Malware Analysis 28
- Agta Strikes Again: A Fake Adobe Update, a Borrowed ScreenConnect, and the 66 Panels Behind It
- RMM Abuse, Four Times Over: How One Fake Webex Download Chained Rocky RMM, ScreenConnect, and Level.io
- They Didn't Hack In, They Logged In: A Six-Shell IIS Backdoor Story
- The @SSL Shuffle: One WebDAV Loader Family, Seven Disguises
- 3,015 Hacked WordPress Sites Later, I Think I Found the Front Door
- ClickFix in 2026: Eight Ways to Start the Same Attack
- The ClickFix Stealer That Makes Microsoft Edge Steal From Itself
- Kovraxis: A Go Stealer That Reads Its C2 Address Off a Steam Profile
- Another day, another 1,738 compromised websites: ClickFix keeps leaning on EtherHiding for C2
- The ledger keeps talking: mapping five EtherHiding operators, two kit families, and 1,829 confirmed hacked websites
- No File, No Fixed C2: Inside NetCon, a WMI Backdoor That Reads Its Command Server Off the Blockchain
- Reading the ledger: how one Polygon smart contract exposed three ClickFix crews and 153 confirmed hacked websites
- Five layers deep for a stealer: reversing the "PuppetKing" ClickFix chain that ended in StealC
- Your RMM Has a Second Owner: Inside a Rogue ScreenConnect Credential Theft Campaign
- Thirty days of finger commands: three ClickFix families, one TCP/79 delivery vector
- The Panel Behind the Prompt: OSINT into a Live Lunex Stealer Network
- Telegram Handles, Binary-Encoded PHP, and a Relay Shell: Inside a WordPress Webshell Compromise
- They built a dictionary to hide their shellcode: the pishbini90ai ClickFix loader
- Fake captcha, five layers of RC4, and a Rust stealer with LSA session enumeration and AD recon
- The Node.js loader that locks its own strings to the folder it lives in
- A Fake "SystemHealth" Service, a Pyarmor Wall, and Three Ways to Get Paid
- The "SharePoint Helper" That Was Really a Localhost Backdoor
- The beacon that won't decrypt unless it beats AMSI: pulling apart a WMI-launched PowerShell loader
- Bring Your Own Node: a PowerShell stager, a blockchain dead-drop, and a RAT that runs on the real Node.js
- A signed OneDrive, a fake note-taking app, and a payload hiding in a PNG: one ClickFix chain, five stages deep
- Seven layers of obfuscation, one 1970s LOLBIN: pulling apart a ClickFix chain through finger.exe
- Twelve layers of obfuscation, one AMSI patch: pulling apart a ClickFix mshta loader
- A driver that wasn't a driver: dissecting a steganographic PowerShell beacon