UAC bypass Archives • Daily CyberSecurity

CVE-2026-50454: Public PoC Shows Windows AppResolver Elevation of Privilege to SYSTEM

Windows AppResolver LPE CVE-2026-50454 UAC bypass chain to a SYSTEM shell and Elevation of Privilege

CVE-2026-50454: Public PoC Shows Windows AppResolver Elevation of Privilege to SYSTEM

Do Son July 24, 2026

A public proof-of-concept details the Windows AppResolver LPE (CVE-2026-50454), a UAC bypass that chains an admin token to a SYSTEM shell.

Weaponized JPEG Payload Deploys Trojanized ScreenConnect for Covert Espionage axios Supply Chain Attack WAVESHAPER.V2 SnappyBee Malware Salt Typhoon Stately Taurus ScoringMathTea RAT, Lazarus Reflective DLL

axios Supply Chain Attack WAVESHAPER.V2 SnappyBee Malware Salt Typhoon Stately Taurus ScoringMathTea RAT, Lazarus Reflective DLL

Weaponized JPEG Payload Deploys Trojanized ScreenConnect for Covert Espionage

Do Son May 14, 2026

CYFIRMA warns of Operation SilentCanvas: A weaponized JPEG delivers trojanized ScreenConnect, bypassing AMSI and UAC for full-system surveillance. Stay alert!

PureRAT Unmasked: The Stealthy, Multi-Stage “Dynamic Loader” Targeting Windows PureRAT Malware Steganography Evasion

PureRAT Unmasked: The Stealthy, Multi-Stage “Dynamic Loader” Targeting Windows

Do Son April 23, 2026

Trellix uncovers PureRAT, a modular Trojan hiding malware in PNG images. Learn how it uses steganography and fileless delivery to bypass Windows security.

New Stealth Attack Chain Weaponizes Legitimate Remote Access Software ScreenConnect Hijack In-Memory Attack

New Stealth Attack Chain Weaponizes Legitimate Remote Access Software

Do Son April 14, 2026

Zscaler reveals a 2026 attack chain using fake Adobe Reader lures to install ScreenConnect via in-memory execution and UAC bypass. Protect your network now!

WhatsApp Under Siege: Microsoft Uncovers Global VBS Malware Campaign WhatsApp VBS Malware Living-off-the-Land (LotL)

WhatsApp Under Siege: Microsoft Uncovers Global VBS Malware Campaign

Do Son April 7, 2026

Microsoft Defender warns of a 2026 WhatsApp malware campaign using VBS and renamed system tools to hijack PCs via AWS and Tencent Cloud. Stay alert!

ResokerRAT Uses Telegram to Hijack Your PC and Disable Your Security Keys GuLoader Malware CloudEye Obfuscation npm, malware Ethereum, npm supply chain OAST techniques StilachiRAT macOS Malware PasivRobber

GuLoader Malware CloudEye Obfuscation npm, malware Ethereum, npm supply chain OAST techniques StilachiRAT macOS Malware PasivRobber

ResokerRAT Uses Telegram to Hijack Your PC and Disable Your Security Keys

Do Son April 6, 2026

Researchers unmask ResokerRAT, a stealthy Trojan using Telegram to spy on systems and block security tools like Task Manager. Is your PC calling home?

The 25-Second Heist: Inside FAUX#ELEVATE’s “Inflated” Phishing Attack on French Corporations FAUX#ELEVATE Living-off-the-Land Attack

The 25-Second Heist: Inside FAUX#ELEVATE’s “Inflated” Phishing Attack on French Corporations

Do Son March 31, 2026

Securonix uncovers FAUX#ELEVATE, a 25-second attack using 10MB "inflated" VBScripts to steal credentials and mine crypto in French corporate environments.

Code by AI: KONNI APT Targets Crypto Devs with “Polished” Backdoor NATS-as-C2 Sysdig CVE-2026-33017 Langflow RCE Microsoft Phone Link Hijack CloudZ Pheno Plugin Insider Threat BlackCat (ALPHV) OFAC Sanctions DPRK IT Workers Transparent Tribe APT36 React2Shell, EtherRAT SideWinder Espionage, Netlify Phishing DDNS Abuse, C2 Infrastructure Hacking Health Club

NATS-as-C2 Sysdig CVE-2026-33017 Langflow RCE Microsoft Phone Link Hijack CloudZ Pheno Plugin Insider Threat BlackCat (ALPHV) OFAC Sanctions DPRK IT Workers Transparent Tribe APT36 React2Shell, EtherRAT SideWinder Espionage, Netlify Phishing DDNS Abuse, C2 Infrastructure Hacking Health Club

Code by AI: KONNI APT Targets Crypto Devs with “Polished” Backdoor

Do Son January 26, 2026

KONNI APT targets APAC developers with AI-generated malware disguised as crypto projects. The "polished" backdoor steals wallets & credentials.

“Purchase Order” Deception: Sophisticated Loader Targets Manufacturing Giants in Italy, Finland, and Saudi Arabia Unified Commodity Loader, Steganographic RAT

Unified Commodity Loader, Steganographic RAT

“Purchase Order” Deception: Sophisticated Loader Targets Manufacturing Giants in Italy, Finland, and Saudi Arabia

Do Son December 23, 2025

Cyble reveals a unified commodity loader targeting Europe & Middle East. It uses steganography and a unique UAC bypass to deploy multiple RATs.

Sophisticated CastleRAT Backdoor Uses Steam Community Pages as Covert C2 Resolver for Espionage CastleRAT, Steam C2 Resolver

Sophisticated CastleRAT Backdoor Uses Steam Community Pages as Covert C2 Resolver for Espionage

Do Son December 9, 2025

A new C-compiled RAT, CastleRAT, uses Steam Community pages to hide its C2. The malware deploys advanced features like UAC Bypass, screen capture, and clipboard hijacking for espionage.

SafePay Ransomware Unleashed: New LockBit 3.0 Variant Hits 200+ MSPs & SMBs Worldwide safe

SafePay Ransomware Unleashed: New LockBit 3.0 Variant Hits 200+ MSPs & SMBs Worldwide

Do Son July 11, 2025

SafePay, a new centralized ransomware group linked to LockBit 3.0, has hit 200+ MSPs/SMBs via RDP. It bypasses Defender, encrypts files, and exfiltrates data using WinRAR and FileZilla.

Katz Stealer: New Stealthy MaaS Steals Everything, Hides in Images, and Hijacks Discord katz

Katz Stealer: New Stealthy MaaS Steals Everything, Hides in Images, and Hijacks Discord

Do Son June 16, 2025

Katz Stealer, a new stealthy MaaS, is actively stealing data from browsers, crypto wallets, and apps, using advanced evasion tactics like steganography and Discord hijacking.

Beware Katz Stealer: Sophisticated Malware-as-a-Service Steals Everything katz

Beware Katz Stealer: Sophisticated Malware-as-a-Service Steals Everything

Do Son May 29, 2025

Katz Stealer, a new MaaS infostealer, targets browsers, crypto wallets, and Discord using advanced evasion and UAC bypass techniques.

SafePay Ransomware: A New Threat with Sophisticated Techniques

Do Son November 17, 2024

Uncover the details about SafePay ransomware: a stealthy and sophisticated strain with ties to known families like LockBit.