The controls you already paid for have named bypasses. Change speed is the constraint.

Google's Threat Analysis Group found financially motivated actors delivering Magniber ransomware through an unpatched bypass in Microsoft's SmartScreen, with no security warning shown to the user at all ^[1]. It is the third case in three years of a widely deployed control being defeated in the wild while operating largely as built: Check Point documented Zloader executing inside a DLL that carried a valid Microsoft signature ^[18], and Microsoft documented phishing that skipped the authentication step entirely for users who had multifactor authentication enabled ^[21].

Read together, the four sets of source material point at something more uncomfortable than a list of vulnerabilities. In each case the buying decision had already been made and the control was present. What failed was the speed at which the defending organisation could change its configuration relative to the speed at which an offensive technique was published, copied, productised and re-tooled around a patch.

The reputation check that fails open

The SmartScreen mechanism is worth reading closely, because it explains why the outcome was silence rather than a warning. When explorer.exe runs a file, shdocvw.dll asks the AppReputationService interface inside smartscreen.exe for a verdict ^[10]. By default, shdocvw.dll's DoSafeOpenPromptForShellExec does not display a security warning, and if the smartscreen.exe request returns an error for any reason, it proceeds with the default and runs the file with no warning shown ^[11]. The error itself came from signature parsing: in smartscreen.exe's windows::security::signature_info::retrieve, if crypt_provider_data and its hMsg member are non-NULL while cert_context is NULL, an E_INVALIDARG error is raised ^[12]. Attackers reached that state by supplying a crafted Authenticode signature ^[13]. In the 2023 campaign they shipped MSI files carrying an invalid but specially crafted signature, and the malformed signature caused SmartScreen to error out and skip the dialog that would otherwise appear for an untrusted file bearing a Mark-of-the-Web ^[2].

That is a fail-open design in the most consequential position in the chain. The control did not produce a false negative; it produced an exception, and the exception path was "run it."

The scale numbers are the part an operator should hold on to. TAG observed over 100,000 downloads of the malicious MSI files since January 2023, with more than 80 percent going to users in Europe, a divergence from Magniber's usual focus on South Korea and Taiwan ^[4]. Google Safe Browsing displayed warnings for over 90 percent of those downloads ^[5]. On that baseline, close to 10,000 downloads reached users with neither the SmartScreen dialog nor a browser warning ^[3]. The useful reading is not that a second layer existed, but that the second layer was independent: a different vendor's telemetry, evaluating a different signal, caught most of what the first control silently waved through.

The reuse cycle is shorter than the change cycle

The timeline is the strongest evidence in the whole set. In September 2022, Magniber was delivered using JScript files; in October, HP Threat Research blogged about the campaigns, after which a researcher noticed the SmartScreen bug that let a malformed Authenticode signature bypass the warning, and on October 28 0patch published further research and patch recommendations ^[6]. By mid-November, other actors were using the same bypass to spread Qakbot, with signatures strikingly similar to Magniber's, which suggests to Google that the two operators either bought the bypass from the same provider or copied each other ^[7]. That is roughly three weeks from public write-up to adoption by a second crew ^[2]. Microsoft patched it in December 2022 as CVE-2022-44698 ^[8].

Then the cycle restarted. TAG reported the successor to Microsoft on February 15, 2023, and it was patched as CVE-2023-24880 ^[3] - about two months after the previous fix shipped ^[1]. Magniber used the earlier bypass before a patch existed, and the new campaign switched from JScript files to MSI files with a different type of malformed signature ^[9].

So the defect being patched was an instance, and what the attackers held was a class. Two months of vendor engineering bought a patch; the same actors returned against the same fail-open behaviour with a different file type. Any programme whose response to this is "we patch on the vendor's cadence" is describing a control loop that has already been outrun twice on the record here.

A valid signature is a statement about a file, not about behaviour

Check Point's Zloader case attacks the other assumption in the stack. Zloader is banking malware built to steal credentials and private information; it was last seen in August 2021, and evidence of the new campaign appeared around early November 2021 ^[14]. Initial access came through Atera, legitimate enterprise remote monitoring and management software, installed via a custom .msi built with a throwaway email address and dressed up as a Java installation ^[15]. Atera's free 30-day trial, Check Point notes, is enough time for an attacker to gain access quietly, and the same tool had previously been used by the Conti ransomware group for persistence and remote access ^[16].

From there the campaign exploited Microsoft's digital signature verification method to inject its payload into a signed system DLL in order to evade defences, with the authors updating their methods weekly, according to Check Point ^[17]. The specific file, appContast.dll, is signed by Microsoft with a valid signature and has the original filename AppResolver.dll; the difference between the two is a script appended by the author ^[18]. Around it, batch scripts modified Windows Defender preferences, added folder exclusions, disabled tools including cmd.exe and the task manager, and turned off Admin Approval Mode ^[19].

Three purchased controls appear in that paragraph, and all three are inverted. Signature trust becomes an execution permit. Endpoint anti-malware becomes a configuration surface the attacker edits. Remote management tooling becomes the delivery channel. None of it requires a novel exploit; it requires that the organisation's allowlisting logic be keyed to a signer rather than to behaviour, and that a trial-tier RMM agent be able to appear on a machine without anyone noticing for 30 days ^[16].

The session, not the login

Microsoft's adversary-in-the-middle research closes the loop on identity. The attacker runs a proxy that passes HTTP traffic between the victim and the impersonated site, so the phishing page is visually identical to the real one, the URL is the only visible difference, and the page holds two separate TLS sessions ^[25]. The campaign stole passwords, hijacked the sign-in session and skipped authentication even where MFA was enabled ^[21], then used the stolen credentials and cookies to reach mailboxes and run follow-on business email compromise against other targets ^[22]. On Microsoft's threat data, that single campaign attempted to target more than 10,000 organisations from September 2021 onward ^[23].

Microsoft is explicit that this is not a vulnerability in MFA: because the session cookie is stolen, the attacker is authenticated on the user's behalf regardless of the sign-in method ^[24]. That framing matters more than it looks. It means the control performed to specification and the organisation was still compromised, which is precisely the case where buying a better version of the same control changes nothing. The remedy Microsoft names is a configuration change, not a purchase: complement MFA with conditional access policies that evaluate sign-in requests against additional identity-driven signals such as user or group membership, IP location and device status ^[26].

Priced, supported, and cheaper than your change window

The economics are the reason none of this stays niche. Microsoft describes AiTM kits as an increasing trend that is supplanting less advanced phishing, and as capable of circumventing MFA through reverse-proxy functionality ^[27]. The actor Microsoft tracked as DEV-1101 developed, supported and advertised several such kits for other criminals to buy or rent, which Microsoft characterises as industrialisation that lowers the barrier to entry ^[28]. The kit was advertised from around May 2022 on a Telegram channel and the exploit[.]in forum as a NodeJS application with PHP reverse-proxy capability, automated setup, antibot evasion, Telegram-based campaign management and ready-made pages imitating services such as Microsoft Office and Outlook ^[29]. On June 12, 2022 it went open source with a $100 monthly licence ^[30]. In September 2022 the actor added Telegram-bot server management so customers could run campaigns from a phone ^[31]. Prices then rose repeatedly through a growing user base from July to December 2022, reaching $300 with a $1,000 VIP tier, with legacy users allowed $200 until January 1, 2023 ^[32]. That is a threefold increase on the launch price, with the VIP tier at ten times launch ^[4].

Microsoft observed campaigns using the tool comprising millions of phishing emails a day, including one run by DEV-0928, tracked since September 2022, that involved over a million emails ^[33]. At the $300 list price, a million-email campaign costs well under a hundredth of a cent per message ^[5]. Compare the two clocks: an attacker upgrades capability for a few hundred dollars and a Telegram message, while the defender's equivalent change is a conditional access policy rollout across a user population.

The same constraint, pointed inward

The last source is vendor material and should be read as such, but it describes the internal version of the same problem. ActiveState surveyed 300 security and engineering leaders across technology, financial services, healthcare, manufacturing and government to test how governance models are holding up ^[35]. Its framing is that AI coding tools have become a rapidly growing source of unvetted open source in production, leaving teams with packages they did not approve, vulnerabilities they cannot prioritise and exposure they cannot control ^[36]. ActiveState says the research quantifies the acceleration of remediation backlogs and maps it to liability and business outcomes, and that its own speakers, Rebecca Banks and Moris Chen, distinguish approaches that mitigate remediation burden from those that merely redistribute it ^[37]. The supplied material contains the claim, not the underlying numbers, so treat the size of the effect as unestablished.

The distinction ActiveState draws is nonetheless the right test for everything above. Mitigation reduces the volume of change a team must absorb. Redistribution moves the queue. Every one of the three bypasses here was survivable by an organisation that could change a default, a trust rule or an access policy quickly, and not survivable by one whose only lever was waiting for a supplier.

What to watch

Four things are checkable this quarter. First, which controls in your own stack fail open: the SmartScreen path ran the file whenever the verdict service errored ^[11], and that pattern is a design choice other vendors also make. Second, whether your layers are independent enough to cover each other, on the evidence that Safe Browsing warned on over 90 percent of downloads SmartScreen passed ^[5] and roughly 10,000 still got through both ^[3]. Third, whether execution decisions rest on signer identity alone, given a Microsoft-signed DLL with an appended script ^[18] and a trial-tier RMM agent as the entry point ^[16]. Fourth, whether conditional access is actually evaluating device and location signals rather than sitting in a design document ^[26]. Kit pricing is the crude demand indicator: it went from $100 to $300 in roughly six months because buyers kept arriving ^[30][32].