Good morning. This is your security briefing for Thursday, March 12, 2026, covering 15 articles analyzed overnight. All attribution is by the article authors, and all article analysis is automated.
Praetorian disclosed critical vulnerabilities in two widely-used reverse proxies. Fabio and OAuth2-proxy contain flaws that allow attackers to bypass authentication and escalate privileges by exploiting hop-by-hop header abuse and header normalization inconsistencies, manipulating HTTP headers like X-Forwarded-For and X-Forwarded-Email to gain unauthorized access.
CodeAnt AI's CEO Amartya Jha reported a critical remote code execution vulnerability in simple-git, affecting versions 3.15.0 to 3.32.2. This Node.js package, with over 12 million weekly downloads, contains a case-sensitivity bug that bypasses previous security fixes, allowing attackers to execute arbitrary commands via the ext:: Git protocol, with approximately 9 million weekly installs currently vulnerable.
Researcher iss4cf0ng released Elfina, a multi-architecture ELF loader designed for educational and research purposes. The tool supports x86, x86-64, ARM32, AArch64, and RISC-V 64 architectures, offering multiple execution methods including mmap and memfd loading capabilities with stated applications in reverse engineering and rootkit development.
StepSecurity released Dev Machine Guard, an open-source security tool that scans developer machines for threats in the developer tooling layer. The tool identifies malicious IDE extensions, rogue MCP servers, untrusted AI agents, and compromised software packages that target developers' access to sensitive code, credentials, and cloud keys.
S3N4T0R-0X0 documented an Iranian APT group Static Kitten conducting spear-phishing campaigns since January 2026. The group targeted diplomatic, maritime, financial, and telecom sectors across the Middle East, delivering a Rust-based implant called RustyWater via malicious macro-enabled documents that establishes C2 communication through XOR-encrypted JSON messages with sophisticated evasion capabilities.
The U.S. Department of the Treasury sanctioned six individuals and two entities facilitating North Korean IT worker fraud schemes. These DPRK government-orchestrated operations use fraudulent documentation and stolen identities to gain employment at U.S. businesses, covertly introducing malware to extract proprietary information while generating nearly $800 million in 2024 for weapons of mass destruction programs.
Gate 15 coordinated a joint advisory from ten Information Sharing and Analysis Centers on March 11, 2026, addressing security implications of the Middle East conflict on critical infrastructure. The advisory urges stakeholders in critical infrastructure sectors to understand threats, assess risks, and take protective action.
AlmondOffSec released tdo_dump, a proof-of-concept tool that extracts account credentials from Windows trusted domain objects. The tool leverages DRS functions to retrieve password hashes and Kerberos keys, enabling attackers to exploit one-way trust relationships for authentication and lateral movement across security boundaries.
Researcher iss4cf0ng published IronPE, a Windows PE manual loader written in Rust. The tool demonstrates memory-based loading and execution of PE files for both x86 and x64 architectures, implementing manual mapping techniques including parsing PE headers, applying relocations, and resolving imports to bypass the Windows loader and evade security software.
Security researcher Zhassulan Zhussupov demonstrated a novel malware obfuscation technique using Discrete Fourier Transform and Inverse DFT. The method transforms executable shellcode into complex numbers representing frequency data, creating high-entropy noise that evades signature-based and heuristic detection tools, with a phase shift serving as a mathematical decryption key.
Binary Defense developed defender-acl-blocker, a proof-of-concept demonstrating a stealthy technique to disable Windows Defender by modifying Access Control Lists on critical system files like kernel32.dll. The technique adds Deny entries that prevent security service identities from loading necessary files, remaining effective after reboots while evading typical detection methods.
Researcher zux0x3a released Phantom, a project enabling in-memory execution of .NET assemblies within IIS worker processes. The tool uses reflective loading techniques to bypass file-based detection and includes an ASPX-based loader with evasion capabilities and PhantomLink component for C2 framework integration in full-trust IIS environments.
A new toolkit called LnkMeMaybe has been released for crafting malicious .lnk shortcut files. Its TriggerAuth function, tracked as CVE-2026-25185, forces systems to send authentication credentials to attacker-controlled servers without executing code, triggerable by user browsing, system indexing, or Microsoft Defender scans.
Bombadil-Systems documented Zombie ZIP, a malformed ZIP archive technique that evades antivirus detection. The method declares compression method zero in the header while containing DEFLATE-compressed malicious payloads, manipulating CRC-32 checksums to match uncompressed data and bypassing approximately 98% of signature-based antivirus engines.
Microsoft reported that Storm-2561 threat actors are conducting a credential theft campaign using SEO poisoning to distribute fake VPN clients. The digitally-signed malware exfiltrates user credentials and VPN data to attacker-controlled servers, then displays fake error messages while redirecting victims to legitimate VPN downloads to mask the compromise. That concludes today's briefing.
That concludes today's briefing.