Good morning. This is your security briefing for Sunday, March 15, 2026, covering 14 articles analyzed overnight. All attribution is by the article authors. All article analysis is automated.
InfoGuard Labs reports that security researchers discovered critical vulnerabilities in Palo Alto Cortex XDR agent versions 8.7 and 8.8, where predefined BIOCs contained hardcoded exceptions and global whitelists that allowed attackers to bypass detections, including LSASS dumping without triggering alerts. Palo Alto Networks has addressed this issue by removing global whitelists in Agent Version 9.1 with content version 2160.
JPCERT Coordination Center has published a technical report on reverse engineering Rust-compiled malware binaries, addressing the growing trend of threat actors using Rust for malware development, including SysJoker variants and BlackCat ransomware. The report provides detailed analysis of Rust binary characteristics to assist defenders in analyzing these increasingly sophisticated threats.
TrustedSec details critical PowerShell logging mechanisms for detecting adversary techniques, focusing on Module Logging, Script Block Logging, and Transcription capabilities. The article emphasizes Script Block Logging with Event ID 4104 as most valuable for capturing deobfuscated script content and detecting attacks that leave no disk artifacts, noting that PowerShell remains a primary attack vector covered extensively in MITRE ATT&CK techniques.
Trellix has identified a Remcos RAT campaign utilizing fileless, multi-stage execution techniques to evade detection. The attack begins with procurement-themed phishing emails containing JavaScript downloaders that fetch AES-encrypted PowerShell scripts, which then load a .NET injector that performs process hollowing on aspnet_compiler.exe to execute the RAT entirely in memory, reducing forensic artifacts.
Aikido Security reports that the Glassworm campaign has compromised over 150 GitHub repositories, npm packages, and VS Code extensions using invisible Unicode characters to hide malicious JavaScript payloads. The attack targets developers and organizations, embedding obscure Unicode within strings that decode and execute scripts to exfiltrate tokens, credentials, and secrets, with attackers leveraging AI to generate convincing commits that mimic legitimate developer activity.
ThreatDown by Malwarebytes has identified CastleRAT as the first known malware campaign to abuse the legitimate Deno JavaScript runtime for defense evasion. Attackers use ClickFix social engineering to trick victims into executing commands that deploy Deno to run obfuscated JavaScript, then deliver encrypted payloads via steganography and inject malware directly into memory, bypassing traditional antivirus detection by operating within trusted processes.
Security researchers have discovered a Cross Prompt Injection Attack vulnerability, CVE-2026-26133, affecting Microsoft Copilot's AI email summarization features. Attackers can embed invisible malicious instructions in emails using HTML and CSS that Copilot processes and incorporates into summaries, enabling model-mediated phishing attacks that exploit user trust in AI-generated content. Microsoft has been notified and mitigations have been implemented.
Security researcher Lorenzo Meacci details advanced EDR bypass techniques using User-Defined Reflective Loader built with Crystal Palace, a Position Independent Code linker, to evade detection when loading Cobalt Strike beacons. The methods circumvent static analysis, behavioral analysis including API hooking and kernel callbacks, and signature-based detection by controlling the entire payload lifecycle from memory loading to execution.
Bitdefender reports that cybercriminals are using malicious Google Ads impersonating Claude Code to distribute malware to Windows and macOS users. Windows victims receive stealer malware via mshta.exe execution, while macOS users are infected with a Mach-O backdoor enabling remote command execution and credential theft through social engineering tactics disguised as installation instructions.
IBM reports that threat actor group Hive0163 deployed AI-generated malware named Slopoly in ransomware attacks targeting corporate environments globally in early 2026. Slopoly is a PowerShell-based C2 framework backdoor used alongside Interlock ransomware, with initial infection via ClickFix social engineering tactics, marking the beginning of an AI-driven cybersecurity arms race where malware development time is significantly reduced.
Unit 42 has responded to numerous incidents across various industries since late December 2025 involving voice-based phishing campaigns. These vishing attacks successfully led to data theft and subsequent extortion of victim organizations, representing an active threat pattern targeting multiple industry sectors.
Huntress SOC identified INC ransomware deployment in a customer's infrastructure on February 25, 2026. The threat actor utilized PSEXEC for privilege escalation, Restic backup utility renamed as winupdate.exe for data exfiltration to AWS, and disabled security software before ransomware deployment, with similar incidents observed across multiple organizations.
YouTube has published conference videos from RE//verse 2026, a conference focused on reverse engineering and cybersecurity. The videos contain technical presentations and research related to reverse engineering techniques, malware analysis, and security research from practitioners sharing their work.
That concludes today's briefing.