The attacks targeted the US Department of Education and Library and Archives Canada, and researchers linked some agents to OpenAI.
The post AI Agents Aimed SQL Injection at US and Canadian Government Sites appeared first on SecurityWeek.
CVE-2026-104286 is a critical-severity path traversal vulnerability that could allow attackers to write arbitrary files to the system.
The post Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action appeared first on SecurityWeek.
Rob Juncker is chief product and technology officer at Mimecast. Is he a hacker? “Unequivocally yes,” he says.
The post Hacker Conversations: Rob Juncker, a Knock at the Door and a Moral Compass appeared first on SecurityWeek.
According to this year’s Microsoft Digital Defense Report, government agencies and services were the sector most impacted by cyber threats in 2026, accounting for 27% of observed activity, up from 17% in 2025. Governments are also the most frequently targeted sectors for nation-state activity. They are attractive targets because they hold sensitive information, operate essential services, and sit at the center of networks of agencies, contractors, technology providers, and critical infrastructure operators.
Dwell time, the period between when an attacker gains access and when defenders detect and stop them, also increased this year across multiple sectors. While organizations responded faster once an intrusion was identified, detecting threats early remains a challenge. Attackers increasingly gain access through techniques that mimic legitimate activity, making malicious behavior harder to spot. For example, phishing accounted for 23% of observed intrusions in 2026, up from 7% in 2025, highlighting the continued importance of compromised identities as an entry point for broader attacks.
Taken together, the implication for governments is clear. Security in the AI era is no longer simply about preventing individual intrusions. It is about ensuring institutions can operate effectively in an environment where risks are interconnected, threats move faster, and attackers remain hidden longer. Public-private partnerships are also more important than ever for securing critical government infrastructure and developing the policies and regulations needed for emerging technologies.
In this year’s report, which examines cyber threat trends observed between July 2025 and June 2026, Terrell Cox, Microsoft’s Corporate Vice President & Deputy Chief Information Security Officer, and I explore how these dynamics are reshaping cyber risk. In a companion blog, Terrell takes a closer look at what these findings mean for CISOs and security professionals.
AI is compressing the window for action. Adversaries are moving faster. A vulnerability’s discovery in the wild to active weaponization can be well below 24 hours. While the number of publicly disclosed software vulnerabilities (commonly tracked as CVEs) is projected to reach a record 72,000 in 2026.
Governments best prepared for the future will be those that can rapidly gather and assess information, make decisions, coordinate across institutions and industries, and communicate effectively during a crisis. This requires clearly defined responsibilities and trusted relationships established before an incident occurs, enabling swift and coordinated action when it matters most.
AI is becoming part of the infrastructure that governments, businesses, and citizens rely on every day. As governments continue to adopt AI across public services and encourage its broader use, they should approach its security as a resilience challenge rather than a narrow technical issue.
AI systems depend on interconnected infrastructure, data, models, applications, suppliers, and governance processes. Governments should promote security across this ecosystem through secure-by-design practices, testing and evaluation, stronger supply chain protections, transparency, accountability, and international cooperation on AI risk.
The goal is not to create a separate AI security agenda. It is to integrate AI security into broader efforts to protect critical infrastructure and build national resilience.
Governments may not immediately know whether an intrusion is criminal, geopolitical, or something else. Cybercriminals and nation-state actors pursue different objectives, but increasingly rely on many of the same entry points, including compromised identities, exposed applications, social engineering, and legitimate administrative tools.
Microsoft found that 52.2% of intrusions involving valid accounts resulted in additional credential theft, highlighting how quickly attackers can expand beyond an initial foothold. A seemingly isolated compromise can evolve into ransomware, espionage, data theft, or disruption of essential services.
Governments should therefore assess incidents not only by how they begin, but by where they could lead. Response plans should account for the suppliers, partners, and service providers supporting critical functions. As attacks expand beyond their initial targets, they can also cross organizational, sectoral, and national boundaries, reinforcing the need for global collaboration.
A compromised account at one organization may provide early warning of a broader campaign. Signals that appear inconclusive in isolation can reveal coordinated activity when combined across organizations and jurisdictions. Modern cybercrime operates through interconnected networks of actors, services, and infrastructure that no single institution can fully see or disrupt on its own.
Information sharing must be timely, trusted, and two-way—also known as bidirectional. The goal is not simply for companies to report threats to government. Public agencies should also return actionable intelligence, guidance, and warnings that help organizations protect their networks, customers, and operations. Trusted channels can enable this exchange among government agencies, law enforcement, critical infrastructure operators, technology providers, and international partners while respecting legal and privacy requirements.
Policymakers can support this cooperation through protections for good-faith information sharing, common anonymization standards, and investment in shared threat intelligence and detection capabilities. Information sharing should also lead to action, including investigations, disruption efforts, and accountability for those responsible for serious cyber intrusions.
The organizations governments depend on to deliver public services, including transportation systems, communications infrastructure, schools, universities, and critical infrastructure operators, are increasingly targeted by cyber threats. Resilience therefore requires understanding not only government systems, but the broader ecosystem that supports them.
Planning documents alone are not enough. Governments should regularly conduct tabletop exercises bringing together policymakers, operational leaders, law enforcement, critical infrastructure operators, and private-sector partners to test how they would respond to incidents disrupting essential services. These exercises can expose gaps in decision-making, information sharing, public communications, and cross-sector coordination before a real-world crisis. Microsoft’s work through initiatives such as the Advancing Regional Cybersecurity (ARC) program, most recently in Kenya, illustrates how scenario-based exercises and cross-sector collaboration can help strengthen preparedness and response capabilities across the broader ecosystem.
Government leaders should also know which services are most critical, which identities, systems, suppliers, and infrastructure support them, and how incidents will be escalated. Shared-service approaches can help extend security and response capabilities to local governments and public institutions that cannot build them independently.
As cyber incidents cross organizational and national boundaries, resilience depends not only on technical preparedness, but on whether institutions can coordinate effectively under pressure.
In an era of AI-enabled and increasingly interconnected cyber threats, resilience is no longer simply about recovering from an attack. It is about preparing for a world in which cyber incidents move faster, spread further, and affect more organizations than ever before. Governments best prepared for the future will be those that can contain harm, adapt quickly, and continue delivering critical services when citizens need them the most.
The post Preparing governments for an era of interconnected cyber risk appeared first on Microsoft On the Issues.
Flashpoint was awarded U.S. Patent No. 12,705,360 for its Ransomware Risk model, which rates how closely new vulnerabilities match those used in ransomware attacks.
Table Of ContentsVulnerability and exposure management (VM) teams need critical metadata and context that clearly show which issues pose an immediate risk to their organization. While traditional VM frameworks tell defenders how severe a vulnerability may be, they do not provide visibility into how likely threat actors are to exploit it. This leaves security teams overwhelmed in patch backlogs without a clear strategy for prioritization.
Nowhere is this prioritization gap more dangerous than with ransomware. Ransomware-as-a-Service (RaaS) groups no longer choose targets at random. They look for specific technical conditions that make vulnerability exploitation easy, fast, and repeatable. With RaaS attacks rising by 45% period-over-period in H1 2026, organizations need a way to identify the specific traits that make a vulnerability attractive to ransomware operators before an attack occurs.
Flashpoint built the Ransomware Risk score into Flashpoint Vulnerability Intelligence to solve exactly this problem. Since 2022, it has rated newly discovered vulnerabilities based on how closely they resemble those known to be used in ransomware attacks. With the grant of the U.S. Patent No. 12,705,360 on August 11, 2026, the methodology behind the score is now formally patented. This milestone formalizes Flashpoint’s ability to cut through the noise with a proven, threat-informed signal that gives defenders the clarity they need to act on Day Zero.
“As vulnerability disclosures surge, prioritization is more important than ever for security teams. A severity score alone can’t tell you which vulnerabilities pose the greatest real-world risk of exploitation by ransomware actors.
Our patented Ransomware Risk model applies years of threat intelligence to that problem, giving customers an earlier signal and helping them prioritize based on how attackers actually operate.”
josh lefkowitz, co-founder and ceo at flashpoint
The patented system evaluates newly disclosed vulnerabilities against the patterns shared by vulnerabilities ransomware groups have exploited. Rather than trying to predict what threat actors will do next, the model learns what past ransomware-exploited vulnerabilities have in common and compares each new flaw against those patterns.
Every vulnerability ingested into Flashpoint Vulnerability Intelligence is profiled against more than 60 distinct technical factors. This “fingerprinting” links the vulnerability to key inputs including whether the flaw is remotely exploitable without authentication, whether it affects SCADA or Operational Technology (OT) systems, and its potential impact on data availability, which is central to extortion schemes.
The model turns each multi-factor fingerprint into a set of values that place it as a single point on a map, so vulnerabilities with similar profiles land close together.
Flashpoint overlays historical threat data onto the map to establish neighborhoods where vulnerabilities previously exploited in real-world ransomware attacks aggregate.
When a new vulnerability is ingested, its coordinates are checked against these neighborhoods. The scoring system calculates its spatial proximity to known ransomware vectors and assigns a clear rating: Low, Medium, High, or Critical.
This four-step method, developed by Flashpoint’s Ben Haynes and Jacob Kouns, is the basis of U.S. Patent No. 12,705,360.
By translating complex structural attributes into a single risk score, the patented model delivers four key operational advantages:
Flashpoint’s Ransomware Risk model is built to enhance, not replace the vulnerability management frameworks organizations already rely on. In fact, it provides even greater value for security teams as our Ransomware Risk model provides clarity for every vulnerability detailed by Flashpoint Vulnerability Intelligence, including over 105,000 issues missed by CVE and NVD.
Within Flashpoint Ignite, security teams have a complete view of vulnerability risk, seeing the score alongside CVSS (v3 and v4), EPSS, Social Risk, and exploit maturity.
Vulnerability management requires more than cataloging. It demands threat-informed prioritization that aligns security operations with real-world business risk. Flashpoint’s patented Ransomware Risk model eliminates guesswork by surfacing the flaws that match the profile of known ransomware targets, allowing security teams to patch what matters most, first.
By combining proprietary knowledge of vulnerability architecture and ransomware attacks, Flashpoint bridges the gap between theoretical and active exposure. Request a demo today to see how our Ransomware Risk model provides the definitive signal needed to stay ahead of extortion groups.
What is the Ransomware Risk score?
The Ransomware Risk score is a rating in Flashpoint Vulnerability Intelligence that shows how closely a vulnerability resembles those known to be used in ransomware attacks. Each vulnerability is rated Low, Medium, High, or Critical, so security teams can see which ones to patch first to reduce their ransomware exposure.
How is Ransomware Risk different from CVSS and EPSS?
CVSS measures how severe a vulnerability could be, and EPSS estimates how likely it is to be exploited in general. Ransomware Risk adds a ransomware-specific signal that works alongside both, showing how closely a vulnerability matches those ransomware groups have used. In Flashpoint Ignite, all three scores appear together.
What does Flashpoint’s ransomware patent cover?
U.S. Patent No. 12,705,360, granted August 11, 2026, covers Flashpoint’s method for rating how likely a vulnerability is to be used in a ransomware event. Each vulnerability is profiled on more than 60 factors, compared with vulnerabilities used in past ransomware attacks, and rated by similarity. The patent formalizes the model behind the Ransomware Risk score, live since 2022.
How often are Ransomware Risk scores updated?
Ransomware Risk scores update in near real time, so new vulnerabilities are rated as soon as they’re disclosed. The model also keeps adjusting as new vulnerabilities join the body it compares against, so ratings reflect the ransomware landscape as it stands today.
The post Ransomware Risk Model: Flashpoint’s Patented Scoring Method to Inform Vulnerability Prioritization appeared first on Flashpoint.
The accord opened the door to future regulation but focused on four voluntary steps for the companies to take.
The post Trump Says Top Tech Firms Have Signed Accord to ‘Self-Police’ AI Development appeared first on SecurityWeek.
The data breach affects the Defense Manpower Data Center (DMDC), which maintains personnel records for the Department of Defense.
The post Pentagon Personnel Agency Data Breach Impacts 3 Million People appeared first on SecurityWeek.
Apple released iOS and macOS updates to patch a zero-day vulnerability (CVE-2026-86950) reported by Meta’s product security team.
The post Apple Patches Zero-Day Linked to ‘Extremely Sophisticated Attack’ appeared first on SecurityWeek.
Microsoft has served the Middle East since it began operations in the region in 1991. Since then, we’ve steadily expanded our presence and investments, growing from a local technology provider into a long-term partner to governments, businesses, educational institutions, and civil society organizations. Today, Microsoft is reaffirming that commitment through a new framework focused initially on Kuwait, Qatar, Saudi Arabia, and the United Arab Emirates.
We are expanding our investments in the Middle East with confidence in the region’s future as it pursues one of the world’s most ambitious AI transformations. We will add to our local partnerships across the region. We will build on the work we have done to stand by these countries’ governments and people through a period of significant challenges. As we look to the future, we will invest further in technology, digital resilience, and the people across the region.
From now until 2030, we will pursue the following initiatives with our partners in the region:
We will expand cloud and AI infrastructure across the Middle East
Microsoft will continue to invest in cloud and AI infrastructure across the region, expanding capacity, launching new capabilities, and delivering long-term infrastructure commitments. We plan to invest more than $10 billion in capital and operating expenses between now and 2030 in the region.
We will deepen our partnerships through national AI champions
Microsoft will deepen strategic partnerships with governments and national AI champion organizations to translate AI ambition into economic growth, modern public services, and global competitiveness. This builds on work with organizations including HUMAIN, G42, QAI, and the Government of Kuwait, alongside digital-government initiatives such as TAMM in the UAE, SDAIA’s ALLaM in Saudi Arabia, TASMU in Qatar, and Microsoft 365 Copilot adoption across the Government of Kuwait.
These partnerships will support responsible AI adoption, sovereign-ready cloud services, Arabic and multilingual AI, and the use of AI to improve services for citizens and businesses. They will be supported by capabilities including Microsoft Sovereign Public Cloud, Sovereign Private Cloud, and Project Digital Shield, where relevant and available.
We will invest in subsea and terrestrial connectivity
Digital resilience depends on strong and reliable networks. Protecting subsea and terrestrial connectivity requires sustained cooperation between governments and the private sector, but the foundation of continuity is redundancy. A diverse network of high-capacity routes allows traffic to be rerouted around disruptions, minimizing latency and maintaining critical data flows.
Microsoft has helped expand both the capacity and reliability of digital connectivity across regions through investments in major international subsea cable systems, including SeaMeWe-6, which has landings in Qatar, Saudi Arabia, and the United Arab Emirates, as well as operating a global network spanning more than 275,000 miles of terrestrial and subsea fiber. During network disruptions, Microsoft has demonstrated the value of redundancy by rerouting traffic through Middle East corridors and maintaining service continuity with minimal impact on customers.
Building on this foundation, Microsoft plans to invest more than $400 million in subsea and terrestrial connectivity across the Middle East by 2030. This investment will expand capacity, strengthen regional data flows, and support Microsoft’s growing cloud and AI infrastructure footprint across the region.
We will build AI infrastructure with the planet in mind
As we expand our cloud and AI infrastructure in Kuwait, Qatar, Saudi Arabia, and the UAE, we will do so with a focus on responsible growth. Guided by Microsoft’s global goals to address carbon, water, waste, and ecosystems, we will work with our lessor partners to ensure that the cloud infrastructure supporting our services advances Microsoft’s water-positive ambitions, including by prioritizing zero-water cooling technologies where feasible.
Water resilience is particularly important across the Middle East. Building on Microsoft’s global experience advancing water stewardship through water reuse, replenishment, and innovative water management solutions, we will work with governments and local stakeholders to identify opportunities that advance responsible water stewardship across the region.
As AI accelerates economic opportunity across the Middle East, expanding access to clean energy will be essential to ensuring this growth is sustainable. We will also collaborate with regulators, utilities, and our lessor partners to help create the market conditions needed to expand carbon-free electricity procurement and stimulate new clean energy investment. By combining infrastructure investment with local partnerships and innovation, we aim to support the region’s energy and water priorities while helping build the sustainable foundations needed for long-term AI-led economic growth.
We will launch a new Middle East digital resilience initiative
Conflict in the Middle East has reinforced the connection between digital resilience and digital sovereignty. Microsoft has worked with customers to support business continuity through resilience options tailored to different operational and regulatory needs. Going forward, Microsoft will make digital resilience a cornerstone of its Middle East strategy, helping organizations strengthen continuity and recovery through digital resilience assessments, reference architectures, readiness guidance, continuity planning, and enablement programs that help identify vulnerabilities, protect critical data, and build tested recovery capabilities.
We will strengthen data protection, privacy, and business continuity
Microsoft will expand our existing commitments on data-protection sovereignty and business continuity to eligible governments and customers in Kuwait, Qatar, Saudi Arabia, and the UAE. These are designed to give organizations greater confidence in how their data, systems, and operations are protected while maintaining continuity in times of uncertainty. They will be complemented by Microsoft’s growing sovereign-cloud portfolio, including Sovereign Public Cloud and Sovereign Private Cloud capabilities, together with Project Digital Shield and other capabilities that support security, privacy, transparency, and operational resilience.
We will expand and strengthen cybersecurity cooperation
As Kuwait, Qatar, Saudi Arabia, and the UAE accelerate their digital transformation, cybersecurity has become a core pillar of national and economic security. As governments, critical infrastructure, and economies become more connected, cyber threats and influence operations can have consequences that extend far beyond physical borders. That’s why we are announcing that we are deepening our partnerships with the cybersecurity authorities in these countries.
A network of dedicated Microsoft cybersecurity champions in Kuwait, Qatar, Saudi Arabia, and the UAE will help governments translate these resources into action and connect national priorities with expertise across Microsoft. Stronger cybersecurity benefits far more than individual networks. It helps build trust to ensure digital transformation will succeed.
We will advance responsible AI through governance, assurance, and inclusion
Microsoft will work with governments, businesses, researchers, and civil society organizations across the Middle East to help people and institutions benefit from new technology. As AI advances, realizing its full potential will require not only access to powerful technology, but the governance, assurance, and skills required to deploy it confidently and responsibly.
We will help strengthen AI governance capabilities across the region and support practical approaches to testing, evaluating, and assurance systems. We will also expand collaboration with the Responsible AI Future Foundation (RAIFF), co-founded with G42 and the Mohamed bin Zayed University of Artificial Intelligence (MBZUAI), to support the development and sharing of responsible AI practices and evaluation tools that can be applied across high-impact AI use cases in the Middle East and beyond.
By helping organizations align with emerging international practices, we aim to strengthen confidence in AI systems, support responsible innovation, enhance global competitiveness, and ensure that the Middle East plays an active role in shaping the future of AI.
We will advance AI for Good research and innovation
Microsoft’s AI for Good Lab will continue to support the region through research and partnerships focused on food security, low-resource language development, and climate and disaster resilience. This includes work through initiatives such as the LINGUA program, which supports the development of language technologies for underserved communities.
In partnership with governments, NGOs, nonprofits, and research institutions, the AI for Good Lab will continue developing and scaling AI solutions that address real-world challenges across the Middle East and beyond.
We will prepare the next generation for the AI economy
We believe AI should enhance human ambition, strengthen human capability, and help prepare workers to thrive in a changing economy. That is why Microsoft will continue to invest in AI skills, workforce readiness, public-sector capability building, and inclusive talent development across Kuwait, Qatar, Saudi Arabia, and the UAE, building on existing commitments to help skill more than 4.2 million people by 2030.
This work includes training for public-sector leaders, students, and workers; initiatives focused on expanding opportunities for women; and partnerships with educational institutions across the region. This work builds on programs such as Saudi Arabia’s AI Global Leadership Program, AI Skills 4 Women programs in Saudi Arabia and Qatar, and the Women’s Datacenter Academy in Saudi Arabia. Microsoft will also engage with workforce coalitions that can support national talent strategies and policy recommendations.
We will help education communities prepare learners for the AI era
Microsoft is working with governments, educators, institutions, and partners across the Middle East to develop responsible AI principles across primary, secondary, and tertiary education. This includes supporting AI literacy, helping educators integrate AI into teaching and learning, and sharing practical guidance for responsible AI use in educational settings. Across Kuwait, Qatar, Saudi Arabia, and the UAE, we will work with local partners to ensure students and educators can benefit from AI safely, responsibly, and effectively and will engage educators, policymakers, industry leaders, and civil society to support practical approaches to AI implementation that reflect local priorities.
We will help empower workers in the AI economy
We will partner with governments, employers, workers, education providers, and other stakeholders to help people adapt to changing workplace demands. Our focus is on practical skills development, workforce readiness, and leadership development that helps countries build competitive economies and create new opportunities for workers in an AI-enabled future.
We will support local and national AI talent priorities across the Middle East
Microsoft is partnering with governments, academic institutions, and civil society organizations to support national talent priorities by advancing AI skills, leadership development, and workforce readiness programs for public-sector leaders, students, underrepresented talent, and people across the Middle East. The goal is to help countries build globally competitive workforces, accelerate innovation, and unlock new economic opportunities in the AI era.
While no one can predict the future, one thing is certain: Microsoft has been part of this region’s journey for more than 35 years, and we are committed to being a partner for the long term. We look forward to continuing to work alongside governments, businesses, educators, and communities to help build that future together.
The post Microsoft strengthens its commitment to the Middle East by investing in technology, digital resilience, and people appeared first on Microsoft On the Issues.
Microsoft has disrupted EvilTokens, a powerful cybercrime platform that used AI at every step of the attack chain—from compromising email accounts to designing intricate roadmaps for financial fraud and scams. While EvilTokens helped cybercriminals access email accounts, at the center of the service was an AI-style chatbot that could analyze a victim’s inbox and help criminals identify trusted relationships, payment authorizations, and sensitive responsibilities, as well as other circumstances where fraud was most likely to succeed. The platform could even recommend fraud strategies, including drafting messages that impersonated trusted contacts to help criminals trick victims into taking action.
In short, AI was not simply helping attackers write more convincing messages. It helped them decide who to target, who to impersonate, and how to most effectively exploit the relationship to extract as much money as possible.
Within months of launching in February 2026, EvilTokens had been linked to more than 12,000 compromised email inboxes across over 10,000 organizations worldwide, showing how quickly the service gained traction. Microsoft observed the highest concentrations of victim activity in the United States, Canada, the United Kingdom, Australia, India, and France. Affected organizations ranged from wholesale distribution and construction to financial services, real estate, higher education, and healthcare. Working with partners, Microsoft seized 50 websites used to operate the service and disabled more than 150 additional domains tied to its supporting infrastructure. In the United Kingdom, the Metropolitan Police Service’s cybercrime team arrested two men on suspicion of offenses connected with the alleged operation of EvilTokens.
But the significance of EvilTokens extends beyond its rapid growth and global reach. It offers an early warning of what happens when cybercriminals combine stolen access with AI capable of understanding how an organization works.
EvilTokens helped criminals gain access to email accounts by tricking victims into entering an authentication code on Microsoft’s legitimate sign-in page. By completing the normal authentication sign-in process, victims unknowingly gave criminals access to their email accounts without revealing their passwords. That access could persist even after a password reset if the associated sessions and tokens were not also revoked. Microsoft Threat Intelligence provides additional technical details about the operation, how device-code attacks work, and steps customers can take to protect themselves here.
Once inside an account, criminals have traditionally needed time and experience to sift through thousands of messages, identify decision-makers, understand payment processes, and find opportunities for fraud.
EvilTokens began automating that work. Its AI tools could summarize and translate emails, surface financial conversations, map organizational roles, identify trusted relationships, and recommend potential targets. Preset prompts offered to find wire-transfer discussions, identify the organization’s “money movers,” locate vendor invoices, and determine the best people to impersonate.
Sold through Telegram for a $1,500 initiation fee and a recurring $500 subscription, EvilTokens combined account compromise, mailbox analysis, target selection, and fraud preparation in a single service. Capabilities that once required experience across identity attacks, cloud systems, social engineering, and financial fraud were available through a ready-made interface.
Investigators found evidence that large portions of EvilTokens had been “vibe coded,” with AI helping its creators build the platform itself. They also determined that EvilTokens drew on capabilities from multiple AI models.
The result was more than a collection of attack tools. EvilTokens packaged much of the fraud process into a commercially run service, complete with subscription pricing, customer support, management dashboards, and tools designed to move customers from account access toward financial exploitation.
No single organization could disrupt EvilTokens alone. The service relied on hosting providers, cloud services, AI tools, financial services, and other online resources that cybercriminals repurposed to support fraud at scale.
The disruption combined civil legal action with coordinated operational work across industry and law enforcement. Because healthcare organizations were among those targeted, Health-ISAC—a global non–profit that helps health sector organizations share cyber threat information and collaborate to improve operational resilience—joined Microsoft’s legal action as a co-plaintiff.
With authorization from the U.S. District Court for the Eastern District of Virginia, Microsoft and Health-ISAC worked with Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation, and TRM Labs to act against key parts of the platform. Microsoft also notified affected customers, helped remediate compromised accounts, and shared intelligence to support further defensive and investigative action.
The operation also demonstrated the value of rapid cooperation between private-sector investigators and law enforcement. Microsoft worked closely with specialist officers from the Metropolitan Police Service’s cybercrime team, sharing intelligence that enabled officers to take operational action in the United Kingdom. On September 11, 2026, officers arrested two men, aged 32 and 38, and seized digital devices and other items for examination. Both men have been released on police bail subject to conditions while the investigation continues.
While EvilTokens used AI to identify targets and prioritize fraud opportunities, Microsoft investigators used reverse engineering and AI-powered tools to analyze evidence, accelerate the investigation, and identify the infrastructure supporting the service. The case shows how AI is changing not only how cybercriminals operate, but also how defenders investigate and disrupt them.
This action marks the Microsoft Digital Crimes Unit’s (DCU) 40th court-authorized disruption spanning nearly two decades of targeting cyber threat actors, malicious tools, and supporting infrastructure. It is also DCU’s first action against an end-to-end AI-enabled cybercrime service.
The infrastructure supporting EvilTokens has been disrupted, but the model it demonstrated will not disappear with it. As Microsoft notes in its 2026 Responsible AI Transparency Report, increasingly capable and accessible AI is being used to scale fraud, impersonation, and other forms of online abuse. EvilTokens offers an early example of how those capabilities can be combined with compromised accounts to accelerate financial fraud.
For organizations, the lesson is: assume that once an inbox is compromised, criminals may understand its contents in minutes, not days. Strong identity protections and monitoring remain essential, but organizations should also independently verify requests to change payment information, redirect funds, or approve unusual transactions through a trusted second channel.
The post Disrupting EvilTokens: The AI Chatbot Built for Cybercrime appeared first on Microsoft On the Issues.
Today we published our latest Global AI Diffusion Report. Global AI diffusion continued to climb in the second quarter of 2026. In June, AI usage was 18.8% of the working-age population worldwide, an increase of about 1% from the first quarter of this year. Growth was broad-based: almost every economy saw increased usage.
Notably, the UAE (73.3%) and Singapore (64.3%) continue to top the leaderboard. South Korea again saw the largest absolute change, with an increase of 3.5 percentage points. Saudi Arabia climbed five places from 30th to 25th, the largest rise in the rankings. Japan recorded the largest relative change, growing by 2.2 percentage points, or roughly 10% relative to its Q1 usage of 22.5%. Worldwide, the quarter brought a continued widening of the AI gap between the Global North and South, with usage now at 28.8% in the North and 16.2% in the South.
To track all these trends, we continue to measure AI diffusion as the share of people worldwide ages of 15 and 64 who have used a generative AI product during the reported period. This measure is derived from aggregated and anonymized Microsoft telemetry data and is adjusted to reflect differences in operating system and device market share, internet penetration, and population. Additional details on the methodology are available in our AI Diffusion technical paper.
No single metric is perfect, and this one is no exception. Through the Microsoft AI Economy Institute, we continue to refine how we measure AI diffusion globally, including how adoption varies across countries in ways that best advance priorities such as scientific discovery and productivity gains. For this report, we rely on the strongest cross-country measure available today. Over the past year, there has been a significant rise in new AI tools and models. For our next report, we will expand our measure to include usage of these new tools and expect this update to increase AI user share across almost all economies, with larger projected increases in China.
In addition to our comparison of AI diffusion between the Global North and the Global South, we also find important differences in how AI is being used. Using consumer Microsoft Copilot usage insights, we examined these differences. The most notable difference is a higher share of education and learning use in the Global South.
This report also includes a substantive discussion of open-weight AI models. Open-weight AI model use is increasingly visible through application programming interface (API) usage of AI, where open models have captured a growing share of token volume. This shift could especially benefit the Global South by lowering access costs and enabling adaptation to local languages and needs, although barriers such as infrastructure, connectivity, and skills remain.
Download the latest Global AI Diffusion report and explore the data here.
The post The continued state of global AI diffusion in 2026 appeared first on Microsoft On the Issues.
Why LinkedIn is challenging an overbroad government demand—and why Congress must make secrecy the exception
Today, the U.S. Court of Appeals for the Fourth Circuit heard oral argument in LinkedIn’s (a Microsoft subsidiary) appeal challenging a government demand for user records and a related secrecy order that is preventing LinkedIn from notifying those users that the government is seeking their data. The appeal asks important, constitutional questions about whether service providers may challenge demands that sweep in records unrelated to an investigation, and when the government may prevent a provider from notifying the user of a request.
This appeal continues Microsoft’s longstanding work to ensure that secrecy orders remain the exception, not the rule. LinkedIn’s appeal asks courts to enforce meaningful limits on both the scope of government demands and the secrecy that can accompany them.
We recognize law enforcement’s important role in protecting public safety and investigating crime, and sometimes that does need to be done covertly. We respond to lawful legal requests. At the same time, customers and users deserve meaningful limits and independent oversight through an adversarial process. And, customers deserve to be notified when the government seeks their data, unless the government clearly establishes the need for secrecy under statutory and constitutional standards.
Those safeguards fulfill basic constitutional rights. The Fourth Amendment protects the right to be free from unreasonable searches and seizures. That right applies to papers kept in a desk, and it also applies when personal and business records are stored online. Online service providers, like LinkedIn and Microsoft, also have a First Amendment right to speak to their customers when the government obtains an order to search their private information. Secrecy may sometimes be justified—but it should be tailored to demonstrated needs and subject to meaningful review.
This particular case arose after LinkedIn received a court order seeking user records together with a secrecy order preventing LinkedIn from informing anyone about the order. The details remain under seal, including the nature of the information the government seeks and the people who own that information. But the Fourth Circuit partially unsealed LinkedIn’s opening brief in July, allowing the public to understand some of the core issues. LinkedIn argues that the demand is overbroad, the secrecy order is unconstitutional, and the government has violated LinkedIn’s due process by withholding evidence from LinkedIn.
Three amicus briefs from a broad coalition support LinkedIn’s position. The American Civil Liberties Union and ACLU of Virginia argue that users’ privacy interests must inform whether a demand is reasonable and that providers may be the only practical means of challenging unlawful process because users often receive no notice. The Reporters Committee for Freedom of the Press warns that overbroad demands, delayed notice, and secret evidence can expose confidential sources and chill newsgathering. Amazon, Apple, Google, Meta, and X emphasize that cloud providers are uniquely positioned to identify irrelevant requests and that secrecy orders require case-specific evidence rather than boilerplate assertions. Together, these briefs show why cloud providers must be able to test both the scope of government demands and the need for secrecy.
Microsoft has a long record of standing up for these principles. In 2014, Microsoft successfully challenged a secrecy order connected to a National Security Letter that prevented notice to an enterprise customer. In 2016, we filed a landmark challenge to the widespread use of indefinite secrecy orders. We’ve successfully challenged individual secrecy orders time and again over the years. Our efforts contributed to updated Justice Department policies, but executive-branch practices can change. Durable protections require the development of case law and legislation.
The U.S. House of Representatives recently took an important step in that direction. On August 31, the House passed legislation to rein in secret surveillance and strengthen notice protections when the government seeks data held by technology providers. As we explained when the bill passed, the reforms would place clearer limits on secrecy orders, require greater accountability, and help ensure that secrecy is the exception – not the rule. The Senate should act promptly to send these historic reforms to the President.
The House –passed legislation recognizes that privacy and public safety are not opposing values. Clear standards can give investigators the confidentiality they genuinely need while providing courts, providers, and customers with predictable rules. The pending legislation and LinkedIn’s appeal are the latest, complementary chapters in this broader effort. Legislation can establish durable, system-wide rules for notice and accountability. Courts must meanwhile enforce the limits already contained in existing statutes and the Constitution. Neither task requires obstructing legitimate investigations. Rather, both mean the government must seek only relevant information, justify secrecy with specific evidence, and infringe on speech to the least extent possible.
That is why today’s argument matters beyond a single sealed investigation. People and organizations increasingly entrust their most sensitive information to online services. If providers cannot challenge demands they know are overbroad—or if courts may silence them without a rigorous, adversarial review—the safeguards the law requires will be weakened precisely when they are most needed.
Microsoft and LinkedIn will continue to support lawful investigations while standing up for customer privacy, transparency, and the rule of law. We have appealed to the Fourth Circuit to preserve providers’ ability to challenge overbroad demands and to require the government to meet its constitutional burden before imposing secrecy. And we urge the Senate to complete the work the House began by enacting durable non-disclosure order reform.
Further reading
The post Protecting customer privacy means standing up for transparency appeared first on Microsoft On the Issues.
As Americans prepare to vote this November, artificial intelligence is changing how many people find and understand election information.
Some voters are deliberately turning to AI tools with questions about candidates, ballot measures, election procedures, and issues that matter to their communities. Others are encountering AI-generated summaries at the top of search results. In either case, AI is increasingly becoming a front door to election information.
This shift is happening quickly. More than 30% of the U.S. working-age population now uses AI (Microsoft AI Diffusion Index, Q1 2026; Microsoft, AI Adoption Across the United States). These tools can help people understand complicated topics, compare information, and explore unfamiliar issues. But election information can also present some challenges for AI. It is highly local, changes quickly, and can be incomplete, contested, or stripped of essential context.
The answer is not to steer voters away from AI, it is to help people use it wisely, particularly when the information may influence aspects of their voting experience, such as how, when, and where they cast their ballot.
That is why, on National Voter Registration Day, a day when our brands and products come together to encourage civic participation, we’re launching the next phase of our voter education initiative, Check. Recheck. Vote. This year, the campaign will equip voters with practical AI literacy skills for the 2026 election season.
We launched Check. Recheck. Vote. in 2024 to help voters recognize the risks posed by deceptive AI-generated content. Deepfakes and other deceptive media remain a serious concern. But in conversations with voters and election organizations, we are also hearing about a broader and more immediate challenge. Millions of people now encounter election information through AI-generated answers, and many are not sure how to determine whether those answers are current, complete, or reliable.
The updated campaign gives voters three straightforward steps:
At the center of the campaign is a new 75-second video that shows how an AI-generated answer can appear during an ordinary election-related search, explains where these answers can fall short, and offers simple steps voters can take before relying on them.
YouTube Video
The campaign website pairs the video with practical guidance and links to authoritative election resources, including state-by-state voting information and tools for educators.
We are working with the National Association of Secretaries of State (NASS) and the National Association of State Election Directors (NASED) to scale the reach of this campaign across all fifty states and the territories and to point voters to accurate information directly from state and local election officials so they can participate with confidence.
We believe that civics and voter education start well before a citizen is old enough to vote. That’s why we are also investing in efforts to extend AI voter literacy education in the classroom. The campaign website includes a classroom activity to help students examine how AI may shape the election information they encounter, practice verifying claims, and keep their own judgment at the center of the process. We are also amplifying our impact on this important issue by supporting the News Literacy Project.
We’re also proud to announce today that, in partnership with iCivics, we are launching Village Square – a new Minecraft Education civic learning experience that helps students explore how communities make decisions and solve shared challenges. The game brings concepts such as dialogue, participation, and collective decision-making to life through immersive gameplay. Village Square gives educators and families an engaging, nonpartisan way to help young people practice listening to different perspectives, weighing trade-offs and working together to build stronger communities.
Finally, we know that credible local reporting remains essential to informed civic participation, and that reporting is under strain in many communities.
In Washington state, Microsoft is partnering with the Associated Press Fund for Journalism to expand election coverage for 10 local newsrooms operating 14 news websites. Participating newsrooms receive access to AP election results and race calls, vote tabulations, state-specific maps and graphics, and resources that help local journalists connect national and statewide developments to the communities they serve.
The newsrooms represent communities from Seattle to Spokane and the Wenatchee Valley. Their work complements the reporting of the Associated Press, helping trusted, fact-based election coverage and results reach communities that might otherwise lack access.
This investment reflects a broader reality. Voters need more than information. They need reliable sources that can provide context, ask hard questions, correct mistakes, and explain what national developments mean at the local level.
Voters aren’t the only ones navigating this AI moment, so are the people running campaigns and conducting elections, all while facing an increasingly complex cybersecurity landscape. Microsoft has long supported the security and resilience of campaigns and elections. In 2018, we launched AccountGuard to help political campaigns and democracy-focused organizations defend against cyberattacks, and during the 2024 election cycle we joined dozens of other technology companies in the Tech Accord to Combat Deceptive Use of AI in 2024 Elections. Here’s how that commitment continues today:
Equipping election officials. With The Elections Group, International IDEA, Ready for Tuesday and Arizona State University’s Mechanics of Democracy Lab, we launched the free, open-source AI + Elections Skills Hub: prompts, sample AI agents, and draft policies for responsible adoption. It’s already reached 1,000+ officials across 45 states.
Strengthening cybersecurity. We’ve deployed Microsoft Sentinel to several state and local election offices for stronger threat detection, and we’re also supporting select election and political stakeholders with MDASH to find and fix software vulnerabilities faster.
Countering bomb hoaxes. More than 300 emailed bomb hoaxes disrupted polling places in 2024. In response, we’ve started a new Elections Bomb Threats Task Force alongside partners Social Scout, Nisos, and the Committee for Safe and Secure Elections (CSSE) to bring together digital intelligence and law enforcement expertise to track & share trends and reduce disruptions. An initial report on the hoaxes encountered in 2024 will shape our approach for 2026.
Supporting campaigns. Built with Defending Digital Campaigns, our Secure AI Toolkit for Campaigns has reached 3,000+ campaigns and political stakeholders with practical AI guardrails. Our Campaign Technology team has also trained thousands of candidates, staff, and officials from both parties on responsible AI use and cybersecurity best practices.
The technology continues to change, but our approach remains consistent: help voters find authoritative information and make informed judgments, help campaigns and election authorities defend against evolving threats, and help the election community adopt technology that strengthens security, accountability, and civic participation. This work is bipartisan by design, and it includes:
The 2026 election will be the first U.S. federal election in which generative AI is part of the everyday environment for millions of voters as well as those who support the political process. That creates new risks, but it also gives us an opportunity to equip people with skills that will remain valuable well beyond a single election.
The post 2026 midterm elections: Helping voters navigate election information in the age of AI appeared first on Microsoft On the Issues.
Today, Microsoft is sharing our Safe Participation Framework, which centers on designing and enabling safe, privacy-preserving, and age-appropriate experiences for young people online. Members of our AI Youth Futures Council have delivered a clear message: they want to learn, create, and prepare for a future with AI. Protecting their privacy, ensuring their safety, and preserving their opportunity to participate must go hand in hand.
They are right. Children and families should not have to choose between the protections they need and the opportunities technology can provide.
Technology companies have a responsibility both to protect young people from harm and to ensure they can benefit from technology through thoughtfully designed experiences, age-appropriate protections, and demonstrable safeguards. Microsoft’s Safe Participation Framework serves as a foundation for our work today, and we expect it to continue evolving as technology, research, and societal expectations change. We do not claim to have all the answers, but we believe it is important to share our approach and our learnings to help inform emerging regulatory frameworks and advance protection and opportunity together.
Microsoft recognizes our responsibility to help create safer experiences for all users, particularly children and those more vulnerable to harm. Our safety-by-design approach seeks to embed protection from the outset: identifying foreseeable risks, examining the impact of product features and user experiences, and implementing proportionate safeguards. As risks evolve, we continue to learn from emerging research, science, andas well as from customers, governments, and other stakeholders.
For more than a decade, Microsoft has invested in technologies designed to protect people online, beginning with PhotoDNA in 2009 and continuing through our work to build safeguards for AI experiences and address emerging harms such as synthetic and non-consensual intimate imagery. We have also learned that families want tools that are simpler, intuitive, and easier to use. That is why, earlier this week, we announced new protections and defaults for children, teenagers, and families using Windows Family Safety. We view these changes as an important step forward, while recognizing that earning and maintaining trust requires continued investment, learning, and iteration.
Bing has also strengthened protections against child sexually abusive material (CSAM) across its generative AI experiences. We have also expanded SafeSearch globally to cover additional categories of harmful content, helping reduce the risk of exposure to harmful material. We will continue to make progress, listen to our users and stakeholders, and learn by working with others to strengthen safety.
Our goal is to help children and teenagers participate confidently in appropriate digital experiences that reinforce access to the meaningful educational, social, and economic opportunities technology can provide. Achieving that goal requires real protections that are proportionate to risk and implemented in ways that respect users’ privacy. Risks are not uniform across different technologies and services, and safeguards should reflect and address those differences.
We recognize that young people are not a single group. Their needs, capabilities, and expectations evolve with age, development, and context. For that reason, age-appropriate design is an important element of creating safer digital experiences and complements safety-by-design. Age-appropriate design ensures protections and experiences are responsive to the needs of users at different stages of development. This approach informs experiences across Microsoft’s consumer ecosystem.
On XBOX, we leverage family safety and privacy tools designed specifically to help manage online interactions, content access, spending, screen time, and privacy settings. These features are intended to support safer experiences while giving families flexibility to make choices. We are applying many of these same learnings to Copilot. All users must now sign in to use Copilot, and access is restricted for children under 13 (or older where required by local law). We have also implemented measures to reduce exposure to harmful content, directing users to crisis support resources when self-harm risks are detected, and encouraging healthy use through transparency, break reminders, reporting tools, and guardrails to protect against delusional outputs.
Microsoft has now also extended protections at the platform level. Through our new Windows Age application programming interface (API), expanded age assurance capabilities, and enhanced family safety tools, Microsoft is helping establish a more consistent and privacy-conscious foundation for age-appropriate experiences across the broader ecosystem. These capabilities are intended to provide developers with trusted age signals to support age-appropriate protections, making the experience ultimately easier for families to understand and navigate downstream.
Reliable age signals play an important role in enabling age-appropriate experiences. Innovations such as the Windows Age API help provide privacy-preserving age signals while minimizing the collection and sharing of personal data. Young people share this expectation. Participants in Microsoft’s AI Youth Futures Council have consistently emphasized the importance of understanding how their information is collected, used, and protected.
Technology alone cannot deliver safe participation. Young people and their families must have an opportunity to provide direct feedback, and they must have easy access to tools and resources that support and build their knowledge as they navigate digital experiences, evaluate what they encounter, and decide when to seek help. Digital literacy is, therefore, a core component of child safety.
Microsoft has invested in digital literacy and safety education for years through resources and partnerships that reach communities around the world. Earlier this year, we launched Behind the Chat: A Human Guide to Safe AI Conversations, designed specifically to help young people understand the opportunities and risks associated with AI companionship. This toolkit is supported by classroom resources for educators and materials for parents and trusted adults, reflecting our belief that supporting young people requires an ecosystem approach. Beginning this fall, we will expand these resources throughout Europe, Asia, and the Americas. We will also continue working closely with educators to ensure safety and privacy.
Over the coming year, we will deepen partnerships with researchers, AI Safety Institutes (AISIs), governments, and civil society to advance the research, evaluations, and benchmarks needed for safer digital and AI experiences. Working together, we will learn and help build the foundation for the next generation of trusted technology.
Our work is far from finished. As technology evolves, our understanding of how to support young people safely and responsibly must continue to evolve with it. This framework reflects our current approach, informed by evidence, shaped by young people and their families, and grounded in ongoing learning. We recognize that we do not have every answer, and that building safer digital experiences will require continued experimentation, humility, and collaboration. No single organization can do this alone. Progress will depend on deep partnerships across government, industry, civil society, educators, and families worldwide. Together, we can help build a future in which every young person has the opportunity to participate, create, learn, and thrive.
The post Safe Participation Framework: Opportunity and Safety for the Next Generation in the Age of AI appeared first on Microsoft On the Issues.
The extortion group has modified its exploit in new attacks targeting the PeopleSoft vulnerability CVE-2026-35273.
The post Google Warns of ShinyHunters’ Fresh Oracle PeopleSoft Campaign appeared first on SecurityWeek.
The platform combines open source software and a reference system design to keep AI agents within set boundaries.
The post Nvidia Unveils AI Agent Safety Platform With Hardware-Based Watchdog appeared first on SecurityWeek.
Citrix has released patches for the critical NetScaler vulnerabilities tracked as CVE-2026-88771 and CVE-2026-88772.
The post Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug appeared first on SecurityWeek.
CISA added CVE-2026-65660 to its KEV catalog, giving federal agencies a patching deadline of September 28.
The post Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks appeared first on SecurityWeek.
In this post, Flashpoint analysts examine Process Parameter Poisoning—a novel EDR evasion technique we validated in Rust—and detail how abusing undocumented process parameters allows attackers to inject code and bypass standard security products.
Table Of ContentsModern Endpoint Detection and Response (EDR) platforms have made traditional malware injection techniques significantly harder to execute. In most cases, if a threat actor attempts to write malicious code into a process, an alert will fire. However, that sense of security is being actively challenged as cybercriminals and red teams find new ways to blend malicious payloads into standard operating system routines.
Flashpoint’s Intelligence team built and tested a proof-of-concept for a newly disclosed technique known as Process Parameter Poisoning. By compiling a custom payload and layering evasion mechanics, our analysts demonstrated how easily traditional API hooks can be rendered blind in a laboratory environment—achieving zero alerts across tested EDR/XDR controls.
Process Parameter Poisoning is a novel endpoint detection and response (EDR) evasion technique that combines process parameter spoofing and thread execution hijacking to inject code into foreign processes without triggering standard security detection mechanisms.
Discovered by researchers Max Hirschberger and Ogulcan Ugur, Process Parameter Poisoning is designed to inject code in foreign processes without relying on the conventional memory-manipulation workflows that modern security tooling monitors.
To execute process injection, historically security tools and threat actors alike have focused on a small set of well-known Windows application programming interfaces (APIs). Process Parameter Poisoning shifts away from these heavily watched routines entirely. Instead of calling memory-accessing APIs to allocate and write into a target process, the technique hides the malicious payload directly inside standard process initialization structures during the initial creation of a process. The result is a fundamental shift in defense evasion that effectively blinds traditional, API-hooking EDR agents during the initial stages of code execution.
Process Parameter Poisoning allows attackers to bypass suspicious memory-accessing Windows APIs, such as VirtualAllocEx(), WriteProcessMemory(), and MapViewOfFile2(). Security products heavily monitor these specific APIs due to their high rate of abuse in traditional process injection techniques. However, by avoiding these calls, an attacker effectively bypasses the initial primary triggers used by endpoint agents to flag malicious cross-process memory activity.
When using the Windows application programming interface (API), CreateProcessA/W(), the developer can specify parameters such as the command-line to be executed by the new process, environment variables for the new process, current working directory for the process, window title if it is a console application, create a hidden window, create the process in a suspended state, etc. Many of these parameters are passed into CreateProcessA/W() via the STARTUPINFOA/W structure.
Some entries are undocumented and labeled “reserved” by Microsoft. The discovering researchers found that data stored in STARTUPINFO->lpReserved ends up in the Process Environment Block once the new process is initialized in an entry called “ShellInfo.” Below is an example of placing data into the STARTUPINFOW->lpReserved entry in a test application and the data stored in ShellInfo while debugging the newly created process.
Flashpoint analysts created a proof-of-concept (POC) in Rust to test this technique based on the POC C++ source code provided by the researchers:
Flashpoint confirmed that after changing the memory to have executable permissions, the threat actors can perform thread hijacking by using GetThreadContext() to acquire information about the current running thread, change the instruction pointer to point to the ShellInfo.Buffer address, and then SetThreadContext() to apply the changes and execute the shellcode.
Flashpoint analysts further confirm that this technique also works with the WindowTitle entry, CommandLine entry using the same series of steps.
The technique also works with the Environment entry but requires additional steps. Environment blocks require a variable name and the variable data separated by an “=.” Environment blocks can contain multiple variable entries in which each entry is ended with a null terminator. Two null terminators are necessary to denote the end of the environment block. This means the payload needs to be embedded in a longer string with a “{NAME} = {VALUE}” format.
Flashpoint analysts note that four null terminators were appended to the shellcode bytes to denote the end of an environment block in Unicode. The resulting payload buffer is then passed into the lpEnvironment variable of CreateProcessW() along with the CREATE_UNICODE_ENVIRONMENT creation flag.
The rest of the process remains the same as reading the PEB and RTL_USER_PROCESS_PARAMETERS structure. The Environment entry is read, but at the offset of the embedded shellcode within the poisoned environment block string. Because four bytes were added to the beginning of the shellcode to make the Unicode environment block, execution needs to begin after four bytes from the beginning of the buffer to begin executing at the shellcode.
Flashpoint notes that the shellcode requires no NULL bytes, and, if using the PAGE_EXECUTE_READ flag, it cannot overwrite itself. This means automated shellcode generators such as MSFVenom might not work either because they contain NULL bytes or use encoders that perform memory writes during execution. Flashpoint analysts wrote custom shellcode to further test this technique. The shellcode downloads and executes an additional payload. The combination of this technique, custom shellcode, and the use of Rust as the programming language proved successful in minimizing initial static detections by security software.
Flashpoint tested this technique with a commonly-used open source EDR platform. The EDR platform itself failed to produce any alerts from executing the malicious binary. However, the XDR component blocked on the initial creation of a new process and COM interactions by the second stage payload.
Flashpoint analysts then combined this technique with the DLL unhooking technique and applied the non-Microsoft block DLL policy during the creation of the sacrificial process. Analysts observed no blocks from the XDR during execution and observed no alerts on the platform.
| Tactic | Technique ID | Technique Name |
| Stealth | T1055 | Process Injection |
| Stealth | T1055.003 | Process Injection: Thread Execution Hijacking |
| Stealth | T1564.010 | Hide Artifacts: Process Argument Spoofing |
Security teams can leverage several detection strategies to identify Process Parameter Poisoning, though each approach carries distinct limitations:
Process Parameter Poisoning demonstrates another advancement in stealthy process injection and the constantly evolving research into evading security products. By using the previously unknown purpose of the lpReserved field within the STARTUPINFOW structure to house shellcode, this technique bypasses standard security product triggers associated with common memory-allocation APIs. While this proof-of-concept was proven successful in lab testing, the technique has multiple opportunities for detection and will most likely require a combination of additional evasion techniques to achieve a higher success rate.
As threat actors continue to refine technique-stacking and exploit overlooked Windows internals, relying on traditional API hooks is no longer enough to protect your enterprise. Staying ahead of modern evasion mechanics requires proactive intelligence and deep visibility into emerging adversary TTPs.
Request a demo today to see how best-in-class threat intelligence can help security teams detect, prepare for, and neutralize advanced defense evasion techniques before they impact your network.
The post Process Parameter Poisoning: Inside a Novel EDR Evasion Technique appeared first on Flashpoint.
The Daybreak initiative will provide subsidized AI cyber capabilities, training and technical assistance, though OpenAI has disclosed few details about costs and eligibility.
The post OpenAI Pledges $1 Billion to Bring Frontier AI to Critical Infrastructure Defenders appeared first on SecurityWeek.
Login