Developers in the Crosshairs: Fake AI Tools Deliver Infostealer
In April 2026, Netskope Threat Labs exposed a Malware-as-a-Service (MaaS) NodeJS infostealer delivered through the ClickFix social engineering technique.

https://www.netskope.com/jp/blog/developers-in-the-crosshairs-fake-ai-tools-deliver-infostealer


🎖@malwr

LockBit String Deobfuscation: Reversing Affine Cipher DLL Loading with Ghidra
Technical analysis of LockBit ransomware string obfuscation — affine cipher, dynamic API resolution, and IAT evasion, reversed with Ghidra.

https://ginomaihuiri.github.io/lockbit-string-deobfuscation


🎖@malwr

Point Wild Exclusive: Dissecting Vanta Stealer, a Python-Based Cross-Platform Information Theft Malware | Point Wild
Point Wild

https://www.pointwild.com/threat-intelligence/point-wild-exclusive-dissecting-vanta-stealer-a-python-based-cross-platform-information-theft-malware/


🎖@malwr

Reverse engineering a miner malware
Introduction I wanted a reverse engineering project, so I decided to analyse a piece of real malware.

https://gustavvising.se/2026/07/17/reverse-engineering-a-miner-malware.html


🎖@malwr

Binary Ninja - The Binary Hiding in Your Registry: Cracking Windows UCPD's Dynamic Rules
Binary Ninja is a modern reverse engineering platform with a scriptable and extensible decompiler.

https://binary.ninja/2026/08/04/ucpd-dynamic-rules.html


🎖@malwr

🚨 CVE-2026-59309
VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.

🎖@cveNotify

🚨 CVE-2026-59310
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.

🎖@cveNotify

CILFI: Automatic Function Identification in .NET Binaries
There is a specific stage of grief every .NET reverse-engineer goes through when writing the next .NET deobfuscator or config extractor. It is the realization you have to write yet another ugly pattern-matching algorithm to find the exact same string decryptor, VM opcode handler, or C2 connection initializer functions to extract obfuscator configurations or IoCs.

https://blog.washi.dev/posts/cilfi/


🎖@malwr

Malware Development Essentials for Operators
Today’s post is a full pipeline walkthrough from a MessageBoxA call all the way to a kernel rootkit doing DKOM process hiding and callback abuse. Dynamic function loading, PEB walking, IAT hooking, process hollowing, DLL injection, shellcode encryption, APC injection all of it, with code.

https://f00crew.org/0x33


🎖@malwr

Windows tcpip.sys ICMP Timestamp Bug: EnableICMPTimestampRep=0 Registry Bypass & RFC 792 Violation | Kernel RE
EnableICMPTimestampRep=0 does not suppress ICMP Timestamp Replies (Type 14) on Windows 11. Ghidra RE of tcpip.sys 10.0.26100.8457 confirms Ipv4pHandleTimestampRequest generates T14 unconditionally, plus a second bug: Receive/Transmit timestamps written little-endian in violation of RFC 792. Only effective mitigation: WFP firewall rule.

https://netacoding.com/posts/windows-icmp-timestamp-bugs/


🎖@malwr

LockBit 5.0 Linux Malware Analysis: ChaCha20 + Curve25519 Offline Encryption, strace Evasion & IOCs
Full reverse engineering of LockBit 5.0 Linux (LINUX Locker v1.01 amd64): offline-capable ChaCha20+Curve25519 encryption, strace anti-analysis evasion, aggressive free space wiping, and zero network activity during encryption. eBPF dynamic tracing, Ghidra static RE, triple-confirmed network behavior, and complete IOC list.

https://netacoding.com/posts/lockbit5-analysis/


🎖@malwr