Cybersecurity articles tagged #Malware Analysis on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/polymorphic-phishing-page-analysis-javascript-obfuscation-flawshttps://runtimerebel.com/blog/polymorphic-phishing-page-analysis-javascript-obfuscation-flawsAnalysis of a polymorphic phishing page utilizing heavy JavaScript obfuscation and variable scope bugs that cause browser loops.Tue, 01 Sep 2026 02:51:10 GMTPhishingCredential TheftObfuscationJavaScriptMalware Analysishttps://runtimerebel.com/blog/state-of-ai-enabled-malware-real-world-impact-and-defenseshttps://runtimerebel.com/blog/state-of-ai-enabled-malware-real-world-impact-and-defensesUnit 42 reports AI-enabled malware is primarily proof-of-concept, with minimal operational activity. Existing defenses effectively detect current threats.Tue, 25 Aug 2026 16:29:19 GMTLLMRansomwareMalware AnalysisSocial EngineeringAI Enabled Malwarehttps://runtimerebel.com/blog/ai-powered-malware-analysis-detecting-persistent-threats-on-sensorshttps://runtimerebel.com/blog/ai-powered-malware-analysis-detecting-persistent-threats-on-sensorsAn analysis using Gemma4 with Ollama reveals high-volume malware downloads on DShield sensors, indicating persistent actor activity and critical compromise risks.Thu, 13 Aug 2026 09:04:55 GMTAIMalware AnalysisThreat HuntingBotnetCowrie Sensorhttps://runtimerebel.com/blog/recorded-future-s-engine-unifying-threat-intelligence-sourceshttps://runtimerebel.com/blog/recorded-future-s-engine-unifying-threat-intelligence-sourcesExplore Recorded Future's unique collection engine, integrating technical, underground, and community intelligence for proactive threat defense and deeper insights.Sat, 08 Aug 2026 01:02:37 GMTThreat IntelligenceData CollectionMalware AnalysisVulnerability ManagementRecorded Futurehttps://runtimerebel.com/blog/analyzing-autoit-payload-injection-techniques-in-modern-malwarehttps://runtimerebel.com/blog/analyzing-autoit-payload-injection-techniques-in-modern-malwareTechnical analysis of how threat actors use AutoIT scripts for process injection, leveraging memory management functions to execute malicious payloads in memory.Tue, 28 Jul 2026 10:39:31 GMTAutoITProcess InjectionMemory ForensicsMalware Analysishttps://runtimerebel.com/blog/dolphin-x-malware-ai-driven-target-prioritization-defensehttps://runtimerebel.com/blog/dolphin-x-malware-ai-driven-target-prioritization-defenseAnalysis of Dolphin X, a new RAT utilizing AI to profile and rank victims, enabling threat actors to prioritize high-value targets for data exfiltration and further…Fri, 24 Jul 2026 02:46:46 GMTDolphinXRATAITargetingMalware AnalysisCyber Threathttps://runtimerebel.com/blog/ai-models-fail-at-nuclear-sabotage-malware-analysis-benchmarkhttps://runtimerebel.com/blog/ai-models-fail-at-nuclear-sabotage-malware-analysis-benchmarkNew SentinelOne research reveals frontier AI models struggle with complex malware investigations, particularly those involving nuclear sabotage and industrial systems.Thu, 23 Jul 2026 14:13:02 GMTAI SecurityFast16SentinelOneMalware AnalysisICS Securityhttps://runtimerebel.com/blog/ousaban-banking-trojan-phishing-lures-target-iberian-bank-usershttps://runtimerebel.com/blog/ousaban-banking-trojan-phishing-lures-target-iberian-bank-usersOusaban, a Brazilian banking trojan, targets Windows users in Spain and Portugal via fake PDF phishing lures, aiming to steal financial credentials.Wed, 01 Jul 2026 16:53:05 GMTOusabanBanking TrojanPhishingSpainPortugalWindowsFinancial CrimeMalware Analysishttps://runtimerebel.com/blog/yara-x-1-18-0-1-19-0-release-enhancing-malware-detectionhttps://runtimerebel.com/blog/yara-x-1-18-0-1-19-0-release-enhancing-malware-detectionYARA-X versions 1.18.0 and 1.19.0 bring key improvements and bug fixes, enhancing malware analysis and threat hunting capabilities for security professionals.Sun, 28 Jun 2026 09:09:21 GMTYARA XMalware AnalysisThreat HuntingSecurity ToolsVersion Updatehttps://runtimerebel.com/blog/malware-evades-ai-analysis-with-forbidden-text-tacticshttps://runtimerebel.com/blog/malware-evades-ai-analysis-with-forbidden-text-tacticsThreat actors embed 'forbidden' text in malware to confuse AI analysis tools, targeting bioinformatics and MCP developers.Thu, 25 Jun 2026 05:28:25 GMTAI EvasionMalware AnalysisMini Shai HuludMiasmaHades WormsBioinformatics SecuritySupply Chain Securityhttps://runtimerebel.com/blog/msi-malware-detection-statistical-analysis-for-base64-payloadshttps://runtimerebel.com/blog/msi-malware-detection-statistical-analysis-for-base64-payloadsLearn how to use statistical analysis to identify obfuscated Base64 payloads within malicious MSI files and improve your incident response capabilities.Mon, 15 Jun 2026 10:19:14 GMTMSI MalwareBase64 ObfuscationThreat DetectionMalware AnalysisSANS ISChttps://runtimerebel.com/blog/python-based-infostealer-masked-as-pdf-targets-browser-credentialshttps://runtimerebel.com/blog/python-based-infostealer-masked-as-pdf-targets-browser-credentialsTechnical analysis of a PyInstaller-compiled infostealer using Discord webhooks to exfiltrate browser credentials, crypto wallets, and session tokens.Tue, 09 Jun 2026 09:19:02 GMTInfostealerPyinstallerDiscord WebhookCredential TheftMalware Analysishttps://runtimerebel.com/blog/wordpress-sites-targeted-by-malware-using-steam-profile-dead-dropshttps://runtimerebel.com/blog/wordpress-sites-targeted-by-malware-using-steam-profile-dead-dropsOver 2,000 WordPress sites compromised in a campaign hiding C2 resolution data within Steam Community profiles. Technical breakdown of the evasion tactics.Mon, 01 Jun 2026 18:06:43 GMTWordPressSteam CommunityC2 EvasionSteganographyMalware Analysishttps://runtimerebel.com/blog/netsupport-rat-infection-how-to-detect-unidentified-loader-exploitshttps://runtimerebel.com/blog/netsupport-rat-infection-how-to-detect-unidentified-loader-exploitsAnalyze the multi-stage infection chain of an unidentified loader delivering NetSupport RAT, featuring technical breakdowns of JavaScript and PowerShell TTPs.Mon, 01 Jun 2026 01:04:07 GMTNetSupport RATMalware AnalysisPowerShellJavaScriptLoaderhttps://runtimerebel.com/blog/obfuscating-strings-in-c-implants-detection-and-analysishttps://runtimerebel.com/blog/obfuscating-strings-in-c-implants-detection-and-analysisAnalyze how stack strings help malware authors evade static analysis. Explore the assembly-level mechanics and detection strategies for Windows implants.Sat, 23 May 2026 08:48:07 GMTStack StringsObfuscationWindows ImplantsRed TeamingMalware Analysishttps://runtimerebel.com/blog/shai-hulud-worm-code-leak-how-clones-threaten-developer-environmentshttps://runtimerebel.com/blog/shai-hulud-worm-code-leak-how-clones-threaten-developer-environmentsThe release of Shai-Hulud worm source code triggers a surge in self-replicating clones, targeting software developers and automated CI/CD pipelines.Mon, 18 May 2026 20:37:43 GMTShai HuludWormDeveloper SecuritySource Code LeakMalware Analysishttps://runtimerebel.com/blog/masjesu-botnet-ddos-for-hire-analysis-of-iot-malware-campaignshttps://runtimerebel.com/blog/masjesu-botnet-ddos-for-hire-analysis-of-iot-malware-campaignsThe Masjesu botnet targets IoT devices across multiple architectures to facilitate DDoS-for-hire services via Telegram, posing risks to global infrastructure.Wed, 08 Apr 2026 20:18:14 GMTMasjesu BotnetDDoSIot SecurityMalware AnalysisTelegram Botnethttps://runtimerebel.com/blog/fileless-malware-registry-persistence-techniques-exposedhttps://runtimerebel.com/blog/fileless-malware-registry-persistence-techniques-exposedAnalyzes how fileless malware leverages the Windows registry for persistence, minimizing filesystem footprint and complicating traditional detection.Wed, 01 Apr 2026 12:30:01 GMTFileless MalwareRegistry PersistenceTTPsMalware AnalysisDetectionWindows Registryhttps://runtimerebel.com/blog/pdf-incremental-updates-detecting-hidden-malicious-urlshttps://runtimerebel.com/blog/pdf-incremental-updates-detecting-hidden-malicious-urlsDiscover how attackers use PDF incremental updates to obfuscate malicious URLs and learn forensic techniques to identify and extract hidden indicators.Mon, 30 Mar 2026 05:02:33 GMTPDF MalwareDidier StevensForensicsMalware AnalysisPhishing Detectionhttps://runtimerebel.com/blog/glassworm-supply-chain-attack-400-malicious-repos-identifiedhttps://runtimerebel.com/blog/glassworm-supply-chain-attack-400-malicious-repos-identifiedThe GlassWorm campaign hits GitHub, npm, and VSCode marketplaces with over 400 malicious repositories. Learn to detect and mitigate this supply chain threat.Wed, 18 Mar 2026 00:36:52 GMTGlassWormNPM SecurityVscode ExtensionsSupply Chain AttackMalware Analysishttps://runtimerebel.com/blog/analyzing-embedded-zip-payloads-in-rtf-documents-for-malware-analysishttps://runtimerebel.com/blog/analyzing-embedded-zip-payloads-in-rtf-documents-for-malware-analysisLearn how to detect ZIP files in RTF documents and extract hex-encoded binary payloads using specialized forensic tools to identify hidden malware threats.Mon, 02 Mar 2026 12:19:41 GMTRTFZIP ExtractionMalware AnalysisDidier StevensForensics