Windows Security News & Threats | Hexnode Threat Watch

Windows

GreatXML-BitLocker-bypass

GreatXML BitLocker Bypass Exploit Exposes Windows Recovery Partition Risks

Aug 20

4 min read

Tailscale-persistence

Tailscale Persistence & OpenSSH Maintain Access After C2 Outage

Aug 20

5 min read

malicious-npm-packages

Malicious PostCSS-Themed npm Packages Deliver Windows RAT

Aug 20

4 min read

Certighost

Certighost CVE-2026-54121 PoC Released: AD CS Domain Takeover Defense Guide

Aug 19

5 min read

Greatness PhaaS Uses RingCentral Trust to Steal Microsoft 365 Tokens

Greatness PhaaS Uses RingCentral Trust to Steal Microsoft 365 Tokens

Aug 7

6 min read

khunt Toolkit Runs Inside Oracle Database After SQL Injection

khunt Toolkit Runs Inside Oracle Database After SQL Injection

Aug 7

7 min read

CaptiveCrunch Turns Hotel Wi-Fi Into an Endpoint and Token Theft Trap

CaptiveCrunch Turns Hotel Wi-Fi Into an Endpoint and Token Theft Trap

Aug 3

6 min read

legacyhive zero day

LegacyHive Zero-Day: Enterprise Response Before Microsoft’s Fix

Jul 23

6 min read

wsus sync delays

Microsoft WSUS Sync Delays: Why Patch Infrastructure Health Is a Security Priority

Jul 23

5 min read

ACR Stealer Surge Targets Enterprise Browsers, Tokens, and Microsoft 365 Data

ACR Stealer Surge Targets Enterprise Browsers, Tokens, and Microsoft 365 Data

Jul 21

6 min read

Zoom Windows Account Takeover Flaw Puts Collaboration Endpoints on Patch Watch

Zoom Windows Account Takeover Flaw Puts Collaboration Endpoints on Patch Watch

Jul 20

5 min read

Microsoft Teams EtherRAT Phishing Uses Fake IT Support Calls to Deliver Malware

Microsoft Teams EtherRAT Phishing Uses Fake IT Support Calls to Deliver Malware

Jul 8

6 min read

Node.js Implant Phishing Campaign Targets Hotels with Photo ZIP File

Node.js Implant Phishing Campaign Targets Hotels with Photo ZIP Files

Jun 29

7 min read

Edgecution Turns Microsoft Edge Native Messaging Into a Ransomware Access Bridge

Edgecution Turns Microsoft Edge Native Messaging Into a Ransomware Access Bridge

Jun 29

5 min read

dragonforce ransomware

DragonForce Uses Microsoft Teams Relays to Hide Backdoor.Turn Ransomware C2

Jun 22

5 min read

USB LNK Worm Turns Clipboard Theft Into a Tor-Backed Windows Backdoor

USB LNK Worm Turns Clipboard Theft Into a Tor-Backed Windows Backdoor

Jun 19

5 min read

RoguePlanet Zero-Day Confirmed as CVE-2026-50656

Microsoft Confirms RoguePlanet Defender Zero-Day CVE-2026-50656 and Says a Patch Is Coming

Jun 18

5 min read

microsoft june 2026 patch tuesday

Microsoft June 2026 Patch Tuesday Breaks Records with Around 200 Vulnerability Fixes

Jun 11

5 min read

Hola Browser Supply Chain Attack

Hola Browser Supply Chain Attack: How a Trusted Browser Distribution Channel Delivered a Cryptominer

Jun 9

6 min read

Microsoft May 2026 Patch Tuesday Fixes 120 Vulnerabilities Across Enterprise Product

Microsoft May 2026 Patch Tuesday Fixes 120 Vulnerabilities Across Enterprise Products

May 13

5 min read