AI is transforming the technology landscape at an unprecedented pace, continuously evolving and reshaping traditional workflows-from replicating complex applications like Photoshop and Microsoft Office to automating software analysis and reverse engineering. As AI capabilities advance, conventional approaches to debugging and reverse engineering are becoming less efficient and increasingly outdated. We need to adapt to this shift, embrace AI-driven methodologies, and prepare for the future of software development and analysis.

- @SirMalware -

🎖@malwr

From my perspective, this transformation is reminiscent of the introduction of computers and the rise of the internet, both of which fundamentally changed how we work. However, I see AI as a more profound shift. While computers automated processes and the internet improved access to information, AI is increasingly capable of performing tasks that require specialized knowledge, reasoning, and problem-solving. Based on my experience, this makes it essential to rethink traditional approaches, adapt to evolving technologies, and continuously develop new skills to remain relevant in an AI-driven future.

- @SirMalware -

🎖@malwr

Case of AgentTesla Malware Distribution Disguised as a Business Proposal Email

Recently, the AhnLab SEcurity intelligence Center (ASEC) identified instances of phishing emails being circulated that disguise themselves as requests to review a business proposal. The email body asks recipients to review the attached product list and reply with their feedback on inventory and pricing, thereby prompting users to download and open the attached ZIP file. […]

https://asec.ahnlab.com/en/95840/


🎖@malwr

Amsi bypass Bypassing AMSI & ETW: Building a Custom PowerShell Runspace in C#
Building a custom C# PowerShell runspace that bypasses AMSI and ETW while enforcing Full Language Mode. Breaking down each defensive layer and how operators can neutralize them using .NET reflection from a compiled binary.

https://by7e.dev/blog/runspace


🎖@malwr

Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware - The Citizen Lab
This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. We call the technique AdFection, and show how it was used to infect devices at Al Jazeera with Candiru’s spyware. We also uncover Discover-Tech, and show how the company helps mercenary surveillance vendors track and hack devices around the world.

https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/


🎖@malwr

KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize
Group-IB researchers analyze KGB RAT, a Windows Remote Access Trojan advertised on underground forums as being fully undetectable, featuring a built-in crypter, HVNC, credential theft, ransomware, and an unusual set of psychological harassment capabilities.

https://www.group-ib.com/blog/kgb-rat-windows-fud-trojan/


🎖@malwr

Glassworm Hacks OVH Clouds CLI tool
On 2026-10-19, the official OVHcloud CLI tool was compromised by the Glassworm threat actors who published five malicious versions to GitHub and Brew

https://opensourcemalware.com/blog/glassworm-hacks-ovh-clouds-cli-tool


🎖@malwr

Ukraine’s State Data-Exchange System Targeted by Russian-Speaking Operator via Graylog Log4Shell
An exposed open directory revealed a solo operator's full Log4Shell chain against a Graylog host holding Trembita logs, with the access log that proves execution.

https://hunt.io/blog/ukraine-state-data-exchange-graylog-log4shell


🎖@malwr

Reverse Engineering Pokémon Sprites (LGPE)
Rebuilding Pokémon Switch sprite rendering pipeline (LGPE edition)

https://triyan.dev/blog/reverse-engineering-pokemon-sprites-lgpe


🎖@malwr

Does It Stop When Someone Is Watching? The Suspicious Behavior of a New Type of Infostealer

It is already well known that illegal software and cracked programs can be exploited for malware distribution. Recently, AhnLab identified a new type of information theft malware (Infostealer) disguised as an illegal program. This malware was first detected in mid-August and, after altering its execution method, began spreading widely in September. Notably, it not only […]

https://asec.ahnlab.com/en/95937/


🎖@malwr