Microsoft has confirmed that the KB5120998 August 2026 non-security preview update is reverting mouse settings on Windows 11 systems. According to user reports, mouse cursor personalization settings are either being changed or reset automatically after installing the KB5120998 update. More importantly, affected Windows 11 users will not be able to restore the previous mouse settings after they are reverted. "Microsoft has received reports indicating that mouse cursor personalization settings are being changed or reverted to certain standard settings. This occurs following installation of Windows updates released August 27 2026 (KB5120998) and later," Microsoft explained. "The issue is described as resulting in appearance regressions and intermittent animation changes. Some reports mention that high-DPI mouse cursors are replaced with larger, white cursors, and custom cursor animations reverting to standard settings. Attempts to restore the previous cursor customization are reported to be unsuccessful."
Learn how the Spring Ring campaign abuses Microsoft Teams and voice phishing to deploy malware and target enterprise domain controllers. The post Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams appeared first on Unit 42.
Attackers typically try to pass off malware as legitimate applications or as potentially unwanted programs that users deliberately search for and download, such as cheats or cracks. They often rely on ad and affiliate networks to deliver their creations to victims’ devices. This post examines a less conventional case: a well-known backdoor distributed under the guise of adware. The attackers may have chosen this distribution method because the adware was signed by the developer. On top of that, users often manually add these apps to exclusions, so their useful features don’t get blocked. Some time ago, a client asked us to analyze a file with the MD5 hash c24e99f9437feacaa63766a3cde3fe3d and add it to our detection database. We initially classified it as adware, but a cursory analysis turned up suspicious network activity, which prompted us to dig deeper. It turned out the sample did far more than serve ads. In fact, its advertising functionality doesn’t even work; instead, it triggers an infection chain that delivers the ValleyRAT backdoor. Malicious installer The file the client shared with us turned out to be an installer that performed different actions depending on the two-letter suffix used in the file name, positioned just before the numeric string. Installer name What it does FS_SETUP_DD_173.exe Installs DingTalk, a workplace collaboration platform FS_SETUP_GG_173.exe Installs Google Chrome FS_SETUP_HY_173.exe Opens hxxps://meeting[.]tencent[.]com/download/ These actions are most likely designed to divert the user’s attention away from the sample’s malicious functionality. Regardless of the file name, the installer deploys a modified Chinese desktop wallpaper management tool called QN Wallpaper (hxxps://qnwallpaper[.]keansoft[.]cn/) and adds it to the registry’s autorun entries. The original version of QN Wallpaper is genuine adware: on installation, it delivers bundled partner apps to the device and then displays ad banners to the user. In this case, however, the attackers use it to carry out DLL sideloading, a technique that allows malicious code to run under the guise of a signed process by way of a malicious DLL. The QN Wallpaper modules, along with the malicious components, are unpacked to C:\Program Files\QNWallpaper\5.4.0.1662\<random string of letters and digits>. The following files are saved in that directory: File name MD5 Purpose 1.zip 7ad1e3ef4e6d9d636c9e7e967733850e Archive containing the adware files QnWallpeper.exe and QnwPlayer.exe, along with the modules needed to run them 7z.dll 96b4c1d0683dce22bd3223e1e40689c1 7z archiver library 7z.exe 9b86d3ab6cef15c633933fbbeab39c0a Archiver chrome_elf.dll edfdc30cbd85879776b8f735ea7de1f1 Library used to launch Electron-based applications libcef.dll 07ddbbe2c71c45577a7a4fbcdba0df91 Malicious library PeLoader 48826d5ca845979d2e6ebd66dc1aae90 File containing the encrypted backdoor QnWallpaper.exe 6c158c0f8e029342192d4f0d72e102b7 Adware module QnwPlayer.exe 9a71d6a41cd258b9e89cdc5fc224de73 Adware module <random string of letters and digits>Nedca.exe c24e99f9437feacaa63766a3cde3fe3d Malicious installer copy After unpacking, the installer uses the DisableAntiSpyware registry key to disable Windows Defender and then launches QnWallpaper.exe. Disabling Windows Defender DLL Sideloading via libcef.dll QnWallpaper.exe has dependencies in libcef.dll, so this library gets loaded when the process starts. QnWallpaper.exe also launches QnwPlayer.exe, which likewise calls libcef.dll. QnWallpaper and QnwPlayer won’t actually function correctly, because the functions exported from libcef.dll are put into an infinite sleep. However, in case that sleep is ever interrupted, the attackers have implemented a function that loads all the necessary functions from the original library into memory, provided it can locate that library on the system. Example of an exported function Loading functions from the original libcef.dll The malicious functionality in libcef.dll is invoked by a call to DllMain, which runs automatically when the library is loaded. That said, alongside the original exports, the library also contains a function named RunDLL, which likewise initiates execution of the malicious code. QnWallpaper never calls this function. We suspect the attackers intended to invoke it manually via rundll32 or planned to use a separate executable for this purpose, one that wasn’t included in the package downloaded by the sample. The RunDLL function Running the malicious code When the library is loaded, code runs that ensures QnWallpaper.exe persists at startup: it adds a file extension association and drops a file with the corresponding extension in C:\Documents and Settings\<username>\Start Menu\Programs\Startup\. This is followed by a chain of wrapper functions whose main job is to call the next one. Execution eventually reaches the function that contains the actual malicious code. For convenience, we’ll refer to it as mw_entry. Inside mw_entry, the malware checks two things: Whether the current user belongs to the Administrators group Which process the DLL is running inside Checking for administrator privileges If the user isn’t a member of the Administrators group, the program attempts to obtain administrator privileges by using the runas utility. Relaunching the process to obtain administrator privileges Once it has administrator privileges, the malicious code determines which process the DLL has been loaded into, and selects the payload accordingly: If the library is running inside QnWallpaper.exe, the payload is loaded from the PeLoader file. Encrypted payload If the library is running inside QnwPlayer.exe, the payload is loaded from libcef.dll resources. Retrieving the payload from a resource Both payloads are AES-encrypted DLLs that contain the ValleyRAT backdoor. The only difference between them is their configuration, specifically, the C2 server addresses. After decryption, libcef.dll checks the magic signatures in the resulting PE file’s headers to confirm the sample is valid. If this check fails, the library releases its resources and takes no further action. Validating the PE file headers after decryption If the headers check out, libcef.dll loads the payload into the process’s memory space and hands control over to the backdoor by calling DllMain. Calling DllMain ValleyRAT ValleyRAT begins its operation by parsing its configuration, which consists of key:value pairs concatenated into a single string. To obfuscate this configuration, the attackers wrote the string in reverse. Obfuscated configuration During parsing, the backdoor restores the correct character order and reads the key values one by one. The set of keys is the same regardless of which process the backdoor is running in. Parsing the configuration Some of the configuration fields are listed below: Key Description p? C2 server IP address o? C2 server port t? Protocol (1: TCP, 0: UDP) dd Sleep duration before executing the main code cl Sleep duration after receiving the corresponding command from the server bz Configuration creation date bh Whether to mark the current process as critical (so that terminating it triggers a blue screen of death) Possible values: 1: yes, 0: no ll Whether to check for running security/traffic-analysis tools/processes (1: check, 0: do not check) sh Whether to inject code into svchost that will restart the malicious process (1: inject, 0: do not inject) The backdoor uses several techniques to protect its process. Some are configuration-dependent, while others are always applied: Injecting code into svchost to restart the process: a configurable option. The backdoor allocates memory inside the svchost process, injects code into it, and sets PAGE_NOACCESS permissions on the memory page containing the injected data. It then creates a suspended thread, waits 60 seconds, grants read, write, and execute permissions on the page, and resumes the thread. Injecting code into svchost The function injected into the process has a single job: restart the backdoor if its execution is interrupted for any reason. Injected function Marking its own process as critical (so that terminating it triggers a blue screen of death): a configurable option. Setting its own process as critical Restarting on an unhandled exception. This protection mechanism is always active, regardless of the backdoor’s configuration. Restarting on exceptions The backdoor also has spyware functionality. While running, it tracks keystrokes and the currently focused window by using functions from the DirectInput8 library. It also captures clipboard contents. All collected data is saved to a file on disk. Capturing clipboard data If the ll key in the configuration is set to 1, ValleyRAT periodically checks for active windows belonging to applications that could be used to analyze processes or traffic. Window enumeration is done via the EnumWindows function, using the following callback: Window name checks After completing these checks, the backdoor collects system information, including: Host name Host IP addresses User idle time Detailed Windows version information (ProductName, EditionId, DisplayVersion) Number of CPU cores Free disk space Graphics adapter Currently focused window and its title System bitness Language settings Path to the system directory On command, the backdoor can perform the actions typical of this malware category: Rebooting the computer Shutting down the computer Taking a screenshot Wiping logs Updating its C2 addresses Downloading additional modules Sending keylogger logs along with clipboard contents Snippet of the command handler Let’s take a closer look at the module-loading functionality. Upon receiving the corresponding command with a link from its operator, the backdoor downloads the file at that link and executes it. The download can come from either the C2 server or a third-party address. The DownloadPeFile function is responsible for downloading a PE file The DownloadAndExecute function calls DownloadPeFile, then launches the downloaded module Additional modules can take the form of purpose-built dynamic libraries or shellcode. If the payload is shellcode, the backdoor uses process hollowing with svchost to launch the module. Implementation of the process hollowing technique If the module is a dynamic library, the backdoor loads the PE file into its own process, calls DllMain, and searches for a Main function among the exported functions. Once Main has been called, the library is unloaded from memory. Calling DllMain after the backdoor loads the PE file Targets and attribution Over the course of 2026, we detected the ValleyRAT backdoor and its associated malware more than 100,000 times, with more than 1500 unique users affected, primarily in China and India. This attack geography, combined with the use of the ValleyRAT backdoor, points to Silver Fox, a known operator of this malware family, as the likely group behind the campaign. Conclusion This case is a clear example of how adware and affiliate networks can turn out to be far more dangerous than they appear. ValleyRAT is a sophisticated backdoor capable of collecting sensitive data such as keystrokes and clipboard contents, taking screenshots, and delivering additional malicious modules. The attackers exploited a well-known adware application to run the backdoor under the guise of a signed process, which complicates detection. Motivated by both cyberespionage and financial gain, Silver Fox targets organizations across multiple countries. To stay protected, organizations should keep employee cybersecurity awareness up to date and enforce clear policies on the use of third-party software on work devices. For individual users, we recommend avoiding the installation of software with a questionable reputation, and, even more importantly, never adding such software to your security solutions’ exclusion lists. IoC MD5 07ddbbe2c71c45577a7a4fbcdba0df91 c24e99f9437feacaa63766a3cde3fe3d 8a626d844943da3456b044f38deae3a2 Network 103.45.66.18:441 103.45.66.18:442 103.45.66.18:443 192.253.225.173:6666 192.253.225.173:8888
Two Nigerian men extradited to the U.S. on Thursday have been charged with involvement in sextortion schemes that resulted in the deaths of two minor victims in Mississippi and North Carolina. Sextortion is a form of online blackmail in which cybercriminals threaten victims with leaking nude images and videos they stole (through hacking) or obtained (through coercion). In some cases, they may also sell the stolen content on criminal marketplaces or share the victims' personal information (including names, dates of birth, emails, phone numbers, and social media usernames) with other criminals, who can use it to further pressure them into providing additional private images and videos. 26-year-old Adebola Festus Adekunle and 24-year-old Mudasiru Afeez Olawale were both arrested in Nigeria in August 2023 as part of "Operation Artemis," a joint international law enforcement action that targets sextortion rings operating from Nigeria who prey on minors in the United States.
Microsoft asked customers this week to ignore incorrect alerts that Defender Antivirus has been turned off after installing the latest Defender updates. Although this issue has been affecting users in the Release Preview Channel of the Windows Insider program since June, it appears Microsoft didn't notice it until now. The erroneous alerts appear on affected systems in the Windows Security app and prompt users to "Tap or click to turn on Microsoft Defender Antivirus." The known issue affects all supported Windows client and server versions, including the latest Windows 11 26H1 and Windows Server 2025 releases. "After installing the latest updates for Microsoft Defender Antivirus, notifications might appear stating that "Microsoft Defender Antivirus is turned off," even though the antivirus is functioning correctly and all settings show it as active," Microsoft explained in a Friday release health dashboard update.
The Manchester Airports Group data breach has been claimed by extortion group FulcrumSec, which told BleepingComputer that it stole approximately 86 GB of data. Samples reviewed by BleepingComputer contained information consistent with MAG's disclosure while indicating that the breach exposed considerably more detailed customer, booking, and travel information than initially revealed. Manchester Airports Group (MAG), the United Kingdom's largest airport operator, disclosed on August 27 that an unauthorized third party had stolen customer data related to Manchester, London Stansted, and East Midlands airports. The company said the affected information came from car park, lounge, and Fast Track bookings and in-airport Wi-Fi registrations. In emails to BleepingComputer, FulcrumSec claimed responsibility for the attack and shared samples of the allegedly stolen data as evidence.
PaperCut servers are under active attack, while 47% of tracked installations still run unpatched versions vulnerable to remote code execution. PaperCut, the print management software running in schools, hospitals, and offices worldwide, confirmed on August 27 that a pre-authentication remote code execution flaw is being actively exploited against real customers. Researchers at Huntress found evidence of exploitation in two customer environments, and the security firm went further, reproducing the entire attack chain from scratch against a clean, unpatched install. “Observed activity focused on system discovery. We have not observed secondary malware, further command-and-control traffic, or additional persistence or post-exploitation from the recovered payload.” reads the report published by Hutress. “Huntress reproduced a full pre-authentication RCE chain against a vanilla PaperCut NG 25.0.11.75758 server. We have reached out to PaperCut to coordinate with them on continued vulnerability analysis.” The vulnerability starts with a simple authorization mistake in PaperCut. An attacker can send a specially crafted request that makes the server display one page while actually running an action from another page. PaperCut checks the permissions for the page it displays instead of the action it actually performs. This flaw, tracked as CVE-2026-81578, can let an attacker change the server’s configuration without logging in. That access can then be combined with a second flaw, CVE-2026-82078. The issue in PaperCut’s database utilities can load unsafe Java classes, allowing the attacker to run arbitrary Java code on the server. The real-world attacks Huntress observed were almost quaint compared to the severity of the bug itself. One incident lasted under two minutes total, with the attacker running nothing more aggressive than whoami and ver, basic commands to identify the compromised account and Windows version. A second incident added tasklist to the mix, checking what processes were running, but neither case showed evidence of deeper persistence, secondary malware, or follow-up command-and-control traffic. The activities observed by Huntress read like reconnaissance rather than a finished operation, the kind of activity that usually precedes something worse. The forensic trail attackers left behind is genuinely useful for defenders, and it’s worth understanding exactly what it looks like. Investigators found a malicious Java class file dropped directly into PaperCut’s own installation directory, capable of running commands, writing results to a temporary file, and then deleting both the output and the server’s own log file to cover its tracks. One artifact survived that cleanup regardless: a Derby database log entry reading memory:...\pwn, an oddly named database directory that PaperCut’s own investigation guidance now flags as a high-confidence indicator of compromise. “After exploitation, the .class file deletes its own Udydn.out file, as well as the server’s server.log file. The server.log file recorded the execution of this code in a log line that contains the string DB URL: jdbc:derby:memory:pwn that immediately followed the large encoded data blob’s appearance in the log.” continues the report. “We observed /data/internal/derby.log was not deleted, and it contains one insightful breadcrumb” PaperCut’s patching process is more complicated than simply installing an update. The company released an emergency patch first, then issued another update less than 24 hours later after additional testing. Fixes for version 24 were still being developed when the report was published. The timing is important because the second confirmed attack targeted a server running version 24, before the fix for that version was available. Huntress successfully recreated the exploit chain in a test environment. From a remote system, the researchers were able to trigger code execution without authentication. The attack caused PaperCut’s pc-app.exe Application Server to launch charmap.exe with SYSTEM privileges, confirming that the vulnerability can lead to code execution at the highest Windows privilege level. The bigger concern involves older versions. Huntress found that about 47% of the roughly 2,500 PaperCut installations it tracks still run version 23 or earlier, and there is currently no patch for those versions. Huntress is working with PaperCut to analyze the vulnerability and coordinate the response. If your organization runs one of these older versions, the safest option for now is to remove the PaperCut Application Server from the public internet. Restrict access through a VPN or a trusted internal network until a proper fix becomes available. If your PaperCut server has been publicly accessible recently, installing the patch should not be the end of your response. It should be the start of an investigation. Before restarting the server, save its logs and configuration files so you don’t lose important evidence. Check whether pc-app.exe has launched a command shell or tools such as tasklist, and look for unexpected .class files in the server’s lib directory. Even a short two-minute reconnaissance attempt could be an early sign of a more serious attack. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Philippine nuclear and naval targets)
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. Hack One Robot, Reach the Next: Unitree G1 Security FlawsRhysida Ransomware Group Targets Berlin Government Ahead of VotePhilippine Nuclear and Naval Targets Hit by Suspected Chinese OperatorLove Electric Breach: 877,000 Driver Records Offered for $600Trump Targets Foreign Technology in New U.S. Power Grid Security OrderU.S. CISA adds ownCloud, Linux Kernel, and JFrog Artifactory flaws to its Known Exploited Vulnerabilities catalogRussian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic OrganizationsPaperCut Zero-Day Under Active Attack: Emergency Patch ReleasedU.S. CISA adds Red Hat, Linux Kernel, Ajax.NET Professional, Microsoft SQL Server, and Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalogCyberattack on UK Airport Operator MAG Exposes Data of 8.7 Million Customers Across Three AirportsDark Caracal Deploys New Go Malware With Ethereum-Based C2 FallbackAustralian Police Charge Two Over TeamPCP Credential TheftMeta to Pay Up to $18B Over Teen Social Media UseCISA Warns Water Utilities: Find Your Exposed PLCs Before Attackers DoOpenAI banned Russian ChatGPT accounts backing covert influence operationCISA Red Team Fully Compromised Two Critical Infrastructure OrgsFBI Seizes China-Linked Hacking Platforms QScan and QTRouter Used Against Critical InfrastructureU.S. CISA adds Gitea flaw to its Known Exploited Vulnerabilities catalog88 ID Verification Breaches Show the Cost of Collecting Identity DataWhatsApp Adds Stronger Security as Passkeys Hit 1 BillionOperation Jackal: 58 Arrests Expose the Money Laundering Machine Behind Global ScamsNorway ’s Digital Government Infrastructure Hit by a new DDoS AttackWhen the Algorithm Fires You: Uber Faces €825M FineTwo CVSS 9.8 Auth Bypasses in miniOrange SAML WordPress Plugin Were Exploited Before Any Database Even Listed the Paid Editions as VulnerableU.S. CISA adds maximum-severity Oracle flaw to its Known Exploited Vulnerabilities catalogFake Minecraft Sites Are Still Spreading WeedHack After C2 TakedownCybercriminals Turn GTA VI Leaks Into Malware BaitSlovakia Warns of Cyber Risks in Road Speed CamerasTikTok Settles U.S. Child Privacy Case for $400 MillioniAuthFlow v2: The $10,000 Phishing Toolkit That Survives Your Password ResetUK Power Plant Disabled for Four Days by Iran-Linked Hackers, Concurrent with US Water AttacksZero-Click Grok Chat History Theft: Adversa AI Demonstrates Cryptographic Context Injection International Press – Newsletter Cybercrime iAuthFlow v2 Enrolls Google Passkeys That Survive Password Resets Fake GTA VI ISO circulates on the internet a few days after leak, internet sleuths claim 113GB download is padded malware Taiwan charges 9 over illegal AI server exports to China, including Nvidia and Super Micro staff Indian man who fled US arrested on charges he helped scammers siphon $7.5 million from the elderly 58 arrests in global effort to dismantle West African organized crime groups Exposing AnonyMousKIT: AI-Powered PhaaS Supply Chain RTM Locker interview: a ransomware actor on the RaaS market Two WA men charged following AFP-FBI-WAPF disruption of alleged global cybercrime syndicate Love Electric driver data for sale: NI, licence numbers Ransomware group says it stole Berlin data, offers it for auction Malware FTP Banners: The New Dead Drop Resolver Delivering Novel RATs The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution 19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads SLEEPWALKER: A Passive Backdoor With Its Own Command Language Hacking One slug, seven editions: the miniOrange SAML SSO bug that let anyone log in as your WordPress admin A Tale of Two SOCs: Insights From Two Red Team Assessments Three UK airports hit by cyber-attack with data of 8.7m customers accessed New GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 to Gain Host Root Access PaperCut Releases Emergency Patch for Exploited Zero-Day Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator Using Known Vulnerabilities The Hugging Face incident and the road ahead Power Leak: Amazon Kiro IDE Prompt Injection Enables Data Exfiltration Claude Opus 4.6 Bypasses Gym Booking Limit, Cancels Other Users’ Reservations in Tests UniBLEed: Unauthenticated Root RCE on Any Unitree G1 Humanoid Robot Within Bluetooth Range PaperCut Actively Exploited: A Pre-Auth RCE Chain Intelligence and Information Warfare Iranian hackers shut down UK power plant Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go Backdoor Digdir stabilizes solutions after cyberattack Justice Department and FBI Seize Platforms Operated and Used by China State-Sponsored Hackers to Target U.S. Critical Infrastructure The infrastructure quartermaster: inside a China-nexus state enablement model Disrupting a new covert influence campaign from Russia Tortoiseshell: New Toolset and Operational Infrastructure Exposed Treasury Launches Unprecedented Campaign Against Iranian Regime on Economic D-Day Dark Caracal Reloaded: New Malware, Same Hunting Grounds Cambodia-focused cluster uses multistage infection chain with localized lures BlueDelta Targets Defense and Diplomacy with HOOKEDGE Cybersecurity Warning about the risks of road meters One billion people are now protected with passkeys on WhatsApp, plus more account security features An ID Check Breach Timeline: 2011–2026 Internet Exposure Reduction Guidance Meta agrees to pay $18 billion to settle US lawsuits over children’s social media addiction DECLARING A NATIONAL EMERGENCY TO SECURE THE UNITED STATES BULK-POWER SYSTEM Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Microsoft has disclosed details of a new ClickFix variant, dubbed TerminalFix, that aims to trick users into running a malicious command in Windows Terminal or PowerShell. "While traditional ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix campaigns apply the same technique but direct users to Windows Terminal or PowerShell instead, increasing the likelihood that complex
Anthropic is permanently increasing Claude Code's standard weekly usage limits by 25% for Pro, Max, Team, and seat-based Enterprise plans, but it's not as good as it sounds. If you use Claude, you're actually getting a 17% reduction compared to what you have today. Claude Code currently has a temporary 50% increase in weekly limits, which Anthropic says will remain in place until September 14. "Starting September 14, we're permanently raising standard weekly limits in Claude Code by 25% for Pro, Max, Team, and seat-based Enterprise plans," Anthropic wrote on X. "Until then, the current 50% increase will be in place." It's a clever way to frame words, as it almost sounds like you're winning as a customer, but you're not, and it's a downgrade. If Claude Code's original weekly allowance was 100, the temporary boost gives you 150 today. On September 14, that drops to 125.
Confirm this action.
Leaving now will discard your changes.