News · r/Malware
-
r/Malware
IronChain Ransomware Threatens Businesses with Permanent Data Loss and Costly Downtime
r/Malware · i.redd.it
-
r/Malware
Practicing malware analyze after finish the Practical Malware Analysis book
Im just graduated from college and currently an intern, after finishing the book they ask me to find a malware family on malpedia and start analyze a sample of that family. Im only working with malware within the book labs before. What sample should I start with? Thank you very much Update Im end up choosing the sample: c012d6850b13e52312b40cff42d444126d137a1ac88f5e77158b5089f6ed25ac At first it…
-
r/Malware
Got a scam APK via WhatsApp, student here, want to learn how you'd approach analyzing it
Hi all, first time posting here, so let me know if I'm breaking any rules. I'm a student from India with a hobby in electronics and programming. A few days ago I got an APK over WhatsApp from someone pretending to be xxx They kept pushing me to install it, which made me suspicious, so I didn't. Now I'm curious what it actually does, and I'd like to learn how people here approach analyzing somethi…
-
r/Malware
Paranoid of spyware/malware after phone repair.
So about a year ago I got my Samsung S24 to a phone repair shop in HuaQiangBei in China(because it was relatively cheaper. And now I'm paranoid that there was a spyware that logged my screen and keys, or hardware level chips or rootkits that can potentially achieve that and breach my privacy. I remember having done factory resets but probably restored the device with the backup aswell. (not sure…
-
r/Malware
Recovering a removed npm malware file using Software Heritage and a surviving CDN digest
I wrote up my investigation into @goodjavascript/[email protected], including how to recover its entry-point file after the npm tarball and jsDelivr file URLs returned 404. The useful detail: Software Heritage’s latest snapshot contained only the security placeholder. An older snapshot retained the original release and its 840-byte index.js. Its SHA-256 matched the digest still available in jsDelivr’s…
-
r/Malware
Zoho Zecurit Agent - Link Phone or Force Shutdown
Hi, I just want to share my experience fighting a malware that was inadvertently downloaded onto my computer while I was simply trying to find a job. I applied for a job on Indeed at a company called Velan. Looks legit and everything. The hiring manager, who was a supposed COO, reached out to me via Indeed messages. Wow seems really legit, I thought. It's a US company with a sizeable presence ove…
-
r/Malware
development malware
What is my assessment of my path in malware development? I am reading the book "Windows System Programming" and "Windows Internals" along with it. Are there any additional resources, booklets, groups, websites, or anything else you would recommend to help me progress? I have a basic understanding of networking and the C programming language. ا👏👏🙌
-
r/Malware
850+ malicious Google-ad landings used fake ChatGPT pages to install Windows malware
r/Malware · cybernews.com
-
r/Malware
Pre-installed C2 loader on cheap Android projectors - deploys proxy/ad-fraud botnets, can run arbitrary code
Hi everyone, I recently bought one of those cheap Android projectors (Nonete HY260Pro, Allwinner H713) and noticed some suspicious network activity. Being curious, I decided to set up a lab, intercept the traffic, and dig into the firmware. I ended up uncovering a factory-installed malware ecosystem: a disguised dropper (StoreOS), a hidden second stage (SilentSDK) and a plugin loader that talks t…
-
r/Malware
Attempted Malware infection on a job listing
Hi, not sure if this is the best place to discuss but I recently was applying for software dev jobs and one "company" sent me a repo, with the task being to add a certain feature, however before running the code I scanned it for malware, which came up positive. It seems like running it would send out a request that could return with external code from the attacker that would run and quite likely…
-
r/Malware
Community Threat Notice: Citrix NetScaler ADC and NetScaler Gateway Vulnerabilities
Citrix has disclosed eight vulnerabilities in NetScaler ADC and NetScaler Gateway; including two actively exploited. NetScaler ADC and NetScaler Gateway sit at the network perimeter, handling VPN, remote access, load balancing, and authentication for enterprise environments, making compromise a high-impact event with broad downstream consequences. CVE-2026-88771 | 9.5 Critical | Improper Input Va…
CVE-2026-88771 -
r/Malware
I got tired of users clicking on stupid links so I built this chrome extension
It's called Click Scout - you hover over the link or email sender, and it tells you if it's safe or not. Were gonna push it out to a couple of our repeat offenders at my company. 100% free, just built it to help fewer people get suckered into clicking on stupid stuff. https://chromewebstore.google.com/detail/clickscout/ekmbgkphebegmfflhfceppmpcheldfak?hl=en-US&utm_source=ext_sidebar
-
r/Malware
Cisco just found Windows malware that runs four AI models simultaneously and lets them vote on what to steal from your computer, with no human attacker giving orders
This is the one that changed how security researchers are thinking about AI-driven malware, and it's worth understanding even though the current version isn't fully operational yet. Cisco Talos disclosed CLOSEDQUORUM on September 22. It's a Windows implant written in Go that, once running on a machine, doesn't report back to an attacker's server and wait for commands like normal malware does. Ins…