zenniskayy2k4/xAI-in-Malware-Detection: An AI-Powered Malware Detection Framework with MCP Integration
https://github.com/zenniskayy2k4/xAI-in-Malware-Detection
🎖@malwr
https://github.com/zenniskayy2k4/xAI-in-Malware-Detection
🎖@malwr
GitHub
GitHub - zenniskayy2k4/xAI-in-Malware-Detection: An AI-Powered Malware Detection Framework with MCP Integration
An AI-Powered Malware Detection Framework with MCP Integration - zenniskayy2k4/xAI-in-Malware-Detection
dantiicu/wine-nx: Experimental Wine runtime for Nintendo Switch: AArch64 Windows PE loading, Horizon/libnx integration, win32u USER/GDI bring-up, software framebuffer display, touch input, and early Notepad GUI support.
https://github.com/dantiicu/wine-nx
🎖@malwr
https://github.com/dantiicu/wine-nx
🎖@malwr
GitHub
GitHub - dantiicu/wine-nx: Experimental Wine runtime for Nintendo Switch: AArch64 Windows PE loading, Horizon/libnx integration…
Experimental Wine runtime for Nintendo Switch: AArch64 Windows PE loading, Horizon/libnx integration, win32u USER/GDI bring-up, software framebuffer display, touch input, and early Notepad GUI supp...
Adham504/iocforge: An advanced, production-ready Threat Intelligence utility that extracts Indicators of Compromise (IoCs) from many file formats, removes false positives, enriches them with live Threat Intelligence APIs, and produces rich JSON / CSV / HTML / summary reports.
https://github.com/Adham504/iocforge
🎖@malwr
https://github.com/Adham504/iocforge
🎖@malwr
GitHub
GitHub - Adham504/iocforge: An advanced, production-ready Threat Intelligence utility that extracts Indicators of Compromise (IoCs)…
An advanced, production-ready Threat Intelligence utility that extracts Indicators of Compromise (IoCs) from many file formats, removes false positives, enriches them with live Threat Intelligence ...
❤1
Anatomy of a WHQL-Signed Windows Filtering Platform (WFP) Kernel-Resident Network Backdoor - Nextron Systems
https://www.nextron-systems.com/2026/06/26/anatomy-of-a-whql-signed-windows-filtering-platform-wfp-kernel-resident-network-backdoor/
🎖@malwr
https://www.nextron-systems.com/2026/06/26/anatomy-of-a-whql-signed-windows-filtering-platform-wfp-kernel-resident-network-backdoor/
🎖@malwr
Nextron-Systems
Anatomy of a WHQL-Signed Windows Filtering Platform (WFP) Kernel-Resident Network Backdoor - Nextron Systems
Enterprise Tech In, Shell Out (Progress Kemp LoadMaster Uninitialized Heap to Pre-Auth RCE CVE-2026-8037)
Welcome back to another watchTowr Labs blog post.
This time, we're looking at Progress Kemp LoadMaster, a load balancer that sits at the edge of a lot of enterprise networks. Edge appliances have a habit of becoming the way in rather than the thing keeping people out, and CVE-
https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/
🎖@malwr
Welcome back to another watchTowr Labs blog post.
This time, we're looking at Progress Kemp LoadMaster, a load balancer that sits at the edge of a lot of enterprise networks. Edge appliances have a habit of becoming the way in rather than the thing keeping people out, and CVE-
https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037/
🎖@malwr
watchTowr Labs
Enterprise Tech In, Shell Out (Progress Kemp LoadMaster Uninitialized Heap to Pre-Auth RCE CVE-2026-8037)
Welcome back to another watchTowr Labs blog post.
This time, we're looking at Progress Kemp LoadMaster, a load balancer that sits at the edge of a lot of enterprise networks. Edge appliances have a habit of becoming the way in rather than the thing keeping…
This time, we're looking at Progress Kemp LoadMaster, a load balancer that sits at the edge of a lot of enterprise networks. Edge appliances have a habit of becoming the way in rather than the thing keeping…
TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry
In this blog entry, TrendAI™ Research examines a wave of phishing emails observed in May 2026 that targeted Japanese accommodation facilities using Booking.com, detailing the victims, attack techniques used, and characteristics of the malware involved.
https://www.trendmicro.com/en_us/research/26/f/tonresolver.html
🎖@malwr
In this blog entry, TrendAI™ Research examines a wave of phishing emails observed in May 2026 that targeted Japanese accommodation facilities using Booking.com, detailing the victims, attack techniques used, and characteristics of the malware involved.
https://www.trendmicro.com/en_us/research/26/f/tonresolver.html
🎖@malwr
Trend Micro
TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry
❤1
Mustang Panda targets India's government and energy sectors with ZOHOMURK and MINIRECON
Acronis Threat Research Unit (TRU) has been tracking two concurrent campaigns orchestrated by Mustang Panda targeting Indian government entities, delivering new malware implants and abusing Zoho WorkDrive, a legitimate cloud storage platform commonly used in the Indian government sector.
https://www.acronis.com/en/tru/posts/mustang-panda-targets-indias-government-and-energy-sectors/
🎖@malwr
Acronis Threat Research Unit (TRU) has been tracking two concurrent campaigns orchestrated by Mustang Panda targeting Indian government entities, delivering new malware implants and abusing Zoho WorkDrive, a legitimate cloud storage platform commonly used in the Indian government sector.
https://www.acronis.com/en/tru/posts/mustang-panda-targets-indias-government-and-energy-sectors/
🎖@malwr
Acronis
Mustang Panda targets India's government and energy sectors with ZOHOMURK and MINIRECON
Acronis Threat Research Unit (TRU) has been tracking two concurrent campaigns orchestrated by Mustang Panda targeting Indian government entities, delivering new malware implants and abusing Zoho WorkDrive, a legitimate cloud storage platform commonly used…
❤1
Chaelsoo/Hollow
https://github.com/Chaelsoo/Hollow
🎖@malwr
https://github.com/Chaelsoo/Hollow
hollow is a shellcode loader generator. You give it a raw shellcode binary and a profile, and it spits out a compiled Windows PE loader with your shellcode encrypted inside.
🎖@malwr
GitHub
GitHub - Chaelsoo/Hollow: A shellcode loader generator with support for multiple injection techniques, built for red team engagements.
A shellcode loader generator with support for multiple injection techniques, built for red team engagements. - Chaelsoo/Hollow
TuncorReUnion/TLAC-MODERN-LOCAL-ANTI-CHEAT-REUNIONED: This Anti-Cheat is local server based and fully open source. it's user space
https://github.com/TuncorReUnion/TLAC-MODERN-LOCAL-ANTI-CHEAT-REUNIONED
🎖@malwr
https://github.com/TuncorReUnion/TLAC-MODERN-LOCAL-ANTI-CHEAT-REUNIONED
🎖@malwr
GitHub
GitHub - TuncorReUnion/TLAC-MODERN-LOCAL-ANTI-CHEAT-REUNIONED: This Anti-Cheat is local server based and fully open source. it's…
This Anti-Cheat is local server based and fully open source. it's user space - TuncorReUnion/TLAC-MODERN-LOCAL-ANTI-CHEAT-REUNIONED
CitrixBleed To Infinity And Beyond (Citrix NetScaler Pre-Auth Memory Overread CVE-2026-8451)
Well, well, well - once again, the cat has dragged us in and spat us out.
Today, we find ourselves questioning the reality we sit within. Must it be so predictable, and why us? “But watchTowr, what do you mean?”
Well, if you’re here, you likely fit into one of
https://labs.watchtowr.com/citrixbleed-to-infinity-and-beyond-citrix-netscaler-pre-auth-memory-overread-cve-2026-8451/
🎖@malwr
Well, well, well - once again, the cat has dragged us in and spat us out.
Today, we find ourselves questioning the reality we sit within. Must it be so predictable, and why us? “But watchTowr, what do you mean?”
Well, if you’re here, you likely fit into one of
https://labs.watchtowr.com/citrixbleed-to-infinity-and-beyond-citrix-netscaler-pre-auth-memory-overread-cve-2026-8451/
🎖@malwr
watchTowr Labs
CitrixBleed To Infinity And Beyond (Citrix NetScaler Pre-Auth Memory Overread CVE-2026-8451)
Well, well, well - once again, the cat has dragged us in and spat us out.
Today, we find ourselves questioning the reality we sit within. Must it be so predictable, and why us? “But watchTowr, what do you mean?”
Well, if you’re here, you likely fit into…
Today, we find ourselves questioning the reality we sit within. Must it be so predictable, and why us? “But watchTowr, what do you mean?”
Well, if you’re here, you likely fit into…
youssefnoob003/SindriKit: A foundational C library for building operationally credible offensive capabilities
https://github.com/youssefnoob003/SindriKit
🎖@malwr
https://github.com/youssefnoob003/SindriKit
🎖@malwr
GitHub
GitHub - youssefnoob003/SindriKit: A foundational C library for building operationally credible offensive capabilities
A foundational C library for building operationally credible offensive capabilities - youssefnoob003/SindriKit
RadonCoding/binsafe: Obfuscator for compiled 64-bit portable executables.
https://github.com/RadonCoding/binsafe
🎖@malwr
https://github.com/RadonCoding/binsafe
🎖@malwr
GitHub
GitHub - RadonCoding/binsafe: Obfuscator for compiled 64-bit portable executables.
Obfuscator for compiled 64-bit portable executables. - RadonCoding/binsafe
Doctor Web’s Q2 2026 review of virus activity on mobile devices
https://news.drweb.com/show/?i=15274&lng=en&c=5
🎖@malwr
https://news.drweb.com/show/?i=15274&lng=en&c=5
🎖@malwr
Iran-Nexus TAG-182 Disseminates MarkiRAT Surveillance Tool
Discover how Iranian-nexus threat cluster TAG-182 uses MarkiRAT malware and fake VPN/media apps to conduct cyber surveillance operations against domestic targets.
https://www.recordedfuture.com/research/nexus-tag182-disseminates-markirat
https://assets.recordedfuture.com/insikt-report-pdfs/2026/cta-ir-2026-0701.pdf
🎖@malwr
Discover how Iranian-nexus threat cluster TAG-182 uses MarkiRAT malware and fake VPN/media apps to conduct cyber surveillance operations against domestic targets.
https://www.recordedfuture.com/research/nexus-tag182-disseminates-markirat
https://assets.recordedfuture.com/insikt-report-pdfs/2026/cta-ir-2026-0701.pdf
🎖@malwr
greit0n/malwarebazaar-downloader: Pull MalwareBazaar samples into an isolated AV-testing lab — safe-by-design CLI + glassmorphic desktop GUI (mbdl).
https://github.com/greit0n/malwarebazaar-downloader
🎖@malwr
https://github.com/greit0n/malwarebazaar-downloader
🎖@malwr
GitHub
GitHub - greit0n/malwarebazaar-downloader: Pull MalwareBazaar samples into an isolated AV-testing lab — safe-by-design CLI + glassmorphic…
Pull MalwareBazaar samples into an isolated AV-testing lab — safe-by-design CLI + glassmorphic desktop GUI (mbdl). - greit0n/malwarebazaar-downloader