Malware News
前往频道在 Telegram
The latest NEWS about malwares, DFIR, hacking, security issues, thoughts and ... Partner channel: @cveNotify For ads: https://telega.io/c/malwr
显示更多📈 Telegram 频道 Malware News 的分析概览
频道 Malware News (@malwr) 英语 语言赛道中的 是活跃参与者。目前社区聚集了 16 124 名订阅者，在 技术与应用 类别中位列第 7 979，并在 美国 地区排名第 2 301 位。
📊 受众指标与增长动态
自 невідомо 创建以来，项目保持高速增长，吸引了 16 124 名订阅者。
根据 25 十月, 2026 的最新数据，频道保持稳定运转。过去 30 天订阅人数变化为 -40，过去 24 小时变化为 1，整体触达仍然可观。
- 认证状态： 未认证
- 互动率 (ER)： 平均受众互动率为 4.83%。内容发布后 24 小时内通常能获得 2.07% 的反应，占订阅者总量。
- 帖子覆盖： 每篇帖子平均可获得 778 次浏览，首日通常累积 333 次浏览。
- 互动与反馈： 受众积极参与，单帖平均反应数为 2。
- 主题关注点： 内容集中在 threat, kernel, cve-2025, actor, attack 等核心主题上。
📝 描述与内容策略
作者将该频道定位为表达主观观点的平台：
“The latest NEWS about malwares, DFIR, hacking, security issues, thoughts and ...
Partner channel: @cveNotify
For ads: https://telega.io/c/malwr”
凭借高频更新（最新数据采集于 26 十月, 2026），频道始终保持新鲜度与高覆盖。分析显示受众积极互动，使其成为 技术与应用 类别中的关键影响点。
16 124
订阅者
+124 小时
+147 天
-4030 天
帖子存档
16 124
VAHPEM/rust-deobf: Recover what obfuscation hides in Rust binaries (strings, crates, library functions, flattened control flow) via static analysis + Unicorn emulation, without running them. For malware triage, protected-app audits. ELF/PE/Mach-O, x86-64/ARM64/32-bit.
https://github.com/VAHPEM/rust-deobf
🎖@malwr
16 124
x86rc/unthemidator: An automated Themida / Code Virtualizer / WinLicense (v3.0-v4) unpacker and dump fixer tool
https://github.com/x86rc/unthemidator
🎖@malwr
16 124
Monitor the Situation | Live World News Map & OSINT Dashboard
Live world news map and OSINT conflict tracker: source-linked reports, aircraft, ships, GPS interference, internet outages and regional crisis views.
https://monitor-the-situation.com/
🎖@malwr
16 124
Vulnerability Attack Case: Installation of a Web Shell and Execution of a Scanner by Exploiting a Telerik UI Vulnerability
The AhnLab SEcurity intelligence Center (ASEC) has identified two vulnerability attack cases that exploited a remote code execution vulnerability (CVE-2019-18935) targeting unpatched Telerik UI for ASP.NET AJAX servers. In the first incident, after exploiting the vulnerability, the attacker executed a reverse shell, attempted to perform privilege escalation, and installed a web shell; in the second […]
https://asec.ahnlab.com/en/95561/
🎖@malwr
16 124
MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration
ESET researchers uncover MythicRatatoskr – a previously unknown Go-based backdoor hiding its C&C server inside the Yggdrasil mesh network – that paved the way for a destructive attack against a Ukrainian grain firm
https://www.welivesecurity.com/en/eset-research/mythicratatoskr-yggdrasil-enabled-backdoor-deployed-uac0099-sandworm-collaboration/
🎖@malwr
16 124
Beware of Phishing Emails That Disguise Themselves as Project Material Purchase Requests
Recently, the AhnLab SEcurity intelligence Center (ASEC) identified a case of phishing emails that disguise themselves as project material purchase request forms. These emails impersonate employees of a specific company in Korea and trick recipients into opening a malicious XLS file attached to the email, which is disguised as a project material purchase request form. […]
https://asec.ahnlab.com/en/95598/
🎖@malwr
16 124
Dissecting Operation FlashHole, a complex attack by Lazarus
Kaspersky researchers analyze Operation FlashHole – a recent complex attack by Lazarus, involving a sophisticated malware set, watering-hole technique and abuse of CrossWeb EX financial security software.
https://securelist.com/lazarus-operation-flashhole/121541/
🎖@malwr
16 124
CyberLauncher: Static Analysis of a GTA VI-Themed Launcher Package
A hash-specific technical report on a deceptive launcher and installer chain. Static evidence, indicators, and limitations.
https://cyberlauncher-20261021-static-analysis.upbeatolm15.chatgpt.site/
🎖@malwr
16 124
figurophobia/gore: Godot RE toolkit: turn any Godot game (PCK/EXE) into an openable Godot project, with automatic encryption key recovery
https://github.com/figurophobia/gore
🎖@malwr
16 124
uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps
Introduction
uCreater (the vendor's own name for the product is YingGai) is a commercial Android surveillance platform built around 群控 (“mass control”). Branded through packages in the com.ucreator.* namespace, it is not a single malware family but a productized framework: a VirtualApp/LSPatch engine, a library of per-
https://www.0x0v1.com/ucreator-virtualization-based-android-spyware-platform-targeting-wechat-telegram-and-other-messaging-apps/
🎖@malwr
16 124
Does It Stop When Someone Is Watching? The Suspicious Behavior of a New Type of Infostealer
It is already well known that illegal software and cracked programs can be exploited for malware distribution. Recently, AhnLab identified a new type of information theft malware (Infostealer) disguised as an illegal program. This malware was first detected in mid-August and, after altering its execution method, began spreading widely in September. Notably, it not only […]
https://asec.ahnlab.com/en/95937/
🎖@malwr
16 124
How Some Malicious AI Skills Hide Instructions from Reviewers
https://blog.virustotal.com/2026/10/how-some-malicious-ai-skills-hide.html
🎖@malwr
16 124
microlift/rosemary: Compatibility layer and high level emulator hybrid for running macOS applications across operating systems and architectures
https://github.com/microlift/rosemary
🎖@malwr
16 124
ag3ntsc4rn/autorun-audit: Find code that runs without you asking: repo files that execute on folder open (VS Code tasks, agent hooks, MCP, devcontainers) and Python .pth/.start startup files.
https://github.com/ag3ntsc4rn/autorun-audit
🎖@malwr
16 124
giveen/decomp.anything: decomp.wtf fork: Windows PE matching, MinGW/clang-cl toolchains, and an optional REA MCP bridge
https://github.com/giveen/decomp.anything
🎖@malwr
16 124
Reverse Engineering Pokémon Sprites (LGPE)
Rebuilding Pokémon Switch sprite rendering pipeline (LGPE edition)
https://triyan.dev/blog/reverse-engineering-pokemon-sprites-lgpe
🎖@malwr
16 124
Ukraineâs State Data-Exchange System Targeted by Russian-Speaking Operator via Graylog Log4Shell
An exposed open directory revealed a solo operator's full Log4Shell chain against a Graylog host holding Trembita logs, with the access log that proves execution.
https://hunt.io/blog/ukraine-state-data-exchange-graylog-log4shell
🎖@malwr
16 124
Glassworm Hacks OVH Clouds CLI tool
On 2026-10-19, the official OVHcloud CLI tool was compromised by the Glassworm threat actors who published five malicious versions to GitHub and Brew
https://opensourcemalware.com/blog/glassworm-hacks-ovh-clouds-cli-tool
🎖@malwr
