fnprint: identify functions in stripped binaries by behavior (microexecution), training-free, cross-compiler
github.comu/BusinessStreet2147 — 8 hours ago
r/Malware
Invadi um servidor de distribuição de malware Trojan, Stealer e Cryptominer
Um SMB exposto e misconfigs me deram acesso a um server parte da cadeia de infecção de um RAT brasileiro com keylogger, desktop capture, shellcode injection, cryptominer e C2 baseado em Tor.
A campanha utiliza múltiplas camadas com repositórios públicos, Blogspot, GitHub, PHP, Tor, Telegram e payloads que se atualizam em cadeia sendo uma Killchain modular, montada para continuar operando mesmo quando um dos estágios quebra a cadeia.
LNK -> VBS -> chunks -> Blogspot -> GitHub -> PHP agent -> chrome.exe
Report completo, feito totalmente por diversaummm
https://mensvr.com/reports/indigo-shark
u/reznovmustdie — 14 hours ago
this is just lazy
Just a quick heads-up everyone. I was surfing the web when a Cloudflare verification page popped up, which seemed pretty normal. But then another pop-up appeared with 3 steps asking me to press Win + R, paste something, and press Enter. It had a PowerShell script already copied to my system.
The script itself is also a red flag:
ExecutionPolicy Bypass→ bypasses PowerShell's normal security restrictions.iwr→ downloads something from the internet.daleeby.com/...→ the unknown external website it downloads from.-OutFile ...\update.ps1→ saves whatever it downloaded as a PowerShell script.& ...\update.ps1→ immediately runs that downloaded script.
The script was basically downloading and running another script from an external website, which is obviously very suspicious.
I know anyone with some technical knowledge would probably recognize that this isn't a normal Cloudflare verification, but just wanted to make everyone aware in case you come across something similar. Don’t follow the steps or paste/run anything if you see this.
u/KAUXIK — 17 hours ago
▲ 9 r/Malware
Fake mParivahan APK spreading on WhatsApp
I recently got a WhatsApp message to pay pending challans and check using some APK that was shared. I knew it was a scam. Thought of doing an analysis using Claude on the APK. Here's what it found:
It is NOT the real app. It's a banking trojan that:
- Creates a VPN to intercept all your network traffic (banking, OTPs, everything)
- Silently installs a second hidden APK in the background
- Targets WhatsApp, Signal, Telegram, SMS and 20+ other apps
u/mnciitbhu — 1 day ago
[RFZO.RS] Serbia Health Insurance Fund hacked
Different posts regarding the sales of databases belonging to RFZO (The Republic Health Insurance Fund of Serbia) have appeared on the dark web by ByteToBreach, who recently also attacked government infrastructure in Hungary and Romania, causing major shutdowns.
The alleged dataset shown in the screenshots shows astonishing figures of 9 millions rows of data per table, which represents a huge risks to the national safety of the citizens of Serbia, if those claims turns out to be true.
The Republic Health Insurance Fund (RFZO) communicated that it has taken preventive measures and is conducting a detailed check of information systems regarding the allegations.
The affected websites are down, but it seems a decision from the management, rather than the consequence of the attack, which seems to have simply targeted the extraction of the data, without any sign of deployment of ransomwares.
https://spear.cx/Thread-Selling-RS-Serbia-Health-Insurance-Databases-RFZO-RS
u/Fit_Asidy — 2 days ago
ICMP Timestamp Type 13/14: Linux Kernel Internals with ftrace
A depth-8 ftrace analysis of how the Linux kernel processes ICMP Timestamp (Type 13/14) requests — covering the full call chain, payload validation, conntrack behavior, and ts_ori echo mechanics.
————————
Most security tooling treats ICMP as a monolith: ping works, or it doesn’t. ICMP Timestamp (Type 13/14) sits in that overlooked middle ground — defined in RFC 792, implemented in every Linux kernel, but rarely scrutinized at the source level.
This post documents a depth-8 ftrace investigation of icmp_timestamp() on Linux kernel 6.17.13. Beyond cataloguing individual findings, the goal is to map the architectural reality of how the kernel processes ICMP Timestamp requests — every code path, every decision point, every place where the implementation diverges from what RFC 792 specifies.
What emerged was a set of concrete, reproducible behaviors: a silent payload threshold, a Code field that is never read, ts_ori that is echoed without any range check, and a netfilter pipeline that creates a conntrack entry for every single exchange.
u/Pale_Surround_3924 — 2 days ago
Watch out for this Remcos Malware
I revisited this malware variant that I came across in the wild to demonstrate to everyone how it works. Stay safe and I hope this helps someone learn something!
u/m3moryhous3 — 1 day ago
Mirage2FA is targeting US corporate M365 accounts with AiTM phishing attacks.
With over 4K potentially compromised victims, it hits Tech and Manufacturing hardest.
Here's what your SOC team needs to know to protect your organization: https://any.run/cybersecurity-blog/mirage2fa-phishing-targets-us-companies/
u/ANYRUN-team — 2 days ago
This Wi-Fi pop-up installs a vicious RAT on your device — Ontario expert explains Microsoft’s latest security alert
durhamregion.comu/Kind-Discussion-7755 — 3 days ago
Webfetch risks
I ran a Claude code skill that without me asking spun up sub agents that downloaded 300 MB of web content. It even created scripts and headless browser instances to get around search restrictions on certain forums, etc. How worried should I be that the security of my computer has been compromised?
u/Sagnet — 7 days ago
🇷🇺 Inside a Russian-Speaking Operator's Ukrainian IP Camera Toolkit
Writeup on two open directories we recovered, with a defender-focused breakdown of the camera and router compromise techniques and the network behavior their proxy tooling produces.
Detection and mitigation angles worth pulling out:
- Edge devices opening outbound connections on port 4444 (chisel reverse tunnels) is a strong compromise signal
- Sequential ONVIF and RTSP discovery and repeated hits on camera ports show up better at the network boundary than in camera logs, which are usually shallow or absent
- Credential guessing was the primary access path before any CVE was tried, so default and weak creds on cameras and routers are still the main exposure
- Exploited camera CVEs are years old and long patched (Hikvision, Dahua); TP-Link Archer and MikroTik were the router targets
- Every targeted device answered directly from the internet, so pulling cameras and routers behind a VPN or onto isolated VLANs removes most of this
Outcomes against the government and military sites in the operator's bash history are not confirmed from the files. Full mitigations and ATT&CK mapping in the post:
https://hunt.io/blog/russian-speaking-operator-ukrainian-camera-toolkit
u/Kv603 — 9 days ago
WhiteCobra Malware on VS Code: Cloudflare C2 to Telegram Infostealer
yeethsecurity.comu/tame-impaled — 8 days ago
Shai-Hulud rebuilt as a standalone stealer
We found a new Mini Shai-Hulud variant that makes the worm a general Linux post-exploitation payload and continues through with Github and NPM propagation.
u/sbahra — 8 days ago
Remus Stealer - 64bit evolution of Lumma
Remus Stealer is a rapidly evolving Malware-as-a-Service infostealer that emerged in 2026.
Remus also shifted from Lumma's 32-bit architecture and traditional resolvers to 64-bit with EtherHiding and enhanced anti-analysis (e.g., sandbox DLL checks, PST honeypot detection).
- It utilizes EtherHiding, storing C2 addresses in Ethereum smart contracts to avoid takedowns.
- The malware steals credentials, browser cookies, authentication tokens, and cryptocurrency wallet data.
- Session theft is one of Remus's most dangerous capabilities because it can bypass MFA by stealing active session cookies directly from browser memory.
- The malware shows strong technical similarities to Lumma Stealer and may represent its evolutionary successor.
- Financial services, healthcare, government, technology firms, and MSPs are particularly attractive targets.
- Common infection vectors include phishing, fake software downloads, malvertising, and fake CAPTCHA campaigns, as well as SEO poisoning and fake GitHub projects to trick tech-savvy users.
See whole ANY.RUN execution chain at https://app.any.run/tasks/ae43628b-9d56-4c43-abac-fae7266c749f/
Check out whole malware analysis report at https://any.run/malware-trends/remus/
u/rifteyy_ — 10 days ago
Fake Cloudflare verification on deceased influencer’s site drops a PowerShell shellcode loader
I was checking the website (felzenergy.com) of an influencer (Joe Felz) who recently passed away and had been researching “free energy.”
The site currently shows a fake Cloudflare-style verification that tells visitors to run a PowerShell command to prove they’re human.
I pulled the payload without executing it. The first stage downloads another blob from the same IP, allocates RWX memory with VirtualAlloc, copies the payload into memory, and runs it with CreateThread.
So the chain is basically:
fake verification -> PowerShell -> downloaded shellcode -> RWX memory -> CreateThread
I have not detonated the second stage. I also have no evidence this has anything to do with his death or research; the site may simply have been compromised.
If anyone is able to check it out and report back on what that is, that'd be much appreciated.
u/ThiccLatinaBabe — 12 days ago
New Mac Malware intrested stealing Crypto Addresses and Crypto Mining Macs.
WARNING: MAC USERS. https://www.huntress.com/blog/mac-crypto-draining-malware Turns out i am infected with a malware already imported. The attack is Clickfix is based via terminal commands. the Website is called FilehoneyMesh and runs CURL Scripts in Base64 Format.
u/Ioannisgn_ — 11 days ago
PhantomEnigma shows the difference between blocking today’s C2 and tracking the operation behind it.
We recovered a Node.js/Electron backdoor with /nbw/ beaconing, 180-second task checks, eval()-based JavaScript execution, EXE delivery, and login persistence — capabilities that can turn a clean-looking sample into longer access, follow-on payload delivery, and higher fraud or data-exposure risk.
The durable signal is the build and execution chain: Delphi/Inno installer ➡️ patched Electron/Boostnote app ➡️ malicious index.js ➡️ HTTP beaconing ➡️ JS/EXE tasking.
That pattern helped us connect 231 sandbox analyses to the same PhantomEnigma cluster, even as domains, IPs, and delivery infrastructure changed ❗️
Full investigation: https://any.run/cybersecurity-blog/phantomenigma-research/
u/ANYRUN-team — 14 days ago