Morning Brief

Microsoft has disclosed details of a new ClickFix variant, dubbed TerminalFix, that aims to trick users into running a malicious command in Windows Terminal or PowerShell. "While traditional ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix campaigns apply the same technique but direct users to Windows Terminal or PowerShell instead, increasing the likelihood that complex

Philadelphia, Pennsylvania, United States, August 24th, 2026, CyberNewswire Security Risk Advisors (SRA) , the authors of the free VECTR platform, announce today another great free platform launch: SCALR AI. Security teams can get SCALR AI for free, delivered through the Azure Marketplace. SCALR AI is an agentive workbench that automates time-consuming security work and ships with fully functional incident triage and enrichment, with AI-driven quality review built-in. There are no limits on the free license (such as local use), and the SCALR AI platform is available to CISO teams to deploy in…

Hackers are using adware to deliver ValleyRAT, a Windows backdoor. The campaign primarily affects users in China and India, turning a program expected to display ads into a route for spying, theft, and further malware delivery. The installer changes its visible behavior according to its filename. One version installs a collaboration app, another installs a browser, and a third opens a meeting-download page. Those harmless-looking actions can keep a victim occupied while the malicious components are placed on the machine. Researchers at Securelist identified the activity after an apparent…

Microsoft has opened an active investigation into a new Exchange Online disruption after a wave of user reports flagged access and mail-flow problems across the cloud-based email service. The incident, logged in the Microsoft 365 admin center as EX1464935, began at 9:23 PM IST on August 31, 2026, with the company confirming at 9:25 PM IST that engineers were “investigating user reports of Exchange Online issues”. As of the latest update, the status remains listed as “Investigating,” meaning Microsoft has not yet isolated a root cause or confirmed the scope of the disruption. The advisory…

HardBreacher’s newly published PoC claims a local privilege-escalation flaw in Kaspersky Endpoint Security on fully patched Windows 11 systems, but the issue remains unverified and has not been publicly confirmed or assigned a CVE by Kaspersky. The project, published by a researcher, MSNightmare, describes the alleged flaw as a zero-day elevation-of-privilege vulnerability in Kaspersky’s enterprise endpoint product. According to the repository’s README, the proof of concept was tested on Windows 11 version 25H2 with Kaspersky Endpoint Security version 14.0.0.504. HardBreacher appears to…

A China-nexus cyber espionage actor tracked as Fire Ant has expanded a long-running campaign beyond VMware hypervisors to compromise Cisco IOS XR routers, Terminal Access Controller Access-Control System (TACACS) servers, and Linux management hosts used to route, authenticate, and manage high-value networks. Sygnia, the incident response firm that investigated the intrusion, said the actor

On Thursday, Trump signed an executive order demanding Lake Ontario be renamed to Lake America. At the signing of the order, he sat next to a big poster board map of the Great Lakes, with a big red arrow labeling Lake Ontario as "Lake America," with the words "Making the Great Lakes Even Greater." The Canadian province of Ontario borders the north, west, and southwest sides of the lake, with New York State on the south and east.