Tag

Powershell

All articles tagged with #powershell

cybersecurity15 days ago•3 min saved

Widely Used Developer Placeholder Domain third-party.com Now Hosts ClickFix Malware

The domain third-party.com, a common placeholder in developer documentation, is now serving a fake Cloudflare verification page that tricks Windows users into executing malicious PowerShell commands. This ClickFix attack exploits the fact that the domain is not reserved for documentation like example.com, allowing attackers to hijack it for malware distribution. While the current payload is broken, the infrastructure remains live, posing a risk if reactivated.

via BleepingComputer|

#clickfix #cloudflare-impersonation #cybersecurity

technology1 month ago•3 min saved

TerminalFix lurks behind fake CAPTCHAs to deliver a stealth reverse-tunnel backdoor

Microsoft warns of TerminalFix, a new ClickFix variant that uses fake Cloudflare CAPTCHA prompts to coax victims into running PowerShell in Windows Terminal, then downloads a signed executable and a malicious DLL, with payloads hidden in PNG images via steganography. The malware establishes persistence, conducts AD/network reconnaissance, and employs a custom Python reverse-tunnel over an encrypted WebSocket to reach internal hosts, enabling attacker control and potential lateral movement, data theft, or ransomware. Defenses include restricting/logging PowerShell, monitoring for LockScreenContentServer.exe, hardening browsers/endpoint protections, and rotating credentials if compromise is confirmed.

via BleepingComputer|

#cybersecurity #phishing #powershell

security2 months ago•4 min saved

AI-Generated PowerShell Tool Maps Active Directory in Rapid Breach

Cybersecurity researchers flag a June 2026 intrusion where attackers used an AI-generated, vibe-coded PowerShell script to enumerate a Windows Active Directory after gaining RDP access to a domain-joined server. The tool locates the Domain Controller, maps AD users, computers, groups, OUs, and trusts, creates a staging area, and exports results (including AD_Report.html). Attackers then deployed s5cmd and SharpShares to locate data repositories, exported data to CSV, archived it, and exfiltrated it to a remote server. The incident highlights how AI-assisted tooling lowers entry barriers and accelerates reconnaissance, aligning with established smash-and-grab playbooks, while a related Sygnia report notes AI-enabled cloud intrusions can scale quickly using credentials and cloud weaknesses rather than new malware.

via The Hacker News|

#active-directory #ai-generated #data-exfiltration

technology4 months ago•7 min saved

Wipe Copilot from Windows 11: Two Practical Methods

Lifehacker outlines two ways to remove Microsoft Copilot from Windows 11: (1) use the Group Policy Editor (gpedit.msc) to disable Copilot or turn off Windows Copilot, a feature available on Windows 11 Pro or higher and only if Copilot hasn’t been launched in the last 28 days; (2) run a GitHub script from RemoveWindowsAI in PowerShell to remove Copilot and other AI features from all apps, with caveats about antivirus blocks and reviewing the script first. Microsoft has begun dialing back Copilot, but a complete off switch isn’t perfect yet.

via Lifehacker|

#copilot #group-policy-editor #powershell

technology5 months ago•5 min saved

Preparing Windows for the June 2026 Secure Boot Certificate Update

Secure Boot certificates expire in June 2026. Check if your PC already has updated certificates with a PowerShell check, then install any pending Windows updates and OEM firmware updates. If firmware updates aren’t available, use Microsoft’s registry-based workaround and reboot as directed. Windows 10 users may need Extended Security Updates to receive the update.

via Digital Trends|

#certificates #firmware #powershell

technology7 months ago•5 min saved

Windows Store Gains a Command-Line Interface for Install and Update

Microsoft introduced a PowerShell-based CLI for the Microsoft Store, enabling search, installation, and updates of Store apps directly from the command line, including bulk updates; however, it only works with Store-listed apps and may not include popular programs like Chrome or Paint.NET.

via WIRED|

#command-line #microsoft-store #powershell

technology7 months ago•4 min saved

DNS Channel Used to Deliver PowerShell Payload in ClickFix Attacks

A new ClickFix variant uses a DNS-based delivery channel: victims are prompted to run nslookup in the Run dialog, querying an attacker-controlled DNS server. The DNS response contains a PowerShell payload that, when executed, downloads a ZIP with a Python runtime and malware scripts, establishes persistence, and installs ModeloRAT. This marks the first known use of DNS for staging and delivering ClickFix payloads, enabling on-the-fly payload updates and blending with normal DNS traffic instead of relying on HTTP.

via BleepingComputer|

#clickfix #dns #modelorat

technology8 months ago•1 min saved

GitHub Script Lets Windows 11 Users Turn Off Built-In AI

A PowerShell script called Remove Windows AI, released on GitHub by Zoicware, enables Windows 11 users to disable built-in AI features such as Copilot, Recall, and Windows Studio Effects for privacy or a cleaner OS. The script is actively maintained and updated to remove newly added AI components, with users encouraged to report missing keys or features for future updates.

via 80 Level|

#ai #open-source #powershell

technology9 months ago•2 min saved

Microsoft Introduces New Security Features Amid Rising Zero-Day Threats

Microsoft has added a new security feature to Windows PowerShell 5.1 that prompts users to confirm before executing web content without special parameters, allowing them to choose between safety and potential risk, primarily impacting enterprise environments but also relevant for interactive users.,

via Forbes|

#powershell #security-update #technology

cybersecurity3 years ago•2 min saved

Undetectable PowerShell Execution via WinRAR SFX Archives

Hackers are using WinRAR self-extracting archives to plant backdoors without triggering security agents on target systems. The SFX files contain harmless decoy files and are password-protected. The attackers add malicious functionality to the SFX files, allowing them to run PowerShell, Windows command prompt, and task manager with system privileges. This type of attack is likely to remain undetected by traditional antivirus software. Users are advised to use appropriate software to check the content of SFX archives and look for potential scripts or commands scheduled to run upon extraction.

via BleepingComputer|

#backdoor #cybersecurity #powershell

cybersecurity3 years ago•2 min saved

WinRAR SFX Archives Enable Undetected PowerShell Execution

via BleepingComputer|

#backdoor #cybersecurity #powershell

cybersecurity3 years ago•2 min saved

"Microsoft addresses BitLocker vulnerabilities with PowerShell scripts"

Microsoft has released PowerShell scripts to fix a BitLocker security bypass vulnerability in the Windows Recovery Environment (WinRE) for Windows 10 and 11 systems. The vulnerability could allow access to encrypted data in storage devices. The scripts enable enterprises to automatically update WinRE images to protect Windows devices. The flaw can only be exploited on systems with the winre.wim on the recovery partition.

via The Register|

#bitlocker #cybersecurity #microsoft