… Microsoft's recommendation is to update Defender to the latest available Security Intelligence version via Settings, then Windows Security, then Virus and Threat Protection, then Protection Updates. …
… According to Mandiant, an AutoHotKey script also downloads silently in the background and begins installing the group's malware toolkit. …
… Endpoint security firm Huntress confirmed active exploitation before the patches existed. What the two zero-days do The more severe of the two, CVE-2026-41091 , carries a CVSS score of 7.8 and targets the Microsoft Malware Protection Engine. …