Latest / Daily DefSec Brief / Daily Defsec Brief - Cyber Security News for July 9 2026
Transcript
- Jerry: If you run Windows Defender, and most Windows fleets do by default, Microsoft has finally shipped the patch for that zero day that's had a working exploit floating around for a month. That's your first job today. This is the daily DefSec brief. I'm Jerry Bell. This is your few minutes on what matters to people defending networks for July 9th, 2026. four stories today and This first one comes Bleeping Computer and Security Week, and it's an update on the Rogue Planet Defender bug. This is a race condition in Microsoft that let an attacker spawn a command prompt running as system. A researcher going by the name of Nightmare Eclipse published a proof of concept. Back on June 9th, in the middle of a dispute with Microsoft over how it runs its bug bounty. Microsoft updated the advisory on july eighth and confirmed patches are out. It's tracked as CBE twenty twenty six fifty six fifty six it affects fully patch Windows ten and Windows eleven running Defender. the public exploit's been out for about a month now, though these sources don't report confirmed active exploitation. The takeaway is straightforward. Apply this week's Defender update now. And until you've got it rolled out fleet wide, watch for unexplained system level CMD.exe processes spawning off Defender itself. ⁓ And you should probably be watching out for those anyway. Alright, moving on. Our next story comes from Dark Reading. Reporting on Symantec's work is about a ransomware group using a kernel driver that Microsoft itself signed to blind security software before it runs. The group is called Hyandina. ⁓ Ransomware is a service that's been around for about four years. The new locker is called God Damn, Following earlier ones called Beast and Monster. in a recent case, Symantec found them loading a legitimately Microsoft signed but malicious kernel driver to kill EDR. That's the bring your own vulnerability driver technique, and it's been a problem for years. They're hitting US healthcare, manufacturing, and education, and they steer clear of former Soviet bloc countries. This is active in the wild, so here's what you do. Make sure Microsoft's vulnerable driver block list is turned on, along with HVCI and WDAC. Pull the driver specific hash from Symantecs write up once it's available, and treat any newly loaded unfamiliar kernel driver as a precursor signal worth chasing, not just background noise. Next up is the Vision campaign, and this one's from Okta by way of bleeping computer. Attackers are cold calling employees posing as IT or security staff, walking them through registering a passkey on their own account, except the pass key belongs to the attacker. There's no bug here. They're abusing a legitimate feature. Microsoft opened up an admin-driven passkey registration campaign feature back in May, and this crew built a phishing kit that mimics it. The victim gets talked into enrolling, and now the attacker has a credential on their account. Okta tracks this actor as Pink, an extortion operation, and this has been running since April across multiple sectors. The action here is threefold. Review who in your aura can even launch those Entra pass key registration campaigns and lock that down. Tell your help desk and your users to verify any pass key enrollment requests out of band, by the way. That's the whole game with Vishing. And pull your Entra sign-in logs for pass key enrollments coming from unfamiliar devices. Our last story comes from Bleeping Computer. If your dev team pulls payment SDKs from NPM or PyPy, it's worth checking what actually landed. At least 17 malicious packages impersonating Paysafe, Skrill, and NutTeller SDKs got published to NPM and PyPy at the same time, and each one exfiltrates credentials and access tokens to a command and control server sitting on AWS. This is active and the packages were live and handing out the stealer. The people at risk are teams building e-commerce gaming, travel, or fintech apps that integrate these payment platforms. So audit your MPM and PyPy dependencies for these fake SDK packages. Pull them and rotate any credentials or tokens that touch the build environment where they were installed. If it was in the build, assume they're gone. Before we wrap, a few quick ones. Chrome 150 patches 27 vulnerabilities, including two critical use after free bugs, so update your browser now. GitLab push fixes for eight flaws across community and enterprise, including a high severity cross-site scripting bug. So get on to a patch release. A group called Lurking Wizard is running over 230 look-like domains pushing a Trojanized 7-zip installer that turns victim machines into residential proxy nodes. So block the known domains and watch for unexpected proxy agent processes. and a fake Let's VPN installer bundles a real signed VPN with a hidden ret called good person rat. so only source your VPN installers from the vendors official site. That's the brief. Thanks for watching. All the sources are in the show notes. this was useful, like and subscribe and pass it along to a friend who can use it. I'm Jerry Bell and I'll see you again tomorrow.