Pokémon Center is notifying customers in the United Kingdom and Germany that it suffered a third-party data breach after hackers stole customer personal and order information from third-party logistics provider CEVA Logistics. While CEVA's systems were compromised in the cyberattack, the exposed records belonged to Pokémon Center customers who submitted orders on the site. The company then shared this information with the logistics provider to fulfill and ship PokemonCenter.com orders. CEVA Logistics is a subsidiary of the CMA CGM Group, the world's third-largest shipping company. The logistics provider operates 1,000 warehouses, handled 15 million shipments last year, and reported $18.3 billion in revenue in 2025. The company recently suffered a cyberattack in which attackers breached its servers between July 29 and August 1, affecting multiple retailers in Europe.
The French Ministry of the Economy and Finance has disclosed a data breach after an attacker accessed the General Directorate of Public Finances (DGFiP) systems and stole data belonging to 678,000 individuals. This incident was discovered after a threat actor using the "ZeroBytes" handle claimed the attack and listed a stolen database for sale on August 12 on the PwnForums hacking forum. "The in-depth investigations conducted since August 12, 2026, have established that, prior to their interruption, these access points had been used to consult and extract data concerning a total of 678,000 individuals and professionals, including tax data such as reference tax income, family quotient, and withholding tax rate, and, for businesses, data such as their company name and SIREN number," the French Finance Ministry said.
On Friday, Microsoft confirmed it has begun working on a security patch for a Defender zero-day vulnerability named "ShieldBreak." A security researcher who uses the "Nightmare Eclipse" handle disclosed this privilege escalation vulnerability after Microsoft released the August 2026 Patch Tuesday security updates. "Microsoft is aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims," a Microsoft spokesperson told BleepingComputer when asked for a statement regarding the new ShieldBreak zero-day. "Microsoft is committed to investigating security issues and updating impacted products to protect customers as soon as possible." Nightmare Eclipse described ShieldBreak as a bypass for RoguePlanet, another Defender privilege escalation flaw disclosed in June, and shared a ShieldBreak proof-of-concept (PoC) exploit that local attackers with limited permissions can use to gain SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems.
Cybersecurity researchers at Wiz have disclosed a new GitHub Actions workflow injection vulnerability in Snowflake's public snowflakedb/snowflake-connector-net repository that it said could be exploited through a crafted GitHub issue to execute commands in a workflow containing internal Jira credentials. The issue was present in .github/workflows/jira_issue.yml, which ran when a
The expensive attacks are not always the clever ones. This week had plenty of proof. Exposed services got hit, old bugs found fresh use, browser sessions became attack paths, and supply-chain problems kept spreading farther than the original compromise. A lot of it came down to access that was already there and defenses that assumed nobody would look too closely. So, nothing magical. Just a
Security researchers at SSD Secure Disclosure have published a two-stage exploit chain that achieves full Android kernel access on devices running Unisoc modem firmware through a VoLTE video call, with no fix from the chipset maker. The advisory, published August 17, 2026, is the second stage of a chain that began in March 2026, when SSD disclosed remote code execution in the
Cybersecurity researchers have flagged a previously undocumented Linux botnet family dubbed Evooo1Bot that derives its core functionality from the Mirai botnet source code and is equipped to turn internet-facing devices into SOCKS proxies. "While the malware reuses the DDoS engine from the publicly leaked Mirai source code, it extends the original framework with numerous capabilities, including
Cryptocurrency hardware wallet provider SafePal is warning of a data breach affecting about 39,798 customers after a flaw was exploited to steal customer order information, and a threat actor is now claiming to be selling the stolen data. SafePal says the breach impacts customers who placed orders between March 2, 2025, and April 11, 2026, exposing their names, email addresses, shipping addresses, phone numbers, and purchase information. The company says the breach did not expose customers' wallet seed phrases, private keys, passwords, bank account information, payment card numbers, government-issued identification numbers, or other credentials. "No evidence has been found that the incident itself compromised access to SafePal wallets or funds," SafePal said in a security advisory published Sunday.
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Kimsuky Integrates AI into Attack Operations, From AI-Generated Decoy Documents to a Local LLM ShieldBreak – August 2026 disclosure Kimwolf v7: An Evolution of the Kimwolf Botnet CISA, FBI and Partners Warn Organizations of Gunra Ransomware Actors Targeting Multiple Critical Infrastructure Sectors China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw AmnesiaStealer: a multi-stage Rust-based macOS infostealer that hijacks Chromium browsers Gone with the WindRelay: A New Malware Combo Behind a Growing Fraud Scheme PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure 737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection Concept Drift Detection and Adaptive Retraining of Malware Classification Models A Comparison of Malware Image Transformations Using Grad-CAM and Hybrid Learning Models C-GUARD: Context-Adaptive Conformal Gating for Improving Robustness Against Evasive Windows PE Malware An Explainable Deep Learning Pipeline for Malware Family Classification: GAF Image Encoding and API-Grounded LLM Interpretation APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Mustang Panda upgraded CoolClient with a signed kernel driver that hides processes, files and network activity, making the backdoor harder to detect. HoneyMyte, also known as Mustang Panda, has pushed its CoolClient backdoor another step deeper into Windows. Kaspersky’s latest analysis shows a new variant that can deploy a signed kernel-mode driver as a Windows service, communicate with it through IOCTL requests, and use it to hide processes, files and registry entries from inspection. That distinction matters. CoolClient was already a capable espionage tool, with keylogging, clipboard theft, credential harvesting, file management, system reconnaissance and a plugin architecture, but the new driver changes how difficult the implant can be to see and remove. Kaspersky observed the updated variant in intrusions across Pakistan, Mongolia and Myanmar, while the wider victim set also includes Russia and confirmed government entities. CoolClient first appeared publicly in 2022 through Sophos research, followed by Trend Micro analysis in 2023. Kaspersky documented another evolution in 2025, when the malware gained clipboard theft and HTTP traffic interception for credential harvesting. The latest version keeps those capabilities and adds something more fundamental: kernel-level control. “The newest CoolClient variant can deploy a signed kernel-mode driver as a Windows service and communicate with it through IOCTL requests. The driver enhances the malware’s stealth by hiding the CoolClient process, protecting related files and registry entries, and preventing them from being inspected or modified.” reads Kaspersky’s report. “The overall design is comparable to the kernel-mode enhancements previously observed in ToneShell, but the CoolClient driver exposes dedicated IOCTL handlers that allow the user-mode backdoor to communicate directly with the driver.” In the Myanmar campaign described by Kaspersky, Mustang Panda first used PlugX as the post-compromise implant and then deployed CoolClient. Before launching the malware, the actor added exclusions to Microsoft Defender for a fake Windows Defender directory and the executable used as the DLL sideloader. The deception is straightforward. The attackers created a fake Microsoft\Windows Defender installation directory, copied the CoolClient components there and renamed a legitimate Sangfor executable, normally Sang.exe, to defender.exe. That trusted executable then loads the malicious libngs.dll through DLL sideloading. Persistence starts early as well. A scheduled task launches defender.exe with SYSTEM privileges at startup, while CoolClient can also create an AutoRun entry and install itself as a Windows service. The malware checks for security software, including several 360 Total Security processes, before taking the service installation route. The user-mode chain has several stages. libngs.dll acts as the first-stage loader, loadcert.ini handles the second stage, cert.ini provides the final backdoor, and time.ini stores configuration data. The names have changed from earlier variants, but the basic architecture remains familiar. libngs.dll also tries to look like the legitimate DLL it replaces. It exports dummy functions that call OutputDebugStringA and then terminate, while the actual malicious code sits inside DllMain. The loader decrypts loadcert.ini and loads it directly into memory. CoolClient prepares the system by establishing persistence, bypassing UAC and injecting its payload into synchost.exe. It then uses an RPC-based technique and parent-process spoofing to gain elevated privileges without relying on a visible administrator prompt. Once privileged, it extracts the compressed msagent.sys driver, installs it as a Windows service and loads it into the kernel. Through IOCTL requests, CoolClient registers itself as trusted, provides its C2 address and defines the files, registry keys and processes to protect. The driver can then block security tools from accessing or terminating protected components, making the malware harder to detect and remove. The driver reads its configuration from \REGISTRY\MACHINE\SYSTEM\RNG. The configuration identifies directories, files, registry keys and values to hide or protect, as well as processes that should be ignored or protected. “To support kernel module hiding, the driver resolves the address of the non-exported kernel variable PsLoadedModuleList at runtime using MmGetSystemRoutineAddress.” continues the report. “This global linked list maintains information about all loaded kernel modules and drivers, allowing the rootkit to enumerate and manipulate module entries.” For process hiding, the driver dynamically locates ActiveProcessLinks inside the Windows EPROCESS structure instead of depending on a fixed offset. That matters because Windows changes internal structures between versions. Once it finds the correct field, the rootkit can unlink a process from the active process list and later restore it. The driver also registers object, process and image-load callbacks. These mechanisms let it track processes and restrict access to protected ones, including the CoolClient code running inside synchost.exe. A process that tries to open a protected process or thread can receive reduced access rights, blocking operations such as termination or code injection. Files get similar treatment through a Windows filesystem minifilter. The driver maintains protected path lists and checks filesystem activity against them, denying access to matching files and directories. Registry protection works in much the same way: protected keys and values disappear from enumeration results, while direct attempts to open, modify or delete them can return STATUS_ACCESS_DENIED. The driver contains 33 IOCTL handlers, although the analyzed CoolClient sample normally uses only three. The unused handlers reveal just how much more the driver can do: hide kernel modules, inject shellcode, terminate processes, remove PPL protection, manipulate registry values, hide processes and modules, disable kernel notification callbacks, load another kernel driver and even write to an arbitrary kernel address. That’s an important distinction between capability and observed behavior. Kaspersky didn’t see the sample invoke all of those functions during normal execution, but their presence shows that msagent.sys isn’t a narrowly designed hiding component. It provides a broader kernel-level toolkit that CoolClient can potentially use when needed. The rootkit doesn’t stop at processes, files and registry entries. It also hooks the Windows Nsiproxy driver to filter network information returned to user mode. CoolClient supplies its C2 IPv4 address to msagent.sys, and the driver removes matching entries before applications receive the network information. For a defender, that creates an unpleasant problem. A tool looking at network information from user mode may simply fail to see the address associated with the malware’s command-and-control infrastructure. The connection still exists, but the rootkit can interfere with what security software and analysts are allowed to observe. The driver can also hide kernel modules by manipulating PsLoadedModuleList. When it finds a matching module, it removes the corresponding entry from the kernel’s linked list, preventing the module from appearing in standard enumeration routines. This is where the new CoolClient variant becomes materially different from a conventional backdoor. An implant running entirely in user mode can still be powerful, but defenders have many opportunities to inspect processes, files, handles and network activity. A kernel component that actively filters those views changes the detection problem. The driver uses a digital signature linked to Nanjing Ranyi Technology Co., Ltd., with a certificate valid from 2013 to 2014. Kaspersky also found older malicious drivers using the same certificate, but no direct link to CoolClient. PDB strings mention a “Nanjing Laboratory” and “Zhang Xuejie Yunnan m,” but researchers found no evidence tying them to a specific developer or threat actor. These clues alone do not prove Chinese involvement. The stronger attribution comes from the wider operation, which matches HoneyMyte activity through CoolClient, PlugX and the deployment techniques observed. HoneyMyte continues to use PlugX to gain an initial foothold before deploying CoolClient as a secondary backdoor, but the latest version adds kernel-level capabilities. By loading msagent.sys, the malware can hide processes, files and registry entries while blocking security tools from accessing or terminating protected components. This complicates incident response: finding Sang.exe, defender.exe or libngs.dll is no longer enough. Investigators must also examine drivers, services, registry changes and unusual network activity. The driver includes additional functions for manipulating kernel components, even if they were not observed in use. For defenders, CoolClient is no longer just a backdoor to hunt in user space—it can change what Windows itself reveals. “The latest CoolClient variant represents a significant evolution of the malware. Rather than operating solely as a user-mode backdoor with plugin support, it now deploys and communicates with a kernel-mode driver that extends its capabilities beyond earlier versions.” concludes the report. “Through this driver, CoolClient can hide and protect processes, files, and registry objects, as well as filter selected network information, making detection and analysis considerably more difficult.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CoolClient)
Confirm this action.
Leaving now will discard your changes.