Windows Security News & Threats | Hexnode Threat Watch

Windows

NeedyMantis malware

NeedyMantis malware: How a modular toolkit supports targeted intrusions

Sep 29

6 min read

third-party.com malware

third-party.com Malware: Placeholder Domain Fuels ClickFix Attack

Sep 28

6 min read

Ukrainian Business Sites Become ClickFix Launchpads for Psychedelic Stealer

Ukrainian Business Sites Become ClickFix Launchpads for Psychedelic Stealer

Sep 25

5 min read

Cisco FMC Exploits Move From Edge Access to Qilin Ransomware and Cyclops Blink

SharePoint CVE-2026-65660: Why Teams Should Reassess Patch Priority

Sep 23

6 min read

ChainScript Uses ClickFix and Polygon to Keep RAT Infrastructure Moving

ChainScript Uses ClickFix and Polygon to Keep RAT Infrastructure Moving

Sep 22

5 min read

task#stomp powershell backdoor

TASK#STOMP PowerShell Backdoor Steals Business Documents

Sep 22

6 min read

One Click on Windows Opens the Door to GRAYRABBIT

One Click on Windows Opens the Door to GRAYRABBIT

Sep 18

5 min read

Defender Patch Bypass Reopens the SYSTEM Privilege Door

Defender Patch Bypass Reopens the SYSTEM Privilege Door

Sep 14

5 min read

bluemoon exploit kit

BlueMoon Exploit Kit Targets Chrome and Windows Endpoints

Sep 11

6 min read

PEEP Malware Turns Chrome and Edge Into Post-Compromise Backdoor

PEEP Malware Turns Chrome and Edge Into Post-Compromise Backdoors

Sep 8

7 min read

REVSTEALER

REVSTEALER, ProManager, WinUpdate, SoftManager and LockAppHost: How the Modules Put Windows at Risk

Sep 8

11 min read

VMware Desktop Virtualization Bugs Put Developer and Admin Hosts at Escape Risk

VMware Desktop Virtualization Bugs Put Developer and Admin Hosts at Escape Risk

Sep 7

5 min read

Faronics Deploy Abuse Turns Endpoint Management into an Attack Path

Faronics Deploy Abuse Turns Endpoint Management into an Attack Path

Sep 2

9 min read

Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE

Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE

Aug 28

8 min read

GreatXML-BitLocker-bypass

GreatXML BitLocker Bypass Exploit Exposes Windows Recovery Partition Risks

Aug 20

4 min read

Tailscale-persistence

Tailscale Persistence & OpenSSH Maintain Access After C2 Outage

Aug 20

5 min read

malicious-npm-packages

Malicious PostCSS-Themed npm Packages Deliver Windows RAT

Aug 20

4 min read

Certighost

Certighost CVE-2026-54121 PoC Released: AD CS Domain Takeover Defense Guide

Aug 19

5 min read

Greatness PhaaS Uses RingCentral Trust to Steal Microsoft 365 Tokens

Greatness PhaaS Uses RingCentral Trust to Steal Microsoft 365 Tokens

Aug 7

6 min read

khunt Toolkit Runs Inside Oracle Database After SQL Injection

khunt Toolkit Runs Inside Oracle Database After SQL Injection

Aug 7

7 min read

CaptiveCrunch Turns Hotel Wi-Fi Into an Endpoint and Token Theft Trap

CaptiveCrunch Turns Hotel Wi-Fi Into an Endpoint and Token Theft Trap

Aug 3

6 min read

legacyhive zero day

LegacyHive Zero-Day: Enterprise Response Before Microsoft’s Fix

Jul 23

6 min read

wsus sync delays

Microsoft WSUS Sync Delays: Why Patch Infrastructure Health Is a Security Priority

Jul 23

5 min read

ACR Stealer Surge Targets Enterprise Browsers, Tokens, and Microsoft 365 Data

ACR Stealer Surge Targets Enterprise Browsers, Tokens, and Microsoft 365 Data

Jul 21

6 min read

Zoom Windows Account Takeover Flaw Puts Collaboration Endpoints on Patch Watch

Zoom Windows Account Takeover Flaw Puts Collaboration Endpoints on Patch Watch

Jul 20

5 min read

Microsoft Teams EtherRAT Phishing Uses Fake IT Support Calls to Deliver Malware

Microsoft Teams EtherRAT Phishing Uses Fake IT Support Calls to Deliver Malware

Jul 8

6 min read

Node.js Implant Phishing Campaign Targets Hotels with Photo ZIP File

Node.js Implant Phishing Campaign Targets Hotels with Photo ZIP Files

Jun 29

7 min read

Edgecution Turns Microsoft Edge Native Messaging Into a Ransomware Access Bridge

Edgecution Turns Microsoft Edge Native Messaging Into a Ransomware Access Bridge

Jun 29

5 min read

dragonforce ransomware

DragonForce Uses Microsoft Teams Relays to Hide Backdoor.Turn Ransomware C2

Jun 22

5 min read

USB LNK Worm Turns Clipboard Theft Into a Tor-Backed Windows Backdoor

USB LNK Worm Turns Clipboard Theft Into a Tor-Backed Windows Backdoor

Jun 19

5 min read

RoguePlanet Zero-Day Confirmed as CVE-2026-50656

Microsoft Confirms RoguePlanet Defender Zero-Day CVE-2026-50656 and Says a Patch Is Coming

Jun 18

5 min read

microsoft june 2026 patch tuesday

Microsoft June 2026 Patch Tuesday Breaks Records with Around 200 Vulnerability Fixes

Jun 11

5 min read

Hola Browser Supply Chain Attack

Hola Browser Supply Chain Attack: How a Trusted Browser Distribution Channel Delivered a Cryptominer

Jun 9

6 min read

Microsoft May 2026 Patch Tuesday Fixes 120 Vulnerabilities Across Enterprise Product

Microsoft May 2026 Patch Tuesday Fixes 120 Vulnerabilities Across Enterprise Products

May 13

5 min read