UAC Bypass

A previously unseen Rust-based ransomware family named Spirals was deployed in a double extortion attack against a South Asian IT services company in June 2026. The attackers compromised an internet-facing IIS web server via an ASP.NET web shell, established multiple redundant C2 channels using revsocks, Chisel, and Cloudflare tunnel, performed credential theft via SAM and LSASS dumps, and deployed the ransomware payload via PsExec across the network within 24 hours of initial access. The ransomware uses AES-128 file encryption with ECDH P-256 key wrapping and includes capabilities for defense evasion, lateral movement, and process termination.

Kaspersky identified OkoBot, a sophisticated multi-stage malware framework delivered via the TookPS PowerShell downloader and orchestrated over an attacker-controlled SSH tunnel, targeting cryptocurrency users. The framework comprises over 20 interconnected payloads that perform UAC bypass, RDP hijacking, browser-extension based credential theft (Rilide), hardware-wallet seed-phrase phishing (SeedHunter), keylogging, and screen/video capture (OkoSpyware), all coordinated through a plugin dispatcher communicating over HTTP/HTTPS C2 channels. The campaign has been active since at least March 2025, continues to evolve its tooling, and shows indicators (geoblocking, Russian code comments, use of Rilide) consistent with Russian-speaking cybercriminal operators.

2026-07-0816 minElastic Security Labshigh

REF6045 is an operator-assisted Mexican banking fraud operation that uses ClickFix fake CAPTCHA pages to deliver the SCMBANKER PowerShell toolkit. Once installed, the toolkit monitors for banking sessions, captures screenshots, deploys vishing overlays, hijacks clipboard data to swap CLABE and card numbers, redirects browsers to phishing pages, and silently installs Remote Utilities as a persistent RAT. The operation's infrastructure suffered significant OPSEC failures including open directories, a leaked web-root archive, and an unauthenticated configuration editor.

A structured, multi-stage infection chain delivers the CrySome RAT via a logistics-themed spear-phishing lure. Initial access is achieved through a fake rate confirmation portal that drops a batch file, which chains UAC bypass (ICMLuaUtil COM interface), in-memory AMSI patching, and the open-source WinDefCtl utility to weaken Microsoft Defender before deploying the persistent RAT payload. CrySome RAT provides the operator with remote command execution, credential theft from Chromium browsers, HVNC, keylogging, and persistence via a scheduled task executing every 5 minutes.

A widespread malware campaign is leveraging compromised WhatsApp accounts to distribute malicious VBScript files disguised as financial documents. The multi-stage infection chain abuses legitimate Windows utilities to download payloads, attempts to bypass UAC via registry modifications, and ultimately deploys a preconfigured ManageEngine Endpoint Central RMM agent to establish persistent remote access.

2026-06-016 minElastic Security Labshigh

PHANTOMPULSE is a sophisticated RAT attributed to DPRK-aligned actors that utilizes hardware breakpoints to bypass AMSI, WLDP, and ETW. It establishes a resilient, sinkhole-able command and control channel by resolving C2 URLs from blockchain transaction inputs and employs multiple process injection and UAC bypass techniques.

A cybercrime campaign is targeting users of pirated media sites with a fake video player update that deploys a modified SilentCryptoMiner and a Remote Access Trojan (RAT). The malware utilizes DLL side-loading, DNS tunneling for initial check-ins, and a DGA for C2 communications, while employing a Watchdog component to ensure persistence via a rogue Google Update service.

The Cloud Atlas APT group has updated its toolset in 2025-2026 campaigns targeting Russia and Belarus, utilizing LNK-based phishing to deploy VBCloud and PowerShower backdoors. The group establishes persistent access by patching termsrv.dll for concurrent RDP sessions and heavily relies on reverse SSH, RevSocks, and Tor for redundant C2 channels. Additionally, a new PowerShell tool named PowerCloud is used to exfiltrate administrator data to Google Sheets.

2026-05-139 minArctic Wolfcritical

Arctic Wolf Labs identified a highly targeted campaign by the DPRK-nexus threat actor BlueNoroff against the Web3 sector. The attackers utilize sophisticated social engineering, including AI-generated deepfakes and stolen webcam footage, to lure victims into fake Zoom or Teams meetings. Once engaged, a ClickFix clipboard injection attack deploys a fileless PowerShell C2 implant, leading to the theft of cryptocurrency wallets, browser credentials, and Telegram sessions.

2026-05-135 minZscaler ThreatLabzhigh

Attackers are utilizing a fake Adobe Acrobat Reader lure to deploy a highly obfuscated VBScript loader that executes a .NET payload entirely in-memory. The attack chain leverages PEB manipulation for process masquerading and abuses auto-elevated COM objects to bypass UAC, ultimately installing the legitimate ScreenConnect remote access tool for malicious purposes.

2026-05-135 minCheck Pointcritical

Check Point Research discovered a zero-day vulnerability (CVE-2026-3502) in the TrueConf client update mechanism, exploited in 'Operation TrueChaos' against Southeast Asian governments. Attackers compromised on-premises TrueConf servers to distribute malicious updates, utilizing DLL sideloading and UAC bypass techniques to deploy the Havoc C2 framework.

2026-05-135 minElastic Security Labshigh

Elastic Security Labs identified a new .NET loader dubbed SILENTCONNECT, which is distributed via phishing emails and Cloudflare Turnstile CAPTCHA pages. The loader utilizes living-off-the-land binaries, PEB masquerading, and UAC bypass techniques to silently install remote monitoring and management (RMM) tools like ScreenConnect for persistent access.

Security researchers identified and disclosed nine methods to bypass the new Windows Administrator Protection feature by abusing the UI Access flag. These bypasses leveraged logical flaws in secure directory checks, shared user profiles, and RPC method handling to achieve arbitrary code execution and privilege escalation.

The GetProcessHandleFromHwnd API contains historical design flaws allowing attackers to bypass User Interface Privilege Isolation (UIPI) and hijack Protected Processes. By forcing a protected process like WerFaultSecure.exe to create a window, attackers can obtain a privileged handle to inject shellcode, a vulnerability that remains exploitable on Windows 10 and pre-24H2 Windows 11 systems.