Persistence - 1

2026 (4)

April (1)

security: Cookie-controlled PHP webshells: A stealthy tradecraft in Linux hosting environments

Microsoft Security Blog

2026-04-02

Microsoft describes a Linux-hosting intrusion technique where PHP webshells are triggered by specially crafted HTTP cookies. The post covers obfuscation, php-fpm execution, and cron-based persistence used to hide activity and maintain access.

March (3)

security: WhatsApp malware campaign delivers VBScript and MSI backdoors

Microsoft Security Blog

2026-03-31

Microsoft describes a malware campaign delivered through WhatsApp messages that uses VBS scripts to start a multi-stage infection chain. The attackers rely on renamed Windows utilities and cloud-hosted payloads to install MSI backdoors and keep persistent access on compromised systems.

security: WhatsApp malware campaign delivers VBS payloads and MSI backdoors

Microsoft Security Blog

2026-03-31

Microsoft describes a malware campaign distributed through WhatsApp messages that uses VBS scripts to start a multi-stage infection chain. The attackers use renamed Windows tools and cloud-hosted payloads to deploy MSI backdoors and keep persistent access on infected systems.

security: Signed malware impersonating workplace apps deploys RMM backdoors

Microsoft Security Blog

2026-03-03

Signed malware using a stolen EV code-signing certificate impersonated workplace apps to install legitimate remote monitoring and management (RMM) tools for persistent enterprise access. The post advises tightening certificate controls and monitoring RMM tool usage to reduce risk.