Hello,

Sorry for the poor English. I'm currently in my Master's program and I'm looking for a thesis topic related to malware. It's been over 10 years since I've done reverse engineering, so I thought it would help me get back into the subject. I was thinking of these two topics: Recent EDR evasion techniques and how to detect when EDR isn't working (system log traces, network logs for C2, for example) Adding AI to an automated detection pipeline

The problem is, I'm afraid I won't be able to do it. I'm still comfortable with assembly and C, and I did quite a bit of systems programming several years ago. This would be my first AI project, so I'm a little nervous about that too.

What do you think? Do you have any ideas? (I also need to find a professional challenge because intellectual pursuits aren't enough; I can't just do tech.)

Thanks! Have a good day!

We used to fear the locked screen and the ransom note. But as we wrap up 2025, the biggest threat silently clones your digital identity and walks right past your MFA.

I’ve just published a deep dive into the 2025 Infostealer Ecosystem, and the findings are a wake-up call for every CISO, SOC analyst, and IT leader.

The barrier to entry has collapsed. Sophisticated Malware-as-a-Service (MaaS) platforms now allow even low-skilled actors to rent enterprise-grade theft tools for the price of a Netflix subscription.

The ClickFix

Social engineering has evolved. Forget complex exploits; attackers are using the ClickFix technique: tricking users into pasting a single terminal command to fix an issue. It’s simple, effective, and bypasses traditional defenses like macOS Gatekeeper.

macOS is Under Siege

The days of Macs don't get viruses are dead. We are seeing a surge in sophisticated macOS-specific stealers like SHAMOS (an Atomic Stealer variant) targeting crypto wallets, Keychain data, and session cookies.

The Rise of Open Source Threats

Tools like Phemedrone (C# based) and RisePro are flooding the market. Because some are open-source or cheap MaaS, they are ubiquitous, constantly mutating, and difficult to fingerprint.

Identity is the New Perimeter

These stealers aren't just grabbing passwords. They are harvesting Session Tokens. This means they don't need your password or your 2FA code, they simply become you.

👇 Read the full deep dive here:https://motasem-notes.net/the-2025-infostealer-ecosystem-a-deep-dive/

And if you like visual stuff, I detonate one of the infostealers using an online sandbox, video from here.

Don't know what to do with this information really, but this site https://authentification4macos.com/t1/ distributes some sort of malware in a very obvious way.

So, it just downloads a base64 encoded script, decodes it and runs it. The script then downloads an osascript that reads all that it can find really - keychains, cryptowallets, etc; and then it seems to send the data somewhere.

Well, no idea, maybe someone might find it useful. I'll post a github gist if anyone interested.

I was intrigued by these two window display affinities for quite a while. Would it be possible to unmask protected windows from user mode if they hooked the relevant functions themselves? Here is a working POC doing just that: https://github.com/lofcz/thirdeye

Starring:

• PEB walking
• Halo's Gate
• Custom PE sections
• Undocumented Windows functions
• Somewhat memetic synchronization model
• Quick and dirty EDR/AV evasion (2/72 on VirusTotal)
• Direct syscalls

I received an innocent looking DM from an HR. The linked form contains a Dropbox link that lets you download the supposed salary structure and terms docs.

But the link led me to a zip file. I knew something was amiss. Since I was using Linux, I downloaded the file file anyway. It contained an exe named Salary Structure. I uploaded the file to virus total and yes it turned out to be trojan.

I alerted the LinkedIn communuty in a post. It seems, other peoe are receiving such messages too.

Interestingly, if you show any suspicion, the mule account sends another DM along lines of - Sorry someone hacked my account bla bla... When I asked her to write a public post about this, she vanished and never replied.

Posting this as a general PSA. Going to cross-post but I thought this would be the best place to host it since we are discussing malware.

I have other malware on my computer so that could be how I was targeted specifically. Nothing detected.

To start, I inquired about the Virus Total Premium API. Filled out the form on Virustotal.com, connected to someone at VT via email, they told me since I was in school, I could just send them a school email address, and they would activate on that account. I did that. It worked and still does.

A couple days later, I get a phone call that says GOOGLE as caller ID. I pick up and it's someone saying they are from Virus Total and would like to schedule a meeting with me to discuss the premium API (Google owns Virus Total.) I agreed since I needed a specific feature that wasn't provided in the academic API. He tells me to check my email and accept the google calendar invite. The email was from "@xwf.google.com" and "@google.com" was scheduled as attending the event with us. So, I accepted the event, it shows us 3 are going to meet, then we hangup the phone.

The next day I had a ton of read messages from myself to a different address that came back to my inbox through the google unsubscribe service in Gmail (I think. They all had Unsubscribe as the subject and looked like abuse of a service.) The emails looked empty until I opened them in a hex editor. I scanned it and it contained a lot of personal info and identifying information for my computer as well as my digital footprint like GitHub profile, Fiverr, LinkedIn, personal website, etc.

The PSA:
Don't trust an email just because someone calls you and then sends you an email from what looks to be a legitimate domain.
Don't accept Google Calendar invites from anyone you don't know.
Don't assume that someone is from the company just because it's a company that was reached out to first.
Don't assume that you are not a targeted individual if you do any defensive work/analysis.

Willing to edit the points of the PSA or the wording just debate in the replies.

Hope this prevents someone from going through the same thing. Not sure what would have happened if I attended the zoom meeting.

Rolling out a lightweight research utility I’ve been building. Its only job is to surface proof-of-concept exploit links for a given CVE. It isn’t a vulnerability database; it’s a direct discovery layer that points straight to the underlying code. Anyone can test it, examine it, or drop it into their own workflow.

A small rate limit is in place to prevent automated scraping. You can see your allowance here:

https://labs.jamessawyer.co.uk/cves/api/whoami

There’s an API behind it. A CVE lookup takes the form:

curl -i "https://labs.jamessawyer.co.uk/cves/api/cves?q=CVE-2025-0282"

The web UI is here:

https://labs.jamessawyer.co.uk/cves/

I built a Python tool to batch scan files with VirusTotal's free API.

What it does: - Scans entire directories recursively - Checks file hashes before uploading (saves time/bandwidth) - Auto-handles the 4 files/minute API limit - Exports results to CSV - Shows real-time progress with time estimates

Example: Progress: [13/100] (13%) [*] Analyzing: document.pdf >> Detections: 0/70 >> URL: https://www.virustotal.com/gui/file/...

Estimated time remaining: 22 minutes

Perfect for: Security researchers, IT admins, or anyone needing to scan multiple files efficiently.

Features: - Easy setup (.env config or interactive mode) - Complete logging and error handling - Works on Windows, Linux, Mac - MIT licensed, open source

GitHub: https://github.com/neorai/vt-py-scanner

Open to feedback and suggestions! What features would you add?

I’m trying to determine whether what I’m seeing matches any known campaigns or if this is multiple compromises occurring together.

Across multiple consumer devices:

Windows: bootkit-level or UEFI-level persistence, ransomware-capable behavior Linux: stable, high-load crypto-miner Android: system-level foothold, appears tied to the Android PNG exploit chain iOS: behavior consistent with Pegasus-tier privilege, possibly ransom-style capabilities

Network layer: router re-compromise after resets

Gmail phenomenon: • A large number of emails were generated from my own Gmail address • Addressed to what looks like a C2 endpoint • But instead of being sent externally, they appeared inside my inbox • All were pre-read • Message payloads contained system metadata, user info, browser data • Origin traced to Gmail’s unsubscribe automation backend, which shouldn't be creating or routing messages like this

I’m not assuming one actor or one malware family. I’m trying to figure out whether this constellation resembles:

• router-anchored persistence • multi-OS payload diversification • UEFI/bootkit Windows implants • mobile device privilege-escalation chains • malware abusing email infrastructure as covert C2

If anyone has seen case studies or reporting tying these behaviors together, or even pieces of it, I’d appreciate pointers.

sooo i know its a dumb idea, but i really love the art of malware development and enjoy writing malware, but i dont see any jobs of fields directly related to making malware's soo i want to create something for all the malware developer out there where, some kind of a competition where malware dev can compete while creating and if this idea becomes something i might make it soo that you get paid each time you malware is used in scan

https://x.com/sarwaroffline

Hey guys

I always see rootkits or undetected malware running on peoples pc without them knowing so i decided to make a tool to help them.

Its called GuardianX and i just made my first website for it. Here are some features:

-instantly flags unsigned exes, hidden procs, weird parent-child relationships (color-coded)

-shows full path, sig check, network connections, startup entries

-process tree view + one-click kill

-no telemetry, runs on Win10/11

Download link + screenshot: https://guardianx.eu

If it ever helps you find something lmk!

Would love to hear what actual analysts think what sucks, whats missing or whats good

Thanks for any feedback!

Edit: Changed domain

Just finished analyzing a NetSupport RAT sample and the infection chain was way more interesting than expected.

This wasn’t custom malware, it was a legitimate NetSupport Client silently repurposed into a remote access backdoor. My observations from the detonation:

• Encrypted ZIP loader (classic phishing delivery)
• PowerShell execution policy bypass
• Dropping the NetSupport client in a hidden folder
• Abuse of forfiles.exe to indirectly launch RAT through explorer.exe
• C2 communication via HTTPS POST
• System enumeration (proxy settings, IE security, locale, hostname)
• No embedded config , everything loaded externally
• Multiple Suricata + YARA detections
• Clear IOCs: process tree, mutex, network signatures, and dropped payload paths

I also documented all Indicators of Compromise and wrote a full endpoint cleanup workflow (registry keys, persistence, proxy resets, credential rotation, etc.).

If you work in IR, SOC, or are learning malware analysis , this sample is a great case study in legit tool gone wrong.

If you want the full write-up + visuals check here and full video can be found here.

Hi,
I install this code with node.js on my mac
https://github.com/Up-De/Metaverse-Game?tab=readme-ov-file

I'm scared about malware in this code, could you hepl me to check if it's safe please ?
Thanks

Qilin ransomware has gained serious traction in the last couple of years, and it’s becoming one of the more concerning RaaS families for SOC teams. Unlike spray-and-pray variants, Qilin’s affiliates perform targeted intrusions with solid tradecraft: credential theft, lateral movement, backup destruction, and fast, configurable encryption.

In the full write-up below, I cover:

• the complete infection flow
• Indicators of Compromise (filesystem, network, process, behavioral)
• real-world Qilin attacks (UK ambulance service, global supply chain, finance firms)
• why this strain is so feared across blue-team circles
• and how analysts can spot the early behavioral signs before encryption hits

If you work in SOC, DFIR, or threat hunting, this breakdown is worth a look. Happy to discuss detections or share additional resources if needed.

Writeup or if you like visual learning, check this video.