The expensive attacks are not always the clever ones. This week had plenty of proof. Exposed services got hit, old bugs found fresh use, browser sessions became attack paths, and supply-chain problems kept spreading farther than the original compromise. A lot of it came down to access that was already there and defenses that assumed nobody would look too closely. So, nothing magical. Just a
Security researchers at SSD Secure Disclosure have published a two-stage exploit chain that achieves full Android kernel access on devices running Unisoc modem firmware through a VoLTE video call, with no fix from the chipset maker. The advisory, published August 17, 2026, is the second stage of a chain that began in March 2026, when SSD disclosed remote code execution in the
Cybersecurity researchers have flagged a previously undocumented Linux botnet family dubbed Evooo1Bot that derives its core functionality from the Mirai botnet source code and is equipped to turn internet-facing devices into SOCKS proxies. "While the malware reuses the DDoS engine from the publicly leaked Mirai source code, it extends the original framework with numerous capabilities, including
Cybersecurity researchers have attributed the exploitation of a newly patched security flaw in Broadcom VMware vCenter to a suspected China-nexus advanced persistent threat (APT). The attacks involve the exploitation of CVE-2026-59310 (CVSS score: 9.8), a severe directory-traversal vulnerability in the VMware vCenter server that could be weaponized by a malicious actor to execute arbitrary code
Cryptocurrency hardware wallet provider SafePal is warning of a data breach affecting about 39,798 customers after a flaw was exploited to steal customer order information, and a threat actor is now claiming to be selling the stolen data. SafePal says the breach impacts customers who placed orders between March 2, 2025, and April 11, 2026, exposing their names, email addresses, shipping addresses, phone numbers, and purchase information. The company says the breach did not expose customers' wallet seed phrases, private keys, passwords, bank account information, payment card numbers, government-issued identification numbers, or other credentials. "No evidence has been found that the incident itself compromised access to SafePal wallets or funds," SafePal said in a security advisory published Sunday.
Claude is experiencing a major outage, with users reporting login problems and degraded performance across several Anthropic services. The incident began on August 16, 2026, at around 21:58 UTC, and is affecting Claude.ai, Claude Code, and Claude Cowork. According to Anthropic’s status page, the company first said it was investigating an issue preventing some users from authenticating to Claude.ai, Claude Code, and Claude Cowork. A few minutes later, Anthropic reported a broader service disruption involving degraded performance on Claude.ai and platform.claude.com. For users, the outage can result in problems signing in, Claude failing to load, requests not completing, or other errors when using the affected services. Anthropic’s status page currently classifies Claude.ai, Claude Code, and Claude Cowork as experiencing a major outage. Claude Console and the Claude API are currently listed as operational.
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Kimsuky Integrates AI into Attack Operations, From AI-Generated Decoy Documents to a Local LLM ShieldBreak – August 2026 disclosure Kimwolf v7: An Evolution of the Kimwolf Botnet CISA, FBI and Partners Warn Organizations of Gunra Ransomware Actors Targeting Multiple Critical Infrastructure Sectors China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw AmnesiaStealer: a multi-stage Rust-based macOS infostealer that hijacks Chromium browsers Gone with the WindRelay: A New Malware Combo Behind a Growing Fraud Scheme PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure 737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection Concept Drift Detection and Adaptive Retraining of Malware Classification Models A Comparison of Malware Image Transformations Using Grad-CAM and Hybrid Learning Models C-GUARD: Context-Adaptive Conformal Gating for Improving Robustness Against Evasive Windows PE Malware An Explainable Deep Learning Pipeline for Malware Family Classification: GAF Image Encoding and API-Grounded LLM Interpretation APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Mustang Panda upgraded CoolClient with a signed kernel driver that hides processes, files and network activity, making the backdoor harder to detect. HoneyMyte, also known as Mustang Panda, has pushed its CoolClient backdoor another step deeper into Windows. Kaspersky’s latest analysis shows a new variant that can deploy a signed kernel-mode driver as a Windows service, communicate with it through IOCTL requests, and use it to hide processes, files and registry entries from inspection. That distinction matters. CoolClient was already a capable espionage tool, with keylogging, clipboard theft, credential harvesting, file management, system reconnaissance and a plugin architecture, but the new driver changes how difficult the implant can be to see and remove. Kaspersky observed the updated variant in intrusions across Pakistan, Mongolia and Myanmar, while the wider victim set also includes Russia and confirmed government entities. CoolClient first appeared publicly in 2022 through Sophos research, followed by Trend Micro analysis in 2023. Kaspersky documented another evolution in 2025, when the malware gained clipboard theft and HTTP traffic interception for credential harvesting. The latest version keeps those capabilities and adds something more fundamental: kernel-level control. “The newest CoolClient variant can deploy a signed kernel-mode driver as a Windows service and communicate with it through IOCTL requests. The driver enhances the malware’s stealth by hiding the CoolClient process, protecting related files and registry entries, and preventing them from being inspected or modified.” reads Kaspersky’s report. “The overall design is comparable to the kernel-mode enhancements previously observed in ToneShell, but the CoolClient driver exposes dedicated IOCTL handlers that allow the user-mode backdoor to communicate directly with the driver.” In the Myanmar campaign described by Kaspersky, Mustang Panda first used PlugX as the post-compromise implant and then deployed CoolClient. Before launching the malware, the actor added exclusions to Microsoft Defender for a fake Windows Defender directory and the executable used as the DLL sideloader. The deception is straightforward. The attackers created a fake Microsoft\Windows Defender installation directory, copied the CoolClient components there and renamed a legitimate Sangfor executable, normally Sang.exe, to defender.exe. That trusted executable then loads the malicious libngs.dll through DLL sideloading. Persistence starts early as well. A scheduled task launches defender.exe with SYSTEM privileges at startup, while CoolClient can also create an AutoRun entry and install itself as a Windows service. The malware checks for security software, including several 360 Total Security processes, before taking the service installation route. The user-mode chain has several stages. libngs.dll acts as the first-stage loader, loadcert.ini handles the second stage, cert.ini provides the final backdoor, and time.ini stores configuration data. The names have changed from earlier variants, but the basic architecture remains familiar. libngs.dll also tries to look like the legitimate DLL it replaces. It exports dummy functions that call OutputDebugStringA and then terminate, while the actual malicious code sits inside DllMain. The loader decrypts loadcert.ini and loads it directly into memory. CoolClient prepares the system by establishing persistence, bypassing UAC and injecting its payload into synchost.exe. It then uses an RPC-based technique and parent-process spoofing to gain elevated privileges without relying on a visible administrator prompt. Once privileged, it extracts the compressed msagent.sys driver, installs it as a Windows service and loads it into the kernel. Through IOCTL requests, CoolClient registers itself as trusted, provides its C2 address and defines the files, registry keys and processes to protect. The driver can then block security tools from accessing or terminating protected components, making the malware harder to detect and remove. The driver reads its configuration from \REGISTRY\MACHINE\SYSTEM\RNG. The configuration identifies directories, files, registry keys and values to hide or protect, as well as processes that should be ignored or protected. “To support kernel module hiding, the driver resolves the address of the non-exported kernel variable PsLoadedModuleList at runtime using MmGetSystemRoutineAddress.” continues the report. “This global linked list maintains information about all loaded kernel modules and drivers, allowing the rootkit to enumerate and manipulate module entries.” For process hiding, the driver dynamically locates ActiveProcessLinks inside the Windows EPROCESS structure instead of depending on a fixed offset. That matters because Windows changes internal structures between versions. Once it finds the correct field, the rootkit can unlink a process from the active process list and later restore it. The driver also registers object, process and image-load callbacks. These mechanisms let it track processes and restrict access to protected ones, including the CoolClient code running inside synchost.exe. A process that tries to open a protected process or thread can receive reduced access rights, blocking operations such as termination or code injection. Files get similar treatment through a Windows filesystem minifilter. The driver maintains protected path lists and checks filesystem activity against them, denying access to matching files and directories. Registry protection works in much the same way: protected keys and values disappear from enumeration results, while direct attempts to open, modify or delete them can return STATUS_ACCESS_DENIED. The driver contains 33 IOCTL handlers, although the analyzed CoolClient sample normally uses only three. The unused handlers reveal just how much more the driver can do: hide kernel modules, inject shellcode, terminate processes, remove PPL protection, manipulate registry values, hide processes and modules, disable kernel notification callbacks, load another kernel driver and even write to an arbitrary kernel address. That’s an important distinction between capability and observed behavior. Kaspersky didn’t see the sample invoke all of those functions during normal execution, but their presence shows that msagent.sys isn’t a narrowly designed hiding component. It provides a broader kernel-level toolkit that CoolClient can potentially use when needed. The rootkit doesn’t stop at processes, files and registry entries. It also hooks the Windows Nsiproxy driver to filter network information returned to user mode. CoolClient supplies its C2 IPv4 address to msagent.sys, and the driver removes matching entries before applications receive the network information. For a defender, that creates an unpleasant problem. A tool looking at network information from user mode may simply fail to see the address associated with the malware’s command-and-control infrastructure. The connection still exists, but the rootkit can interfere with what security software and analysts are allowed to observe. The driver can also hide kernel modules by manipulating PsLoadedModuleList. When it finds a matching module, it removes the corresponding entry from the kernel’s linked list, preventing the module from appearing in standard enumeration routines. This is where the new CoolClient variant becomes materially different from a conventional backdoor. An implant running entirely in user mode can still be powerful, but defenders have many opportunities to inspect processes, files, handles and network activity. A kernel component that actively filters those views changes the detection problem. The driver uses a digital signature linked to Nanjing Ranyi Technology Co., Ltd., with a certificate valid from 2013 to 2014. Kaspersky also found older malicious drivers using the same certificate, but no direct link to CoolClient. PDB strings mention a “Nanjing Laboratory” and “Zhang Xuejie Yunnan m,” but researchers found no evidence tying them to a specific developer or threat actor. These clues alone do not prove Chinese involvement. The stronger attribution comes from the wider operation, which matches HoneyMyte activity through CoolClient, PlugX and the deployment techniques observed. HoneyMyte continues to use PlugX to gain an initial foothold before deploying CoolClient as a secondary backdoor, but the latest version adds kernel-level capabilities. By loading msagent.sys, the malware can hide processes, files and registry entries while blocking security tools from accessing or terminating protected components. This complicates incident response: finding Sang.exe, defender.exe or libngs.dll is no longer enough. Investigators must also examine drivers, services, registry changes and unusual network activity. The driver includes additional functions for manipulating kernel components, even if they were not observed in use. For defenders, CoolClient is no longer just a backdoor to hunt in user space—it can change what Windows itself reveals. “The latest CoolClient variant represents a significant evolution of the malware. Rather than operating solely as a user-mode backdoor with plugin support, it now deploys and communicates with a kernel-mode driver that extends its capabilities beyond earlier versions.” concludes the report. “Through this driver, CoolClient can hide and protect processes, files, and registry objects, as well as filter selected network information, making detection and analysis considerably more difficult.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CoolClient)
A new information-stealing malware called AmnesiaStealer, which targets macOS users via ClickFix attacks, includes a streaming module that allows the attacker to interactively control the victim's web browser. A notable capability is copying the victim's Chromium profile, including its authentication state, and loading it into a hidden, headless browser on the infected system. This allows the hacker to access victims' authenticated sessions while preserving the identifiers associated with the browser, host, and network. AmnesiaStealer can collect data in 16 Chromium-based web browsers as well as other sensitive information, such as passwords, cryptocurrency wallets, Apple Notes and documents, and keychain data. The malware is currently distributed through ClickFix campaigns that use a fake GitHub download page to drop a password-protected ZIP archive.
France’s tax agency says hackers stole data on 678,000 taxpayers, including income and tax details, in a sophisticated cyberattack. A threat actor claimed to have breached France’s tax agency in late June. France’s tax administration confirmed that a cyberattack exposed personal data of 678,000 individuals and businesses, prompting an immediate criminal investigation. The cybercrime unit of the Paris Public Prosecutor’s Office has opened a probe and handed it to OFAC, France’s dedicated cybercrime fighting office. Tax officials described the attack as more sophisticated than anything they’d faced before. “The attack allowed hackers to extract data relating to 678,000 users of France’s tax system, including both private individuals and companies.” reports French media RFI. “Tax authorities said the incident was more complex than cyberattacks they had faced in the past, potentially renewing concerns over the security of government information systems following a series of recent breaches involving other public bodies.” The Directorate-General for Public Finances (DGFiP) stressed that the stolen data doesn’t grant access to taxpayers’ secure accounts on impots.gouv.fr. That’s a meaningful distinction, but income figures, tax rates, and family circumstances are exactly what an attacker needs to make a phishing email or phone call sound credible enough to extract a password or bank account number. “Officials said those affected would be contacted from early next week, with particular emphasis on alerting them to the potential risk of identity theft and fraudulent attempts to obtain further personal information.” continues RFI. French authorities did not disclose technical details about the cyberattack or its motivation. The breach follows recent attacks on systems linked to ANTS, the national secure documents agency, and INSEE, France’s statistics authority. Three government bodies hit in quick succession is a pattern, not a coincidence. For businesses, the exposed data was considered less sensitive, SIREN registration numbers, business addresses, and the address of the authorized representative. Public Accounts Minister David Amiel has asked the DGFiP to start notifying affected taxpayers from Monday and requested proposals on how to strengthen security procedures. Investigators still need to establish how the attackers got in, who they are, and whether the data has already been sold or used. Anyone contacted about this breach should treat follow-up requests for passwords or banking information as fraudulent regardless of how official they sound. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, France’s tax agency)
Confirm this action.
Leaving now will discard your changes.