Week of March 30, 2026

A previously unknown Microsoft-signed kernel driver, PoisonX.sys, was discovered enabling Bring-Your-Own-Vulnerable-Driver (BYOVD) attacks to terminate CrowdStrike Falcon's Protected Process Light (PPL) sensor. The driver exposes an undocumented IOCTL (0x22E010) that allows user-mode attackers to kill any process by PID from kernel mode, bypassing PPL protections. This vulnerability highlights the risk of signed but vulnerable drivers being exploited to disable endpoint security.

Qilin ransomware operators use a malicious msimg32.dll to execute a multi-stage infection chain that terminates endpoint detection and response (EDR) processes. The attack leverages DLL side-loading and a custom tool to disable security software before deploying ransomware. This technique allows attackers to evade detection and encrypt systems unimpeded.

Researchers presented 'Memory Fluctuation' at CoRIIN 2026, a technique that evades memory scanners in EDR/AV by cyclically encrypting shellcode and toggling memory protections. The method prevents tools like Moneta or pe-sieve from detecting malicious code during dormant periods. Proof-of-concept code and detection scripts were released on GitHub.

SentinelOne's AI-powered EDR autonomously detected and blocked a zero-day supply chain attack targeting the LiteLLM library. The attack involved malicious code injected into the supply chain, which was stopped before execution globally. This demonstrates the capability of AI-driven endpoint security to prevent novel threats without prior signatures.

A malware campaign distributes VBScript files via WhatsApp messages, initiating a multi-stage infection chain that installs MSI backdoors for persistent access. The attack abuses renamed Windows tools and cloud-hosted payloads to evade detection. This campaign highlights the use of social engineering and living-off-the-land techniques to bypass endpoint security.

SysInject is a proof-of-concept technique that bypasses EDR hooks by routing calls through legitimate hooked functions with clean parameters, then using an exception handler to redirect execution to the intended syscall. This maintains a clean callstack and evades both hook-based and callstack-based detection.

A local privilege escalation vulnerability (CVE-2026-3991) was disclosed in Symantec Data Loss Prevention (DLP) Agent for Windows. The flaw allows attackers with local access to escalate to SYSTEM by exploiting a hardcoded OpenSSL configuration path. Broadcom has released patches to address the issue.

An infostealer campaign targeting professional networks used DLL sideloading via a legitimate signed Microsoft Office binary (winword.exe) to execute malicious code. At the time of discovery, the payload had zero detections on VirusTotal, indicating effective evasion of antivirus engines. The technique leverages trusted process execution to reduce behavioral suspicion.