We are pleased to announce that our latest Trellix Endpoint Detection and Response with Forensics (EDRF) Cloud threat detection update for August 2026 is now available.
This cumulative report summarizes the detection content released throughout July 2026, adding 69 new detections to your defense stack.
Key threat coverage
-
State-sponsored APTs and Espionage: Expanded detection for North Korean Sapphire Sleet targeting macOS via fake software update lures, Russian Turla's STOCKSTAY malware, APT44's telecommunications-themed MSXMLPL1.exe backdoor, and UNC1040 VERMONSTER CHM archives.
-
Supply chain and evasion techniques: Added behavioral coverage for ChromElevator syscall process hollowing, ROT-cipher PowerShell infostealers (ClickFix), MacSync stealer, and expanded macOS MITRE coverage for T1570, T1080, and T1534.
- Zero-day and vulnerability defenses: Deployed proactive detections for the RedSun MS Defender LPE zero-day, ADFS SAML token forgery via exposed DPAPI signing keys, and gap remediations for Zero-Modification and Ghostly Hollowing.
These updates are fully compatible with all EDR and EDRF client versions. There is no action required.
For more details and a complete list of the changes, see the release details in the Knowledge article Trellix EDRF Cloud Threat Detection Updates – July 2026.