before defenders can respond. These exploits are commonly used in advanced attacks, including ransomware campaigns and espionage. The lifecycle of a zero-day exploit typically involves discovering a vulnerability, weaponizing it, delivering the exploit, executing malicious code, and achieving the attacker's objectives. Traditional antivirus solutions may not consistently prevent zero-day exploits, as they primarily focus on known threats. Endpoint Detection and Response (EDR) platforms provide visibility and detection but do not inherently prevent exploitation. Effective prevention strategies emphasize stopping the exploitation techniques themselves, rather than solely relying on detection. Memory-based attack prevention is a key approach, as all exploits must execute within memory. This method disrupts exploitation techniques and can protect against unknown vulnerabilities. Best practices for preventing zero-day exploits include reducing the attack surface, enforcing least privilege, maintaining aggressive patch management, strengthening identity security, deploying prevention-based endpoint protection, and maintaining a layered security strategy.

Tech Optimizer

July 21, 2026

Advanced Threat Protection: How AI Transforms Enterprise Security

An attacker is testing stolen passwords against a company with inadequate firewall protection, highlighting the flaws in traditional security measures. Modern attacks, including ransomware and phishing, have evolved, necessitating advanced threat protection (ATP) that incorporates artificial intelligence (AI) for improved threat detection and response. AI-driven ATP identifies attacks that conventional tools miss, such as fileless malware and targeted phishing, by learning normal operating patterns and flagging deviations. Traditional security relies on known malware signatures, which are ineffective against zero-day attacks and polymorphic malware that changes its identity. Cloud misconfigurations and hybrid security gaps further complicate security. AI enhances detection by focusing on malicious behaviors rather than just file signatures, allowing for rapid identification of threats. Automated incident response can isolate affected endpoints and terminate malicious processes quickly. Behavioral analytics and threat intelligence integration improve ATP effectiveness by understanding user behavior and recognizing attack patterns. AI-powered ATP significantly reduces breach containment time and false positives, shifting the focus from reactive cleanup to proactive prevention. Best practices for maximizing ATP include integrating it into existing security operations, keeping machine learning models updated, and regularly testing defenses against real-world threats.

Tech Optimizer

July 21, 2026

Advanced Threat Protection: How AI Transforms Enterprise Security

An attacker is testing stolen passwords against a company that incorrectly believes its firewall is sufficient protection. Traditional defenses have become inadequate due to the speed and sophistication of modern attacks, including ransomware groups renting tools and phishing kits being easily accessible. Advanced threat protection (ATP) was designed to address these challenges, especially with the integration of artificial intelligence (AI). AI-powered ATP identifies attacks that conventional tools overlook, such as fileless malware and targeted phishing attempts, by learning the normal behavior of an organization’s environment and flagging anomalies. Traditional security relies on identifying known malware through established fingerprints, which fails against novel threats like zero-day attacks and polymorphic malware. The rise of remote work and cloud services has introduced new risks due to misconfigurations and inconsistent security rules. AI enhances threat detection by focusing on malicious behavior rather than matching files against known threats, allowing for rapid detection and automated incident response. Behavioral analytics establishes a baseline for users and devices, flagging deviations that may indicate insider threats or credential theft. Integrating threat intelligence provides insights into emerging threats and helps prioritize alerts. AI-driven ATP can contain breaches faster, significantly reducing the financial impact and dwell time of attackers. Best practices for maximizing ATP include integrating with security operations, ensuring comprehensive coverage, updating models regularly, conducting real-world testing, securing AI systems, and maintaining human oversight.

Winsage

July 16, 2026

Nightmare Eclipse Drops ‘LegacyHive’ Windows Zero-Day

A security researcher known as Nightmare Eclipse has revealed a new unpatched vulnerability in Windows, named LegacyHive, which is a local privilege escalation flaw in the Windows User Profile Service. This vulnerability allows attackers to access and load user hives of other accounts, including administrators. Nightmare Eclipse has provided proof-of-concept exploit code that works on systems with Microsoft's July 2026 patches. The exploit initially did not require user credentials but now necessitates them for accessing other hives. Nightmare Eclipse has previously disclosed over half a dozen zero-day vulnerabilities affecting Microsoft products. Microsoft has not yet acknowledged the LegacyHive exploit.