Week of April 27, 2026

Microsoft Defender for Endpoint incorrectly flagged and quarantined legitimate DigiCert root certificates, causing potential disruption to TLS validation and application trust. The incident underscores risks of automated endpoint remediation when security tools misclassify critical system artifacts.

Cybersecurity vendor Trellix disclosed that a threat actor gained unauthorized access to its source code. The breach raises supply chain concerns as exposure of security product internals could aid attackers in bypassing detections. Details remain limited.

Security researchers demonstrated a technique called CopyFail that bypasses Linux kernel-level EDR/security agents even when the attacker has root access. The method exploits the fact that security modules cannot intercept direct kernel function calls, allowing an attacker to tamper with agent memory and disable protections. This challenges the assumption that root access means total compromise, showing that EDR can still provide value if properly implemented.

Researchers disclosed a Python-based remote access trojan (RAT) named Deep#Door that uses tunneling and obfuscation to evade detection on Windows endpoints. The malware steals credentials and maintains persistence, posing a threat to endpoint security controls.

Hades Gate is a proof-of-concept tool that constructs direct syscall stubs at runtime by manually walking the PEB, parsing PE headers, and extracting syscall numbers from ntdll.dll. It bypasses userland EDR/AV hooks by executing syscalls without calling monitored ntdll functions, demonstrating a technique relevant to endpoint security evasion.

A North Korean threat actor uploaded an AI-generated npm package in October 2025 as part of a campaign dubbed PromptMink. The package delivered remote access trojans (RATs) and was linked to broader DPRK operations involving fake firms. The use of generative AI to craft malware represents an evolution in supply chain attack techniques.

Checkmarx suffered a supply chain incident where attackers gained unauthorized access to GitHub repositories, likely via the TeamPCP attack on Trivy scanner, leading to publication of malicious Jenkins AST plugin artifacts. Customer data was not stored in the affected repositories, but data exfiltration occurred on March 30, 2026, with stolen data later published by LAPSUS$.

Check Point Research discovered that VECT 2.0 ransomware contains a critical encryption flaw causing permanent data destruction for files larger than 128 KB. The flaw, present across Windows, Linux, and ESXi variants, discards three of four decryption nonces, making recovery impossible even for the attacker. This effectively turns the ransomware into a wiper for virtually all meaningful enterprise data.

A security researcher disclosed a new privilege escalation technique called PhantomRPC that abuses RPC interfaces exposed by Local Service accounts, such as the DHCP Client service, to escalate privileges on Windows systems. No patch is available, and the technique relies on design flaws in RPC server implementations.

The RansomHouse ransomware group claims to have breached a $1 billion cybersecurity vendor, with speculation pointing to Barracuda. The breach allegedly exposed customer contact lists, proprietary detection logic, source code, and support tickets containing detailed customer network configurations. This incident raises significant supply chain concerns for the vendor's customers.

Persistent Security Research Team launched a 'Month of Bypasses' series, using their Nemesis AI-driven BAS platform to discover a bypass for Microsoft Defender for Endpoint's detection of SAM hive credential dumping (T1003.002). The AI iteratively found a method using WMI to create a shadow copy and a raw disk read to extract the SAM hive, evading behavior monitoring. This demonstrates how AI can systematically find gaps in endpoint detection logic.

A phishing campaign targeted Pakistan government employees using fake project files to deliver malware. The attack employed obfuscation and staged payload delivery hosted on BunnyCDN to evade detection. This technique highlights a method to bypass endpoint security by splitting malicious code into multiple stages and hiding it behind legitimate CDN services.

Researchers developed a malware generator that applies semantic-preserving transformations to Linux ELF binaries, successfully evading machine learning-based malware detectors. The technique highlights weaknesses in current AI-driven endpoint security tools for Linux environments.

CrowdStrike published a security advisory on April 21, 2026, addressing a critical vulnerability in its Falcon platform products. The Canadian Centre for Cyber Security issued an alert (AV26-384) regarding the advisory. No further technical details were provided in the article.