Attackers have let loose a new ransomware strain that deliberately disarms Windows’ own recovery mechanisms before locking up files, while a separate stealthy credential stealer quietly siphons browser passwords, cookies, and session tokens from the same operating system. The warning comes from a weekly threat intelligence report published July 24, 2026 by CYFIRMA, which profiles both the Orexin ransomware and the VeilStealer information stealer — two threats that, taken together, show how a single compromised Windows endpoint can lead to both immediate data loss and long-term identity theft.

What’s New in This Week’s Threat Landscape

Orexin Ransomware: Recovery Sabotage First, Encryption Second

Orexin is a ransomware family that encrypts files and appends a victim-specific ID, an attacker email address, and the .orexin extension. A ransom note named HOW_TO_RECOVER.txt is dropped, and the desktop wallpaper is changed to display recovery instructions. But the real damage happens before any file is locked.

The malware first attempts to gut Windows’ ability to restore data. It runs bcdedit to disable recovery boot options and then deletes Volume Shadow Copies using wmic shadowcopy delete and purges system state backups with wbadmin. This means even if an organization has recent backups, they may be useless if those backups were reachable from the compromised machine.

It also stops critical services. The ransomware targets Microsoft SQL Server components — MSSQLSERVER, SQLSERVERAGENT, SQLWriter, and the Distributed Transaction Coordinator MSDTC — to ensure database files are unlocked and can be encrypted. Any environment running these services on Windows should treat a sudden, unplanned stoppage as a high‑severity incident.

To survive reboots, Orexin writes entries into Registry Run and RunOnce keys, often using a benign‑sounding value name like CortizolRecovery and pointing to an executable in a user‑writable directory. It also modifies legal notice captions, alters the transcoded wallpaper cache, and attempts to spread via removable drives and accessible network shares.

The malware uses the Themida packer to hide from static analysis and includes anti‑debugging and anti‑sandbox checks, making automated analysis more difficult.

VeilStealer: Quietly Hoovering Up Browser Secrets

VeilStealer is an information stealer designed to operate under the radar. The infection chain starts with PowerShell commands using -ExecutionPolicy Bypass and -WindowStyle Hidden — a classic sign of malicious script execution. The stealer copies itself into a hidden location within the user profile, sets up a Registry Run key for persistence, and then begins extensive reconnaissance.

It collects operating system details, user accounts, running processes, network configuration, and browser data from Chromium‑based browsers, Microsoft Edge, and Mozilla Firefox. That includes saved passwords, cookies, browsing history, autofill records, and encryption key material. The malware also grabs desktop screenshots, searches for documents with financial or cryptocurrency keywords, and stages everything in temporary directories before encrypting the loot and sending it to attacker‑controlled servers.

Because session cookies can allow an attacker to hijack authenticated web sessions even without a password, a VeilStealer infection should trigger an identity‑level response — not just a malware cleanup. Stolen credentials don’t expire when the stealer is removed.

Sandworm Returns with ClickFix Social Engineering

The same report highlights renewed activity from Sandworm, the Russia‑linked threat actor behind NotPetya and other disruptive attacks. The latest campaign uses a technique called ClickFix: victims land on a compromised or convincing website and are told to fix a CAPTCHA, update a browser, or resolve a security warning by opening the Windows Run dialog, pasting a pre‑copied command, and pressing Enter. The command actually invokes PowerShell and fetches a next‑stage payload.

Because the user executes the command themselves, traditional advice about not clicking links or attachments is insufficient. The tactic bypasses a mental model trained to distrust downloads and URLs.

High‑Severity SAP Commerce Cloud Flaw

CVE‑2026‑44761, scored 9.1, affects SAP Commerce Cloud deployments that still carry a sample OAuth2 client with publicly documented credentials. An unauthenticated attacker can obtain a valid access token and read or modify data. The fix is to apply SAP’s update and, more critically, to remove or rotate any sample credentials anywhere in production.

What It Means for You

For Home Users

If Orexin lands on a personal Windows PC, it will encrypt documents, photos, and other files after deleting local shadow copies. Recovery without a clean backup is nearly impossible. VeilStealer can silently steal online account credentials — email, social media, banking — and session tokens that let attackers log in as you without a password. The combination can turn a single malware infection into a full identity crisis.

For IT Administrators and Security Teams

Orexin changes the calculus: if your backups are visible to the endpoint — whether on a mapped drive, a network share, or a connected USB disk — they can be encrypted or deleted along with the production data. The ransomware’s service‑stopping behavior is a critical signal. Unexpected termination of MSSQLSERVER, SQLSERVERAGENT, SQLWriter, or MSDTC should be treated as a potential precursor to encryption.

VeilStealer means that a compromised endpoint has likely already leaked browser‑based credentials. Incident response must go beyond wiping the machine: reset passwords, revoke active sessions, rotate API keys, and investigate whether synchronized browser profiles have spread the damage to other devices.

Sandworm’s ClickFix social engineering will sail past anyone who hasn’t been explicitly trained that no legitimate website will ever ask you to paste a command into Run, Command Prompt, PowerShell, or a developer console to complete a CAPTCHA or fix a browser issue. Technical controls — browser isolation, constrained scripting policies, and endpoint detection — must complement awareness training.

How We Got Here

Ransomware has evolved from simple file‑lockers into multi‑stage extortion platforms. The 2017 NotPetya attack by Sandworm showed how recovery sabotage could amplify damage. Since then, attackers have increasingly used living‑off‑the‑land techniques — legitimate Windows tools like bcdedit, wmic, vssadmin, and wbadmin — to disable backups without dropping suspicious binaries.

Information stealers have matured in parallel. The shift to cloud‑based services and browser‑stored credentials transformed the browser into a high‑value target. Stealers like VeilStealer don’t just grab passwords; they capture session tokens that can bypass multi‑factor authentication under certain conditions. Stolen credentials are often sold in underground markets, then used to deploy ransomware months later.

The ClickFix technique represents a newer social engineering evolution: instead of tricking a user into running a malicious file, the attacker persuades the victim to execute a script themselves, often with administrative‑looking PowerShell commands.

The SAP vulnerability is a reminder that default and sample credentials remain a persistent weakness across enterprise software — not because patching is too hard, but because configuration hygiene lags behind patch management.

What to Do Now

Protect Your Backups

  • Keep at least one backup copy offline, immutable, or on a separate credential‑domain so that a compromised endpoint cannot alter it.
  • Test restores regularly. A backup that has been silently corrupted by a time‑delayed attack may look complete until you try to recover.
  • For Windows environments, monitor for sudden deletion of Volume Shadow Copies or backup catalogs. Command‑line auditing for vssadmin, wmic shadowcopy, wbadmin, bcdedit, and diskshadow is essential.

Harden Windows Services

  • Review which accounts can stop critical services like SQL Server and MSDTC. Least‑privilege policies limit the blast radius.
  • Set up monitoring to alert on unexpected service stoppage — especially if combined with shadow copy deletion or registry changes within a short window.

Lock Down Credentials and Sessions

  • Enforce phishing‑resistant multi‑factor authentication (hardware tokens, platform‑based biometrics) for all privileged accounts and remote access.
  • Conditionally block legacy authentication protocols and require re‑authentication for high‑risk session activity.
  • If a machine is hit by an information stealer, immediately reset passwords for all affected users, revoke web sessions, and rotate any stored API keys or SSH keys.

Defend Against ClickFix Attacks

  • Explicitly train users: no legitimate site will ever instruct you to paste a command into the Windows Run dialog, Command Prompt, or PowerShell.
  • Enable Attack Surface Reduction rules that block script‑based payloads from browsers and Office applications.
  • Use endpoint detection that flags browser processes spawning PowerShell, cmd.exe, or wscript.exe.

Handle the SAP Vulnerability

  • If you run SAP Commerce Cloud, check whether sample OAuth2 clients or publicly known credentials exist in production. Apply SAP’s security note.
  • Audit token issuance logs for unfamiliar client IDs or IP ranges.

Use Available Detection Logic

  • CYFIRMA’s report includes Sigma rules for detecting suspicious Run key modifications. While these should be tested against your own telemetry, they provide a good starting point. Pay special attention to autorun entries that point to %AppData%, %LocalAppData%\\Temp, C:\\Windows\\Temp, C:\\ProgramData, C:\\Users\\Public, or Recycle Bin paths.

Outlook

Orexin’s recovery‑sabotage techniques will likely be copied by other ransomware groups. As immutable backups become standard, attackers may invest in time‑delayed payloads that corrupt backups weeks before triggering encryption. VeilStealer’s quiet, multi‑browser credential theft points toward a future where the initial infection rarely makes noise — and the real damage happens later when your identity is used to breach your employer’s network. Sandworm’s pivot to ClickFix shows that social engineering will continue to shift from “open this attachment” to “run this command,” making it harder for users to recognize the threat. And the SAP flaw is a reminder that production systems still ship with dangerous defaults. The common thread: Windows security can’t start at the moment of encryption. It must begin with identity hygiene, resilient backups, and the ability to spot the quiet, early signals of a looming attack.