Theo

security researcher

[Theo @theokwebb]

My talk with @hinoshiba from @Botconf is out! :)
At the start, Kuma talks about repo squatting as a malware delivery technique. From 9:25, I talk about GPU-based anti-analysis and the overall campaign:
https://t.co/ATgvRoK68C

[Theo @theokwebb]

@hinoshiba You did such a great job! I don't think that will be our last one together ;)

[Theo @theokwebb]

Slides are available here:
https://t.co/f7Vzqe4NFe

[Theo @theokwebb]

My talk with @hinoshiba from @Botconf is out! :)
At the start, Kuma talks about repo squatting as a malware delivery technique. From 9:25, I talk about GPU-based anti-analysis and the overall campaign:
https://t.co/ATgvRoK68C

[Theo @theokwebb]

Yesterday, I presented at BSides Tokyo 2026.
Thank you to the organizers for the opportunity, and thank you to everyone who came up to me after my talk. I really appreciate it💜

[Theo @theokwebb]

#BsidesTokyo 2026に登壇しました！沢山の出会いに感謝します。
ここで頂いたフィードバックは私のモチベーションと成長の糧となります。
楽しい時間をありがとうございました！

[Theo @theokwebb]

@FABO97662188 @gmo_ierae So sorry.. I just saw your message. Thanks so much for the kind words.

[GMOサイバーセキュリティ byイエラエ株式会社【公式】 @gmo_ierae]

【ブログを公開しました】BotConf 2026 登壇報告: GPUGate: Repo SquattingとOpenCL解析回避によるHijackLoaderの配送

https://t.co/uk7tp8KcrY

登壇者本人による、「Botconf 2026」の登壇レポートです🎉ぜひご覧ください！

[eversinc33 🤍🔪⋆｡˚ ⋆ @eversinc33]

When practicing on a VM crackme recently, I created a devirtualizer which lifts the virtual machine to LLVM to defeat the protection. LLVM-based devirtualisation is a lot of fun and I wrote down my experience and lessons learned on my blog:

https://t.co/LiWNIj31uK

[Check Point Research @_CPResearch_]

VECT RaaS is making headlines via partnerships with BreachForums and TeamPCP. Behind the polished image is a weak operator: the ransomware is bug-ridden, poorly built, and most encrypted files aren’t fully recoverable, even with the decryption key.
https://t.co/4tK7OIoIiw

[eversinc33 🤍🔪⋆｡˚ ⋆ @eversinc33]

Had a lot of fun presenting at BotConf! Talk is already available on YouTube :)

https://t.co/j9quOv6oOC

[𝙁 𝙀 𝙇 𝙄 𝙓 𝙈 @felixm_pw]

Introducing Combat Theater, a malware technique emulator built for blue teams, detection engineers and security researchers to perform testing and detection validation quickly and easily.

Check out the introduction blog to learn more!

https://t.co/mX8qmWDI9W

[GMOサイバーセキュリティ byイエラエ株式会社【公式】 @gmo_ierae]

Theo Webb and Shungo Kumasaka will be speaking at Botconf 2026, an international conference in France focused on botnet countermeasures and malware research.
https://t.co/r0vhMyv4vy

[GMOサイバーセキュリティ byイエラエ株式会社【公式】 @gmo_ierae]

【JSAC2026のLTの資料が公開されました】LTでは、マルウェアの配布手法に注目し、Repo Squatting が実行されるポイントのリポジトリネットワークの詳細な挙動について解説しました!

Deceiving Developers: Abusing Legitimate GitHub Repositories to Deliver Malware - Theo Webb
https://t.co/HRwdiZJZKS

[Theo @theokwebb]

Slides from my JSAC2026 lightning talk are now available.
I cover repo squatting as a malware delivery technique, why it works, and how it was used in the GPUGate campaign:
https://t.co/6KnWtrM8hM

[Theo @theokwebb]

@eversinc33 Great job on this mate. Really enjoyed it

[Theo @theokwebb]

@rpargman @d4rksystem You can probably add this to your anti-analysis techniques list. This was an absolute pain haha

[Theo @theokwebb]

It’s been a while since I posted. My last one was back in 2023 about my roadmap for learning C.
Last year I joined @gmo_ierae as a security engineer.
Here’s my first research report revisiting the malware dubbed “GPUGate.”
https://t.co/XYasJ8znA2

[GMOサイバーセキュリティ byイエラエ株式会社【公式】 @gmo_ierae]

以前、弊社ブログにて注意喚起した正規リポジトリの悪用によるマルウェアの配布について、 #JSAC2026 でLTを行いました。

Deceiving Developers: Abusing Legitimate GitHub Repositories to Deliver Malware - Theo Webb

本ブログでは、JSAC2026のLT内では紹介しきれないマルウェアの詳細な動作について紹介します。

Revisiting GPUGate: Repo Squatting and OpenCL Deception to Deliver HijackLoader

https://t.co/atLFQIYc7u

[Theo @theokwebb]

It uses GPU-based anti-analysis and code deception to confuse analysts.

[Check Point Research @_CPResearch_]

Check Point Research unveils #VoidLink, a highly modular Linux malware framework with 30+ plugins, cloud/container persistence, robust OPSEC (runtime encryption, rootkits, self-delete), and links to Chinese-affiliated actors. Full analysis on our blog
https://t.co/9ucKf6eyGC