Malware Developers Embed Deceptive Text to Evade AI Analysis

Malware developers are getting sneaky, hiding their spyware behind a façade of disturbing text about nuclear and biological weapons to throw AI analysis off their trail. By embedding this decoy content, they're making it harder for automated systems to detect their malicious code.

https://osintsights.com/malware-developers-embed-deceptive-text-to-evade-ai-analysis?utm_source=mastodon&utm_medium=social

#MalwareOperations #AiEvasion #EmergingThreats #MalwareAnalysis #ThreatIntelligence

We read more threat attribution claims than we make. Six signals separate the ones that hold up from the ones that don't, and analysts weigh them together to build a defensible case.

https://zeltser.com/six-signals-for-threat-attribution

#malwareanalysis #incidentresponse

Back in the Windows XP/7 days, Rootkits were like: "Nice Antivirus you got there. It’d be a shame if I loaded into Kernel space BEFORE it even wakes up." 💀

Check out my latest post on the Windows Boot Process and why ELAM (Early Launch Anti-Malware) exists. TL;DR: Turning the tables on early-stage malware! 💻👇

https://runmalware.com/?p=800

#MalwareAnalysis #Cybersecurity #WindowsInternals #Rootkit #BlueTeam #Infosec

🔍 New analysis: an Italian phishing campaign abusing Chrome Native Messaging to escape browser sandbox restrictions.

Attack chain:

Invoice phishing → obfuscated JS → DLL sideloading → malicious Chrome extension → Native Messaging Host → PowerShell execution.

Legitimate technologies chained together to turn Chrome into a backdoor.

📌 https://www.d3lab.net/breaking-out-of-chromes-sandbox-a-native-messaging-backdoor-observed-in-italy/

#ThreatIntelligence #Chrome #BrowserSecurity #MalwareAnalysis #CTI #CyberSecurity

Malware Developers Embed Deceptive Code to Evade AI Analysis

Malware developers are getting sneaky, hiding deceptive code in their spyware to throw off AI analysis - and it's working, with one developer adding text about nuclear and biological weapons to their malicious software. This clever trickery tricks AI systems into ignoring the real threat.

https://osintsights.com/malware-developers-embed-deceptive-code-to-evade-ai-analysis?utm_source=mastodon&utm_medium=social

#MalwareOperations #AiEvasion #EmergingThreats #MalwareAnalysis #DeceptiveCoding

I found an exposed installer on a malware distribution site.

The installer let me create a new admin account.

The rest got interesting.

https://potato.id/en/posts/i-accidentally-logged-into-threat-actor-website/

#CyberSecurity #ThreatHunting #InfoSec #ThreatIntel #ThreatIntelligence #Malware #MalwareAnalysis #WebSecurity #BlueTeam #DFIR #SOC #IncidentResponse #OSINT #PHP #RedTeam

I was tired of digging through endless random cybersecurity lists, so naturally I built another random cybersecurity list - just cleaner, prettier and actually organized.

Hack Hub is a curated directory of useful security resources.

https://hackhub.fyi

#CyberSecurity #InfoSec #Hacking #EthicalHacking #Pentesting #RedTeam #BlueTeam #DFIR #OSINT #ThreatIntel #MalwareAnalysis #BugBounty #CloudSecurity #MobileSecurity #OpenSource #SecurityTools #SecurityResearch #Linux #Hackers #Tech

The REMnux MCP server can now draft malware analysis reports using my new report template:

https://zeltser.com/ai-malware-analysis-remnux

#malwareanalysis #remnux

Malware analysis : outils ou état d'esprit ?

Les outils changent, les techniques évoluent — mais la capacité à raisonner sur un comportement inconnu reste le cœur du métier. Un sandbox ne remplace pas la compréhension de ce que le code *tente* de faire, ni pourquoi il le cache.

L'outillage facilite. L'analyse, elle, reste un muscle à entretenir. 🧠

#infosec #MalwareAnalysis #BlueTeam
https://www.secjuice.com/malware-analysis/

🚀 OhMyPCAP 4.0.0 is HERE!

The ultimate FOSS PCAP analyzer just got a massive upgrade for deeper file intelligence.

New in v4.0:
• Upgraded to YARA Forge Full ruleset — more comprehensive malware & threat detection
• Exiftool + rich file metadata analysis — get more file information even if there are no YARA matches

All the power you love is still here:
Suricata alerts, file alerts, Sankey diagrams, full-text search, ASCII transcripts, hexdumps, stream carving + single Docker/Podman container (perfect for air-gapped or quick spins).

Ideal for malware analysis, incident response, threat hunting, forensics & teaching.

Who’s pulling this version right now? Drop a ❤️+ reply with your main use case (malware samples? CTFs? real-world incidents? teaching?)

#PCAP #DFIR #Cybersecurity #Infosec #BlueTeam #ThreatHunting #Suricata #YARA #MalwareAnalysis

@chrissanders88 @lennyzeltser