Privilege Escalation in CrowdStrike. TerminalFix, ClickFix Lure, Steganography, Reverse Tunnel. REVSTEALER Disable Windows Update and Defender.Langflow and Ruby on Rails Vulnerabilities. Microsoft Teams, Spring Ring Intrusion. Chrome Zero-Day.... and more

A security researcher known as Chaotic Eclipse has published FalconFlank, a proof-of-concept (PoC) claiming to demonstrate a zero-day local privilege escalation vulnerability in CrowdStrike Falcon Sensor. Security researcher Kevin Beaumont has independently verified the PoC is functional; CrowdStrike states it is actively investigating and has not formally confirmed the vulnerability, and no CVE has been assigned. The flaw reportedly abuses Falcon's Office malicious macro remediation process, a feature that operates with elevated privileges to clean malicious content from Office documents, and manipulates that process to gain SYSTEM-level access on the host. The exploit requires CrowdStrike Falcon configured at Phase 3 Optimal Protection with the "Microsoft Office file malicious macro removal" policy enabled, and works on fully updated Windows 11 25H2 and Windows Server 2025 systems. CrowdStrike advised customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting, noting that the Cloud Anti-malware for Microsoft Office Files setting continues to provide protection. A FalconFlank Tech Alert has been issued through the CrowdStrike support portal. The researcher noted that Falcon likely already detects the unmodified PoC, meaning obfuscation or modified DLL loading would be required to test.

Source

Analyst Comment

FalconFlank is a post-compromise tool, not an initial access vector; an attacker requires an existing low-privileged foothold before this becomes relevant. Analysis suggests this technique most likely serves ransomware affiliates or targeted intrusion sets during post-exploitation; malicious insiders with low-privilege access are a plausible category. No source attributes FalconFlank to any specific threat actor, and no exploitation in the wild has been identified as of publication. Exposure requires two conditions simultaneously: Phase 3 Optimal Protection and the "Microsoft Office file malicious macro removal" policy both enabled. Phase 3 is not the default; it is the recommended target state for mature deployments following CrowdStrike's phased methodology, so newer or partially configured environments may not be affected. CrowdStrike states Cloud Anti-malware continues to provide protection following the recommended mitigation; as an analytical assessment, the two controls are not functionally equivalent, and defenders should weigh whether disabling active macro remediation creates meaningful exposure before applying the change. Further exploitation requires obfuscation and modified DLL loading, making near-term mass exploitation less likely in this analyst's assessment, though the vulnerability remains unpatched and no CVE has been assigned. This is part of an active research pattern targeting security product remediation mechanisms as an attack surface.

TerminalFix is a variant of ClickFix, a technique that socially engineers victims into running attacker-supplied commands from their own keyboard. The campaign targets organizations across multiple industries via compromised websites displaying fake Cloudflare verification overlays, loading a malicious PowerShell command onto the victim's clipboard and directing them to execute it in Windows Terminal or PowerShell rather than the Windows Run dialog targeted by standard ClickFix attacks. The command downloads a ZIP archive containing a legitimate signed binary and a malicious Dynamic Link Library (DLL), sideloaded into the trusted process to execute an obfuscated payload in memory. The payload retrieves three PNG images from attacker-controlled servers, extracts files hidden in pixel data using steganography, and reassembles them on disk before deleting the images. Persistence is established through a Registry Run key and a scheduled task re-executing every 60 minutes. The malware performs Active Directory (AD) enumeration covering domain trusts, domain administrator group membership, AD users, and internal server infrastructure. A Python-based reverse tunnel connects outbound over an encrypted WebSocket to attacker infrastructure, giving the operator SOCKS5-style arbitrary TCP proxy access into the victim's network through the compromised host. No hands-on operator activity was observed.

Source

Analyst Comment

The significant distinction in this campaign is not the ClickFix lure but what follows it. A standard Command and Control (C2) implant operates through the compromised host; a SOCKS5 reverse tunnel allows the operator to address any system that host can reach directly, with traffic appearing to originate internally. Combined with the Active Directory enumeration performed before tunnel deployment (domain trusts, domain administrator membership, named server roles), the campaign pattern is consistent with deliberate target selection rather than opportunistic access. That enumeration covers the infrastructure typically associated with privilege escalation, lateral movement, and ransomware deployment; based on the observed pattern rather than confirmed downstream activity, this analysis assesses the campaign as consistent with pre-positioning for follow-on operations. The absence of observed hands-on activity does not reduce the threat; it may indicate access capability staged for later use, though it could equally reflect a limited observation window. Either way, defenders should treat any confirmed indicator as an active network-level exposure, not a contained endpoint compromise. Practically, PowerShell restriction for standard users addresses the root execution mechanism directly, though many organizations will find monitoring more achievable: LockScreenContentServer.exe executing outside its standard SystemApps path is a low-noise, precise detection opportunity. Based on the established evolution of ClickFix-class tradecraft, this analysis assesses the broader behavioral pattern (user-executed commands, no exploit required, legitimate tooling abused throughout) as likely to persist across future variants regardless of the specific lure or payload.

REVSTEALER is a commercial Windows infostealer sold since at least February 2026. The core stealer exfiltrates credentials and session data from browsers, 51 cryptocurrency wallet applications, 225 wallet-related browser extensions, gaming platforms including Roblox, Steam, Battle.net, and EA Desktop, messaging clients, VPNs, and password managers, then deletes itself to leave no persistent footprint. To bypass Chrome's App-Bound Encryption, it launches the browser under debugger control and reads the decryption key directly from memory using a hardware breakpoint. Four follow-on modules, assessed to be delivered through command-and-control (C2) tasking based on shared code tradecraft, extend the operation beyond initial theft: ProManager overlays attacker-controlled content over legitimate wallet application windows to phish credentials; WinUpdate silently replaces copied cryptocurrency addresses in the clipboard and harvests seed phrases; SoftManager routes attacker traffic through the victim's connection via a reverse SOCKS5 proxy; and LockAppHost abuses the Microsoft Connection Manager Profile Installer (CMSTP) to bypass User Account Control (UAC), disables Windows Update and Microsoft Defender protections, then deploys the XMRig miner inside legitimate system processes. All components store fallback C2 addresses in Polygon blockchain smart contracts, a technique known as EtherHiding that survives domain takedowns. Distribution has relied on hijacked YouTube channels promoting game cheats and packages impersonating software including Slack, qBittorrent, and Blender.

Source

Analyst Comment

The most operationally significant aspect of this report is the gap between apparent and actual remediation. The core stealer self-deletes, and an investigation that begins with a miner found in a suspended system process may conclude there without establishing whether LockAppHost was the installer. That matters because LockAppHost's disablement of Windows Update services, scheduled tasks, and Microsoft Defender exclusions persists after the miner is removed, leaving the host in a degraded defensive state until those changes are explicitly reversed. Where XMRig is found alongside the specific service, task, and Defender exclusion changes Elastic documents in their published indicators, responders should assess for the broader REVSTEALER module set before closing the investigation. Where REVSTEALER infection is confirmed, password resets alone are insufficient given the session cookie scope of the core stealer. Full session revocation is the correct response, though for organizations without centralized SSO visibility this is likely to be incomplete in practice; prioritizing identity providers, email, and financial platforms is a reasonable triage approach. The Chrome App-Bound Encryption bypass is currently difficult to detect without endpoint tooling that generates hardware breakpoint telemetry; organizations without that visibility should not assume this class of credential theft will surface through conventional logging. For defenders without dedicated threat intelligence capability, the most actionable response to the Polygon dead drop infrastructure is network-level alerting on outbound connections to Polygon JSON-RPC endpoints. Finally, SoftManager's reverse proxy capability means an infected host may be used for the attacker's operations against third parties, which carries IP reputation and potential compliance implications beyond the immediate credential theft.

Two critical, unauthenticated vulnerabilities in the artificial intelligence (AI) platform Langflow and the Ruby on Rails framework are under active exploitation, according to VulnCheck. CVE-2026-0768 (CVSS v3 9.8) allows remote code execution as root through Langflow's validate endpoint and was disclosed publicly on January 9, 2026. VulnCheck first observed exploitation on August 29, 2026, recording more than 50 detections that day and 360 by August 31. Requests queried environment variables, read Langflow's secret key file, and checked SSH access and shell history, with traffic initially from Russia against UK-based canaries. CVE-2026-66066 (CVSS v4.0 9.5), known as KindaRails2Shell, affects Rails applications processing untrusted image uploads through Active Storage's vips processor, with exploitation requiring a reachable direct-upload route. A crafted upload can expose Rails signing material and credentials. Fixes ship in versions 7.2.3.2, 8.0.5.1, and 8.1.3.1, requiring libvips 8.13 or later. Rapid7 verified code execution via recovered signing material on vulnerable servers; VulnCheck found a Marshal-based signed variation executes on a patched 8.1.3.1 server. VulnCheck recorded exploitation against canaries in Singapore, Israel, and the United Kingdom, with traffic from one French IP address establishing command-and-control to an Israeli host. As of August 7, VulnCheck identified more than 7,100 internet-exposed vulnerable Rails instances.

Source

Analyst Comment

Both flaws are worth patching quickly, but the more useful lesson here is behavioral. The initially disclosed Langflow requests were consistent with credential reconnaissance, with no destructive activity described in that telemetry, which suggests watching for those access patterns on this specific service rather than waiting for a louder signal. The Rails finding carries a similar warning. A patched 8.1.3.1 server can still allow code execution through a validly signed variation, so upgrading alone will not undo signing material or credentials exposed before the patch landed. Operators of affected or potentially compromised deployments should treat rotation as mandatory, not optional cleanup after updating, though this applies where exposure or compromise cannot be excluded rather than to every installation of either product. Remediation priority should follow confirmed configuration and exposure data rather than assumption. The broader pattern still matters beyond this incident though. Langflow's deployment model supports direct internet exposure by design, and AI workflow tools like it can hold or reach cloud and model-provider credentials. Any organization running comparable tooling should ask whether its own deployments share that exposure, and whether its credential inventory would hold up under similar probing.

A social engineering campaign called Spring Ring used fake Microsoft Teams help desk accounts to trick employees into installing malware or handing over remote access, according to threat intelligence researchers. Between January and April 2026, it reached more than 150 employees across at least 10 companies. Attackers set up external Teams accounts resembling internal IT support, then called to build trust before directing victims to install software or grant remote control. Researchers initially identified 26 attacker identities, with successful calls often lasting 10 to 15 minutes. The attack split into two paths. In one, the attacker gained remote control of the victim's machine, ran enumeration commands, then delivered a PowerShell-based remote access Trojan that disabled the Antimalware Scan Interface (AMSI) and contacted a command and control server before being blocked during execution. In the other, the victim downloaded and ran a cloud-hosted file that established persistence, hijacked the browser, scanned the internal network, and used PetitPotam to coerce the domain controller into authenticating to attacker-controlled infrastructure in an NTLM relay attempt blocked before completion. In the researchers' telemetry, phishing alerts tied to collaboration platforms made up 42 percent of all such alerts in early 2026, up from 30 percent previously.

Source

Analyst Comment

Defenders should see Spring Ring as social engineering shifting from traditional email phishing to live, real time conversations inside platforms employees trust. Both observed intrusion chains progressed past initial contact before being stopped, one reaching remote endpoint control and the other an attempted domain takeover, showing a successful call can lead to serious post-compromise activity. Microsoft Teams allows external tenants to chat and call employees by default unless restricted. Restricting that access, and watching for rapid chat to call transitions, unexpected remote support use, and unusual authentication traffic toward domain controllers, offers a practical starting point. The escalation path relies on the established PetitPotam and NTLM relay technique, not a new exploit, so reducing NTLM exposure and enforcing EPA or signing protections where applicable remain relevant. Other researchers have documented similar Teams help desk impersonation campaigns, suggesting the approach extends beyond one operation. None have publicly attributed the activity to a named threat actor, so the name reflects a tracking label rather than an actor designation. Because both chains depended on the victim trusting an unsolicited support contact, verifying unexpected IT requests through a known channel can stop the attack early and complements technical controls.

Google released a Chrome update with 12 fixes, including high-severity CVE-2026-85046, which Google said had an exploit in the wild at release. The flaw is a type confusion bug in V8, Chrome's JavaScript engine, letting a remote attacker execute code inside the sandbox via a crafted web page. Researcher Salvatore Gulizia, known as Serotav, traced the bug to a sort-inlining optimization in V8's Maglev and Turbofan compilers. A malicious comparator can call Array.prototype.fill mid-sort to shift the receiver from PACKED_ELEMENTS to PACKED_SMI_ELEMENTS without reallocating its backing store, a change V8's post-sort map check misses. This exposes heap offsets as plain numbers, creating an addrof primitive. Gulizia used Array.prototype.unshift to move a tagged pointer without emitting a write barrier, gaining arbitrary read/write access to the JavaScript heap. Gulizia reported the bug on August 4, 2026, earning a $1,000 reward, and chained it with an n-day sandbox escape to capture a flag in Google's v8CTF challenge. Google fixed the flaw by no longer inlining the sort optimization when receiver element kinds differ. This is the sixth actively exploited Chrome zero-day Google has patched in 2026. Update to Chrome 152.0.7977.82/.83 or later on Windows and macOS, and 152.0.7977.82 or later on Linux.

Source

Analyst Comment

The exploited flaw lived in a sort optimization present in V8's Maglev and Turbofan compiler tiers. The trigger relies on ordinary JavaScript operations, including fill and unshift, though exploitation also requires manipulating V8's JIT and heap behavior. Google said an exploit existed in the wild at release but has not disclosed when exploitation began, who was targeted, or how victims were reached, and the external researcher credit provides no basis to infer a particular operator or campaign. The CVE describes exploitation through a crafted web page, though the exact interaction required has not been independently confirmed here. Because the flaw resides in V8, other Chromium based browsers incorporating vulnerable V8 versions may also be affected and require their own vendor updates. The researcher published detailed exploitation primitives and proof of concept code on August 28, six days before Google released the fixed Chrome Stable build on September 3, meaning technical detail sufficient to reproduce key primitives was already public before that release. Google has not published CVE specific detection guidance or a workaround, making rapid deployment of vendor specific updates, followed by verifying the installed version and restarting the browser, the primary available remediation.