Self process injection occurs when a program loads or executes a malicious payload in its own address space (rather than writing to or…

Despite a recent doxxing attempt, Lumma Stealer has resurfaced, integrating browser fingerprinting into its C&C to collect WebGL/Canvas signatures for sandbox evasion and victim assessment.

K7 Labs exposed a Python malware using multi-layer encoding (Base64/BZ2/Zlib) and a PNG-disguised RAR archive. The payload executes in memory and achieves stealth by injecting into cvtres.exe.

SEQRITE exposed Operation DUPEHIKE targeting Russian HR with a malicious LNK bonus lure. The DUPERUNNER implant uses PowerShell and process injection into explorer.exe to deploy the Adaptix C2 Beacon.

KittyLoader is a highly evasive loader written in C / Assembly. Features Hijacks early execution by replacing the C runtime entrypoint (__scrt_common_main_seh) with custom assembly. Hides all modu…

DbgNexum is a 2026 PoC that uses Hardware Breakpoints and File Mapping to inject shellcode without standard APIs, making it invisible to most EDRs.

Silver Fox APT targets users with fake LINE installers delivering ValleyRat. New campaign uses rare "PoolParty" injection to evade detection.

Siber güvenlik dünyasında artık klasik ‘dosya tabanlı’ zararlı yazılımların geçerliliği azaldı. Bugün EDR sistemlerini atlatabilmenin yolu…

How threat actors abuse process tracing to rewrite executable instructions in volatile RAM, and how modern EDRs detect memory modification…