AI Weekly Malaysia

Security researcher Chaotic Eclipse released a PoC called FalconFlank, a zero-day privilege escalation exploit abusing CrowdStrike Falcon Sensor's Office malicious macros remediation on fully updated Windows 11 25H2 and Windows Server 2025. This follows the same researcher's recent PoCs for Kaspersky endpoint security (HardBreacher) and an unpatched Microsoft Defender zero-day (ShieldBreak, CVE-2026-69414) that grants SYSTEM privileges.

Why: If your organization runs CrowdStrike Falcon on Windows 11 25H2 or Server 2025, this PoC demonstrates a working local privilege escalation path that may require adding detection exclusions or DLL load technique changes to test—security teams should verify whether CrowdStrike has shipped detections and whether their Falcon configuration is exposed. For founders running endpoint protection on these specific Windows builds, it's a prompt to check patch status across all three named products (CrowdStrike, Kaspersky 14.0.0.504, and Microsoft Defender, which remains unfixed).

The Silver Fox threat group is distributing the ValleyRAT backdoor (Winos 4.0) bundled inside QN Wallpaper, a legitimate signed Chinese adware app, using DLL sideloading to run malicious code inside a trusted process. The installer disables Windows Defender via the DisableAntiSpyware registry key, adds itself to autorun, escalates privileges with runas, and marks its process as critical so termination triggers a BSOD. Kaspersky published IoCs including file hashes and C2 servers (103.45.66.18:441-443, 192.253.225.173:6666/8888).

Why: This is a consumer-targeted adware-to-RAT campaign with no direct bearing on AI tooling, developer infrastructure, or SaaS workflows this audience ships. The only actionable detail for builders is the DLL sideloading pattern (signed exe + planted libcef.dll) worth noting if you ship desktop installers or maintain endpoint exclusion policies for your own software.