Spent the last 2 weeks working on a devirtualizer for VMProtect 3.5 and learning Remill. Idk yet if I will blog about it, but I at least wanted to publish the code:
https://t.co/GLqKWpOOU7
The approach is different from my last blog, as it lifts the whole x86 code of the VM
“Three months ago, I went to Ukraine for a week. I ended up staying.”
@delian_ai’s Mark Melhorn on setting up shop and delivering where it matters.
“Even our CEO came for a four-week sprint to help solve some knotty issues and lived the same conditions.”
This is my very definition of a defense tech company.
in 2000 a programmer discovered you can implement coroutines in C using the same switch trick as Duff's Device
it's called Tatham's Coroutine. it still compiles and is technically valid C
he used it in production inside PuTTY (the SSH client used by millions)
Simon Tatham's own words: "As far as I know, this is the worst piece of C hackery ever seen in serious production code."
Rust reverse engineering is about to get a lot easier. 🦀
I'm thrilled to announce that Oxidizer, the first Rust decompiler, has been officially merged into angr!
Try it out: https://t.co/D9ILIgVH1K
You can also find the paper here: https://t.co/k97qZRvEAm
For years, Rust binaries made reversing a nightmare. Modern decompilers only support C, lacking meaningful types, constructs, and language-specific functions. Led by @34r7hm4n, we're releasing our S&P work Oxidizer, the first deep Rust decompiler, built on angr!
Interested? 🧵👇
Early this week, we had a meeting at Apple Park in Cupertino. While there, we also shared with Apple our latest vulnerability research report: the first public macOS kernel memory corruption exploit on M5 silicon, surviving MIE. It was laser printed, in honor of our hacker friends.
Full story: https://t.co/AmKMGUmWPt
🕵️♂️We’ve observed a callback phishing campaign abusing legitimate PayPal invoice workflows. Here’s how it works⤵️
Attackers create invoices through PayPal, which are then delivered to recipients with instructions to contact the sender. The actual phishing occurs during this follow-up...
To make the campaign scalable and appear more legitimate, invoices are created through PayPal and sent via distribution lists created in Microsoft Outlook to addresses hosted on dedicated (criminal-owned) domains.
The target addresses act as “exploders” meaning they automatically redistribute incoming messages to large numbers of pre-configured emails.
As a result:
✅All messages are legitimately DKIM-signed by PayPal
✅Authentication is validated
✅Emails are then ARC-sealed by Outlook
For the final recipient, the messages appear fully authenticated and legitimate.
Subjects observed include ⤵️
✉️Invoice from Question ! Get in touch, 8OO_596_O886. PPL (TRX-#1234)
✉️Invoice from Question ! Get in touch, 8OO_596_O886. PPL (TRX-#1234)
✉️Invoice from Any Question. Get in touch,1-(800)596-0886. PPL (TRX-#1ab23)
✉️Invoice from Any Question. Get in touch,1-(800)596-0886. PPL (TRX-#1ab23)
@PayPal has been notified and is actively blocking the abuse from generating more invoices. @Microsoft has also been informed regarding the Outlook infrastructure involved.
Have you noticed that those deep-dive stories about complex Windows malware have pretty much vanished, especially in recent years? It feels like the era of "blockbuster" Windows malware has just gone silent, and this blog post tries to give some answers why.
https://t.co/sFsf3uPm5o
IDA 9.3sp2 has been released. This update addresses...
*reads notes*
> idaclang: fixed an argument injection in CLANG_ARGV that could lead to arbitrary code execution when opening a malicious database
oh
Zscaler ThreatLabz has published a technical analysis on activity we believe to be orchestrated by Tropic Trooper, using military-themed lures and a trojanized SumatraPDF to deploy AdaptixC2 with a custom GitHub-based C2, then pivoting to Visual Studio Code tunnels for remote access.
Read more: https://t.co/myj0VbDZYr
Zscaler ThreatLabz has observed a wave of ransomware attacks that share similar TTPs with prior BlackBasta initial access brokers. These attacks start with spam bombing followed by vishing via Microsoft Teams and Quick Assist to deploy malware. ThreatLabz has linked these attacks to a relatively unknown ransomware group called Payouts King.
Check out our technical analysis of Payouts King ransomware including the file encryption methods (4,096-bit RSA + 256-bit AES CTR) and techniques to evade malware sandboxes, antivirus and EDR detection.
Link: https://t.co/CsMH0onbSi
Adobe has confirmed our findings and has issued an emergency security update for all Adobe Reader (and other affected products) users.
https://t.co/2cOeuZ9Gn0
The underlying exploited zero-day vulnerability has been rated Critical (CVSS 9.6) and is tracked as CVE-2026-34621. It appears that Adobe has determined the bug can lead to arbitrary code execution — not just an information leak. This aligns with our findings and those of other security researchers over the last few days.
EXPMON would like to thank Adobe for releasing this emergency security update quickly to help protect users.
UPDATE NOW!
#expmon #zeroday #0day #pdf #adobereader #CVE-2026-34621