f4n6.co.uk - October 2026 - TLP:CLEAR. All indicators are defanged. Hash: f745c2d897ad6f16cb5c0428ba74a7f041f7c3e94f52cc3727532577fe12507d 0:00 /2:34 1× TL;DR * A 9 MB, 64-bit Windows loader compiled at 05:57 UTC on 7
read post →A 12 MB batch file that unpacks a genuine, signed ScreenConnect client wired to an attacker's relay, disables every user-visible indicator, survives reboot and Safe Mode — and what it looks like on a real infected host.
The first detonation gave us nothing. No DNS, no sockets, no drops, no persistence 8.6 MB of Go binary that ran, yawned, and went back
A loader disguised as libcurl refuses to run on VMs and dies silently in sandboxes. We patched its six anti-VM checks out and captured its WebSocket C2 on port 406.
A 3.5 KB Windows loader with one import, a split-up C2 address, and a forty-byte handshake it repeats until somebody answers. We answered
A 15 KB DLL that silently rewrites cryptocurrency addresses on your clipboard. I pulled it apart statically, confirmed it in a sandbox, recovered all nine of
A Go crypter, a RAT with SQLite in its WebAssembly belly, and an encrypted C2 configuration that eventually introduced itself through an error message. The salad
1. Executive summary Citizen Lab and Confiant published parallel investigations into Discover-Tech, an Israel-based firm that used digital advertising to deliver zero-
1. Executive summary Signals Corps sampled 217 million HTTP page responses from Common Crawl and found 30 sites attempting indirect prompt injection through HTTP
1. Executive summary The Akira ransomware operation listed Videk, a UK provider of vision-based print verification and inserter scanning systems, on its leak
1. Executive summary Cisco Talos published its Q3 vulnerability pulse alongside new joint research with Recorded Future's Insikt Group on UAT-6275,
1. Executive summary The Eclipse Foundation has published fixes for six vulnerabilities in Eclipse Milo, the Java OPC UA stack used to build both