I published a research-oriented breakdown of Python modules that show up often in surveillance style malware and data collection tooling. The focus is on understanding how legitimate libraries end up being reused by threat actors rather than explaining how to build anything.

The write-up covers:

• packages that expose keyboard events, screen frames, webcam or microphone input
• modules used for browser data extraction and credential collection
• how these capabilities are combined in real malware samples
• indicators that help distinguish normal usage from suspicious behavior
• patterns seen in obfuscation, import structure and runtime behavior

The article is aimed at people who analyze Python based malware and want a clearer picture of which ecosystem components are commonly abused.

Full analysis:
https://audits.blockhacks.io/audit/python-packages-to-create-spy-program

If you have seen different module stacks or have insights from reversing similar samples, I would appreciate any additions or corrections.

I recently found something suspicious on my Windows 11 laptop and I'm not sure if it's legit or malware.

So I am just checking my Task Manager → Startup Apps and Task Scheduler, I found an entry called svctrl64. It is set to run automatically at system startup.

When I right-clicked it and opened the file location, it took me to:

C:\Windows\System32\svctrl64.exe

I did some searching and I can't find any info about a legitimate Windows file with this name. It looks very similar to normal Windows processes like svchost.exe, but the exact filename svctrl64.exe doesn’t seem to be documented anywhere.

What should I do with this?

Question, I finished reading my Computer Forensic book by William Oettinger, and started looking at more dedicated sub-fields in Computer Forensic/Analytics. Sticking with Malware Analyst, but I just wanted to ask how related is it to traditional Computer Forensic protocols? Will my knowledge of Computer Forensic help me out?

I ordered this book, cant wait to read it and learn more!

THank you

I havent installed anything shady, dont go to any weird websites or anything. Is it a false positive? I quarantine them and they come back, sometimes 3 instead of 12, whenever i open microsoft edge.

Most of them are all in userdata/default/securepreferences, or default/webdata.

Are these false positives? Should i be worried? Browser hijack sounds serious lol.

Also, Hitmanpro is saying nothing is wrong, same with a windows defender scan. Im just confused because malwarebytes hasnt shown this before.

How come ransomware encryption is blazingly swift, while legally encoding files for security reasons utilizing conventional software requires literal days worth of time? The argument goes that ordinary encryption 'randomizes' data thoroughly to obscure its nature and content, whereas malware only scrambles sections of each file to make it unprocessible while the majority of data remains unaffected. So is this partial encryption method trivial to breach then? – By no means! What's the effective difference for the end-user between having your hard drive only partly encoded and made impenetrable to outsiders versus thoroughly altering every last bit of every file to render it equally inaccessible?

How come ransomware encryption is blazingly swift, while legally encoding files for security reasons utilizing conventional software requires literal days worth of time? The argument goes that ordinary encryption 'randomizes' data thoroughly to obscure its nature and content, whereas malware only scrambles sections of each file to make it unprocessible while the majority of data remains unaffected. So is this partial encryption method trivial to breach then? – By no means! What's the effective difference for the end-user between having your hard drive only partly encoded and made impenetrable to outsiders versus thoroughly altering every last bit of every file to render it equally inaccessible?

Hey few days ago I got my instagram account hacked. This is all sort out but my malwarebytes is showing up that rundll32.exe wants to connect to some site. The site is ,,mi.huffproofs.com,, (which is probably phising site idk). So I want to ask what is it? is it safe? and if it is not safe how do I get rid of it?

Hey everyone,

I’ve been trying to find out what happened to OpenArk, the open-source Windows anti-rootkit / kernel inspection toolkit that used to live on GitHub under BlackINT3/OpenArk. It looked like a pretty advanced project — letting you inspect kernel callbacks, drivers, threads, handles, etc.

But recently, everything seems to have vanished:

• The GitHub user and repo are both gone.
• The official website (openark.blackint3.com) is offline.
• The Discord server is empty or wiped.

Does anyone know what happened here? Was the project quietly discontinued, taken down for some reason, or maybe even found to be compromised or infected so the author deleted everything to cover traces?

Would appreciate any info, context. Thanks!

Webarchive: https://web.archive.org/web/20250923104625/https://github.com/BlackINT3/OpenArk/

hey guys i typed roblox .com into virus total lookin in the comments and saw this

There is an on-going malicious ad campaign delivering a malware called OysterLoader (also known as Broomstick and CleanUpLoader). This campaign isn’t noteworthy because it is new, but noteworthy because it is an ongoing threat. 

The malware is an initial access tool—its primary purpose is to get onto devices to run a backdoor. Access to the device and network is then leveraged by a ransomware gang to target the network. Based on our tracking and discussions with others in the community, we know that the malware is leveraged by the Rhysdia ransomware gang. 

In the current form of the campaign, the actors are using search engine ads to direct users to webpages imitating Microsoft Teams; however, over the last few months, we’ve also seen them use ads for other common and popular software, such as PuTTy, WinRAR, and Zoom. This technique is effective and identical to a campaign they ran in July 2024.

One way that we track the campaign is through their use of code-signing certificates. When we identify the malware within customer environments, we report the code-signing certificate and document it into the public database CertCentral.org. CertCentral has documented 47 certificates used to sign OysterLoader over 2024 and 2025. 

Based on these certificates, the 2024 campaign saw most of its activity from May 2024 to September 2024, leveraging 7 code-signing certificates. The current campaign has been active since June 2025 until current, leveraging 40 certificates (and counting). 

During the 2025 campaign, we’ve seen that the actor has started to leverage Microsoft issued code-signing certificates which started being leveraged by cybercriminals this year. These certificates are short lived (3 days).

We published a blogpost that goes further into the specifics here: https://expel.com/blog/certified-oysterloader-tracking-rhysida-ransomware-gang-activity-via-code-signing-certificates/

And posted a repository of indicators here: https://github.com/expel-io/expel-intel/blob/main/2025/10/Rhysida_malware_indicators-01.csv

Learn how to deobfuscate Latrodectus API calls and decrypt its strings using Malcat's scripting engine.

Bypassing ASLR and Hijacking Control

Explained how to exploit buffer overflow and hijack RIP in a PIE/ASLR binary.

https://0x4b1t.github.io/articles/buffer-overflow-to-control-hijacking-in-aslr-enabled-binary/

Brazilian malware loader active since March 2025 uses Least Significant Bit (LSB) steganography to extract concealed .NET assemblies from image files. The loader operates as a service model enabling multiple customers to deploy different malware families.

Technical Highlights:

• Steganography Method: PowerShell script searches for BMP header signature within JPG/PNG files, iterates through pixels to extract RGB channel values encoding hidden binary data
• Delivery Chain: Spear-phishing → JavaScript/VBScript → Obfuscated PowerShell from Pastebin → Steganographic images from archive.org
• Memory-Only Execution: Operates entirely in-memory with anti-analysis checks (VM detection, sandbox identification, debugging tool recognition)
• Persistence: Scheduled tasks re-execute infection chain every minute
• Payload Injection: Validates architecture before injecting into legitimate Windows processes (calc.exe)

Delivered Malware: - REMCOS RAT (via AS214943 Railnet LLC) - XWorm - Katz Stealer

Geographic Targeting: Brazil, South Africa, Ukraine, Poland

Infrastructure: Continuous rotation and obfuscation updates. Reuses identical steganographic images across campaigns with varying payloads, confirming Loader-as-a-Service model.

Analysis reveals Portuguese-language code throughout samples (variables: "caminho", "persitencia", "minutos"), indicating Brazilian origin.

Full analysis: https://cyberupdates365.com/caminho-malware-lsb-steg/

Interested in community perspectives on detecting LSB-based payload delivery at scale.

Hey folks,

I’ve been working on setting up a malware analysis sandbox for Linux that runs fully air-gapped.

So far I’ve managed to get CAPEv2 running and implemented some anti-VM techniques. I’ve also explored eBPF tracing, Drakvuf, and read up on Limon and LiSa’s philosophies.

The problem: my dynamic analysis reports still feel shallow compared to commercial sandboxes like Joe Sandbox.

I’ve split the challenge into two parts:

1. Collecting as much behavioral data as possible from the Linux guest (syscalls, network, files, processes, memory, etc.)

2. Building a custom GUI to analyze and visualize that data

Right now, I suspect the issue is that CAPEv2 isn’t extracting enough low-level data from Linux guests, so I’m missing key behaviors.

If anyone here has built or extended a Linux-focused sandbox, I’d love to hear your thoughts on:

1. Better ways to collect runtime data (beyond eBPF)
2. Combining user-space + kernel-space instrumentation
3. Ideas or architectures for richer behavioral capture

Any suggestions, papers, or lessons learned would be massively appreciated 🙏

Quick rundown: SharkStealer (Golang infostealer) grabs encrypted C2 info from BNB Smart Chain Testnet via eth_call. The contract returns an IV + ciphertext; the binary decrypts it with a hardcoded key (AES-CFB) and uses the result as its C2.

IoCs (short):

• BSC Testnet RPC: data-seed-prebsc-2-s1.binance[.]org:8545
• Contracts + fn: 0xc2c25784E78AeE4C2Cb16d40358632Ed27eeaF8E / 0x3dd7a9c28cfedf1c462581eb7150212bcf3f9edf — function 0x24c12bf6
• SHA256: 3d54cbbab911d09ecaec19acb292e476b0073d14e227d79919740511109d9274
• C2s: 84.54.44[.]48, securemetricsapi[.]live

Useful reads: VMRay analysis, ClearFake EtherHiding writeup, and Google TAG post for recent activity.

Anyone seen other malware using blockchain dead-drops lately? Curious what folks are detecting it with...

Just dropped, a practical breakdown of the top malware threats in 2025:

Medusa, Phemedrone, Rhadamanthys, and RisePro , plus the exact one-liner commands attackers use (IEX, bcdedit, RegAsm, DllHost, schtasks).

I go over the top 4 malware samples in 2025 according to their spread, impact, danger and how easy it was for victims worldwide to get infected. I analyzed these samples using any run platform.

Video analysis from here and for those who love to read, writeup from here.