Malware & Botnets
Cybersecurity news in this category
Automating Malware Reverse Engineering with Local LLMs, PyGhidra and Neo4j Graphs
GitHub Removes 10,000 Malware Repositories After Public Exposure but Takes No Further Action
Dolphin X Malware Adds AI Profiler to Rank and Prioritize High-Value Victims After Infection
YARA Style Guide: Comprehensive Best Practices for Naming, Structuring and Maintaining Detection Rules
The article presents a detailed translation and adaptation of Florian Roth's YARA Style Guide, aimed at bringing consistency to large collections of YARA rules used by security teams. It explains how to construct informative rule names that include threat category, context, operating system, architecture, technology, packers and creation date, using prefixes such as MAL, HKTL, WEBSHELL, EXPL, VULN, SUSP and PUA. The guide recommends specific metadata fields including description, author, date, reference, score and hash, along with a three-tier string categorization system using $x*, $s* and $a* prefixes for high-specificity, group and preliminary strings. It also covers false-positive filters marked with $fp*, proper indentation, readable hex and string formatting, and a recommended order of conditions that begins with header checks and ends with false-positive filters. The publication highlights the benefits of this structured approach for long-term maintainability and faster triage during mass detections. Additional references point to the separate YARA-Performance-Guidelines project for deeper optimization techniques.
187,064 Instructions for One Flag: Reverse Engineering HTB Callfuscated Insane Challenge
A detailed technical breakdown of the HackTheBox Callfuscated reversing challenge reveals an extremely heavy obfuscation scheme built around a custom virtual machine, mixed Boolean-arithmetic transformations, opaque predicates, and call-based junk code. The binary implements a password checker that executes 187,064 instructions even on a short input because every real operation is wrapped inside thousands of call/pop gadgets. The author bypassed static analysis by building a ptrace-based tracer, dumping the 586-cell VM program array, and writing a Python emulator that faithfully replays the recorded execution trace. After fixing several edge cases involving rand() return addresses and operand-size detection, the emulator reproduced the exact register state of the original binary. Dynamic analysis exposed that the VM performs simple big-endian word construction followed by XOR operations with eight constant pairs, allowing the flag to be recovered directly without further symbolic execution.
HollowGraph Malware Abuses Microsoft 365 Calendars to Conceal Stolen Files and C2 Traffic
A newly discovered espionage malware called HollowGraph turns compromised Microsoft 365 calendars into hidden channels for receiving commands and exfiltrating stolen data. The implant schedules events for 13 May 2050, a distant future date chosen to reduce the likelihood of discovery by account owners. Developed as a Windows DLL, HollowGraph leverages the Microsoft Graph API to blend its traffic with legitimate corporate service activity, eliminating the need to contact attacker-controlled servers directly. It supports two primary commands: “get” to retrieve instructions attached to operator-created appointments and “send” to encrypt collected data with RSA and AES-256-GCM before uploading it as calendar attachments. Separate encryption keys are used for inbound commands and outbound data, while stolen files are written to a disguised logAzure.txt file. Researchers have identified at least 12 compromised systems, three of which remained active, with operations observed between 3 June and 9 July 2026 and primarily targeting Israeli entities.
ClickLock Stealer Locks macOS Until Victims Enter Real Passwords and Exfiltrates Browser, Crypto and Keychain Data
Researchers at Group-IB have discovered a new macOS infostealer called ClickLock that blocks normal computer operation until the user supplies valid account credentials. The campaign, active since May 2026, has already affected at least 100 victims across 33 countries. Infection begins with a fake Cloudflare verification page that tricks users into pasting a command into Terminal, after which the malware silently downloads four modules from compromised WordPress sites. A convincing macOS password prompt then appears; ClickLock validates the entered password locally and only forwards working credentials to the operators. Two persistent LaunchAgent modules repeatedly close all visible applications and force Keychain authorization, while a separate process disables Notification Center for several hours. The malware harvests data from eight browsers, 31 crypto-wallet extensions, seven password managers, eight desktop wallets, Keychain items, command history, FTP credentials and six blockchain addresses before exfiltrating everything via Telegram bots and hijacked domains, leaving behind a disguised GSocket backdoor.
New Russian Translations of Leading Cybersecurity Books on Ethical Hacking, Reverse Engineering, Malware Analysis, and Privacy Released
A popular Russian library project has published fresh translations of more than a dozen top-tier English-language books covering ethical web hacking, bug bounty hunting, network protocol attacks, binary reverse engineering, malware analysis, fuzzing, and privacy protection. The updates continue the long-running “Materials on Hacking in Russian” series, with all books made freely available through the Hackbooks platform. Titles include Web Hacking 101, Real-World Bug Hunting, the official Nmap guide, Attacking Network Protocols, a comprehensive beginner’s reverse engineering textbook, and specialized works on binary format analysis, obfuscation techniques, Windows security internals, Practical Malware Analysis, Evasive Malware, and The Fuzzing Book. Additional volumes address the history of state surveillance, Crypto Wars, and the societal implications of mass data collection. Each book entry features detailed descriptions, practical examples, and direct links to the corresponding Hackbooks cards, enabling Russian-speaking researchers and students to study advanced information security topics without language barriers.
TELEPUZ Malware Spreads via ClickFix Social Engineering, Targets Windows with Modular Capabilities and Resilient C2 Infrastructure
Since late April 2026, compromised websites have been distributing the new modular malware TELEPUZ through the ClickFix scheme. Attackers replace standard browser error fixes with instructions that trick users into pasting and executing a PowerShell command from the clipboard, which then downloads an intermediate loader, the Vidar infostealer, and finally TELEPUZ via rundll32.exe. The malware performs extensive environment checks to avoid sandboxes and debuggers before disabling Windows security features, escalating privileges, and persisting as a service inside svchost.exe. For command-and-control, TELEPUZ relies on WebSocket connections with multiple fallback mechanisms, including encrypted links stored in Telegram profiles, Steam accounts, DNS records, and a Polygon smart contract. It offers a wide range of capabilities such as file manipulation, keylogging, screenshot capture, process management, cookie theft from Chromium browsers, and arbitrary JavaScript execution in both Chromium and Firefox. Researchers at Elastic assess TELEPUZ as a malware-as-a-service offering still in early development, evidenced by a limited number of C2 domains yet frequent daily builds and rapid updates hosted on compromised sites in Brazil and India.
RedHook Android Trojan Automatically Enables Wireless ADB Debugging to Hijack Devices Without Root or User Interaction
The RedHook trojan, first identified in July 2025, has gained a novel capability that allows it to independently activate wireless ADB debugging on infected Android devices, granting system-shell privileges without requiring root access or any victim interaction. Infection begins through social engineering calls or messages impersonating bank or government officials, tricking users into installing malicious APKs hosted on legitimate platforms such as GitHub repositories and Amazon S3 storage. Once installed, the malware obtains accessibility service permissions and then silently navigates device settings, taps the build number seven times to unlock developer options, and enables wireless debugging. Leveraging code derived from the popular Shizuku tool, RedHook launches its own ADB client to connect directly to the local debugging server, bypassing the need for a computer. With elevated privileges, the trojan can install or uninstall applications, modify protected settings, grant itself permissions, and exfiltrate data and screen recordings over encrypted channels while employing multiple persistence techniques including mutual process resurrection and post-reboot restoration. Attacks have so far been concentrated in Southeast Asia, particularly Vietnam and Indonesia. Security experts recommend installing apps only from official stores and exercising caution with accessibility permission requests.
Fake Telegram Proxy Repositories on GitHub Deliver Stealer Malware to Home Users Seeking to Bypass Restrictions
Cybersecurity researchers from Solar 4RAYS at GC Solar have uncovered a widespread campaign where attackers distribute fake Telegram proxy tools on GitHub and mirror sites. The scheme capitalizes on Russian users searching for ways to circumvent Telegram restrictions, with malicious repositories quickly replacing legitimate ones in search engine results. Victims download trojans such as Salat Stealer or Santa Stealer that are disguised as useful proxy software, complete with copied README files, layout, and even the original developer’s donation details. These stealers extract browser sessions, passwords, and specific file types, potentially leading to account takeovers and data theft. The attack benefits from high user trust in GitHub, although the platform’s hosting service cannot always review the constant stream of new uploads. Experts warn users to avoid automatic downloads and to watch for warning signs such as brand-new accounts, zero stars or forks, and requests to disable antivirus software before installation.