Duna's Kiat
All editions
News

CyberNews: 22/08/2026 Edition

Today’s roundup

  • Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot
  • 14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2
  • Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet

    • Summary

    Check Point Research disclosed a technique that abuses BTR.sys, the legitimately signed boot-time remediation driver of Microsoft Defender, to perform arbitrary kernel-level file and registry operations on Windows 7 through Windows 11 25H2. No software flaw is exploited and no external driver is imported, which lets attackers delete security software at boot.

    TrendAI, Trend Micro's research unit, found 14 trojanized npm packages posing as calendar and streak utilities that silently deliver RedC2 4.0, an AI-assisted Linux implant. When the module loads, it locates the bundled binary, marks it executable and launches it as a detached background process.

    Kaspersky flagged a new malware family built to infect Android-based vehicle head unit firmware developed by DoFun. Discovered in June 2026 and spread through the units' built-in updaters, it serves a multi-stage downloader whose end goal is ad fraud and the creation of a proxy botnet.