Week of November 3, 2025

A publicly released research framework demonstrates a method to bypass Driver Signature Enforcement (DSE) on Windows 10 and 11 by surgically patching SeCiCallbacks in the kernel. The tool includes a boot-time native application and a runtime loader, enabling loading of unsigned drivers. This proof-of-concept highlights a persistent attack surface in kernel code integrity mechanisms.

A technique has been demonstrated to evade Elastic EDR's call stack signature detections by using call gadgets that manipulate the call stack to bypass behavioral detection. This method alters expected call stack patterns, complicating detection. No known in-the-wild exploits exist, but it highlights a detection gap.

Google Threat Intelligence Group reports that Russian APT28 is actively deploying PromptSteal, an AI-enabled data miner, in Ukraine. PromptSteal uses AI to generate Windows commands for collecting documents and exfiltrating them to a C2 server. Another AI-enabled malware, PromptFlux, is under development.

Google security researchers identified what they describe as the first known case of hackers using AI-powered malware in a real-world cyberattack. The malware leveraged generative AI to craft malicious components, marking a shift toward operationalizing AI for attacks. This development signals an evolution in adversary capabilities that could challenge endpoint detection systems.

A new open-source tool, TNFBypass, has been published to bypass the serial verification step in TNFlash.exe, the flashing utility for TN ROM 3.x. The tool targets the endpoint security mechanism that checks device serials against a database, allowing users to flash custom ROMs without approval. It employs memory hooking to intercept and modify the serial during the fastboot process, circumventing recent anti-tampering updates.

A security researcher used an LLM with a $5 prompt to find six potential issues in Django, two of which were assigned CVEs (CVE-2025-64458, CVE-2025-64460), and a denial-of-service vulnerability in Starlette (CVE-2025-62727). The approach demonstrates how LLMs can lower the cost and barrier for vulnerability discovery in open-source web frameworks.

A security researcher released StyxLoaderX, an open-source modular framework for EDR evasion on Windows x64. It uses dynamic syscalls, AES encryption, and process hollowing to achieve an 85% evasion rate against Sysmon. The tool is intended for educational and red team use.