VMware Exploitation, Unpatched Windows Flaw, MCP Attacks & Browser Hijacking: Weekly Threat Recap and Defensive Playbook

This week's threat landscape is a case study in a lesson I keep repeating to clients: the attacks causing the most damage are rarely the most sophisticated. The recurring themes from the past seven days — exploitation of exposed VMware services, an actively discussed but still-unpatched Windows vulnerability, attacks against Model Context Protocol (MCP) infrastructure, browser session hijacking, and supply-chain compromises propagating well beyond the initial victim — all share one root cause: access that already existed and defenses that assumed nobody would look too closely.

If you run vSphere or ESXi anywhere near a network boundary, deploy AI tooling with MCP servers, or have users with browser sessions holding SSO tokens (which is all of you), this recap has direct operational relevance. This post breaks down each threat class, gives you hunting logic you can deploy today, and closes with concrete hardening steps. Note that this recap does not publish specific CVE identifiers for these items — where the underlying issues are unpatched or identifiers are pending, I've focused on behavior-based detection rather than signature-chasing.

Technical Analysis

1. VMware Security Issue: Exposed Management Surfaces Under Fire

VMware infrastructure remains one of the highest-value targets in enterprise environments, and this week's activity reinforces a pattern we've tracked across multiple IR engagements: attackers are not burning zero-days on ESXi — they're walking in through exposed vCenter Server instances, ESXi management interfaces reachable from user segments, and credential reuse from earlier breaches.

From a defender's perspective, the attack chain typically looks like this:

Discovery — Internet scanning (Shodan/Censys) identifies vCenter Server (TCP/443) or ESXi Host Client (TCP/443, TCP/902) exposed to the internet, or reachable from a compromised user workstation.
Initial access — Exploitation of unpatched management services, or simple authentication with harvested/guessed credentials. Once inside vCenter, the attacker owns every workload the hypervisor hosts.
Execution on hosts — On ESXi, attackers execute commands via the shell (/bin/sh), drop Python-based payloads, or deploy ransomware encryptors that target .vmdk files directly — bypassing every EDR agent installed inside the guest VMs.
Impact — Mass encryption of datastores, snapshot deletion (vim-cmd vmsvc/ or direct datastore manipulation), and theft of virtual disk files for offline credential extraction.

The critical detection gap: most organizations have no telemetry from the hypervisor layer itself. Your EDR sees inside guests, not the host. If ESXi hostd or vpxd logs aren't shipped to your SIEM, you are blind to the most damaging stage of the attack.

2. Unpatched Windows Vulnerability: Operating in the Gap

This week also highlighted a Windows vulnerability that remains unpatched at time of writing. This is the most dangerous window in a vulnerability's lifecycle: technical details are circulating, proof-of-concept interest is high, and defenders have no vendor fix to apply. During these gaps, exploitation typically concentrates on local privilege escalation — an attacker who already has code execution as a standard user elevates to SYSTEM, then deploys ransomware, dumps LSASS, or disables security tooling.

What matters defensively during an unpatched-window event:

Assume pre-auth or low-priv footholds will be converted to SYSTEM. Your detection strategy must shift from "prevent exploitation" to "detect post-exploitation" — token manipulation, suspicious service creation, ntds.dit access, and LSASS memory reads.
Apply vendor workarounds immediately. Microsoft's advisories for unpatched issues frequently include registry key changes, ACL modifications on affected binaries, or protocol-handler disablement. These are stopgaps, not excuses to skip the eventual patch.
Watch for exploit staging. Even without knowing the exact vulnerable component, exploit delivery follows recognizable patterns: Office spawning script interpreters, rundll32.exe/regsvr32.exe loading from user-writable paths, and unexpected child processes of system services.

3. MCP Attacks: The New Supply-Chain Frontier

Model Context Protocol — the standard connecting LLM-based agents to external tools, data sources, and APIs — has moved from research curiosity to production infrastructure faster than security teams have moved to govern it. This week's coverage of MCP attacks focused on a problem set we've started seeing in real assessments:

Tool poisoning and malicious MCP servers: An MCP server can inject instructions into the tool descriptions and schemas it presents to the LLM. A user connecting their AI assistant to a "helpful" third-party MCP server may silently hand the server operator the ability to steer the agent — exfiltrating files the agent can read, or invoking other connected tools (email, shell, cloud APIs) on the attacker's behalf.
Command execution through MCP server processes: MCP servers frequently run locally as child processes of the AI client (Claude Desktop, Cursor, VS Code-based agents, custom orchestrators), commonly spawned via npx, uvx, node, or python with configuration pulled from JSON config files. A tampered config or a malicious package means arbitrary code execution under the user's context, launched by a trusted parent process that most EDR policies ignore.
Credential and data exposure: MCP servers routinely receive broad access — filesystem roots, database connection strings, API tokens — and a compromised or malicious server inherits all of it.

The defensive reality: MCP servers are unsigned, unaudited code execution infrastructure that your developers installed last Tuesday. Treat them like you treated npm/PyPI dependencies five years ago — because they are that, plus a prompt-injection vector.

4. Browser Hijacking and Session Theft

Browser sessions remain the soft underbelly of identity security. This week's incidents follow the mature infostealer playbook — with a twist toward session-token theft rather than password theft, which defeats MFA entirely:

Malicious browser extensions with excessive permissions (cookies, webRequest, tabs, <all_urls>) silently exfiltrating session cookies for SaaS and identity providers.
Infostealers decrypting browser credential stores — Chrome/Edge cookie and login databases protected by DPAPI (and now Chrome's app-bound encryption, which stealers have adapted to) get lifted and replayed from attacker infrastructure.
Session replay into cloud consoles — a stolen session cookie for your IdP or cloud provider is functionally equivalent to a logged-in browser. Conditional Access policies that don't enforce token protection or continuous access evaluation won't stop it.

Detection hinges on spotting the theft mechanism (processes reading browser data stores, unsigned extensions) and the replay anomaly (impossible travel, session use from datacenter ASNs, user-agent mismatches).

5. Supply-Chain Propagation

The recap closes on supply-chain compromise continuing to spread beyond the original victim — the defining characteristic of this attack class. Whether it's a poisoned package, a compromised vendor update channel, or (increasingly) a malicious MCP/AI-tooling component, the blast radius is determined by how much implicit trust downstream consumers place in the upstream artifact. The defense is boring and non-negotiable: dependency pinning, package provenance verification, egress filtering on build systems, and monitoring for first-seen binaries in developer and CI/CD environments.

Detection & Response

The detections below are tuned to the behaviors described above. Every rule targets post-exploitation or staging behavior that survives the absence of a CVE-specific signature — which is exactly what you need when the Windows flaw is unpatched and the VMware intrusion uses valid credentials.

Sigma Rules

YAML

---
title: ESXi or vCenter Process Spawning Shell or Script Interpreter
id: 3f8a1c42-7b2d-4e91-a6c3-9d5f2b8e1a47
status: experimental
description: Detects VMware hostd, vpxd, or vpxa spawning shells or script interpreters, a hallmark of post-exploitation activity on ESXi/vCenter after management-interface compromise.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://thehackernews.com/2026/08/weekly-recap-vmware-exploits-windows-0.html
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.execution
  - attack.t1059
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/hostd'
      - '/vpxd'
      - '/vpxa'
      - '/rhttpproxy'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/python'
      - '/python3'
      - '/busybox'
      - '/openssl'
  condition: selection_parent and selection_child
falsepositives:
  - VMware support bundle collection and vendor-directed troubleshooting
level: high
---
title: AI Client Spawning MCP Server via Package Runner
id: 8c2e5d19-4a6f-4b83-9e27-1c4d7a3f6b58
status: experimental
description: Detects AI assistant clients and code editors spawning npx, uvx, node, or python as MCP server processes. Establish a baseline of approved MCP servers and alert on deviations.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1195/
  - https://thehackernews.com/2026/08/weekly-recap-vmware-exploits-windows-0.html
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.execution
  - attack.t1195.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\Claude.exe'
      - '\Cursor.exe'
      - '\Code.exe'
      - '\Windsurf.exe'
  selection_child:
    Image|endswith:
      - '\npx.cmd'
      - '\npx.exe'
      - '\uvx.exe'
      - '\node.exe'
      - '\python.exe'
  selection_cli:
    CommandLine|contains:
      - 'mcp'
  condition: selection_parent and selection_child and selection_cli
falsepositives:
  - Legitimate approved MCP servers - baseline per-user config and alert on additions
level: medium
---
title: Browser Credential or Cookie Store Access by Non-Browser Process
id: 5d1a9f73-2e8c-4b64-a391-7f2c6e8d4b15
status: experimental
description: Detects non-browser processes reading Chrome or Edge cookie/login databases, consistent with infostealer session-token theft used to bypass MFA.
references:
  - https://attack.mitre.org/techniques/T1555/
  - https://attack.mitre.org/techniques/T1539/
  - https://thehackernews.com/2026/08/weekly-recap-vmware-exploits-windows-0.html
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.credential_access
  - attack.t1555.003
  - attack.t1539
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Google\Chrome\User Data\'
      - '\AppData\Local\Microsoft\Edge\User Data\'
  selection_file:
    TargetFilename|endswith:
      - '\Network\Cookies'
      - '\Login Data'
      - '\Local State'
  filter_browser:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
  condition: selection_path and selection_file and not filter_browser
falsepositives:
  - Enterprise backup agents and DLP tooling - filter by known signer and path
level: high

KQL (Microsoft Sentinel / Defender)

This hunt query chains two high-signal behaviors: process access against browser credential stores and suspicious MCP/AI-client child process execution. It also includes a vCenter/ESXi syslog hunt for environments shipping hypervisor logs via CEF/Syslog — which you should be.

KQL — Microsoft Sentinel / Defender

// Hunt 1: Non-browser processes touching browser credential stores (session theft)
DeviceFileEvents
| where Timestamp > ago(7d)
| where FileName in~ ("Cookies", "Login Data", "Local State", "Web Data")
| where FolderPath has_any ("\\Google\\Chrome\\User Data\\", "\\Microsoft\\Edge\\User Data\\", "\\BraveSoftware\\")
| where not(InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "brave.exe", "msmpeng.exe"))
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          InitiatingProcessSHA256, FolderPath, FileName, ReportId
| order by Timestamp desc;

// Hunt 2: AI clients spawning MCP servers - baseline and review for unapproved tooling
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("Claude.exe", "Cursor.exe", "Code.exe", "Windsurf.exe")
| where FileName in~ ("node.exe", "npx.cmd", "uvx.exe", "python.exe", "cmd.exe", "powershell.exe")
| where ProcessCommandLine has_any ("mcp", "modelcontextprotocol")
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Count=count()
    by DeviceName, FileName, ProcessCommandLine, AccountName
| order by FirstSeen asc;

// Hunt 3: ESXi/vCenter shell execution and datastore operations via syslog ingestion
Syslog
| where TimeGenerated > ago(7d)
| where Computer has_any ("esx", "vcenter", "vcsa") or ProcessName has_any ("hostd", "vpxd", "shell")
| where SyslogMessage has_any ("/bin/sh", "vim-cmd vmsvc", "esxcli vm process",
                               "Get User=", "logged in", "shell --cmd")
| where SyslogMessage !has "health"
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc;

Velociraptor VQL

Use this artifact to sweep endpoints for two artifacts of this week's threats: browser credential-store access staging (copies of Cookies/Login Data outside the browser profile) and MCP server configurations that enumerate what AI tooling is actually deployed in your fleet.

VQL — Velociraptor

-- Hunt for staged browser credential stores and enumerate MCP server configs
SELECT 
    FullPath,
    Size,
    Mtime AS ModifiedTime,
    Ctime AS CreatedTime
FROM glob(globs=[
    'C:/Users/*/AppData/Local/Google/Chrome/User Data/*/Network/Cookies',
    'C:/Users/*/AppData/Local/Microsoft/Edge/User Data/*/Network/Cookies',
    'C:/Users/*/.claude.json',
    'C:/Users/*/AppData/Roaming/Claude/claude_desktop_config.json',
    'C:/Users/*/.cursor/mcp.json',
    'C:/Users/*/AppData/Roaming/Code/User/mcp.json',
    'C:/Users/*/AppData/Local/Temp/**/Cookies',
    'C:/Users/*/AppData/Local/Temp/**/Login Data'
])
ORDER BY ModifiedTime DESC

VQL — Velociraptor

-- Hunt for suspicious child processes of AI clients (live endpoint state)
SELECT 
    Pid,
    Ppid,
    Name,
    CommandLine,
    Exe,
    Username,
    CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)mcp|modelcontextprotocol'
   OR (Name =~ '(?i)node|python|npx|uvx' 
       AND CommandLine =~ '(?i)server|stdio')

Remediation & Verification Script

The script below verifies pending Windows security updates, checks for exposed browser extensions with high-risk permissions (session-theft vector), and inventories MCP configuration files on a Windows endpoint — the three areas you can act on today while the Windows flaw remains unpatched.

PowerShell

# Security Arsenal - Weekly Threat Recap Verification Script
# Run as Administrator. Review output before making changes.

Write-Host "=== [1] Pending Windows Security Updates ===" -ForegroundColor Cyan
$UpdateSession = New-Object -ComObject Microsoft.Update.Session
$UpdateSearcher = $UpdateSession.CreateUpdateSearcher()
try {
    $Pending = $UpdateSearcher.Search("IsInstalled=0 and Type='Software' and IsHidden=0")
    if ($Pending.Updates.Count -eq 0) {
        Write-Host "[OK] No pending updates detected via WUA." -ForegroundColor Green
    } else {
        foreach ($U in $Pending.Updates) {
            $Sev = if ($U.Title -match 'Security|Critical') { 'HIGH' } else { 'normal' }
            Write-Host "[PENDING - $Sev] $($U.Title)" -ForegroundColor Yellow
        }
        Write-Host "ACTION: Approve and deploy pending security updates via your patch management pipeline." -ForegroundColor Red
    }
} catch { Write-Host "WUA query failed: $_" -ForegroundColor Red }

Write-Host "`n=== [2] Recently Installed Security Updates (last 30 days) ===" -ForegroundColor Cyan
Get-HotFix | Where-Object { $_.InstalledOn -gt (Get-Date).AddDays(-30) } |
    Sort-Object InstalledOn -Descending |
    Format-Table HotFixID, Description, InstalledOn -AutoSize

Write-Host "`n=== [3] Chrome Extensions with High-Risk Permissions (per-user) ===" -ForegroundColor Cyan
$ExtPaths = Get-ChildItem "$env:SYSTEMDRIVE\Users\*\AppData\Local\Google\Chrome\User Data\*\Extensions\*\*\manifest.json" -ErrorAction SilentlyContinue
foreach ($M in $ExtPaths) {
    try {
        $Manifest = Get-Content $M.FullName -Raw | ConvertFrom-Json
        $Perms = @($Manifest.permissions) + @($Manifest.host_permissions)
        if ($Perms -match 'cookies|<all_urls>|webRequest|tabs') {
            Write-Host "[REVIEW] $($Manifest.name) | Path: $($M.FullName)" -ForegroundColor Yellow
            Write-Host "         Permissions: $($Perms -join ', ')" -ForegroundColor Yellow
        }
    } catch { }
}
Write-Host "ACTION: Cross-reference reviewed extensions against your approved-extension allowlist. Remove anything unapproved." -ForegroundColor Cyan

Write-Host "`n=== [4] MCP Configuration Inventory (AI tooling attack surface) ===" -ForegroundColor Cyan
$McpConfigs = @(
    "$env:APPDATA\Claude\claude_desktop_config.json",
    "$env:USERPROFILE\.cursor\mcp.json",
    "$env:APPDATA\Code\User\mcp.json",
    "$env:USERPROFILE\.claude.json"
)
foreach ($Cfg in $McpConfigs) {
    if (Test-Path $Cfg) {
        Write-Host "[FOUND] $Cfg" -ForegroundColor Yellow
        try {
            $Json = Get-Content $Cfg -Raw | ConvertFrom-Json
            $Json.mcpServers.PSObject.Properties | ForEach-Object {
                Write-Host "         Server: $($_.Name) | Command: $($_.Value.command) $($_.Value.args -join ' ')" -ForegroundColor Magenta
            }
        } catch { Write-Host "         (unable to parse - review manually)" }
    }
}
Write-Host "ACTION: Every MCP server listed above executes code as the user. Require security review and an approved-server allowlist." -ForegroundColor Cyan

Write-Host "`n=== [5] VMware vCenter/ESXi Reachability Check (from this host) ===" -ForegroundColor Cyan
foreach ($Target in @('vcenter', 'esxi')) {
    Write-Host "Manual step required: enumerate your vCenter/ESXi management addresses and verify they are NOT reachable from user VLANs or the internet." -ForegroundColor Cyan
    break
}
# Example reachability test - replace with your management hosts:
# 'vcsa.corp.local','esx01.corp.local' | ForEach-Object { Test-NetConnection $_ -Port 443 -InformationLevel Quiet }

Remediation

VMware / vSphere:

Pull your vCenter Server and ESXi build numbers (Get-VMHost | Select Name,Version,Build via PowerCLI, or vmware -v on hosts) and compare them against the current VMware by Broadcom security advisories at https://support.broadcom.com/web/ecx/security-advisory. Patch any management-plane component that is behind the current advisory baseline — these are the first systems attackers target and the last most teams patch.
Remove vCenter and ESXi management interfaces from any internet-facing or user-segment reachability. Management traffic should live on a dedicated, ACL'd management VLAN reachable only from a privileged access workstation or jump host. Block TCP/443 and TCP/902 to hypervisors from user networks at the firewall.
Enable and forward ESXi/vCenter logs (hostd, vpxd, shell, auth logs) to your SIEM. Without this, the Sigma and KQL content above has nothing to fire on.
Lock down ESXi: disable shell/SSH when not in active use (lockdown mode), enforce MFA on vCenter SSO via your IdP, and audit local root usage.

Unpatched Windows vulnerability:

Monitor Microsoft Security Response Center (https://msrc.microsoft.com) for the advisory and out-of-band patch. When an advisory drops with a workaround — registry value, ACL change, feature disablement — deploy it via GPO/Intune the same day, and track the exception in your vulnerability management platform so the workaround is retired when the patch lands.
In the gap, lean on the post-exploitation detections above and enforce attack surface reduction rules, application control (WDAC/AppLocker), and Credential Guard to limit what SYSTEM-level compromise yields.
Confirm your patch pipeline can execute an emergency out-of-band deployment within 72 hours; test it now, not when the patch drops.

MCP / AI tooling:

Inventory MCP configurations fleet-wide using the PowerShell script above. You cannot govern what you haven't enumerated.
Establish an approved MCP server allowlist. Everything else gets removed or blocked. Treat MCP servers with the same supply-chain rigor as production dependencies: pinned versions, source verification, hash checking.
Where possible, run MCP servers in sandboxed/least-privilege contexts, scope filesystem and API access to the minimum required, and log every tool invocation from your AI orchestration layer.
Apply egress filtering so that a malicious MCP server cannot exfiltrate to arbitrary internet destinations.

Browser session hijacking:

Deploy a browser extension allowlist via Chrome/Edge enterprise policy (ExtensionInstallAllowlist / ExtensionInstallBlocklist). Block all by default; approve by business need.
Enable token protection / Continuous Access Evaluation in your identity provider (Microsoft Entra ID conditional access token protection, Okta identity threat protection) so stolen session cookies can't be replayed from foreign infrastructure.
Alert on impossible-travel and datacenter-ASN session use in your IdP sign-in logs — this is where stolen sessions surface.
Shorten session lifetimes for high-value applications (cloud consoles, financial systems) and require re-authentication for sensitive operations.

Supply chain:

Pin dependency versions, verify package provenance/signatures where supported, and run software composition analysis in CI.
Monitor for first-seen executables in developer and build environments — poisoned packages detonate there first.
Maintain an asset inventory that maps which vendors and packages feed which systems; when the next upstream compromise is announced, blast-radius assessment should take hours, not weeks.

Conclusion

None of this week's stories required attacker brilliance. Exposed VMware management planes, a patch gap being actively probed, unaudited AI tooling running arbitrary code, and browser sessions treated as bearer tokens — these are architectural debts coming due. The defenders who come out ahead are the ones who close the boring gaps: segment the management plane, ship hypervisor logs, govern the AI tooling your developers are already running, and stop treating session cookies as harmless. Do those four things this week and you'll have materially raised the cost for the next round of "unsophisticated" attacks.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub