Week of April 6, 2026

A security researcher released SCUDSTORM, an obfuscator that defeats fuzzy hashing (SSDEEP) and import hashing (IMPHASH) using opaque predicates and randomized control flow graphs. The technique appends unused DLL imports to alter the Import Address Table without affecting execution, and can be combined with fileless malware delivery to hinder static analysis.

A convincing fake Microsoft support website tricks users into downloading malware that steals passwords, payment information, and account credentials. The malware targets endpoint data and poses a direct threat to user security. This incident highlights the ongoing risk of social engineering campaigns delivering infostealers.

A vulnerability in Rapid7 Insight Agent for Linux allows eval injection via crafted beacon responses, potentially leading to remote code execution as root. Exploitation requires prior highly privileged access to the backend platform due to mutual TLS authentication, limiting practical risk. No patch is currently available.

BlueHammer is a disclosed Windows zero-day vulnerability that leverages the Microsoft Defender update mechanism to achieve privilege escalation. The exploit remains unpatched at the time of reporting, posing a risk to systems relying on Defender. Technical details were published by Howler Cell.

Security researchers released a tool that patches the Qualcomm Android Bootloader (ABL) to spoof a locked bootloader state on Snapdragon 8 Elite Gen 5 devices. The patched ABL is flashed to the efisp partition, causing the Trusted Execution Environment to report a locked state, which passes hardware key attestation and yields STRONG Play Integrity and Widevine L1. This bypasses bootloader unlock detection and undermines device integrity checks.