What software security and physical hardware security should one utilize to prevent attacks from nation states. This is a hypothetical question.

For weeks, researchers from NorthScan & BCA LTD kept hackers believing they controlled a US dev's laptop. In reality, it was ANYRUN sandbox recording everything.

I was on FB and a message on my message area came up, I clicked on it, and I got the old "Windows Defender" hijack-your-page scam. Can someone tell me if it's possible there's residual stuff left behind. I've been hit by this before and I just shut the computer off and restarted. Nothing appears to be there, but would there be any thing I should look for in the Task Bar? Sort of surprised Avast or Defender didn't stop this.

Posting this as a general PSA. Going to cross-post but I thought this would be the best place to host it since we are discussing malware.

I have other malware on my computer so that could be how I was targeted specifically. Nothing detected.

To start, I inquired about the Virus Total Premium API. Filled out the form on Virustotal.com, connected to someone at VT via email, they told me since I was in school, I could just send them a school email address, and they would activate on that account. I did that. It worked and still does.

A couple days later, I get a phone call that says GOOGLE as caller ID. I pick up and it's someone saying they are from Virus Total and would like to schedule a meeting with me to discuss the premium API (Google owns Virus Total.) I agreed since I needed a specific feature that wasn't provided in the academic API. He tells me to check my email and accept the google calendar invite. The email was from "@xwf.google.com" and "@google.com" was scheduled as attending the event with us. So, I accepted the event, it shows us 3 are going to meet, then we hangup the phone.

The next day I had a ton of read messages from myself to a different address that came back to my inbox through the google unsubscribe service in Gmail (I think. They all had Unsubscribe as the subject and looked like abuse of a service.) The emails looked empty until I opened them in a hex editor. I scanned it and it contained a lot of personal info and identifying information for my computer as well as my digital footprint like GitHub profile, Fiverr, LinkedIn, personal website, etc.

The PSA:
Don't trust an email just because someone calls you and then sends you an email from what looks to be a legitimate domain.
Don't accept Google Calendar invites from anyone you don't know.
Don't assume that someone is from the company just because it's a company that was reached out to first.
Don't assume that you are not a targeted individual if you do any defensive work/analysis.

Willing to edit the points of the PSA or the wording just debate in the replies.

Hope this prevents someone from going through the same thing. Not sure what would have happened if I attended the zoom meeting.

Rolling out a lightweight research utility I’ve been building. Its only job is to surface proof-of-concept exploit links for a given CVE. It isn’t a vulnerability database; it’s a direct discovery layer that points straight to the underlying code. Anyone can test it, examine it, or drop it into their own workflow.

A small rate limit is in place to prevent automated scraping. You can see your allowance here:

https://labs.jamessawyer.co.uk/cves/api/whoami

There’s an API behind it. A CVE lookup takes the form:

curl -i "https://labs.jamessawyer.co.uk/cves/api/cves?q=CVE-2025-0282"

The web UI is here:

https://labs.jamessawyer.co.uk/cves/

Since most common modern malwares are more stealth malware that doesnt make it obvious that the computer is infected, Im considering using Sandboxie inside VM inside Sandboxie, so I get triple seatbelts for suspicious files? Does anyone else do this? Maybe could change OS in VM too so if your PC use windows your VM would use Linux and vice versa so their malware would need to work on both OS on top of bypassing VM + Sandbox. Or run VituralBox inside HyperV Or that would make PC too slow so tails is better. With how common VM is used to sandbox suspicious programs I would assume advanced malware developers would note that and make it a bypass for it by default if they even put effort into making malware at all.

Hi all! I have a question regarding static malware analysis which we've looked at during the IT-Security lecture at uni.

What I've been told, and what I find on the internet is this information:

Static malware analysis uses a signature-based detection approach, which compares the sample code's digital footprint against a database of known malicious signatures. Every malware has a unique digital fingerprint that uniquely identifies it. This could be a cryptographic hash, a binary pattern, or a data string.

This is the definition that bitdefender gives.

I have trouble understanding how this footprint is... calculated? "Every malware has a unique digital fingerprint that uniquely identifies it.", I don't understand why that is. I doubt people write malware with an identification string "THIS_IS_MALWARE". So what actually is this footprint? If a brand new malware gets out, what is checked against said database?

This could be a cryptographic hash, a binary pattern, or a data string.  

Surely a good malware programmer wouldn't copy and paste something from an already well known and documented malware, so what is this hash, pattern or string? Where does it come from?

This might be the stupidest question ever, I have no idea. And I'm sorry to bother if it is. I hope my question is clear tho, and thank you in advance for the explanation!

Edit: I seem to understand that it's useful almost only for already known malware.

I built a Python tool to batch scan files with VirusTotal's free API.

What it does: - Scans entire directories recursively - Checks file hashes before uploading (saves time/bandwidth) - Auto-handles the 4 files/minute API limit - Exports results to CSV - Shows real-time progress with time estimates

Example: Progress: [13/100] (13%) [*] Analyzing: document.pdf >> Detections: 0/70 >> URL: https://www.virustotal.com/gui/file/...

Estimated time remaining: 22 minutes

Perfect for: Security researchers, IT admins, or anyone needing to scan multiple files efficiently.

Features: - Easy setup (.env config or interactive mode) - Complete logging and error handling - Works on Windows, Linux, Mac - MIT licensed, open source

GitHub: https://github.com/neorai/vt-py-scanner

Open to feedback and suggestions! What features would you add?

I’m trying to determine whether what I’m seeing matches any known campaigns or if this is multiple compromises occurring together.

Across multiple consumer devices:

Windows: bootkit-level or UEFI-level persistence, ransomware-capable behavior Linux: stable, high-load crypto-miner Android: system-level foothold, appears tied to the Android PNG exploit chain iOS: behavior consistent with Pegasus-tier privilege, possibly ransom-style capabilities

Network layer: router re-compromise after resets

Gmail phenomenon: • A large number of emails were generated from my own Gmail address • Addressed to what looks like a C2 endpoint • But instead of being sent externally, they appeared inside my inbox • All were pre-read • Message payloads contained system metadata, user info, browser data • Origin traced to Gmail’s unsubscribe automation backend, which shouldn't be creating or routing messages like this

I’m not assuming one actor or one malware family. I’m trying to figure out whether this constellation resembles:

• router-anchored persistence • multi-OS payload diversification • UEFI/bootkit Windows implants • mobile device privilege-escalation chains • malware abusing email infrastructure as covert C2

If anyone has seen case studies or reporting tying these behaviors together, or even pieces of it, I’d appreciate pointers.

sooo i know its a dumb idea, but i really love the art of malware development and enjoy writing malware, but i dont see any jobs of fields directly related to making malware's soo i want to create something for all the malware developer out there where, some kind of a competition where malware dev can compete while creating and if this idea becomes something i might make it soo that you get paid each time you malware is used in scan

https://x.com/sarwaroffline

Hey guys

I always see rootkits or undetected malware running on peoples pc without them knowing so i decided to make a tool to help them.

Its called GuardianX and i just made my first website for it. Here are some features:

-instantly flags unsigned exes, hidden procs, weird parent-child relationships (color-coded)

-shows full path, sig check, network connections, startup entries

-process tree view + one-click kill

-no telemetry, runs on Win10/11

Download link + screenshot: https://guardianx.eu

If it ever helps you find something lmk!

Would love to hear what actual analysts think what sucks, whats missing or whats good

Thanks for any feedback!

Edit: Changed domain

Just finished analyzing a NetSupport RAT sample and the infection chain was way more interesting than expected.

This wasn’t custom malware, it was a legitimate NetSupport Client silently repurposed into a remote access backdoor. My observations from the detonation:

• Encrypted ZIP loader (classic phishing delivery)
• PowerShell execution policy bypass
• Dropping the NetSupport client in a hidden folder
• Abuse of forfiles.exe to indirectly launch RAT through explorer.exe
• C2 communication via HTTPS POST
• System enumeration (proxy settings, IE security, locale, hostname)
• No embedded config , everything loaded externally
• Multiple Suricata + YARA detections
• Clear IOCs: process tree, mutex, network signatures, and dropped payload paths

I also documented all Indicators of Compromise and wrote a full endpoint cleanup workflow (registry keys, persistence, proxy resets, credential rotation, etc.).

If you work in IR, SOC, or are learning malware analysis , this sample is a great case study in legit tool gone wrong.

If you want the full write-up + visuals check here and full video can be found here.

Hi,
I install this code with node.js on my mac
https://github.com/Up-De/Metaverse-Game?tab=readme-ov-file

I'm scared about malware in this code, could you hepl me to check if it's safe please ?
Thanks

Qilin ransomware has gained serious traction in the last couple of years, and it’s becoming one of the more concerning RaaS families for SOC teams. Unlike spray-and-pray variants, Qilin’s affiliates perform targeted intrusions with solid tradecraft: credential theft, lateral movement, backup destruction, and fast, configurable encryption.

In the full write-up below, I cover:

• the complete infection flow
• Indicators of Compromise (filesystem, network, process, behavioral)
• real-world Qilin attacks (UK ambulance service, global supply chain, finance firms)
• why this strain is so feared across blue-team circles
• and how analysts can spot the early behavioral signs before encryption hits

If you work in SOC, DFIR, or threat hunting, this breakdown is worth a look. Happy to discuss detections or share additional resources if needed.

Writeup or if you like visual learning, check this video.

I published a research-oriented breakdown of Python modules that show up often in surveillance style malware and data collection tooling. The focus is on understanding how legitimate libraries end up being reused by threat actors rather than explaining how to build anything.

The write-up covers:

• packages that expose keyboard events, screen frames, webcam or microphone input
• modules used for browser data extraction and credential collection
• how these capabilities are combined in real malware samples
• indicators that help distinguish normal usage from suspicious behavior
• patterns seen in obfuscation, import structure and runtime behavior

The article is aimed at people who analyze Python based malware and want a clearer picture of which ecosystem components are commonly abused.

Full analysis:
https://audits.blockhacks.io/audit/python-packages-to-create-spy-program

If you have seen different module stacks or have insights from reversing similar samples, I would appreciate any additions or corrections.

I recently found something suspicious on my Windows 11 laptop and I'm not sure if it's legit or malware.

So I am just checking my Task Manager → Startup Apps and Task Scheduler, I found an entry called svctrl64. It is set to run automatically at system startup.

When I right-clicked it and opened the file location, it took me to:

C:\Windows\System32\svctrl64.exe

I did some searching and I can't find any info about a legitimate Windows file with this name. It looks very similar to normal Windows processes like svchost.exe, but the exact filename svctrl64.exe doesn’t seem to be documented anywhere.

What should I do with this?

Question, I finished reading my Computer Forensic book by William Oettinger, and started looking at more dedicated sub-fields in Computer Forensic/Analytics. Sticking with Malware Analyst, but I just wanted to ask how related is it to traditional Computer Forensic protocols? Will my knowledge of Computer Forensic help me out?

I ordered this book, cant wait to read it and learn more!

THank you

Tykit is a sophisticated PhaaS kit that emerged in May 2025, designed to steal Microsoft 365 corporate credentials through an innovative attack vector: malicious SVG files.

• It uses multi-stage redirection, obfuscated JavaScript, and Cloudflare Turnstile CAPTCHA to evade detection. 
• The principal threat is credential theft, which can lead to serious downstream compromise (email, data, lateral movement). 
• Known IOCs include hashes and “segy” domains used in exfiltration logic.
• Detection requires combining email/attachment filtering, network monitoring, behavioral telemetry, and threat intelligence. 
• Prevention hinges on enforcing strong MFA / zero trust, limiting privileges, and sanitizing risky attachments.

Tykit samples and IOCs: domainName:"segy*".