Week of June 29, 2026

Ransomware groups are increasingly using Bring Your Own Vulnerable Driver (BYOVD) techniques to disable endpoint security systems. Even fully patched Windows systems with all exploit mitigations enabled do not provide complete protection against this method. The Sophos Counter Threat Unit also investigated a partnership between VECT and TeamPCP combining supply chain credential theft with ransomware.

Arctic Wolf's internal SecOps identified a GitHub page impersonating the company to target customers and prospects. The page distributed an information stealer, though the specific malware family is not named. This incident highlights the use of trusted platforms for social engineering and malware delivery.

Jamf Threat Labs discovered a ClickFix-style attack using a sponsored ad on X to distribute malware. The attack tricked users into running malicious commands, leading to endpoint compromise. This incident highlights evolving social engineering tactics that bypass traditional security controls.

A widespread campaign used fake software installers to deliver a legitimate ScreenConnect instance, which attackers then leveraged to deploy the AsyncRAT trojan. The attack chain abuses trusted remote administration tools to bypass endpoint defenses and gain persistent remote access.

A phishing campaign distributes a fake invoice PDF that leads to the deployment of AsyncRAT, VenomRAT, and XWorm. The attack uses social engineering and malicious scripts to infect endpoints, posing a threat to endpoint security by evading detection through legitimate-looking documents.

A vulnerability in Microsoft Defender (CVE-2025-24084) was publicly disclosed on April 2, 2025, before a patch was available. The flaw is now being linked to ransomware attacks in the wild, allowing attackers to bypass Defender protections.

Opera has introduced a new security feature in its desktop browser that detects and blocks malicious 'ClickFix' clipboard attacks. The feature monitors clipboard content for suspicious commands and warns users before they execute potentially harmful code. This addresses a growing social engineering technique where users are tricked into pasting and running malicious scripts.

In a real-world incident, attackers disabled Windows Defender, Sysmon, and a web application firewall on a compromised IIS server before using Mimikatz to dump credentials. The attack highlights how adversaries systematically neutralize endpoint defenses to enable credential theft.

A recent ValleyRAT campaign employs RC4-encrypted payloads, Donut-generated shellcode, and in-memory execution via suspended rundll32 processes to evade endpoint security detection. The malware achieves stealth by decrypting and injecting shellcode into a legitimate Windows process, bypassing traditional signature-based and behavioral defenses.

A proof-of-concept demonstrates ransomware delivered entirely through a web browser using the File System Access API, requiring only user consent to access a folder. The attack avoids traditional endpoint detection by executing within the browser process without dropping binaries or using exploits. This technique highlights a gap in endpoint security tools that focus on native code execution.