🧰 Windows

The items that name it 277

• Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer
  writeupas affected products2026-10-31
• Malicious Claude Code extension on Cursor planted SSH backdoors
  articleas affected products2026-10-30

  Microsoft

• Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines
  writeupas affected products2026-10-30
• Cursor Removes Malicious Claude Code 2.1.313 Extension From Its Marketplace
  articleas affected products2026-10-30
• TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines
  articleas classification.technologies2026-10-30
• Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
  writeupas affected products2026-10-30
• A quiet week in infosec <.<
  articleas affected products2026-10-29It is written here as Windows (target of NIK C2).

  target of NIK C2

• Digital Forensics: Analyzing Windows Prefetch Files for Evidence
  articleas classification.technologies2026-10-29
• NIK C2: The new AI-enabled command-and-control framework
  writeupas classification.technologies2026-10-29
• Dark Web Intelligence (@DailyDarkWeb) on X
  threadas affected products2026-10-29It is written here as Windows (native HTTP/3, kernel QUIC).

  native HTTP/3, kernel QUIC

• Managed for Malice: How Attackers Turn MDM into Remote Access
  writeupas classification.technologies2026-10-28
• Camera Management Software Compromise Leads to Malware Deployment
  writeupas classification.technologies2026-10-27
• Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover
  articleas classification.technologies2026-10-27
• cubillas (@cubillas888) on X
  threadas classification.technologies2026-10-27
• Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
  advisoryas classification.technologies2026-10-26
• Adaptix C2 Architecture: Configuring Command & Control Listeners
  articleas classification.technologies2026-10-26
• David Gutierrez | Eng (@david_x_ai) on X
  threadas classification.technologies2026-10-25
• x86rc/unthemidator
  repoas classification.technologies2026-10-23
• Field Notes: Reconstructing an Attacker’s Workflow
  writeupas affected products2026-10-22
• [tl;dr sec] #351 - PHP2Shell, Autopatching Skills, AWS Pathrunner
  articleas classification.technologies2026-10-22
• VibecodersHQ (@VibeCodrHQ) on X
  threadas classification.technologies2026-10-21
• litellm 1.107.0 Compromised on PyPI: Backdoored Wheels Drop a Credential Stealer and an Hourly Remote Code Loader
  writeupas affected products2026-10-21It is written here as Windows: the remote code loader fails (no fcntl or os.fork), but the stealer still runs.

  no fcntl or os.fork

• Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware
  writeupas affected products2026-10-21It is written here as Windows (Run dialog, finger.exe, curl, tar; Windows-specific payloads).

  Run dialog, finger.exe, curl, tar; Windows-specific payloads

• lee1981 (@lee1981b) on X
  articleas classification.technologies2026-10-21
• Active and Passive Attacks against TPM 2.0-based Full Disk Encryption
  paperas classification.technologies2026-10-21
• Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)
  advisoryas classification.technologies2026-10-21
• There's only so much code: the rise in vulnerability numbers
  articleas classification.technologies2026-10-20
• Digital Forensics: Analyzing Systems with Live-Forensicator
  articleas affected products2026-10-20It is written here as Windows (tested platform for Live-Forensicator; the tool also works on Linux and macOS).

  tested platform for Live-Forensicator; the tool also works on Linux and macOS

• AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign
  articleas classification.technologies2026-10-20
• Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks
  articleas classification.technologies2026-10-19
• Santhosh Patel (@santhosh_patell) on X
  threadas classification.technologies2026-10-19
• In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit
  articleas affected products2026-10-16It is written here as Windows (KGB RAT target; Windows Defender evaded via daily crypter updates).

  KGB RAT target; Windows Defender evaded via daily crypter updates

• AI-Powered Espionage Campaign Targets Government Linux Infrastructure
  articleas affected products2026-10-15It is written here as Windows (SysGoRAT supports it).

  SysGoRAT supports it

• CikaBika Bot RAT Uses Discord for C&C
  articleas affected products2026-10-15It is written here as Windows (LNK shortcut, UAC, PowerShell).

  LNK shortcut, UAC, PowerShell

• Investigating Ephemeral Supply Chain Tampering
  writeupas classification.technologies2026-10-15
• Dark Web Informer (@DarkWebInformer) on X
  threadas classification.technologies2026-10-14
• Dark Web Informer (@DarkWebInformer) on X
  threadas classification.technologies2026-10-14
• Passkeys Raise the Bar. Here’s Where Attackers Can Still Get In.
  articleas classification.technologies2026-10-14
• ♫Why♥Not♪ (@Python_s_) on X
  advisoryas classification.technologies2026-10-14
• XBOW Used AI to Hack Google Chrome in Six Days, Earning $250,000
  articleas affected products2026-10-14It is written here as Windows (code execution outside the Chrome sandbox demonstrated).

  code execution outside the Chrome sandbox demonstrated

• Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations
  articleas classification.technologies2026-10-14
• Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day
  articleas affected products2026-10-14It is written here as Windows (1,102 CVEs patched in October 2026 Patch Tuesday).

  1,102 CVEs patched in October 2026 Patch Tuesday

• Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)
  writeupas classification.technologies2026-10-13
• Patch Tuesday - October 2026
  advisoryas affected products2026-10-13It is written here as Windows (1,102 vulnerabilities in October 2026 Patch Tuesday; Microsoft published 1,413 own-product vulnerabilities in total).

  1,102 vulnerabilities in October 2026 Patch Tuesday; Microsoft published 1,413 own-product vulnerabilities in total

• Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities
  advisoryas classification.technologies2026-10-13
• ZDI: The October 2026 Security Update Review
  advisoryas classification.technologies2026-10-13
• XBOW Built a Chrome Full-Chain Exploit Affecting a Billion Users in Six Days | XBOW
  articleas affected products2026-10-13It is written here as Windows (machine taken over via the Chrome full-chain exploit).

  machine taken over via the Chrome full-chain exploit

• Zero to calc in six days: inside XBOW's Chrome full chain
  writeupas classification.technologies2026-10-13
• XWorm RAT Evolves Into Surveillance Platform
  articleas affected products2026-10-13It is written here as Windows (XWorm RAT targets Windows systems).

  XWorm RAT targets Windows systems

• ThreatWire (@ThreatWire_) on X
  threadas classification.technologies2026-10-10
• No, Your Tools Are Not Enough: It's Time to Bring Agents to the Hunt
  paperas classification.technologies2026-10-10
• Telegram Desktop vulnerability allowed any user's file to be stolen
  writeupas classification.technologies2026-10-10
• Unpatched AhsayCBS Vulnerabilities Exploited in the Wild
  articleas classification.technologies2026-10-09
• Post-quantum authentication: Why organizations should start testing certificate ecosystems now
  articleas classification.technologies2026-10-08
• Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
  writeupas classification.technologies2026-10-08
• Malicious npm Campaign “MALFEX” Delivers RAT and Stealer via Eight Packages with 40,000+ Downloads
  articleas affected products2026-10-08

  Platform affected by all three malware families; payloads silently fail on non-Windows platforms

• Microsoft, Adobe, Apple, and Foxit vulnerabilities
  advisoryas classification.technologies2026-10-07
• 3 lessons from frontier AI vulnerability research
  writeupas affected products2026-10-07It is written here as Windows (140 CVEs assigned May 2026–September 2026, including 52 addressed in September 2026 security release).

  140 CVEs assigned May 2026–September 2026, including 52 addressed in September 2026 security release

• Malware Analysis: Analyzing AI-Backed Malware with CAIRN
  writeupas affected products2026-10-07

  Platform targeted by the CLOSEDQUORUM implant

• Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs
  writeupas classification.technologies2026-10-07
• Chrome 155 Update Patches 247 Vulnerabilities
  articleas classification.technologies2026-10-07
• How to Investigate a GitHub Repo's Real History
  writeupas affected products2026-10-06

  Target platform for the temp_auto_push.bat batch script used in the PolinRider tampering scenario.

• | Blog | Endor Labs
  articleas affected products2026-10-06

  platform using Job Objects and AppContainer for sandbox enforcement

• Living off The Browser: Running Popular Hacking Tools Inside Chrome
  writeupas affected products2026-10-06

  Target machine in lab, scanned for open ports including Kerberos (88), LDAP (389), SMB (445), WinRM (5985), and port 9389; identified as a domain controller

• Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack | Huntress
  writeupas affected products2026-10-06

  Domain controller and endpoints targeted; Windows Registry (Shellbags), Windows Event Logs, and PowerShell logs used in investigation

• Blinder Tunnel Campaign Targets Iraqi Infrastructure
  articleas affected products2026-10-06It is written here as Microsoft Windows.

  RuntimeBroker.exe (renamed legitimate process), AppDomainManager hijacking via RuntimeBroker.exe.config, registry persistence under HKCU Run key.

• MALFEX npm Malware Campaign: Three Payloads And An Adversary That Signs Their Work
  writeupas affected products2026-10-05

  All three payload paths (Overlord RAT, movinlike, function-flag downloader) only affect Windows systems; macOS/Linux launch commands exist but fail silently

• How Huntress Detects and Responds to a ClickFix Attack
  writeupas classification.technologies2026-10-05
• Jan Curn (@jancurn) on X
  threadas affected products2026-10-03It is written here as Windows (mcpc login flow).

  mcpc login flow

• Pentesting: Managing Compromised Machines with Platypus
  writeupas affected products2026-10-02
• Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX
  writeupas affected products2026-10-02It is written here as Windows (OS).

  OS

• Field Notes: Reconstructing the Attacker's LSASS Dump
  writeupas classification.technologies2026-09-30
• MALFEX npm Attack Spreads Windows RAT, Steals Discord and Browser Data
  articleas affected products2026-09-30

  Targeted operating system for the MALFEX campaign's RAT deployment and data theft

• Defender Exclusion Abuse: How Attackers Hide Malware from MDAV
  writeupas affected products2026-09-30

  Operating system hosting MsMpEng.exe (MDAV binary) and the registry keys/GPO mechanisms used to configure exclusions

• China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor
  writeupas classification.technologies2026-09-30
• Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers
  writeupas classification.technologies2026-09-30
• Phishing Abuses RMM Tools for Persistent Access
  writeupas classification.technologies2026-09-29
• Star Blizzard refines phishing and malware delivery with the RedFlick technique
  writeupas affected products2026-09-29

  Targeted via LNK files, scheduled tasks, VHDX files, control.exe/CPL applet abuse, and WebDAV redirector exploitation for malware delivery

• Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
  writeupas affected products2026-09-28

  Target OS; PowerShell, msiexec, Run keys, scheduled tasks, ntdll, AMSI, and Mark-of-the-Web features abused.

• NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
  writeupas affected products2026-09-28

  Platform targeted; abuses kernel32.dll, dnsapi.dll, ws2_32.dll naming, DLL sideloading, Windows Services persistence

• Microsoft Windows NCSI Cross-Context Proxy Authentication Coercion - ZDI-26-708 - Part 1
  writeupas classification.technologies2026-09-28
• Microsoft Windows NCSI Cross-Context Proxy Authentication Coercion - ZDI-26-708 - Part 2
  writeupas affected products2026-09-28It is written here as Windows (domain-joined host).

  NETWORK SERVICE can represent the computer account when authenticating to a remote resource

• Metasploit Wrap Up: Belgian Waffles, Chocolates, and…Modules-Frites?
  articleas affected products2026-09-25It is written here as Windows (and RFC 8106 IPv6 clients).

  and RFC 8106 IPv6 clients

• [tl;dr sec] #347 - AI Agents Hacking Companies for $25, Threat Hunter's Guide to GitHub, Finding Gadgets Like it’s 2026
  articleas affected products2026-09-24It is written here as Windows (kernel LPE, older builds).

  kernel LPE, older builds

• OAuth Token Theft Through Microsoft's Front Door | Huntress
  writeupas classification.technologies2026-09-23
• artemy-ccrsky/COM-Jungle
  repoas classification.technologies2026-09-23
• DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer
  writeupas classification.technologies2026-09-22
• The Closed Quorum: Inside the First Reported Autonomous AI C2 Implant
  writeupas affected products2026-09-22

  64-bit Windows executable (16.4MB, compiled in Go) targeted as the implant host platform

• The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress
  writeupas classification.technologies2026-09-21
• Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM
  writeupas affected products2026-09-17

  Targeted via native utilities (reagentc, diskpart, cipher, ipconfig) and Windows Event Logs cleared; Windows Recovery Environment and recovery partitions disabled/removed

• Threat Actors Abuse IronPython to Deliver CastleLoader/CastleRAT
  writeupas classification.technologies2026-09-17
• Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use
  articleas affected products2026-09-17It is written here as Microsoft Windows.

  Ransomware targeting Windows environments linked to The Gentlemen; also target of GPO-based wiper deployment by Qilin.

• WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials
  writeupas affected products2026-09-17

  Targeted for keylogging capability and clipboard capture (Get-Clipboard)

• HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack
  writeupas classification.technologies2026-09-17
• Pass-the-Passkey Family of Attacks
  writeupas classification.technologies2026-09-16
• Securing the unpatchable in an age of AI-driven vulnerabilities
  articleas classification.technologies2026-09-16
• Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware
  writeupas affected products2026-09-15

  Targeted via ClickOnce-deployed application, PowerShell loader chain, and DocSend desktop application installer

• Huntress: How Attackers Abuse VSS, and How Huntress Detects It
  articleas classification.technologies2026-09-15
• KillaBoi/BrokenPipe
  repoas classification.technologies2026-09-14
• DeathShotXD/0xCr0ssCrush
  repoas classification.technologies2026-09-14
• Malicious Code in Open Source: How to Detect It Before You Ship | Blog | Endor Labs
  articleas classification.technologies2026-09-11
• Metasploit Wrap Up: This One Goes to Sixteen!
  articleas affected products2026-09-11It is written here as Windows (BootVerificationProgram registry key).

  Abused for persistence via new boot_verification_program module

• Field Notes: From AV Alert to Impacket
  writeupas affected products2026-09-11

  Remote Registry service (MS-RRP protocol, winreg RPC interface over SMB) used to remotely access and save SAM registry hive

• Best Practices for Good Endpoint Hardening | Huntress
  articleas affected products2026-09-10

  Platform affected by RDP exposure, Run prompt abuse, SMBv1 legacy protocol risk

• Grand Theft Auto VI hype leads to malware
  writeupas classification.technologies2026-09-09
• Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence
  writeupas affected products2026-09-09

  Endpoint OS targeted; cmd.exe and service-based persistence used by rogue ScreenConnect clients

• Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Chrome/Windows Zero-Day Chain
  writeupas classification.technologies2026-09-09
• Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities
  advisoryas classification.technologies2026-09-08
• Patch Tuesday - September 2026
  advisoryas affected products2026-09-08It is written here as Windows (723 vulnerabilities in September 2026 Patch Tuesday).

  723 vulnerabilities in September 2026 Patch Tuesday

• ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager
  writeupas affected products2026-09-08It is written here as Microsoft Windows.

  WebDAV/WebClient service, rundll32.exe (32-bit), ntdll.dll, dbghelp.dll, explorer.exe used as execution/hollowing targets

• AD Rights Management Service (Part 1): Architecture, Deprecation, and Reconnaissance
  articleas classification.technologies2026-09-08
• kaandemir993/DarkTortilla-RAT-Telegram-Exfiltration-Payload-Extraction-Analysis
  repoas classification.technologies2026-09-05
• Numbat
  repoas affected products2026-09-05

  amd64/arm64, single-binary numbat distribution; native Windows uses vendor-defined profile and AppData paths

• Machine Speed is a lie: stop trying to fight AI with AI
  articleas classification.technologies2026-09-03
• MECCHA CHAMELEON can't hide from the RCE
  writeupas classification.technologies2026-09-03
• Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
  writeupas affected products2026-09-03It is written here as Microsoft Windows.

  target OS; Quick Assist, Registry Run Keys, wscript.exe/cscript.exe, PowerShell, Windows Defender/HVCI abused

• The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT
  writeupas affected products2026-09-01

  Target OS; abused via Windows Script Host, search-ms: URI handler, WebClient/WebDAV service, Task Scheduler COM API, explorer.exe process re-parenting

• age
  repoas affected products2026-08-31

  supported platform for pre-built age binaries

• PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE
  advisoryas classification.technologies2026-08-28
• CrystalPotato
  repoas classification.technologies2026-08-27
• Built to Blend: Miraak's Modular Post-Exploitation Framework
  writeupas classification.technologies2026-08-26
• Why C Has Always Broken Static Analysis | Blog | Endor Labs
  articleas affected products2026-08-25

  Memory-safety bugs made up 65 to 70 percent of high and critical vulnerabilities, year after year

• What Good Identity Hardening Looks Like
  articleas affected products2026-08-25
• duty1g/x64dbg-mcp-server
  repoas classification.technologies2026-08-22
• Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia
  articleas affected products2026-08-20It is written here as Windows (VIDAR target).

  VIDAR target

• Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware
  writeupas affected products2026-08-19

  Targeted via ClickOnce GapiUpdate.application installer and PowerShell ClickFix script

• Windows Infostealer Hits npm and Ruby
  writeupas affected products2026-08-19

  Only platform that receives the malicious payload; Linux/macOS installs receive telemetry only

• StubMaker RubyGems Campaign Delivers a Windows Infostealer
  writeupas affected products2026-08-16

  Target OS for the loader/infostealer payload delivery and execution

• MAJINAHANASHI RANSOMWARE: Yet Another Japanese Locker
  writeupas classification.technologies2026-08-14
• Potential for Remote Code Execution in Microsoft SCCM via Newly-Discovered Exploit Chain
  writeupas classification.technologies2026-08-13
• Orca Security: Zoom Zero-Click RCE Flaws Allow Any Meeting Attendee to Compromise All Participants
  advisoryas classification.technologies2026-08-12
• xiaoyeuzixi/revlab
  repoas classification.technologies2026-08-11
• XBOW: A Shell Is Worth a Thousand Images
  writeupas classification.technologies2026-08-08
• Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages
  writeupas affected products2026-08-06

  x64/x86, targeted via package.exe payload

• Inside an Oracle Database SQL Injection Attack | Huntress
  writeupas classification.technologies2026-08-05
• Bank of America Phishing Email Delivers ScreenConnect Malware
  writeupas affected products2026-08-04

  Target operating system where ScreenConnect is installed, hidden as service 'Windows Security', with UAC bypassed via ICMLuaUtil COM interface exploit

• Hunting the Hunter II: Reversing xhunter2.sys and Its Three-Layer Authentication
  writeupas classification.technologies2026-08-04
• Hunting the Hunter: A Live Kernel LPE 0day in Anti-Cheat on a Billion Machines
  writeupas classification.technologies2026-08-04
• Momoko-Ayase/Senbei
  repoas classification.technologies2026-08-03
• Introducing the Wiz Sensor for Developer Workstations to Protect Endpoints in the AI Era
  articleas affected products2026-08-03

  Platform for Wiz Sensor for Developer Workstations, Private Preview

• Critical N-able N-central Vulnerability and Active Exploitation
  writeupas classification.technologies2026-08-03
• AgentHound
  repoas affected products2026-08-01

  builds available from GitHub Releases

• Awesome Malware Analysis
  repoas affected products2026-07-31

  Target platform for most malware analysis, debugging, and forensics tools listed (e.g. PE files, OllyDbg, WinDbg, Process Explorer)

• Ghidra
  repoas classification.technologies2026-07-31
• HEVD Windows Kernel Exploitation Tutorial
  writeupas classification.technologies2026-07-31
• hackingtool
  repoas affected products2026-07-31

  not supported by hackingtool — the app tells you so and exits

• Mimikatz Missing Manual
  repoas affected products2026-07-31

  Identity, Kerberos, and PKI internals (LSA, LSASS, tokens, processes, services, RPC, DPAPI) covered by the manual

• Rapid7
  articleas classification.technologies2026-07-30
• YuroGod/VMPStaticUnpacker
  repoas classification.technologies2026-07-29
• Socket: Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers
  writeupas affected products2026-07-29

  Persistence via killing Alilang security app and replacing app.asar with Trojan copy

• User Accounts and Privilege Management
  articleas classification.technologies2026-07-27
• Filesystems and File Permissions Explained
  articleas affected products2026-07-27It is written here as Windows (NTFS).

  NTFS

• Field Notes: NSSM - the Non-Sucking Service Manager
  writeupas affected products2026-07-27

  Windows services mechanism abused via nssm.exe to wrap malicious executables as services

• FauxUV campaign (Xygeni)
  writeupas classification.technologies2026-07-18
• 0x1ceKing/HTB-Certified-Penetration-Testing-Specialist
  repoas affected products2026-07-18

  platform covered under Windows Privilege Escalation

• It’s Not Safe To Pay SafePa
  writeupas affected products2026-07-17

  Operating system targeted by SafePay ransomware via RDP access, Defender tampering, UAC bypass, and shadow copy deletion.

• Harden-Runner Block Mode Now Available for macOS and Windows GitHub-Hosted Runners
  articleas classification.technologies2026-07-16
• Socket: Operation Muck and Load
  writeupas classification.technologies2026-07-16
• Destructive Command Guard (dcg)
  repoas affected products2026-07-15

  Supported via WSL for the install.sh path, and natively via install.ps1 (dcg.exe)

• The Cursor deeplink vulnerability that turns a “review this PR” click into remote code execution
  writeupas classification.technologies2026-07-15
• Socket: 11 Malicious NuGet Tools Pose as Game Cheats
  writeupas affected products2026-07-15It is written here as Windows (host OS).

  Target of the second-stage payload; system clock resync via elevated PowerShell, registry modification (HKLM\Software\Policies\Microsoft\Windows\Installer), and file/folder deletion on exit

• 5 Modern Threats You Need to Watch
  articleas affected products2026-07-14

  Built-in Windows admin tools used by attackers to move laterally between machines; Windows Run dialog (Win+R) noted as a vector used before unusual network activity.

• Threat Actors Achieve Persistence After SQL Injection
  writeupas affected products2026-07-13

  Endpoint OS; Terminal Services (Remote Desktop Services) enabled, Guest account and new admin account abuse, Windows Defender disabled.

• jscrambler npm package publishes malicious preinstall binary
  writeupas affected products2026-07-12

  Targeted by PE32+ native binary payload with IsDebuggerPresent anti-debug check

• jscrambler npm Package Compromised in Supply Chain Attack
  writeupas affected products2026-07-11It is written here as Windows (x86-64).

  Targeted by dropped PE32+ native binary payload

• ZX41R/awesome-reverse-engineering-and-malware-analysis
  repoas affected products2026-07-06

  OS internals track; target of malware analysis track (triage, static, dynamic, unpacking, config extraction)

• Plain Text Passwords: The Risks of Storing Them
  writeupas classification.technologies2026-07-06
• prempti
  repoas affected products2026-07-04

  supported install target (.msi installer)

• Lateral Movement Attack: Techniques, Detection & Prevention
  writeupas affected products2026-07-01It is written here as Microsoft Windows.

  Platform where lateral movement techniques (RDP, DCOM, WinRM, SMB, LSASS credential theft) occur

• Defence Impairment Olympics
  writeupas affected products2026-06-29It is written here as Microsoft Windows.

  Operating system whose Registry, event logs, WMI, CLSID entries, and system components (WScript, Shell.Application, Program Files, System32) were manipulated by the threat actor

• Fantastic clear-text passwords and where to collect them (Part 2 - Windows)
  writeupas classification.technologies2026-06-28
• Malwoverview 8.0.5
  repoas affected products2026-06-28It is written here as Windows (platform Malwoverview is tested on).

  platform Malwoverview is tested on

• From Code to Coverage (Part 6): What netlogon.log Sees That Event 1644 Never Will
  writeupas classification.technologies2026-06-24
• Reverse-Skill
  repoas affected products2026-06-21

  CI runs routing tests on Windows + Ubuntu

• Socket: 141 Mastra npm Packages Compromised via Typosquatted Dependency
  writeupas affected products2026-06-20
• Mastra Attack Targets Crypto, Password Managers, Authenticators, and Zapier
  writeupas affected products2026-06-18

  Platform targeted by implant persistence via HKCU Run key NvmProtocal and PowerShell-based enumeration

• Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack
  writeupas affected products2026-06-16

  Endpoint OS targeted; abused via Run Dialog, pcalua.exe, mshta.exe, msiexec, Windows Registry Run keys, WMI, SMB, WinRM for the intrusion and lateral movement.

• The Devil, Eight Million Emails, and a Whole Lot of Milk | Phishing Stager Exposed
  writeupas classification.technologies2026-06-15
• Anatomy of a Deno-Based Proxy & RAT
  writeupas affected products2026-06-15

  Target OS; malware used cmd.exe, conhost.exe --headless, Windows Run key persistence

• DECODING GRIXBA — A PLAY RANSOMWARE SCANNER
  writeupas affected products2026-06-08It is written here as Microsoft Windows (Server, via RDP).

  Grixba dropped to C:\Users\Public\Music\ via RDP on target Windows servers across all versions.

• portbuster1337/ArachneC2
  repoas affected products2026-06-05

  supported implant/operator platform

• Inside .NET Loader Analysis: From Malspam to In-Memory Loader
  writeupas classification.technologies2026-06-03
• Nx Console VS Code Extension Compromised
  writeupas affected products2026-06-02

  planned target per Windows error code 9009 handling in injected code; exact persistence mechanism not statically determined

• Dev Machine Guard Now Scans Extensions Across Every Modern IDE
  articleas affected products2026-06-02

  Platform on which IDE extension scanning works identically

• Unpatched NTLM Leakage in Windows search: URI Handler, Same Bug, No CVE, No Fix
  writeupas classification.technologies2026-06-02
• Threat Actor Targets Crypto Organizations | Wiz Blog
  writeupas affected products2026-05-27

  Not directly observed compromised, but actor-controlled infrastructure (windows.driver-store.com) suggests possible future targeting

• Inside Microsoft Defender's Signature World
  writeupas affected products2026-05-22

  Microsoft Defender is preinstalled on every Windows machine since Windows 7.

• nikaiw/VMkatz
  repoas classification.technologies2026-05-22
• The Gentleman Ransomware | Defense Evasion TTPs Uncovered | Huntress
  writeupas classification.technologies2026-05-21
• X Post by @ale_sp_brazil
  threadas affected products2026-05-14

  referenced via hashtag as a platform covered by ERS exploit development series

• Bullying LLMs
  writeupas classification.technologies2026-05-13
• Hack Skills
  repoas affected products2026-05-13
• PromptZero
  repoas affected products2026-05-12

  target OS for example BadUSB reverse-shell payload generation

• One year of Opengrep: What we built and what’s next
  articleas classification.technologies2026-05-12
• CVE-2026-3609: PPL-Bypassing Handle Leak in XIGNCODE3 (xhunter1.sys)
  advisoryas classification.technologies2026-05-12
• PentHertz/LUKSbox
  repoas affected products2026-05-08

  LUKSbox mount support via WinFsp; TPM 2.0 keyslot support via Windows TBS design

• Threat Actors Weaponize Tiflux RMMs in Malspam Attacks
  writeupas affected products2026-05-07

  Operating system targeted; installer modifies registry policies affecting Secure Attention Sequence (SAS) consent prompts and Safe Mode service startup

• 0xhackerfren/ProcMon-MCP
  repoas affected products2026-05-07

  OS internals monitored: processes, ETW kernel traces, event logs, services, drivers, minifilters; example target C:\Windows\System32\cmd.exe analyzed for PE imports

• 0xMohammedHassan/morphkatz
  repoas classification.technologies2026-05-07
• dMSA Ouroboros: Self-Sustaining Credential Extraction in Windows Server 2025
  writeupas classification.technologies2026-05-04
• ClickFix Removes Your Background but Leaves the Malware
  writeupas classification.technologies2026-04-30
• Komari Red: The Monitoring Tool with a Built-in Reverse Shell
  writeupas affected products2026-04-30It is written here as Windows (workstation OS).

  Target endpoint [REDACTED-WRKSTN]; compromised via smbexec.py, RDP enablement, and Komari agent installed as SYSTEM service

• SecTor 2025 | Ghost SIM Attack: Hacking Mobile Network Authentication Policies
  videoas technologies2026-04-25
• Nightmare-Eclipse Tooling Seen in Real-World Intrusion
  writeupas affected products2026-04-20It is written here as Windows (SAM database / Storage Tiers Management Engine COM object / System32).

  Underlying OS components abused: SAM credential database read via BlueHammer's VSS/TOCTOU technique; Storage Tiers Management Engine COM object hijacked by RedSun to achieve SYSTEM execution via C:\Windows\System32\TieringEngineService.exe.

• Uptick in Bomgar RMM Exploitation
  writeupas classification.technologies2026-04-17
• When PUPs Grow Fangs: Dragon Boss Solutions' $10 Supply Chain Risk
  writeupas classification.technologies2026-04-14
• The 60ms Window: How Event 5156 Solves the ADWS Attribution Problem
  writeupas affected products2026-04-09

  Windows Filtering Platform (WFP) auditing, generates Event 5156 for network connections; enabled by default under 'Filtering Platform Connection' audit subcategory

• The ADWS Architecture That Hides PowerShell AD Enumeration
  writeupas classification.technologies2026-04-08
• Supply Chain Compromise of axios npm Package
  writeupas affected products2026-03-31

  Targeted via VBScript/PowerShell chain, powershell.exe copied to %PROGRAMDATA%\wt.exe

• That “Friendly” Prompt is ClickFix
  articleas affected products2026-03-25

  Native OS functionality abused by ClickFix attacks.

• How a Tax Search Leads to Kernel-Mode AV/EDR Kill
  writeupas classification.technologies2026-03-19
• Extending Conquest using Python Modules
  writeupas affected products2026-03-13

  Target platform for lateral movement via SMB using SCShell BOF technique; Windows API functions (e.g. KERNEL32$VirtualAlloc) resolved dynamically by BOF loader

• Data Exfiltration and Threat Actor Infrastructure Exposed
  writeupas classification.technologies2026-03-12
• How Threat Actors Abuse Remote Management Tools | Huntress
  writeupas affected products2026-03-11

  Targeted OS platform; phishing pages fingerprinted user agent and only allowed Windows visitors to proceed to malicious MSI delivery.

• Dracarys
  otheras classification.technologies2026-03-08
• Unmasking an Attack Chain of MuddyWater
  writeupas classification.technologies2026-03-06
• How Fake OpenClaw Installers Spread GhostSocks Malware
  writeupas affected products2026-03-04

  Platform targeted via fake OpenClaw_x64.exe installer delivering information stealers and GhostSocks

• The Evolving Linux Threat Landscape
  articleas affected products2026-03-03

  Operating system targeted alongside Linux in multi-OS/cross-OS attacks

• Hiding in Plain Sight with App Domain Manager Injection
  writeupas affected products2026-02-19

  Platform hosting the .NET Common Language Runtime and writable directories exploited for the technique

• Trust Me, I’m a Shortcut
  writeupas classification.technologies2026-02-12
• Employee Monitoring and SimpleHelp Software Abused in | Huntress
  writeupas affected products2026-02-11

  Operating system of compromised hosts, including a domain controller accessed via RDP in Case #2.

• Windows ProjFS Internals: A Technical Deep Dive | Huntress
  writeupas classification.technologies2026-02-05
• They Got In Through SonicWall. Then They Tried to Kill | Huntress
  writeupas affected products2026-02-04It is written here as Windows (x64, kernel-mode driver loading / Driver Signature Enforcement).

  Since Windows Vista x64, DSE requires kernel drivers to be signed, but the kernel does not check Certificate Revocation Lists (CRLs), allowing an expired/revoked-certificate driver to load

• Local administrator account remote logon in Windows
  writeupas affected products2026-01-31It is written here as Windows (domain-joined computers generally).

  subject to UAC remote restrictions via LocalAccountTokenFilterPolicy affecting local administrator account remote logon

• Dissecting CrashFix: KongTuke's New Toy
  writeupas affected products2026-01-16It is written here as Windows (finger.exe / System32).

  finger.exe abused as a Living-off-the-Land Binary (LOLBin), copied to %temp% as ct.exe to fetch and pipe remote payloads to cmd.

• Cross-Platform Unity in EDR
  articleas affected products2026-01-13

  Platform for Huntress Managed EDR, in production for almost five years; faces significant ransomware threats including SMB-based remote ransomware

• ESXi Exploitation in the Wild
  writeupas classification.technologies2026-01-07
• The LDAP Whitespace Problem | Huntress
  writeupas classification.technologies2025-12-30
• ALPC You Later: CVE-2025-64721 Sandbox Escape Smashing The Heap Over IPC | depthfirst
  writeupas classification.technologies2025-12-23
• A Series of Unfortunate (RMM) Events
  writeupas affected products2025-12-18
• The OID Problem: Writing LDAP Detections That Actually Work
  writeupas classification.technologies2025-12-16
• PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182
  writeupas classification.technologies2025-12-10
• ClickFix Gets Creative: Malware Buried in Images
  writeupas affected products2025-11-24

  Targeted via mshta.exe, PowerShell, Run box (Win+R), and RunMRU registry artefact abused/exploited in the execution chain

• Dissection of a PHP Backdoor leveraging php-win.exe
  writeupas affected products2025-11-16

  Windows Temp directory, Scheduled Tasks, and Services abused for persistence; Windows Security Event log ID 7045 recorded service installation

• Manual Configuration Manager (SCCM) credential harvesting
  writeupas affected products2025-10-05

  hosts running Configuration Manager client, DPAPI, LSA secrets in SYSTEM registry hive

• Unpacking the AAD Broker LocalState Cache
  writeupas classification.technologies2025-09-30
• Detecting insiders on GNU/Linux servers
  writeupas affected products2025-04-21It is written here as Microsoft Windows (mentioned for comparison).

  mentioned for comparison

• Tear Down The Castle - Part 2
  writeupas classification.technologies2025-01-30
• PerfMon! What Is It Good For? | Huntress
  writeupas classification.technologies2025-01-23
• Tear Down The Castle - Part 1
  writeupas affected products2025-01-19It is written here as Windows (local Administrator account).

  Often shares same local admin password across machines absent LAPS

• LOLBins: What are they & How to Detect Them
  articleas affected products2025-01-09

  Endpoints where LOLBins such as net.exe, cmd.exe, Explorer.exe, PowerShell, and WMI are natively available and can be abused for account creation and command execution

• EDR: The Great Escape - RomHack Training Review
  writeupas classification.technologies2024-09-30
• Botnet Fenix
  writeupas affected products2024-08-22It is written here as Microsoft Windows.

  target OS; process injection into AuthHost.exe, registry Run key persistence, PowerShell/wscript abuse

• Today I Learned - WebDAV Cache
  writeupas affected products2024-08-08

  WebDAV client (davclnt.dll) and rundll32.exe used to establish WebDAV connections; TfsStore\Tfs_DAV local cache folder involved

• Abusing the “search-ms” URI protocol handler
  writeupas affected products2024-08-04

  search-ms URI protocol handler abused to display fake search results in Windows Explorer

• Remote Session Enumeration via Undocumented Windows APIs
  writeupas affected products2024-07-14

  Remote Desktop Session Host server; session enumeration works via qwinsta and WinStation API even when Remote Desktop is not enabled

• Removing Traces of RMM Tools
  writeupas affected products2024-05-10

  Operating system on which the registry keys, Start Menu folders, ProgramData folders, and firewall rules are manipulated

• Canarytokens: Catching Insider Threats (and Threat Actors?)
  writeupas affected products2024-05-06

  Target OS for Cobalt Strike Elevate Kit UAC bypass (uac-schtasks) and Image File Execution Options based canarytoken

• Windows explorer restrictions bypasses - filesystem access
  writeupas classification.technologies2024-04-08
• N-IOCs to Rule Them All
  writeupas affected products2023-12-31

  endpoint OS on which malware persistence artifacts (registry Run keys, Startup folder, Scheduled Tasks, AppData) are created

• Kernel Drivers, Process Protection, and ...Bears?
  writeupas classification.technologies2023-08-22
• CVE-2023-36631: Circumventing Windows Firewall controls with... Malwarebytes' Windows Firewall Control
  writeupas classification.technologies2023-06-21
• PrivEsc: Abusing the Service Control Manager for Stealthy & Persistent LPE
  writeupas affected products2023-02-27

  Service Control Manager (scmanager) DACL can be modified via sc.exe sdset to grant SYSTEM-level service creation rights to non-administrative users, enabling persistent local privilege escalation

• Divin'n'phishin with executable filetypes on Windows
  writeupas affected products2022-10-26

  Filetype/extension associations (assoc, ftype) determining direct or indirect execution of files; tested on a Windows system

• Evading command-line detection with doskey
  writeupas affected products2022-10-22

  doskey.exe command-line alias/macro feature used to evade command-line detection

• ELearnSecurity Certified Threat Hunting Professional (eCTHPv2) review
  articleas affected products2022-07-10It is written here as Microsoft Windows.
• Multiple vulnerabilities in Synametrics' Synaman
  writeupas classification.technologies2022-04-05
• Attacking Azure & Azure AD, Part II
  writeupas affected products2021-10-26It is written here as Windows (hybrid Azure AD/on-premise joined devices).

  Target devices for pivoting from cloud to on-premise via Intune script execution

• Incident Response | ZipExec
  writeupas affected products2021-10-25

  Host OS targeted by ZipExec loader; process creation and file modification events (EventCode 4688) generated on Windows via wscript.exe, cmdkey.exe, and Windows Shell (shell.application COM object)

• ElearnSecurity Certified Incident Responder (eCIR) review
  articleas affected products2021-08-08

  Most incident response TTP examples and post-exploitation content in the course focus on Windows

• Cobalt Strike and Tradecraft
  writeupas affected products2021-07-26

  Target OS for Cobalt Strike tradecraft techniques described (cmd.exe, PowerShell, logon sessions, dllhost.exe, etc.)

• Creating a Red & Blue Team Homelab
  writeupas classification.technologies2021-03-04
• Using a C# Shellcode Runner and ConfuserEx to Bypass UAC
  writeupas affected products2020-10-30

  User Access Control (UAC) on Windows 10, bypassed via DLL hijack of the 'SilentCleanup' scheduled task

• rikugan: LLM reverse-engineering agent for IDA Pro and Binary Ninja
  repoas affected productsIt is written here as Windows (needs the latest Microsoft Visual C++ Redistributable 2015-2022 x64; an outdated runtime can crash IDA at startup).

  needs the latest Microsoft Visual C++ Redistributable 2015-2022 x64; an outdated runtime can crash IDA at startup

• microsoft/mxc
  repoas affected products
• chainguard-dev/malcontent
  repoas affected products

  Platform malcontent analyzes to a lesser extent

• target/strelka
  repoas affected productsIt is written here as Microsoft Windows.

  Client platform supported by Strelka; analyzed EXE sample flagged with fixed.operating_systems: WINDOWS32

• Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign
  articleas affected products

  Target OS for the Antino backdoor and the abused Windows Scripted Diagnostics framework.

• NVIDIA OpenShell — secure runtime for autonomous AI agent fleets
  repoas classification.technologies
• openrig — multi-agent Claude Code/Codex orchestration
  repoas affected productsIt is written here as Windows (native).

  Not supported yet

• SpecterOps/Blacklight — local AI agent attack surface mapping toolkit
  repoas affected products

  Platform target for Scout build matrix (BOF/executables, including ai_path_scout-windows-x64.exe and ai_path_scout-managed.exe)

• Sandyaa — open-source autonomous code auditor that proves bugs with working exploit PoCs
  repoas affected productsIt is written here as Windows (native).

  not currently supported — Sandyaa shells out using Unix-only commands (which claude) and spawns the Claude CLI without a shell wrapper

• Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer
  articleas affected products

  Targeted by WEL1DROPPER payload net.dl.wel1.ru; ETW/AMSI patching, Registry Run key and scheduled task persistence, downloads /pkg/update_win.exe

• Amazon Kiro Prompt Injection Can Exfiltrate Sensitive Data Through Kiro Powers
  articleas classification.technologies
• agent-egress-bench
  repoas affected products

  release archives provided for amd64 and arm64 carrying aeb-gauntlet and aeb-validate

• sage — Agent Detection & Response (ADR) for AI coding agents
  repoas affected productsIt is written here as Windows (AMSI integration).

  AMSI integration

• Dev Machine Guard Now Supports Windows - StepSecurity
  articleas classification.technologies