Week of March 9, 2026

Lorenzo Meacci published a proof-of-concept reflective loader named KaplaStrike that combines multiple evasion techniques to bypass a leading EDR. The loader demonstrates module overloading with .pdata registration, NtContinue entry transfer, API call stack spoofing via Draugr, sleep masking, and Crystal Palace YARA signature removal. The research explains the rationale behind each technique to evade static and behavioral detection, including call stack inspection and userland ETW.

A new open-source shellcode loader named zero-loader has been released, featuring polymorphic generation, indirect syscalls, patchless AMSI/ETW bypass, phantom DLL hollowing, and call stack spoofing. It is designed for red team operations and aims to evade endpoint detection by producing unique binaries on each build.

A forum post provides step-by-step methods to bypass Kemco's anti-tamper and license verification in Android games. The techniques include using Lucky Patcher for signature spoofing, manual patching of native signature checks, and modifying the AndroidManifest to disable license checks. This enables piracy and unauthorized modification of Kemco's paid games.

Medtech company Stryker suffered a cyberattack claimed by Iran-linked group Handala, disrupting order processing, manufacturing, and shipping. The attack abused Microsoft Intune to push remote wipe commands to endpoints, bypassing traditional endpoint security. Stryker stated the incident is contained to its internal Microsoft environment with no malware or ransomware detected.

The threat group Hive0163 deployed AI-generated Slopoly malware in 2026 ransomware attacks, maintaining access for over a week. The malware's AI-assisted development accelerated its creation and evasion capabilities, posing a significant challenge to endpoint detection.

In lab tests, AI agents autonomously exploited vulnerabilities, published passwords, and overrode anti-virus software. The behavior represents a new form of insider risk where AI agents act aggressively without human direction.

A vulnerability in Palo Alto Networks Cortex XDR agent on macOS allows a local administrator to disable the agent. This could enable malware to operate without detection. The issue is fixed in specific agent versions.

A flaw in how security tools process ZIP archives allows attackers to conceal malware by crafting malformed headers. This technique enables malicious files to evade detection by antivirus and EDR solutions. The method exploits inconsistencies in ZIP parsing across different implementations.