Philippe Lagadec

@decalage
1,066 Followers
289 Following
257 Posts
Author of open-source projects oletools, olefile, ViperMonkey, ExeFilter, Balbuzard. Posting about #DFIR, #malware analysis, maldocs, file formats and #Python.
https://linktr.ee/decalage
Websitehttps://www.decalage.info
Githubhttps://github.com/decalage2
Twitterhttps://twitter.com/decalage2
Twittodonhttps://twittodon.com/share.php?t=decalage2&[email protected]
Philippe LagadecMar 9
WietzeMar 9

Yet another LNK flaw allows for target spoofing, yet executes any DLL, including remote via WebDAV. Even worse, unless you installed the Feb 2026 updates, MotW will be ignored.

Next to updating, your best defence is to look for RunDLL32 + Shell32 + Control_RunDLL executions with non-standard targets. After all, most users click accept on those MotW prompts.

See how this works on https://github.com/wietze/lnk-it-up

Philippe LagadecMar 3
Karsten HahnMar 3

New blog: Using LLMs the right way for malware analysis

💡Tips for building an autonomous AI analysis lab on a 12 yo laptop and getting stuff done faster without loss of accuracy.

https://blog.gdatasoftware.com/2026/03/38381-llm-malware-analysis

Philippe LagadecMar 3
jwzMar 3

That one XKCD thing, now interactive.

This is so much fun... Craig S. Kaplan: In my online undergraduate P5.js course, students are about to begin the module on motion and physics, including a bit of physics simulation using Matter.js. It suddenly...
https://jwz.org/b/yk4B

Philippe LagadecFeb 11
TaggartFeb 11

Here's my CVE-2026-20841 PoC.

(Not really, but I have a feeling it's something that rhymes with this)

Philippe LagadecFeb 10
A vulnerability in Notepad 🤦‍♂️
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841
Security Update Guide - Microsoft Security Response Center

Philippe LagadecFeb 6
How can we detect malicious documents exploiting CVE-2026-21509, the recent 0-day vulnerability in MS Office ?
=> I designed a YARA rule for this, which detects all the malicious files that have been reported.
I also improved oletools to analyze those files and see the suspicious URLs.
You can find the YARA rule and all the explanations about that vulnerability on my website https://decalage.info/CVE-2026-21509/
Philippe LagadecJan 26
Laurent CheylusJan 26
A Look Back at 30 Years of Development of ReactOS, a free and open-source Operating System to run Windows softwares #OSS #ReactOS https://reactos.org/blogs/30yrs-of-ros/
30 years of ReactOS

ReactOS is a free, opensource reimplementation of windows

Philippe LagadecJan 26
Karsten HahnJan 25

🦔 📹 New Video: Can office files be malicious without Macros?

➡️ VSTO Add-Ins
➡️ External Templates
➡️ Checklist for Office analysis
#MalwareAnalysisForHedgehogs
https://www.youtube.com/watch?v=RtHHckH5IsI

Malware Analysis - Malicious MS Office files without Macros

YouTube
Philippe LagadecJan 21
/r/netsecJan 21
oss-sec: GNU InetUtils Security Advisory: remote authentication by-pass in telnetd https://seclists.org/oss-sec/2026/q1/89
oss-sec: GNU InetUtils Security Advisory: remote authentication by-pass in telnetd

Philippe LagadecDec 16
circlDec 16

As we approach the end of the year, we have a small gift for everyone.

We ran a series of Rust training sessions as an introduction to the Rust programming language, and we recorded them. The videos, along with the training materials, are now available online.

Thanks to Quentin Jerome and all the participants for their contributions.

📽️ https://www.youtube.com/playlist?list=PLhSWiKucshm5vWvFCqtJePVVYgIXH6_6y
🔗 https://github.com/ngsoti/rust-training

#rust #rusttraining #programming #cybersecurity #opensource #training

Rust training

YouTube