Malware News
Ir al canal en Telegram
The latest NEWS about malwares, DFIR, hacking, security issues, thoughts and ... Partner channel: @cveNotify For ads: https://telega.io/c/malwr
Mostrar más📈 Análisis del canal de Telegram Malware News
El canal Malware News (@malwr) en el segmento lingüístico de Inglés es un actor destacado. Actualmente la comunidad reúne a 16 117 suscriptores, ocupando la posición 7 776 en la categoría Tecnologías y Aplicaciones y el puesto 2 298 en la región EEUU.
📊 Métricas de audiencia y dinámica
Desde su creación el невідомо, el proyecto ha mostrado un crecimiento acelerado, reuniendo a 16 117 suscriptores.
Según los últimos datos del 05 octubre, 2026, el canal mantiene una actividad estable. En los últimos 30 días la variación de miembros fue de -129, y en las últimas 24 horas de -7, conservando un alto alcance.
- Estado de verificación: No verificado
- Tasa de interacción (ER): El promedio de interacción de la audiencia es 4.56%. Durante las primeras 24 horas tras publicar, el contenido suele obtener 2.10% de reacciones respecto al total de suscriptores.
- Alcance de las publicaciones: Cada publicación recibe en promedio 734 visualizaciones. En el primer día suele acumular 339 visualizaciones.
- Reacciones e interacción: La audiencia responde de forma activa: el promedio de reacciones por publicación es 2.
- Intereses temáticos: El contenido se centra en temas clave como threat, kernel, cve-2025, actor, attack.
📝 Descripción y política de contenido
El autor describe el recurso como un espacio para expresar opiniones subjetivas:
“The latest NEWS about malwares, DFIR, hacking, security issues, thoughts and ...
Partner channel: @cveNotify
For ads: https://telega.io/c/malwr”
Gracias a la alta frecuencia de actualizaciones (últimos datos recibidos el 06 octubre, 2026), el canal mantiene la vigencia y un amplio alcance. La analítica demuestra que la audiencia interactúa activamente con el contenido, lo que lo convierte en un punto de referencia dentro de la categoría Tecnologías y Aplicaciones.
16 117
Suscriptores
-724 horas
-347 días
-12930 días
Archivo de publicaciones
16 117
morluto/rea: Reverse engineer anything with agents, from app behavior down to native binaries.
https://github.com/morluto/rea
🎖@malwr
16 117
grisuno/LazyOwn: LazyOwn RedTeam/APT Framework is the first RedTeam Framework with an AI-powered C&C, featuring rootkits to conceal campaigns, undetectable malleable implants compatible with Windows/Linux/Mac OSX, and self-configuring backdoors. With its Web interface and powerful Console Client, it is the best combination for your Autonomous RedTeam/APT campaigns.
https://github.com/grisuno/lazyown
🎖@malwr
16 117
AkaTorich/KernelFlirt: KernelFlirt is powerful kernel debugger.
https://github.com/akatorich/kernelflirt
🎖@malwr
16 117
PaperCut MF Zero-Day Intrusion: Java Loader, Web Shell, and AdaptixC2 via CVE-2026-82078 and CVE-2026-81578
eSentire TRU details a PaperCut MF zero-day intrusion (CVE-2026-82078, CVE-2026-81578) using a Java loader, web shell, and trojanized Copilot binary to deploy AdaptixC2.
https://www.esentire.com/blog/papercut-mf-zero-day-intrusion-java-loader-web-shell-and-adaptixc2-via-cve-2026-82078-and-cve-2026-81578
🎖@malwr
16 117
China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor
Cisco Talos uncovered a cluster of activity we track as UAT-11587 targeting government and policy organizations across Asia, including in Taiwan, India, the Philippines, and Cambodia, to deliver a previously undocumented backdoor referred to as “Antino” in developer artifacts.
https://blog.talosintelligence.com/china-nexus-uat-11587-targets-government-and-policy-organizations-across-asia-with-antino-backdoor/
🎖@malwr
16 117
JoasASantos/Offensive-Security-AI-Models: Uncensored AI models or those fine-tuned for cybersecurity tasks.
https://github.com/JoasASantos/Offensive-Security-AI-Models
🎖@malwr
16 117
NeedyMantis: Unpacking a post-compromise malware family used in targeted operations | Microsoft Security Blog
Microsoft Threat Intelligence identified NeedyMantis, a modular post-compromise malware framework used in targeted intrusions that combines custom loaders, encrypted archives, and extensible components to maintain long-term access and support follow-on operations.
https://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/
🎖@malwr
16 117
Uncovering a SectopRAT Variant Embedded in Legitimate Software | FortiGuard Labs
Analysis of a SectopRAT variant hidden in tampered legitimate software that steals credentials and enables remote system control…
https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software
🎖@malwr
16 117
TwoSevenOneT/InjectSetConsole: Proof of Concept for Process Code Injection Without Using WriteProcessMemory
https://github.com/TwoSevenOneT/InjectSetConsole
🎖@malwr
16 117
rPlayAI/rPlayHub: iPhone Mirroring for macOS and Linux — scrcpy for iOS and a cross-platform Device Hub clone. Mirror and control an iPhone (iOS 27+); Raspberry Pi and Windows next. Part of rPlay.
https://github.com/rPlayAI/rPlayHub
🎖@malwr
16 117
newliver666/apk-reverse: Suitable for Android APK reverse engineering analysis
https://github.com/newliver666/apk-reverse
An Agent Skill for Android APK reverse engineering, debloating, ad removal, surgical dex patching, repacking, and runtime/server analysis.
🎖@malwr
16 117
EDR Evasion: Process Injection Without WriteProcessMemory
Technique performs Windows process code injection by leveraging a Windows named pipe, it does not use VirtualAllocEx and WriteProcessMemory
https://www.zerosalarium.com/2026/09/edr-evasion-process-injection-without-WriteProcessMemory.html
🎖@malwr
16 117
nbs32k/LocalStranger: PoC for WinNotify, demonstrated through a driver mapper, and local privilege escalation.
https://github.com/nbs32k/LocalStranger
🎖@malwr
16 117
ngwg/ceasta: disassembler, decompiler and debugger in one, with a built-in mcp server: point an ai at a binary and it can debug it, not just read it. ida-style listing, pseudocode (f5), x64dbg-style debugger (windows and linux), binary diff, lua plugins. reads pe, elf and mach-o. runs on windows, linux and macos.
https://github.com/ngwg/ceasta
🎖@malwr
16 117
Kothamine malware uses Tailscale’s tailcat to evade network detection
Kothamine uses a legitimate Tailscale tool to receive attackers’ commands through an encrypted connection with no malicious domain to block.
https://www.malwarebytes.com/blog/threat-intel/2026/09/kothamine-malware-uses-tailscales-tailcat-to-evade-network-detection
🎖@malwr
16 117
Bypassing EDR with Local AI
How hard is it to bypass EDR in the modern times with AI? As it turns out, not very hard.
https://projectblack.io/blog/bypassing-edr-with-local-ai/
🎖@malwr
16 117
Part 2: Visual-layer hiding — Hawkeye Research
Visual-layer anti-capture in DWM: CVisual::HasProtectedContent (bit 7 at +0x6A), vtable heap scan, HWND/PID attribution, and defender-side detection on Windows 10/11.
https://hawkeye-leo.github.io/hawkeye/research/capture/02-visual-hiding/
🎖@malwr
16 117
HimitsuShell/HimitsuShell: shell script protector (obfuscation, embedded interpreter, DRM) - invisible to kernel tracing
https://github.com/HimitsuShell/HimitsuShell
🎖@malwr
16 117
Inside a multi stage toll fraud operation targeting Poland
CERT Polska uncovered a toll fraud operation targeting Polish users through deceptive Meta advertisements and malicious applications distributed via Google Play. We preserved 1235 ads, linked 852 to 17 applications through code or infrastructure, reconstructed the complete execution chain, and observed live premium SMS and carrier billing tasking.
https://cert.pl/en/posts/2026/09/tollfraud-analysis/
🎖@malwr
