Comprehensive Collection of Malware Analysis and Development Books Released for Security Researchers
A curated selection of books on malware analysis and development has been assembled, covering techniques for both creating and defending against malicious software across Windows, macOS, and Android platforms.
The collection begins with MalDev Academy Complete, a modular course on Windows malware development and offensive security. It guides readers from foundational topics such as C programming, Windows internals, and WinAPI to advanced subjects including PE files, memory manipulation, payload encryption, obfuscation, process injection, APC injection, and shellcode execution.
Its companion, MalDev Academy Extended Modules, expands on the core curriculum with specialized modules on Rust implementations, enhanced evasion tactics, and practical exercises designed to test deeper understanding of malware techniques.
The Art of Mac Malware by Patrick Wardle offers a practical guide to analyzing macOS threats. It covers infection vectors, persistence mechanisms, Mach-O binary analysis, dynamic debugging, and anti-analysis bypasses, concluding with a detailed case study of the EvilQuest malware.
The second volume focuses on building heuristic detection systems for macOS using Endpoint Security frameworks and code signing analysis to reduce false positives.
The Android Malware Handbook examines Android threats through static and dynamic analysis, feature extraction, and machine learning models for classifying banking trojans, ransomware, and spyware.
Classic references include Malware Analyst’s Cookbook, which provides recipes for classification, unpacking, memory forensics with Volatility, and rootkit detection, as well as Practical Malware Analysis, a foundational text on setting up isolated labs, using IDA Pro and WinDbg, and defeating packers and anti-debugging tricks.
The roundup concludes with Evasive Malware by Kyle Cucci, a field guide dedicated to analyzing samples that deliberately evade sandboxes, disassemblers, and forensic tools through context awareness and anti-forensics methods.
Related articles
Octagon Android RAT Poses as Bahrain Emergency Alert App to Steal Credentials and Establish Persistent Surveillance
A remote access trojan named Octagon targets Android devices by masquerading as the official emergency alerts application from Bahrain. The infection begins when victims download the BH-Alert.apk file from phishing websites. The malware guides users through seven steps to grant dangerous permissions while using encrypted code hidden inside a font file extension to evade static analysis. It installs a secondary component called OctagonPanel and deploys mutual-monitoring surveillance services that restart each other if terminated. Additional persistence is achieved through boot receivers, a fake Android account, and scheduled synchronization tasks every 30 minutes. The trojan abuses the Accessibility Service to record unlock patterns, PINs, and passwords while also harvesting SMS messages, contacts, call logs, and screenshots. A criminal-controlled VPN allows interception and redirection of victim traffic.
Distributed Crawler Poses as Human Visitor to Evade Analytics and Ad Filters
A detailed investigation revealed a sophisticated distributed crawler that successfully mimicked legitimate human browsing behavior across multiple unrelated websites. The crawler generated realistic events in Google Analytics while avoiding ad script loading and resource chains that would confirm genuine user sessions. Server logs showed consistent patterns of fake search engine referrers, internal navigation with fabricated Referer headers, and selective requests limited mostly to images returning 404 errors. Analysts built a graph-based detection system that correlated events across sites to expose the coordinated activity despite individual requests appearing benign. The campaign rotated browser signatures and IP addresses frequently, making single-site rate limiting ineffective. The case demonstrates how modern crawlers can exploit Measurement Protocol and incomplete bot detection to consume server resources without contributing to revenue.
Bots Now Form Over Half of Global Internet Traffic in 2025, Driving API Attacks and Business Metric Distortion
Automated clients generated more than 50% of analyzed internet traffic in 2025, with malicious bots responsible for 40% of the total volume. AI-enabled automation attacks increased 12.5 times year-over-year, while daily API attacks rose 113% according to Akamai data. Simple scripts still dominate volume at 59% of bot traffic, yet sophisticated botnets exceeding 4.5 million devices now distribute activity across residential proxies and compromised endpoints. Credential stuffing, scraping, and transaction abuse continue to target business logic rather than software vulnerabilities, distorting analytics, inflating infrastructure costs, and degrading user experience. Cloudflare reports that 20% of verified bot traffic now comes from AI crawlers, blurring lines between beneficial and harmful automation. Organizations must classify bots by intent, delegation, and business impact instead of relying on IP reputation or single signals such as User-Agent strings.
Astaroth Trojan Hijacks WhatsApp Web Sessions to Spread Banking Malware to Contacts
The operators of the Astaroth banking Trojan, also known as Guildma, have added a new module that turns infected Windows systems into automated spam bots for WhatsApp Web. The malware copies browser profiles from Chrome or Edge, launches a legitimate WebDriver instance, and connects to an already authenticated WhatsApp Web session using the WPPConnect/WA-JS library. Once active, the bot scans the victim's contact list and sends each recipient a personalized greeting, a ZIP archive containing the Astaroth loader, and a closing message, all generated with randomized phrasing to evade detection. The technique leverages the trust users place in messages from known contacts, significantly increasing the likelihood of successful infection. Researchers at CrowdStrike note code similarities with tools used by other Latin American groups, including Vareg, suggesting shared development or active exchange of components. Indicators of compromise include PowerShell downloads of WebDriver, creation of ChromeAuto_ folders in C:\Users\Public\Temp, headless Chromium execution, and network activity tied to WPPConnect components.