Do Son Microsoft finds hackers using SolarWinds WHD to run hidden QEMU VMs. The attack uses DLL sideloading for full domain compromise. Patch immediately.
Microsoft Defender
Microsoft warns of "CrashFix": malicious extensions crash browsers to trick users into running a "fix" that installs a RAT. Beware fake ad blockers.
Microsoft warns: Infostealers now target macOS & use WhatsApp worms. "Eternidade" & "Crystal PDF" steal credentials via cross-platform attacks.
Microsoft Defender's Smart App Control is blocking ASUS Armoury Crate in Jan 2026. Learn why your ROG Ally controls are broken and how to fix it.
Microsoft warns of an AiTM phishing campaign targeting the energy sector. Hackers steal session cookies and abuse SharePoint to launch internal attacks.
Microsoft Defender's new FakeMas filter is erroneously blocking the official MAS activation script due to a typosquatted domain war. Learn the fix.
Microsoft blocked a credential phishing campaign that used AI to generate complex, verbose code in an SVG file to obfuscate its payload and evade defenses.
SonicWall and Microsoft uncover a campaign distributing a trojanized NetExtender VPN client that steals credentials by bypassing certificate validation.
Windows 11's Smart App Control offers proactive malware blocking with performance benefits over traditional antivirus. Learn how it works.
Threat actors abuse Node.js in malvertising campaigns to steal data and deliver malware via fake crypto installers and stealthy PowerShell scripts.
Learn about Security Copilot agents, Microsoft's solution to modern cyber threats, and their role in enhancing organizational security.
Learn about the I2PRAT malware campaign, a sophisticated threat that leverages the Invisible Internet Project (I2P) to hide its activities and evade detection.
Discover the details of CVE-2024-38217 (LNK stomping), a zero-day vulnerability affecting Microsoft Defender. See how hackers exploit this flaw to bypass security safeguards.
The CVE-2024-21338 (CVSS 7.8) vulnerability allowed attackers to deploy an advanced, stealthy rootkit, named "FudModule."