News · r/Malware

• r/Malware 13 h ago

  Adding onto the post "Archived malware I found over the years pt1" BY: "u/Fickle_Plan_208" Effort post!!!!! read description.

  LINK TO THEIR POST: link. LINK TO MY OTHER POST ON THIS: Link All malware I found on the GitHub user LEMZzip and links to archived malware they made if found plus info and updated file! This post also includes a screenshot of their GitHub page at the bottom! SCAN LINKS IN ANYRUN: (:SCAN 1: SCAN 2:) VIRUS TOTAL SCAN LINKS I FOUND: (:Love.exe, Browser setup 1.2.exe:) MALWARE NAMES THAT WERE ARCHIVE…
• r/Malware 15 h ago

  Laowa lens firmware updater: 20/57 VirusTotal detections + official website flagged as JS/Redirector.TYD

  r/Malware ·
• r/Malware 15 h ago

  How I Concurrently Bypassed LLM Guardrails to Build Shitblaster via Modular Abstraction

  This post details a live, empirical case study demonstrating how standard Large Language Model (LLM) safety frameworks exhibit a critical architectural flaw: Contextual Blindness. By utilizing a prompt engineering methodology termed Modular Abstraction, I systematically forced an advanced AI assistant to generate a multi-stage, triple-extortion network cryptoworm—codename Blaster 2.0 (ShitBlaster…
• 
  r/Malware 23 h ago

  Unpacking ATT&CK With MalChela v4.4

  r/Malware · bakerstreetforensics.com
• r/Malware Fri 30 Oct

  i js do a malwwarre

  with propaganda and is for android and pc
• 
  r/Malware Fri 30 Oct

  php2shell exploit toolkits and a PAN-OS repackaging recovered from open directorie

  r/Malware · hunt.io
• r/Malware Fri 30 Oct

  Fling trainer fake website.

  I apprently instslled a file from a website titled “fling trainer(.)io…i found the true site of filng. On the fske site it installed a zip ehich i extracted, put the password in, and then when executing, injtslly the file continued bring deleted which has happened with other files that arent makicious, but once it worked, it did nothing which caused me to immediately delete it, delete every file,…
• r/Malware Fri 30 Oct

  Cursor warns malicious Claude Code extension may leave malware after removal, with up to 5,000 users affected

  r/Malware · reddit.com
• 
  r/Malware Fri 30 Oct

  GitHub - HappyHackingSpace/claude-code-backdoor-check: Read-only scanner for the backdoored Claude Code 2.1.313 extension (Cursor marketplace, Oct 2026): SSH key, persistence, reverse tunnel. macOS + Linux.

  r/Malware · github.com
• 
  r/Malware Fri 30 Oct

  Trojanized Claude Code extension on Open VSX planted a persistent SSH backdoor

  r/Malware · runtimewire.com
• 
  r/Malware Thu 29 Oct

  Hidden Browser Extensions Hijack Searches for 13 Million Users

  r/Malware · socket.dev
• r/Malware Wed 28 Oct

  Open-source tool for unpacking stripped Android native (.so) malware: static RegisterNatives recovery, ARM64 OLLVM (BR X8) deobfuscation, and Dobby anti-Frida tracing

  If you analyze Android banking trojans, droppers, or spyware, you've probably run into samples where: classes*.dex declares native methods, but lib/*.so has 0 exported Java_* symbols and wiped ELF section headers. JNI_OnLoad constructs strings on the stack (MOVZ/MOVK), uses an OLLVM CSEL + BR X8 state machine, and registers JNI handlers dynamically. Attaching Frida immediately crashes the app due…
• 
  r/Malware Wed 28 Oct

  SEO Poisoning Campaign Targets DeepSeek Users: Chinese Threat Actor Deploys Kong RAT via Multi-Stage Attacks

  r/Malware · hybrid-analysis.blogspot.com
• 
  r/Malware Wed 28 Oct

  Rebranded GodPotato + PowerShell stager + Impacket env, left open by an operator who stole 68 GB from a Philippine government agency

  r/Malware · hunt.io
• r/Malware Mon 26 Oct

  Indirect Syscall Rust Loader Analysis (Stream)

  r/Malware · youtu.be
• 
  r/Malware 26 Oct

  Malicious AGENTS.md file in Downloads folder hijacks AI coding agents

  r/Malware · vectorwire.ai
• r/Malware 25 Oct

  Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain

  r/Malware · papers.lisdex.sh
• r/Malware 24 Oct

  Reversing a Ren’Py installer: hidden payloads, Amatera Stealer and a changing C2

  r/Malware ·
• r/Malware 23 Oct

  Windows msi Malware file - Downloaded from fake cloudflare Clickfix page

  r/Malware ·
• r/Malware 23 Oct

  Windows msi Malware file - Downloaded from fake cloudflare Clickfix page
• r/Malware 22 Oct

  Nextcloud compromised via the built-in Collabora app (richdocumentscode): how I found out and what I found

  r/Malware ·
• r/Malware 22 Oct

  I found a cool one, its like a temporary lockdown

  I have no images of what this https://pastebin.com/t2BCUMr7 does, but essentially it uses UAC, login notices, switches apps for ones you will have to download and changes the way the device is viewed. Its quite obvious you will need Berdett Browser to make it work and the explorer replacement which is llm (Long-Lined Monitor). Also for context: the llm is a completely new layout of how your scree…
• r/Malware 22 Oct

  Wtf ....PHP High alert

  r/Malware · i.redd.it
• 
  r/Malware 22 Oct

  KeyStealth: A $10,000 PhaaS Kit caught in the wild

  r/Malware · adamnet.works
• r/Malware 21 Oct

  Tanpering with AI models via writing to GPU memory a la poisoned python

  Given the increasing reliance/uptake of AI models and this year's bonanza of PyPI supply chain attacks: thought it would be worthwhile looking at an attack that combines the two: Rank-One Model Editing (ROME) attacks + later some thoughts on detecting this particularly evasive supply chain attacks. ROME attacks: Supply chain attack is likely prerequisite to get malicious python to the model / GPU…
• r/Malware 21 Oct

  A fake HTML file, three AES layers, and three C2 domains: unpacking a malware ZIP

  r/Malware ·
• r/Malware 20 Oct

  LOLCHAIN: Blockchain abuse research and evidence for malware analysts

  LOLCHAIN is a community reference covering blockchain abuse for malware delivery, hosting and C2, including EtherHiding. It connects techniques to original reports, published contracts, transactions and explorer links, with downloadable network endpoints for threat hunting. Evidence labels distinguish observed activity from research demonstrations. Shared infrastructure is clearly marked, since a…
• 
  r/Malware 20 Oct

  The OffiDocs Browser Extension Campaign

  r/Malware · amibeingpwned.com
• 
  r/Malware 20 Oct

  Offensive toolkit (payload builder, serialized gadgets, stager) pulled from an open directory

  r/Malware · hunt.io
• r/Malware 20 Oct

  RenPy based windows infostealer Malware - Flooding almost everywhere and causing financial losses

  r/Malware ·
• r/Malware 19 Oct

  Potential malware alert in plugin

  r/Malware ·
• r/Malware 17 Oct

  Fake AI tool campaigns plant infostealers

  Everyone is hungry for tokens! Claude, ChatGPT are the most abused AI tools (see how Gemini isn't mentioned? :D) Based on telemetry, at least 45% of them attempt to social engineer the user into executing a malicious ClickFix command It's not always suspicious domains / URLs hosting the malicious site; attackers leverage GitHub sites, Cloudflare pages, Google sites and chatgpt.com specific chat s…
• 
  r/Malware 17 Oct

  Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

  r/Malware · unit42.paloaltonetworks.com

  CVE-2024-47575
• r/Malware 17 Oct

  JS formatting / deobfuscation can silently rewrite the script you’re analyzing.

  A formatter, minifier or deobfuscator can be made abused to change the entire logic. You can go try out all 186 techniques with this script: https://divergence.trustsig.eu/ Or try the Tetris-Snake demo here (Tetris runs normally, copy the formatted output from even just DevTools and it becomes Snake): https://divergence-game.trustsig.eu/ Blog/writeup post: trustsig.eu/blog/javascript-divergence/
• r/Malware 17 Oct

  Reversing Windows Infostealer: Warden Stealer’s hidden payload, C2 and ten-network crypto clipper

  r/Malware ·
• r/Malware 16 Oct

  Warning: Axqua VS Code extension is MALWARE

  r/Malware ·
• 
  r/Malware 15 Oct

  Inside a PaperCut attacker’s AI toolkit: custom Rust collectors, chisel persistence, and AI-directed exploitation using 25 concurrent agents

  r/Malware · hunt.io
• 
  r/Malware 15 Oct

  ‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted Ads

  r/Malware · wired.com
• r/Malware 15 Oct

  api.wakhtar.com

  Hi All, This interesting malware came to my attention. I have analysed it and so far discovered the following: You run the masked .exe file; it checks if the machine is not ARM or running in VMware environment, and then it executes itself. It possibly executes directly into RAM. I am still going through ram dump but its interesting as its masking the IP from Cloudfare - 172.67.168.69 Has anyone s…
• r/Malware 14 Oct

  One Android Loader, Four Malicious APKs: Linking Challan and Gas Phishing to BTMOB

  r/Malware ·
• r/Malware 14 Oct

  Code safety

  r/Malware ·
• r/Malware 14 Oct

  ⚠️ URGENT WARNING: Fake "VRChat-DLSS5-Cam" GitHub repository is a dangerous Infostealer Malware (SmartLoader)

  Hi everyone, I want to issue an urgent security warning regarding a trending YouTube campaign promoting a tool called "VRChat-DLSS5-Cam" hosted on GitHub (under the user seefn1000-afk). https://github.com/seefn1000-afk/VRChat-DLSS5-Cam THIS IS A SOPHISTICATED MALWARE TRAP. DO NOT DOWNLOAD OR RUN IT. https://preview.redd.it/7fooqrtg4dvh1.png?width=1419&format=png&auto=webp&s=116efd93c29662dc9cb782…
• r/Malware 14 Oct

  Reverse Engineering an Android Banking Trojan: “Blackhole VPN,” DEX Anti-Analysis & SMS OTP Theft

  r/Malware ·
• r/Malware 13 Oct

  fake homebrew

  r/Malware ·
• r/Malware 13 Oct

  Malicious Infostealer Windows Malware EXE - Reportedly caused financial loss

  r/Malware ·
• r/Malware 12 Oct

  Outlook automatically clicks the “unsubscribe” hyperlink of malicious emails when reporting them as phishing.

  r/Malware ·
• 
  r/Malware 12 Oct

  Yahoo Mail malvertising: two cloaked tech suppor…

  r/Malware · whack.sh
• r/Malware 12 Oct

  Yara Rule Detection Engineering (Stream)

  r/Malware · youtube.com
• r/Malware 12 Oct

  Observed fake Claude Code ad / DLL sideloading chain with blockchain C2 (EtherHiding) - IOCs included

  r/Malware ·
• r/Malware 12 Oct

  Anatomy of an Android malware APK: hidden DEX, remote ad modules and links to Konfety/Kaleidoscope

  r/Malware ·

Older