Malware News
Open in Telegram
The latest NEWS about malwares, DFIR, hacking, security issues, thoughts and ... Partner channel: @cveNotify For ads: https://telega.io/c/malwr
Show more📈 Analytical overview of Telegram channel Malware News
Channel Malware News (@malwr) in the English language segment is an active participant. Currently, the community unites 16 124 subscribers, ranking 7 979 in the Technologies & Applications category and 2 301 in the USA region.
📊 Audience metrics and dynamics
Since its creation on невідомо, the project has demonstrated rapid growth, gathering an audience of 16 124 subscribers.
According to the latest data from 25 October, 2026, the channel demonstrates stable activity. Although there has been a change in the number of participants by -40 over the last 30 days and by 1 over the last 24 hours, overall reach remains high.
- Verification status: Not verified
- Engagement rate (ER): The average audience engagement rate is 4.83%. Within the first 24 hours after publication, content typically collects 2.07% reactions from the total number of subscribers.
- Post reach: On average, each post receives 778 views. Within the first day, a publication typically gains 333 views.
- Reactions and interaction: The audience actively supports content: the average number of reactions per post is 2.
- Thematic interests: Content is focused on key topics such as threat, kernel, cve-2025, actor, attack.
📝 Description and content policy
The author describes the resource as a platform for expressing subjective opinions:
“The latest NEWS about malwares, DFIR, hacking, security issues, thoughts and ...
Partner channel: @cveNotify
For ads: https://telega.io/c/malwr”
Thanks to the high frequency of updates (latest data received on 26 October, 2026), the channel maintains relevance and a high level of publication reach. Analytics show that the audience actively interacts with content, making it an important point of influence in the Technologies & Applications category.
16 124
Subscribers
+124 hours
+147 days
-4030 days
Loading data
Similar Channels
Tags Cloud
Incoming and Outgoing Mentions
---
---
---
---
---
---
Attracting Subscribers
October '26Oct '26
October '26
+87
in 1 channels
September '26
+57
in 0 channels
Get PRO
August '26
+647
in 4 channels
Get PRO
July '26
+806
in 2 channels
Get PRO
June '26
+700
in 0 channels
Get PRO
May '26
+637
in 0 channels
Get PRO
April '26
+476
in 1 channels
Get PRO
March '26
+257
in 0 channels
Get PRO
February '26
+324
in 1 channels
Get PRO
January '26
+348
in 0 channels
Get PRO
December '25
+397
in 0 channels
Get PRO
November '25
+412
in 0 channels
Get PRO
October '25
+188
in 0 channels
Get PRO
September '25
+95
in 2 channels
Get PRO
August '25
+45
in 0 channels
Get PRO
July '25
+51
in 0 channels
Get PRO
June '25
+46
in 1 channels
Get PRO
May '25
+31
in 1 channels
Get PRO
April '25
+56
in 0 channels
Get PRO
March '25
+22
in 0 channels
Get PRO
February '25
+36
in 0 channels
Get PRO
January '25
+34
in 1 channels
Get PRO
December '24
+457
in 0 channels
Get PRO
November '24
+1 858
in 3 channels
Get PRO
October '24
+980
in 0 channels
Get PRO
September '24
+1 070
in 1 channels
Get PRO
August '24
+957
in 2 channels
Get PRO
July '24
+611
in 1 channels
Get PRO
June '24
+483
in 0 channels
Get PRO
May '24
+637
in 0 channels
Get PRO
April '24
+640
in 1 channels
Get PRO
March '24
+806
in 2 channels
Get PRO
February '24
+521
in 1 channels
Get PRO
January '24
+293
in 0 channels
Get PRO
December '23
+361
in 2 channels
Get PRO
November '23
+85
in 2 channels
Get PRO
October '23
+86
in 1 channels
Get PRO
September '23
+97
in 0 channels
Get PRO
August '23
+85
in 0 channels
Get PRO
July '23
+63
in 0 channels
Get PRO
June '23
+77
in 0 channels
Get PRO
May '23
+65
in 0 channels
Get PRO
April '23
+75
in 0 channels
Get PRO
March '23
+75
in 0 channels
Get PRO
February '23
+38
in 0 channels
Get PRO
January '23
+63
in 0 channels
Get PRO
December '22
+99
in 0 channels
Get PRO
November '22
+70
in 0 channels
Get PRO
October '22
+101
in 0 channels
Get PRO
September '22
+165
in 0 channels
Get PRO
August '22
+986
in 0 channels
Get PRO
July '22
+27
in 0 channels
Get PRO
June '22
+31
in 0 channels
Get PRO
May '22
+63
in 0 channels
Get PRO
April '22
+72
in 0 channels
Get PRO
March '22
+74
in 0 channels
Get PRO
February '22
+43
in 0 channels
Get PRO
January '22
+112
in 0 channels
Get PRO
December '21
+99
in 0 channels
Get PRO
November '21
+42
in 0 channels
Get PRO
October '21
+34
in 0 channels
Get PRO
September '21
+36
in 0 channels
Get PRO
August '21
+48
in 0 channels
Get PRO
July '21
+95
in 0 channels
Get PRO
June '21
+77
in 0 channels
Get PRO
May '21
+11
in 0 channels
Get PRO
April '21
+39
in 0 channels
Get PRO
March '21
+28
in 0 channels
Get PRO
February '21
+40
in 0 channels
Get PRO
January '21
+54
in 0 channels
Get PRO
December '20
+938
in 0 channels
| Date | Subscriber Growth | Mentions | Channels | |
| 26 October | +2 | |||
| 25 October | +3 | |||
| 24 October | +4 | |||
| 23 October | +2 | |||
| 22 October | +5 | |||
| 21 October | +2 | |||
| 20 October | +10 | |||
| 19 October | +10 | |||
| 18 October | +2 | |||
| 17 October | 0 | |||
| 16 October | +4 | |||
| 15 October | +5 | |||
| 14 October | +8 | |||
| 13 October | +3 | |||
| 12 October | +3 | |||
| 11 October | +4 | |||
| 10 October | +7 | |||
| 09 October | 0 | |||
| 08 October | +3 | |||
| 07 October | +5 | |||
| 06 October | +3 | |||
| 05 October | 0 | |||
| 04 October | +1 | |||
| 03 October | +1 | |||
| 02 October | 0 | |||
| 01 October | 0 |
Channel Posts
VAHPEM/rust-deobf: Recover what obfuscation hides in Rust binaries (strings, crates, library functions, flattened control flow) via static analysis + Unicorn emulation, without running them. For malware triage, protected-app audits. ELF/PE/Mach-O, x86-64/ARM64/32-bit.
https://github.com/VAHPEM/rust-deobf
🎖@malwr
| 2 | x86rc/unthemidator: An automated Themida / Code Virtualizer / WinLicense (v3.0-v4) unpacker and dump fixer tool
https://github.com/x86rc/unthemidator
🎖@malwr | 428 |
| 3 | Monitor the Situation | Live World News Map & OSINT Dashboard
Live world news map and OSINT conflict tracker: source-linked reports, aircraft, ships, GPS interference, internet outages and regional crisis views.
https://monitor-the-situation.com/
🎖@malwr | 437 |
| 4 | Vulnerability Attack Case: Installation of a Web Shell and Execution of a Scanner by Exploiting a Telerik UI Vulnerability
The AhnLab SEcurity intelligence Center (ASEC) has identified two vulnerability attack cases that exploited a remote code execution vulnerability (CVE-2019-18935) targeting unpatched Telerik UI for ASP.NET AJAX servers. In the first incident, after exploiting the vulnerability, the attacker executed a reverse shell, attempted to perform privilege escalation, and installed a web shell; in the second […]
https://asec.ahnlab.com/en/95561/
🎖@malwr | 389 |
| 5 | MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration
ESET researchers uncover MythicRatatoskr – a previously unknown Go-based backdoor hiding its C&C server inside the Yggdrasil mesh network – that paved the way for a destructive attack against a Ukrainian grain firm
https://www.welivesecurity.com/en/eset-research/mythicratatoskr-yggdrasil-enabled-backdoor-deployed-uac0099-sandworm-collaboration/
🎖@malwr | 511 |
| 6 | Beware of Phishing Emails That Disguise Themselves as Project Material Purchase Requests
Recently, the AhnLab SEcurity intelligence Center (ASEC) identified a case of phishing emails that disguise themselves as project material purchase request forms. These emails impersonate employees of a specific company in Korea and trick recipients into opening a malicious XLS file attached to the email, which is disguised as a project material purchase request form. […]
https://asec.ahnlab.com/en/95598/
🎖@malwr | 581 |
| 7 | Dissecting Operation FlashHole, a complex attack by Lazarus
Kaspersky researchers analyze Operation FlashHole – a recent complex attack by Lazarus, involving a sophisticated malware set, watering-hole technique and abuse of CrossWeb EX financial security software.
https://securelist.com/lazarus-operation-flashhole/121541/
🎖@malwr | 523 |
| 8 | taniungou/php2shell-lab
https://github.com/taniungou/php2shell-lab
🎖@malwr | 506 |
| 9 | CyberLauncher: Static Analysis of a GTA VI-Themed Launcher Package
A hash-specific technical report on a deceptive launcher and installer chain. Static evidence, indicators, and limitations.
https://cyberlauncher-20261021-static-analysis.upbeatolm15.chatgpt.site/
🎖@malwr | 590 |
| 10 | figurophobia/gore: Godot RE toolkit: turn any Godot game (PCK/EXE) into an openable Godot project, with automatic encryption key recovery
https://github.com/figurophobia/gore
🎖@malwr | 527 |
| 11 | uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps
Introduction
uCreater (the vendor's own name for the product is YingGai) is a commercial Android surveillance platform built around 群控 (“mass control”). Branded through packages in the com.ucreator.* namespace, it is not a single malware family but a productized framework: a VirtualApp/LSPatch engine, a library of per-
https://www.0x0v1.com/ucreator-virtualization-based-android-spyware-platform-targeting-wechat-telegram-and-other-messaging-apps/
🎖@malwr | 455 |
| 12 | Does It Stop When Someone Is Watching? The Suspicious Behavior of a New Type of Infostealer
It is already well known that illegal software and cracked programs can be exploited for malware distribution. Recently, AhnLab identified a new type of information theft malware (Infostealer) disguised as an illegal program. This malware was first detected in mid-August and, after altering its execution method, began spreading widely in September. Notably, it not only […]
https://asec.ahnlab.com/en/95937/
🎖@malwr | 456 |
| 13 | How Some Malicious AI Skills Hide Instructions from Reviewers
https://blog.virustotal.com/2026/10/how-some-malicious-ai-skills-hide.html
🎖@malwr | 437 |
| 14 | microlift/rosemary: Compatibility layer and high level emulator hybrid for running macOS applications across operating systems and architectures
https://github.com/microlift/rosemary
🎖@malwr | 438 |
| 15 | ag3ntsc4rn/autorun-audit: Find code that runs without you asking: repo files that execute on folder open (VS Code tasks, agent hooks, MCP, devcontainers) and Python .pth/.start startup files.
https://github.com/ag3ntsc4rn/autorun-audit
🎖@malwr | 353 |
| 16 | giveen/decomp.anything: decomp.wtf fork: Windows PE matching, MinGW/clang-cl toolchains, and an optional REA MCP bridge
https://github.com/giveen/decomp.anything
🎖@malwr | 381 |
| 17 | https://www.sophos.com/en-us/blog/bronze-sandcastle-deploys-modified-meterpreter-shells
🎖@malwr | 340 |
| 18 | Reverse Engineering Pokémon Sprites (LGPE)
Rebuilding Pokémon Switch sprite rendering pipeline (LGPE edition)
https://triyan.dev/blog/reverse-engineering-pokemon-sprites-lgpe
🎖@malwr | 337 |
| 19 | Ukraineâs State Data-Exchange System Targeted by Russian-Speaking Operator via Graylog Log4Shell
An exposed open directory revealed a solo operator's full Log4Shell chain against a Graylog host holding Trembita logs, with the access log that proves execution.
https://hunt.io/blog/ukraine-state-data-exchange-graylog-log4shell
🎖@malwr | 425 |
| 20 | Glassworm Hacks OVH Clouds CLI tool
On 2026-10-19, the official OVHcloud CLI tool was compromised by the Glassworm threat actors who published five malicious versions to GitHub and Brew
https://opensourcemalware.com/blog/glassworm-hacks-ovh-clouds-cli-tool
🎖@malwr | 631 |
