Windows' Own Security Driver Can Be Weaponized — Plus 5 Critical Patches
Saturday, August 22, 2026 · 5-minute read
Researchers at Check Point presented a troubling finding at Black Hat USA 2026 this week. A legitimate, signed driver built into Windows — called BTR.sys — can be hijacked to delete security software at boot time, before your computer even fully starts up. No outside tools are needed, and Microsoft can't simply block the driver without breaking its own Defender antivirus.
The good news: Check Point found no evidence this has been used in real attacks yet. Microsoft has been notified and is working on a response.
↗ The Hacker NewsSecurity researchers at Kaspersky have discovered the first known malware designed specifically to infect Android-based car entertainment systems — those touchscreen consoles that control navigation, music, and phone calls. The malware slipped in through the cars' own built-in software update system and was used to commit ad fraud and quietly turn infected vehicles into part of a botnet. The activity is linked to a China-based group called MoYu, previously tied to a broader fraud scheme called BADBOX.
↗ The Hacker NewsToronto's Hospital for Sick Children confirmed that a cybersecurity incident exposed personal information belonging to current and former employees, as well as job applicants. The breach came from a flaw in third-party software the hospital uses — not from its own systems. Patient records and clinical systems were not affected. If you've applied to or worked at SickKids, watch for phishing emails that may use your details.
↗ BleepingComputerA rogue ransomware affiliate has been posing as a legitimate data recovery company. Victims who've already had their files locked and are desperate for help end up paying this fake firm — which then simply pays the original attackers a cut and pockets the rest, adding a second layer of theft to an already devastating situation. It's a con-within-a-con targeting people at their most vulnerable.
Attackers are sending phishing messages through Microsoft Teams to deliver a newly discovered piece of malware called SynkLoader. Once clicked, it shows victims a fake lock screen while quietly stealing their login credentials in the background. Because the messages come through Teams rather than email, they can slip past traditional spam filters that most organizations rely on. This is a growing tactic targeting businesses that use Microsoft 365.
Cisco patched five vulnerabilities this week — four of them scoring a perfect 10 out of 10 on the severity scale. The worst allows an attacker to inject malicious database commands (called SQL injection) into Cisco's network management tools, potentially taking full control without needing a password. These affect Cisco Crosswork and Secure Workload software used by large enterprises to manage complex networks.
Status: Patches available — update to Cisco Crosswork version 7.2.1-SP immediately.
Microsoft patched a maximum-severity flaw in Entra ID, the system millions of organizations use to manage employee logins and access. This one is already being used in real attacks. A successful exploit lets an attacker run their own code or escalate their privileges — essentially becoming an admin across company systems without authorization.
Status: Patch released by Microsoft — apply August 2026 updates now if your organization uses Entra ID.
Citrix is urging admins to patch two flaws in NetScaler Gateway and NetScaler ADC — the products many companies use to let employees securely log in from home. Attackers are already targeting these. A successful attack could expose the remote access layer of an organization, effectively unlocking a front door that was supposed to be secure.
Status: Patches available — Citrix says patch immediately, no waiting for a maintenance window.
A critical bug in Elementor Pro — one of the most popular WordPress plugins used to build websites — lets attackers upload malicious files and run their own code directly on the web server. This means a hacker could take over an affected website completely. Elementor Pro is used on millions of sites globally.
Status: Patch available — WordPress site owners using Elementor Pro should update the plugin immediately through their dashboard.
A new free service called DecryptAds (decryptads.com) lets anyone look up which advertising companies and data brokers are harvesting information from any given website or app. It was built by security researcher Zach Edwards and colleagues at Infoblox, and it works by cross-referencing publicly available advertising disclosure files that websites are legally required to publish.
The tool flags high-risk ad partners — including ones based in Russia, China, and the UAE — and shows exactly what kind of data they collect, from your location to your device's unique fingerprint. A quick search on ESPN.com, for example, revealed 143 ad partners and 19 data brokers, including four linked to Russia, China, or the UAE. It also exposed that several major U.S. military news websites share ad partners with geopolitically sensitive firms — a significant national security concern worth watching.
↗ Krebs on SecurityTwo separate supply chain attacks hit the developer world this week. Fourteen fake npm packages — disguised as calendar and productivity tools — were found to secretly install an AI-powered backdoor called RedC2 4.0 on Linux systems the moment any developer imported them. Separately, hackers broke into the account of the maintainer behind a widely used Rust programming package called arrayref and injected infostealer malware that ran automatically when developers compiled their code. Both attacks are reminders that the code you download is only as safe as the people and systems behind it.
↗ BleepingComputer / The Hacker NewsImagine hiring a security guard to protect your building — and then discovering that the guard's own keycard can be copied and used to let intruders in through a back door that can never be locked. That's essentially what Check Point Research revealed this week about a core component of Windows security.
The component in question is a file called BTR.sys — short for Boot Time Removal Tool. It's a driver that Microsoft Defender uses during the very earliest moments of Windows startup to clean up malware before the operating system fully loads. It's legitimately signed by Microsoft, which means Windows trusts it completely. Researcher Jiří Vinopal discovered that this driver can be manipulated to perform powerful actions — like deleting files or editing the registry — at the kernel level, which is the deepest, most privileged layer of an operating system. Crucially, because the driver is required for Defender to work, Microsoft can't add it to its own blocklist without disabling its flagship security product. The flaw affects every version of Windows from Windows 7 all the way through the latest Windows 11 25H2 release.
For everyday users, the immediate risk is low — Check Point found no evidence this technique is being used in the wild right now. But for security teams and organizations, this is a serious architectural problem. Sophisticated attackers — especially the kind backed by nation-states — look for exactly these kinds of "living off the land" techniques, where they use tools already present on a system rather than importing their own malware. That makes detection extremely difficult, because nothing unusual is being installed.
Microsoft was notified before the public disclosure and is working on a fix, though no patch timeline has been announced. This is one to watch closely — if and when a workaround becomes available, it will be worth applying quickly. In the meantime, keeping your security software updated and running endpoint detection tools that monitor behavior rather than just known malware signatures gives you the best chance of catching any exploitation attempt.