Securonix has identified Deep#Door, a stealthy Python-based backdoor that gives attackers persistent remote command execution and extensive surveillance on Windows systems. The threat uses embedded Python in batch scripts, disables security controls, establishes multi-layered persistence, and employs advanced in-memory and evasion techniques to remain covert and resilient. #DeepDoor #Windows...

A trojanized CPUID HWMonitor installer was used to deliver a multi-stage, fileless malware chain that leverages trusted Windows binaries (PowerShell, MSBuild, regsvr32) to execute scriptlet payloads such as Clippy.sct which reconstructs and runs a .NET assembly entirely in memory. The reconstructed payload is deserialized and dynamically invoked (with likely follow-on shellcode execution via VirtualAlloc/CreateThread), and organizations are advised to validate installers, deploy EDR, and monitor for regsvr32/MSBuild/scriptlet usage and large embedded arrays. #HWMonitor #Clippy.sct

Microsoft Defender Security Research details a campaign in which malicious VBS scripts delivered via WhatsApp download additional VBS payloads and MSI installers from cloud storage, leveraging renamed system utilities and UAC bypass attempts to evade detection and escalate privileges. The report provides Microsoft Defender detections, hunting queries, mitigation recommendations (EDR in block mode, network and web protection, tamper protection, attack surface reduction rules), and IOCs including SHA-256 hashes, cloud storage URLs, and C2 domains. #TrojanVBS_ObfuseKPP #Neescil_top

Researchers found a new campaign that uses the ClickFix social engineering lure to run an undocumented loader called DeepLoad, which leverages AI-assisted obfuscation, in-memory APC injection, and immediate credential theft to evade static detection. DeepLoad hides inside legitimate Windows processes (e.g., LockAppHost.exe), compiles randomized temporary DLLs via Add-Type, uses WMI for...