Melted in Hex

A malicious file is only one way in.

A friendly git-helper skill hides a payload your Markdown preview never shows you.

Why your AI coding agent obeys strangers: the confused-deputy bug at the root of prompt injection, the trust tiers involved, and why the fix has to live outside the model.

To hide its command-and-control server, this operation writes the address onto a public blockchain.

AnalystAIPack is an open, Apache-2.0 library of runnable agent skills that give an AI agent a malware analyst's working knowledge across analysis, RE, and threat hunting.

We have all trained ourselves to look for the call home: the hard-coded IP, the suspicious .xyz domain, the base64 URL that decodes to something hostile.

The short version A package called nhmpy showed up on PyPI sitting one keystroke away from NumPy (n-h-mpy instead of n-u-mpy).

MuddyWater is an APT group that has been active throughout 2017, targeting victims in the Middle East with in-memory vectors leveraging PowerShell.

Flare-On is an annual CTF challenge organized by FireEye with a focus on reverse engineering.

Noblis is in-development ransomware which is built in Python and packed by PyInstaller.

MD5: de7b31517d5963aefe70860d83ce83b9 [VirusTotal ] FileName: BAYER_CROPSCIENCE_OFFICE_BEOGRAD_93876.doc FileType: MS Word Document The Word file has an embedded macro.

Introduction: Attackers have been recently breaking into corporate servers via RDP brute force attacks to spread a new variant of ransomware called LockCrypt.

Flare-On is an annual CTF-style challenge organized by FireEye with a focus on reverse engineering.

PyInstaller and py2exe bundle a Python application and all its dependencies into an executable file.

Celery is an asynchronous task queue based on distributed message passing.

Summary: The sample is a JavaScript file.