News · r/Malware

• r/Malware 38 min ago

  Open-source tool for unpacking stripped Android native (.so) malware: static RegisterNatives recovery, ARM64 OLLVM (BR X8) deobfuscation, and Dobby anti-Frida tracing

  If you analyze Android banking trojans, droppers, or spyware, you've probably run into samples where: classes*.dex declares native methods, but lib/*.so has 0 exported Java_* symbols and wiped ELF section headers. JNI_OnLoad constructs strings on the stack (MOVZ/MOVK), uses an OLLVM CSEL + BR X8 state machine, and registers JNI handlers dynamically. Attaching Frida immediately crashes the app due…
• 
  r/Malware 3 h ago

  SEO Poisoning Campaign Targets DeepSeek Users: Chinese Threat Actor Deploys Kong RAT via Multi-Stage Attacks

  r/Malware · hybrid-analysis.blogspot.com
• 
  r/Malware 4 h ago

  Rebranded GodPotato + PowerShell stager + Impacket env, left open by an operator who stole 68 GB from a Philippine government agency

  r/Malware · hunt.io
• r/Malware Mon 26 Oct

  Indirect Syscall Rust Loader Analysis (Stream)

  r/Malware · youtu.be
• 
  r/Malware Mon 26 Oct

  Malicious AGENTS.md file in Downloads folder hijacks AI coding agents

  r/Malware · vectorwire.ai
• r/Malware Sun 25 Oct

  Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain

  r/Malware · papers.lisdex.sh
• r/Malware Sat 24 Oct

  Reversing a Ren’Py installer: hidden payloads, Amatera Stealer and a changing C2

  r/Malware ·
• r/Malware Fri 23 Oct

  Windows msi Malware file - Downloaded from fake cloudflare Clickfix page

  r/Malware ·
• r/Malware Fri 23 Oct

  Windows msi Malware file - Downloaded from fake cloudflare Clickfix page
• r/Malware Thu 22 Oct

  Nextcloud compromised via the built-in Collabora app (richdocumentscode): how I found out and what I found

  r/Malware ·
• r/Malware Thu 22 Oct

  I found a cool one, its like a temporary lockdown

  I have no images of what this https://pastebin.com/t2BCUMr7 does, but essentially it uses UAC, login notices, switches apps for ones you will have to download and changes the way the device is viewed. Its quite obvious you will need Berdett Browser to make it work and the explorer replacement which is llm (Long-Lined Monitor). Also for context: the llm is a completely new layout of how your scree…
• r/Malware Thu 22 Oct

  Wtf ....PHP High alert

  r/Malware · i.redd.it
• 
  r/Malware Thu 22 Oct

  KeyStealth: A $10,000 PhaaS Kit caught in the wild

  r/Malware · adamnet.works
• r/Malware 21 Oct

  Tanpering with AI models via writing to GPU memory a la poisoned python

  Given the increasing reliance/uptake of AI models and this year's bonanza of PyPI supply chain attacks: thought it would be worthwhile looking at an attack that combines the two: Rank-One Model Editing (ROME) attacks + later some thoughts on detecting this particularly evasive supply chain attacks. ROME attacks: Supply chain attack is likely prerequisite to get malicious python to the model / GPU…
• r/Malware 21 Oct

  A fake HTML file, three AES layers, and three C2 domains: unpacking a malware ZIP

  r/Malware ·
• r/Malware 20 Oct

  LOLCHAIN: Blockchain abuse research and evidence for malware analysts

  LOLCHAIN is a community reference covering blockchain abuse for malware delivery, hosting and C2, including EtherHiding. It connects techniques to original reports, published contracts, transactions and explorer links, with downloadable network endpoints for threat hunting. Evidence labels distinguish observed activity from research demonstrations. Shared infrastructure is clearly marked, since a…
• 
  r/Malware 20 Oct

  The OffiDocs Browser Extension Campaign

  r/Malware · amibeingpwned.com
• 
  r/Malware 20 Oct

  Offensive toolkit (payload builder, serialized gadgets, stager) pulled from an open directory

  r/Malware · hunt.io
• r/Malware 20 Oct

  RenPy based windows infostealer Malware - Flooding almost everywhere and causing financial losses

  r/Malware ·
• r/Malware 19 Oct

  Potential malware alert in plugin

  r/Malware ·
• r/Malware 17 Oct

  Fake AI tool campaigns plant infostealers

  Everyone is hungry for tokens! Claude, ChatGPT are the most abused AI tools (see how Gemini isn't mentioned? :D) Based on telemetry, at least 45% of them attempt to social engineer the user into executing a malicious ClickFix command It's not always suspicious domains / URLs hosting the malicious site; attackers leverage GitHub sites, Cloudflare pages, Google sites and chatgpt.com specific chat s…
• 
  r/Malware 17 Oct

  Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

  r/Malware · unit42.paloaltonetworks.com

  CVE-2024-47575
• r/Malware 17 Oct

  JS formatting / deobfuscation can silently rewrite the script you’re analyzing.

  A formatter, minifier or deobfuscator can be made abused to change the entire logic. You can go try out all 186 techniques with this script: https://divergence.trustsig.eu/ Or try the Tetris-Snake demo here (Tetris runs normally, copy the formatted output from even just DevTools and it becomes Snake): https://divergence-game.trustsig.eu/ Blog/writeup post: trustsig.eu/blog/javascript-divergence/
• r/Malware 17 Oct

  Reversing Windows Infostealer: Warden Stealer’s hidden payload, C2 and ten-network crypto clipper

  r/Malware ·
• r/Malware 16 Oct

  Warning: Axqua VS Code extension is MALWARE

  r/Malware ·
• 
  r/Malware 15 Oct

  Inside a PaperCut attacker’s AI toolkit: custom Rust collectors, chisel persistence, and AI-directed exploitation using 25 concurrent agents

  r/Malware · hunt.io
• 
  r/Malware 15 Oct

  ‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted Ads

  r/Malware · wired.com
• r/Malware 15 Oct

  api.wakhtar.com

  Hi All, This interesting malware came to my attention. I have analysed it and so far discovered the following: You run the masked .exe file; it checks if the machine is not ARM or running in VMware environment, and then it executes itself. It possibly executes directly into RAM. I am still going through ram dump but its interesting as its masking the IP from Cloudfare - 172.67.168.69 Has anyone s…
• r/Malware 14 Oct

  One Android Loader, Four Malicious APKs: Linking Challan and Gas Phishing to BTMOB

  r/Malware ·
• r/Malware 14 Oct

  Code safety

  r/Malware ·
• r/Malware 14 Oct

  ⚠️ URGENT WARNING: Fake "VRChat-DLSS5-Cam" GitHub repository is a dangerous Infostealer Malware (SmartLoader)

  Hi everyone, I want to issue an urgent security warning regarding a trending YouTube campaign promoting a tool called "VRChat-DLSS5-Cam" hosted on GitHub (under the user seefn1000-afk). https://github.com/seefn1000-afk/VRChat-DLSS5-Cam THIS IS A SOPHISTICATED MALWARE TRAP. DO NOT DOWNLOAD OR RUN IT. https://preview.redd.it/7fooqrtg4dvh1.png?width=1419&format=png&auto=webp&s=116efd93c29662dc9cb782…
• r/Malware 14 Oct

  Reverse Engineering an Android Banking Trojan: “Blackhole VPN,” DEX Anti-Analysis & SMS OTP Theft

  r/Malware ·
• r/Malware 13 Oct

  fake homebrew

  r/Malware ·
• r/Malware 13 Oct

  Malicious Infostealer Windows Malware EXE - Reportedly caused financial loss

  r/Malware ·
• r/Malware 12 Oct

  Outlook automatically clicks the “unsubscribe” hyperlink of malicious emails when reporting them as phishing.

  r/Malware ·
• 
  r/Malware 12 Oct

  Yahoo Mail malvertising: two cloaked tech suppor…

  r/Malware · whack.sh
• r/Malware 12 Oct

  Yara Rule Detection Engineering (Stream)

  r/Malware · youtube.com
• r/Malware 12 Oct

  Observed fake Claude Code ad / DLL sideloading chain with blockchain C2 (EtherHiding) - IOCs included

  r/Malware ·
• r/Malware 12 Oct

  Anatomy of an Android malware APK: hidden DEX, remote ad modules and links to Konfety/Kaleidoscope

  r/Malware ·
• r/Malware 11 Oct

  Visual Creepypasta malware scavenger hunt

  r/Malware ·
• r/Malware 11 Oct

  Researchers at Apiiro identified 17,610 malicious GitHub repositories associated with a campaign called FakeGit.

  r/Malware · apiiro.com
• r/Malware 11 Oct

  EntropyStrip: finding hidden payloads when naive Shannon entropy misses them

  r/Malware · github.com
• r/Malware 11 Oct

  I unpacked a fake mParivahan APK: fake Google Play update, UPI phishing, SMS control and a hidden C2 and firebase backend

  r/Malware ·
• r/Malware 11 Oct

  Phone Guardian

  Is Phone Guardian a good antivirus app?
• r/Malware 10 Oct

  How do you vet browser-based WASM game ports (GTA V, BO1 Zombies) for malicious code? Looking for a practical workflow

  Over the last few days I’ve seen several WebAssembly game ports go viral: the unofficial GTA V one (playgta5.com, which reportedly went down within hours) and a fan-made BO1 Zombies port. Reports suggest the GTA V one runs locally using WASM + WebGPU and may be built from leaked source code, but nobody has confirmed that. I know WASM runs in the same browser sandbox as JS, so I’m not assuming “WA…
• r/Malware 10 Oct

  Malicious APK - Fake Gas payment APK Stealing UPI, card, Banking credentials

  r/Malware ·
• r/Malware 10 Oct

  Malwarebytes Antivirus App

  Is malwarebytes actually a good antivirus/security app?
• r/Malware 9 Oct

  Malicious APK - Possible Android ad-fraud malware/loader

  r/Malware ·
• r/Malware 9 Oct

  Fraudulent use of credit card on PayPal after .exe execution

  Hello, I was trying to download a game from www.ziperto.com and after downloading a file I accidentally run a ~600 Kb .exe (I know, I wanted to hit backspace to delete the folder, instead I hastily pressed enter). I then got a message that the executable was not compatible with Windows. The morning after I've got a notification from my bank about a purchase I didn't make on PayPal, and hundreds o…
• r/Malware 7 Oct

  Malware analysis update: Suspicious ZIP Hid a Windows Malware Loader and an Antivirus-Killing Driver

  r/Malware ·

Older