Week of July 21, 2025

A new Magisk/KernelSU module, TS-Enhancer-Extreme, enhances TrickyStore to hide bootloader unlock detection points on Android devices. It spoofs bootloader lock status, fixes VerifiedBootHash, and syncs security patch levels, potentially defeating security tools that rely on these signals. The module includes a CLI tool for keybox theft and a WebUI for configuration.

Aqua Security discovered a sophisticated Linux malware named Koske that uses AI-generated code to deploy CPU/GPU-optimized miners on misconfigured JupyterLab instances. The malware employs polyglot JPEG files to deliver a rootkit and uses multiple adaptive techniques for persistence and C2 communication. AI assistance is evident from verbose comments, modular design, and defensive scripting patterns.

A publicly available tool named UpadtedMethod demonstrates DLL injection to bypass multiple security features of Respondus LockDown Browser, including window switching detection, focus enforcement, blacklisted application closure, and clipboard clearing. The tool is presented as educational but provides a functional proof-of-concept for cheating on proctored exams.

Vidoc Security Lab tested LLMs on 95 real-world vulnerabilities from open-source projects and found they could identify 80% of them. The study highlights that LLMs are becoming highly effective at discovering security issues through brute-force patience rather than advanced reasoning. This capability poses a significant risk as it lowers the barrier for vulnerability discovery.

Security researchers demonstrated that modern EDRs can be bypassed using simple, well-known techniques such as process hollowing, DLL unhooking, and syscall obfuscation. The proof-of-concept shows that these methods remain effective against current endpoint detection solutions, highlighting gaps in behavioral detection. This matters because it underscores that attackers can still evade defenses without sophisticated zero-days.

A GitHub repository named 'AMSI-Bypasses' by Matthew-Holt was published containing two PowerShell scripts that demonstrate techniques to bypass the Antimalware Scan Interface (AMSI). The first script uses an in-memory patch of the AmsiScanBuffer function, while the second is a basic reverse shell. This provides attackers with ready-to-use methods to evade endpoint detection.

A bug report in Wazuh's open-source repository indicates that the vulnerability detection module fails to detect CVE-2023-6152 for Grafana 10.0.0 on Windows 11 and CentOS 7 agents, while CVE-2024-1442 is correctly detected. Root cause analysis confirmed the detection logic incorrectly marks the vulnerability as 'unaffected' due to version matching issues in the NVD feed data.