FacebookXInstagramPinterest

Data security

Document content security is the discipline of verifying that files are not only protected through access controls and confidentiality measures, but are also intrinsically safe to use. It emphasizes confirming that documents such as PDFs, Microsoft Office files, and images are free from embedded malware, ransomware, or other concealed threats before they are opened or shared. This is accomplished through proactive inspection, validation, and sanitization of file structures to eliminate suspicious active content while preserving the integrity of legitimate data. By treating document safety as a baseline assurance, organizations can support secure collaboration, block a primary malware delivery vector, and guarantee that every exchanged file is both trusted and genuinely clean.

When the Bank Email Ships a Script: A VBScript Phishing Chain and Where Content Security Actually Helps

A fake Bank of America notice ends with a silent remote-access install. The interesting part for defenders is where in that chain a file threat can be neutralized, and where it cannot. Huntress recently documented a phishing campaign that impersonates Bank of America and ends with a stealthy remote monitoring and management tool planted on the victim's machine. It is a good case study, not because any single step is novel, but because the chain shows exactly how a file-borne threat travels from an inbox to full administrative control, and it lets us be precise about which defensive layers engage at which moment. That precision matters. Overstating what any one control catches is how security teams end up surprised. What [...]

UAT-11795 Shows Why Modern Financial Attacks Are Won or Lost at the File

Threat Analysis · Content Analysis, Disarm and Reconstruction Cisco Talos has disclosed a financially motivated intrusion set it tracks as UAT-11795, a Russian-speaking group that has been active since at least June 2025 and has focused on victims in the United States and Europe, with additional cases seen in Germany, Romania, and Venezuela. The campaign is a clear example of how today's cybercriminals combine custom malware with carefully staged delivery to slip past traditional endpoint defenses. The operation relies on two homegrown tools. The first is a Python-based remote access tool that Talos calls Starland RAT. The second is a PowerShell command-and-control implant known as the Cisco Talos has disclosed a financially motivated intrusion set it tracks as UAT-11795, a [...]

VEC: One of Cybercrime’s Most Effective Attack Surfaces

How modern Vendor Email Compromise campaigns take advantage of everyday financial workflows, weaponized invoice files, and trusted supplier relationships to slip past traditional security controls. Business Communication Has Become a Trusted Delivery Channel for Attackers Most organizations run on a steady stream of contact with outside partners. Finance teams process invoices, procurement coordinates supplier contracts, sales exchanges quotes, and vendor managers talk daily with contractors, agencies, distributors, and service providers. All of that activity builds one of the most trusted communication environments inside a company, simply because employees come to expect a constant flow of financial messages about invoices, payment confirmations, purchase orders, and vendor account details. Criminals have figured out that this dependence on routine is an opening. Instead [...]

How Attackers Use JavaScript and PowerShell to Steal Your Credentials

The PureLogs infostealer campaign is a textbook example of a technique that is spreading fast: use normal Windows tools to silently steal everything on your machine. Here is how it works, why it is so hard to stop, and what defenders can do. When most people think about malware, they imagine a suspicious file downloaded from a shady website. The reality in 2026 looks very different. Today's most effective attacks start with an ordinary-looking email, use tools that are already installed on your computer, and never write the most dangerous parts of the attack to your hard drive at all. The recent PureLogs campaign analyzed by FortiGuard Labs is one of the clearest examples of this approach, and understanding it [...]

When Your Antivirus Becomes the Attack Vector

CVSS Score 7.8 (High) Severity High Disclosed May 19, 2026 CISA KEV Deadline June 3, 2026 Think you work in an office building with a security guard (Microsoft Defender) who has a master key to every room. You slip a fake sign on a broom cupboard that says "Server Room". The guard dutifully unlocks the actual server room on your behalf because they followed your sign without checking where it really pointed. That fake sign is a symbolic link: a pointer on the filesystem that redirects one path to another. CVE-2026-41091 exists because Defender's engine follows these pointers without verifying the destination before operating on them with full NT AUTHORITY\SYSTEM privileges. Technical Root Cause The bug lives in the Microsoft Malware Protection Engine (MMPE), classified under CWE-59: [...]

Malicious SVG Files: How Attackers Abuse Scalable Vector Graphics and Why Traditional Protections Are Not Enough

Scalable Vector Graphics (SVG) files are widely used across modern digital environments. They power website graphics, marketing assets, user interface components, email signatures, cloud-hosted content, QR codes, and responsive web applications. Because SVG files are typically associated with logos and illustrations, they are often perceived as harmless image files. That assumption is increasingly dangerous and measurably so. Security firms including Kaspersky, Trustwave, and Sophos have documented a dramatic rise in SVG-based attacks starting in late 2024 and accelerating sharply through 2025 and partially in 2026. Based on reporting numbers the Trustwave has seen an 1,800% surge in SVG-driven phishing activity in early 2025 compared to April 2024, while KnowBe4 recorded a 245% jump between Q4 2024 and early March 2025. [...]

ADVERSARIAL TECHNIQUE ANALYSIS: File Recovery from Backup via WBAdmin.exe

This research provides a comprehensive technical analysis of a post-exploitation technique that abuses Windows' native backup and recovery infrastructure to obtain sensitive system files that are normally protected on a live operating system. By leveraging wbadmin.exe — a Microsoft-signed, built-in administrative utility — an attacker with sufficient privileges can silently recover historical copies of credential stores and configuration files, bypassing modern endpoint defences entirely. The technique is particularly dangerous because it requires no custom tooling, leaves a minimal forensic footprint compared to direct memory-access methods, and exploits data that administrators often overlook in their security posture. Historical backups may contain credentials that predate password-rotation policies, making them a goldmine for lateral movement and privilege escalation. MITRE ATT&CK Framework Mapping Technique [...]

Malware-Free Intrusions: How Modern Attacks Weaponize Trusted Tools and Active Content

Traditional malware is no longer required to compromise enterprise environments. Increasingly, threat actors are achieving full operational access without deploying conventional executable payloads at all. Instead of relying on ransomware binaries, trojans, or obvious malicious files, attackers are abusing legitimate administrative utilities, trusted scripting frameworks, cloud identity infrastructure, and active content embedded inside common business documents. This evolution has fundamentally altered the cybersecurity landscape. Many modern intrusions now resemble normal administrative activity rather than recognizable malware infections, allowing adversaries to evade signature-based antivirus engines, bypass static scanning, and operate for extended periods inside enterprise networks before detection. One of the most heavily abused components in these operations remains Microsoft PowerShell, particularly when execution is initiated indirectly through active content embedded [...]

Microsoft warns of sophisticated phishing campaigns that bypassed multi-factor authentication

Microsoft's Defender Research team has disclosed a large-scale phishing campaign that used fake workplace compliance notices to lure employees into surrendering their Microsoft account credentials, and, critically, their authentication session tokens through an adversary-in-the-middle (AiTM) attack. Scale and targeting The campaign targeted more than 35,000 users across 13,000 organizations in 26 countries, with the United States accounting for many targets. Microsoft did not disclose how many accounts were successfully compromised. How the attack was constructed The campaign ran in waves between April 14 and 16, 2026, and was built around a convincing impersonation of internal HR and compliance communications. Phishing emails arrived with subject lines such as "Internal case log issued under conduct policy" and "Reminder: employer opened a non-compliance [...]

BYOVD-Powered EDR Killers and Their Role in Modern Ransomware Operations

A recent ESET investigation into tools designed to disable endpoint detection and response (EDR) software found that a large number of them use a technique called "bring your own vulnerable driver" (BYOVD). In total, 54 different tools were found using this method, taking advantage of 35 known weak drivers. These tools have become a key part of how ransomware attacks work — attackers use them to knock out security software before unleashing their file-encrypting malware. Why EDR Killers Exist Ransomware groups, especially those running ransomware-as-a-service (RaaS) operations, constantly churn out new versions of their encryption software. Keeping each version hidden from security tools is hard and costly. The core problem is that encryption software is inherently noisy — it rapidly [...]

Go to Top