Really nice paper on defeating evasive malware - huge kudos to the authors ππ₯
In a nutshell:
They use AI-generated instruction-skip YARA rules to automatically bypass evasions inside CAPE and expose hidden malware behavior π€―
Also interesting: Joe Sandbox came out as the clear leader for malware family detection compared to the other sandbox platforms in their evaluation ππ¦
Great to see academic research using Joe Sandbox as a strong benchmark πͺ
https://t.co/xCjhMMtJsI
Unknown phishing kit with browser-fingerprinting / VM-detection spotted π΅οΈββοΈ
The script probes WebGL, RTC/STUN, plugins, console behavior, prototype hooks, screen/window/navigator props and more to identify analysis environments.
Joe Sandbox detects the evasion and directly chains the run to a bare-metal analyzer β where the phishing payload continues execution πͺπ₯
π https://t.co/QHALS8BAng
π https://t.co/JBLeNsGF5P
#JoeSandbox #Phishing #MalwareAnalysis #ThreatIntel #CyberSecurity #DFIR #Evasion
π¨ New analysis from Joe Reverser: Sikka BFaaS β an operationalized Indian banking fraud toolkit targeting SBI, HDFC, Paytm, BHIM/NPCI UPI, FreeCharge, PhonePe, Axis Bank & IRCTC.
π Implements HWID-bound licensing, reseller/operator roles, AES-encrypted C2 traffic, and encrypted `.rg` session files.
𧬠Uses stolen mobile banking API keys, device fingerprint spoofing, OAuth/session hijacking, OTP interception flows, and UPI cryptographic abuse.
π‘οΈ Includes anti-debugging, VM checks, tool blacklisting, registry tampering, and Chrome/WebDriver automation.
Deep technical breakdown in Joe Reverser. πβοΈ
https://t.co/xipiXHZGOX
π¨ New research from Joe Security: A spear-phishing campaign targeting Pakistanβs PSCA & PPIC3 abused β‘ VS Code Remote Tunnels and Discord webhooks for stealthy remote access.
Instead of stealing Microsoft accounts, attackers enrolled victim machines into their own VS Code tunnel infrastructure using device-code authentication - a clever twist on classic phishing techniques. π―
Key findings:
πΉ Malicious Office macros downloading & executing `code.exe`
πΉ Abuse of legitimate VS Code tunneling workflows
πΉ Discord webhooks used for exfiltration & status reporting
πΉ ClickOnce-based PDF delivery chain impersonating Adobe Reader
πΉ Trusted Microsoft infrastructure leveraged for persistence & stealth
This campaign highlights how threat actors increasingly weaponize legitimate developer tooling to blend into normal cloud traffic. βοΈπ»
Read the full analysis here π
https://t.co/MQ9X4vuwhz
#CyberSecurity #ThreatIntelligence #MalwareAnalysis #Phishing #VSCode #Microsoft #BlueTeam #DFIR #JoeSecurity
π¨ Auphora Stealer: AI apps entering infostealer scope
Early signals point to "Claude-aware" collection routines (e.g., harvest_claude()):
β’ Electron storage parsing (LevelDB / IndexedDB)
β’ Session cookies & auth artifacts
β’ Extensions / MCP configs
β’ User context data
π― Primary objective: Anthropic API keys
β from LevelDB state
β from ANTHROPIC_API_KEY env vars
AI desktops should be treated like browsersβsame surface, higher value.
https://t.co/LdQLSxJSGx
π¨ Threat Insight: Emerging LLM-Generated Infostealer π€π
A Python-based infostealer π has surfaced under the label βHackerAI Stealer Pipeline,β presented as an βauthorized pentesting tool.β Despite the branding, the workflow clearly aligns with credential-theft operations: Chrome password extraction π β data staging π¦ β Telegram exfiltration π€ β self-deletion π§Ή.
Attribution to a specific platform remains unverified β οΈ. However, the structured pipeline, consistent formatting, and descriptive comments strongly suggest LLM-assisted development π§ π».
This reflects a broader shift π: adversaries are leveraging AI to rapidly generate and refine commodity malware, reducing development effort while increasing scalability.
https://t.co/Y5DVV5fBzP
#ThreatIntel #CyberSecurity #Malware #LLM
π§΅ From a "harmless" DLL to a fully reconstructed multi-stage #CobaltStrike Beacon.
In our latest blog, we break down how we:
π Uncovered a hidden multi-stage loader chain
π§ Bypassed anti-sandbox domain checks
π οΈ Rebuilt dumped memory into runnable PE files
π Reconstructed C2 comms & crypto
π― Extracted IOCs and linked the implant to known infrastructure
A deep dive into loader reconstruction, memory forensics, protocol analysis, and attribution.
Read it here: https://t.co/4PlAL20CK3 #MalwareAnalysis #ThreatIntel #DFIR #ReverseEngineering #InfoSec
π¨ CVE-2026-34621 β Adobe Acrobat Reader PDF Vulnerability πβ οΈ
Multiple analysts have taken a deep dive into this threat using π§ͺ Joe Reverser β definitely worth exploring:
π Analysis #1
https://t.co/Fl6aKvIUkW
π Analysis #2
https://t.co/zO9hluBRt7
Packed with insights into modern PDF exploitation techniques π‘π οΈ
#malware #infosec #threatanalysis
π¨ Joe Reverser's Export Mode (rebranded from Skill Only Mode) in action - you can dive deep, ask the agent specific questions, and really understand whatβs going on inside a sample.
Take this recent case π
A 64-bit loader hiding a Meterpreter reverse shell:
β’ RC4-encrypted payload in .fltpk
β’ Dynamic API resolution via PEB walking
β’ Anti-debugging (RDTSC + BeingDebugged)
β’ Heavy obfuscation to evade static tools
No more just reading reports β now you can explore and question every layer.
π¬ Check the report:
https://t.co/5GEB7cC0Fy
β¨ Bonus: The report now includes a capability image + workflow & IOC diagrams