Static Devirtualization of Tencent VM
Over the course of several months we have noticed an increased interest in Tencent VM obfuscation. We have had complete static devirtualization of this VM obfuscation for quite some time now and have noticed others have achieved similar deobfuscation results.

https://back.engineering/blog/31/07/2026/


🎖@malwr

Inside the Falcon How CrowdStrike Catches You
A full reverse-engineering teardown of the CrowdStrike Falcon sensor: the six kernel callback sources, the WFP network engine, the file-system minifilter, the cspcm4 broker, the user-mode service (DNS / AMSI / browser / Identity Protection), and the cloud-loaded detection engine — plus every structural blind spot. How Falcon sees you, and where the seams are.

https://0xdbgman.github.io/posts/inside-the-falcon-how-crowdstrike-catches-you/


🎖@malwr

Turning Chrome Remote Desktop into Pure Red Team Ops
How to hide the Chrome Remote Desktop connection banner by patching a single dialog resource, then abuse host.json and MSI packaging to turn CRD into a quiet persistent access channel.

https://zerotracelab.com/blog/chrome-remote-desktop-red-ops


🎖@malwr

VMMap Basics: How to Read a Windows Process's Memory Layout » TrainSec
Pavel Yosifovich uses VMMap to break down a process's memory layout, for developers and researchers who want to see what memory a process really uses.

https://trainsec.net/library/windows-internals/vmmap-basics-how-to-read-a-windows-processs-memory-layout/


🎖@malwr

Flying Eagle Android RAT: Leaked Source Code, 170 Active Servers, and a New Platform Called Night Dragon
Hunt.io and NetAskari trace a leaked Android RAT framework across 170 active servers, analyze the APK builder internals, and document a successor platform called Night Dragon targeting Chinese users.

https://hunt.io/blog/flying-eagle-android-rat-170-servers-night-dragon


🎖@malwr

OctLurk and SilkLurk: new Backdoors in Central Asia
Our experts discovered OctLurk and SilkLurk, backdoors operating primarily in memory, targeting Central Asia. They inject plugins to launch shells, scan networks, dump credentials, and keylogging.

https://securelist.com/octlurk-silklurk-backdoors-central-asia/120840/


🎖@malwr

ENISA Secure by Design and Default Playbook | ENISA
ENISA is the EU agency dedicated to enhancing cybersecurity in Europe. They offer guidance, tools, and resources to safeguard citizens and businesses from cyber threats.

https://www.enisa.europa.eu/publications/enisa-secure-by-design-and-default-playbook

https://www.enisa.europa.eu/sites/default/files/2026-07/ENISA_Secure_By_Design_and_Default_Playbook_v1.pdf

🎖@malwr

Fake Xeno Roblox Cheats Deliver Powerful Java Stealer Through Discord and Forums
A malware campaign disguised as an “undetected” version of the Xeno Roblox script executor is directly affecting players

https://www.bitdefender.com/en-us/blog/labs/fake-xeno-roblox-discord-executor


🎖@malwr