Five layers deep for a stealer: reversing the "PuppetKing" ClickFix chain that ended in StealC

Five-stage ClickFix chain reversed statically - game decoy, bitmap stego, custom ConfuserEx, bespoke byte cipher, and StealC v2 with blockchain-rotated C2.

Jun 25, 2026 Malware Analysis

Rogue ScreenConnect campaign -- Telegram exfiltration and competitor eviction

Your RMM Has a Second Owner: Inside a Rogue ScreenConnect Credential Theft Campaign

Three Telegram bots, five named operators, a 3,000-line competitor eviction script -- a newly onboarded host had been compromised for months before the customer onboarded it.

Jun 19, 2026 Malware Analysis

Thirty days of finger commands: three ClickFix families, one TCP/79 delivery vector

25 finger commands over approximately 30 days, three ClickFix families, one TCP/79 delivery vector: IronPython loader, Python RAT lspy, and a pre-positioned DigitalOcean staging cluster.

Jun 17, 2026 Malware Analysis

Lunex stealer C2 panel -- OSINT investigation

The Panel Behind the Prompt: OSINT into a Live Lunex Stealer Network

OSINT follow-up to the ClickFix/CAPTCHA campaign: six confirmed Lunex stealer C2 panels across five countries, including a Cloudflare-hidden instance on a Google-impersonating domain. Cookie theft, credential harvesting, real-time JavaScript injection, browser spoofing, and full remote browser control -- documented from the observable panel interface.

Jun 13, 2026 Malware Analysis

Telegram Handles, Binary-Encoded PHP, and a Relay Shell: Inside a WordPress Webshell Compromise

A compromised WordPress site, eleven hundred lines of IIS logs, a two-stage binary-encoded webshell, and six attempts to deploy a gsocket reverse shell.

Jun 12, 2026 Malware Analysis

They built a dictionary to hide their shellcode: the pishbini90ai ClickFix loader

A ClickFix loader that hides shellcode as 256 English words in .rdata, delivers via WebDAV-over-HTTPS, and executes via Windows fibers. IOCs and YARA inside.

Jun 11, 2026 Malware Analysis

Fake captcha, five layers of RC4, and a Rust stealer with LSA session enumeration and AD recon

Five-layer RC4+gzip ClickFix stager drops a Rust infostealer with browser extension force-install, LSA session enumeration, and AD recon via NetAPI.

Jun 11, 2026 Malware Analysis

The Node.js loader that locks its own strings to the folder it lives in

A Node.js loader disguised as a dev tool: signed node.exe, extensionless script, folder-keyed string cipher, and an in-memory payload that never touches disk.

Jun 10, 2026 Malware Analysis

A Fake "SystemHealth" Service, a Pyarmor Wall, and Three Ways to Get Paid

A fake SysMon.py in C:\Windows\SystemHealth runs a Pyarmor-locked Python bundle: an XMRig Monero miner, a credential and wallet stealer, and a fake-wallet phisher.

Jun 6, 2026 Malware Analysis

The "SharePoint Helper" That Was Really a Localhost Backdoor

A brand-new scheduled task on a two-year-old host launches a fileless PowerShell HTTP-RAT that listens on localhost only and waits for an operator's tunnel.