RuntimeRebel — #Malware DeliveryCybersecurity articles tagged #Malware Delivery on RuntimeRebel.https://runtimerebel.comNode.js Abuse: Attackers Deploy Malware via Trusted Runtimehttps://runtimerebel.com/blog/node-js-abuse-attackers-deploy-malware-via-trusted-runtimehttps://runtimerebel.com/blog/node-js-abuse-attackers-deploy-malware-via-trusted-runtimeThreat actors are leveraging Node.js as a signed, trusted tool to deploy various malicious payloads, evading detection in targeted attacks since February 2026.Thu, 03 Sep 2026 12:22:47 GMTNode JsMalware DeliveryClickFixLiving-off-the-LandEtherHidingNew Phishing Campaign Exploits SVG Attachments to Evade Filtershttps://runtimerebel.com/blog/new-phishing-campaign-exploits-svg-attachments-to-evade-filtershttps://runtimerebel.com/blog/new-phishing-campaign-exploits-svg-attachments-to-evade-filtersSecurity researchers report a wave of phishing emails using malicious SVG attachments to deliver scripts and bypass email security gateways. Learn how to defend.Tue, 02 Jun 2026 09:35:03 GMTPhishingSVGMalware DeliverySocial EngineeringEmail SecurityAI Chatbot Poisoning: Defending Against Malicious Cryptojacking Linkshttps://runtimerebel.com/blog/ai-chatbot-poisoning-defending-against-malicious-cryptojacking-linkshttps://runtimerebel.com/blog/ai-chatbot-poisoning-defending-against-malicious-cryptojacking-linksMicrosoft warns of threat actors manipulating AI chatbot recommendations to deliver cryptojacking malware via poisoned web search results.Wed, 27 May 2026 09:16:19 GMTCryptojackingAI SecuritySocial EngineeringMicrosoft DefenderMalware DeliveryAbuse of MSHTA in Stealthy Malware Delivery Chainshttps://runtimerebel.com/blog/abuse-of-mshta-in-stealthy-malware-delivery-chainshttps://runtimerebel.com/blog/abuse-of-mshta-in-stealthy-malware-delivery-chainsAttackers are abusing the legacy Windows MSHTA utility to deliver malware silently via phishing and fake downloads, bypassing EDR through LOLBIN techniques.Tue, 19 May 2026 13:20:43 GMTMshtaLolbinPhishingMalware DeliveryStealth AttacksMalware Delivery via Malicious .WAV Files — Technical Analysishttps://runtimerebel.com/blog/malware-delivery-via-malicious-wav-files-technical-analysishttps://runtimerebel.com/blog/malware-delivery-via-malicious-wav-files-technical-analysisSecurity analysts identify .WAV audio files being used to hide malicious payloads. Learn how steganography allows attackers to bypass perimeter security.Tue, 21 Apr 2026 08:45:41 GMTSteganographyWav MalwarePowershell ObfuscationAPT32Malware DeliveryAbused n8n Webhooks Facilitate Automated Malware Delivery Since 2025https://runtimerebel.com/blog/abused-n8n-webhooks-facilitate-automated-malware-delivery-since-2025https://runtimerebel.com/blog/abused-n8n-webhooks-facilitate-automated-malware-delivery-since-2025Threat actors are weaponizing n8n AI workflow automation webhooks to bypass email filters and distribute malware in persistent phishing campaigns.Wed, 15 Apr 2026 20:22:35 GMTN8nPhishingWebhooksMalware DeliveryAutomation AbuseZIP Archive Evasion: Detecting Malicious Multi-File Payloadshttps://runtimerebel.com/blog/zip-archive-evasion-detecting-malicious-multi-file-payloadshttps://runtimerebel.com/blog/zip-archive-evasion-detecting-malicious-multi-file-payloadsAnalyze how threat actors use ZIP archives containing over 100,000 files to bypass security inspection and overwhelm automated analysis tools.Fri, 27 Mar 2026 04:52:03 GMTEvasion TechniquesMalware DeliveryZIP ArchivesEmail SecurityCVE-2026-0866: Mitigating Zombie Zip File Evasion Techniqueshttps://runtimerebel.com/blog/cve-2026-0866-mitigating-zombie-zip-file-evasion-techniqueshttps://runtimerebel.com/blog/cve-2026-0866-mitigating-zombie-zip-file-evasion-techniquesTechnical analysis of CVE-2026-0866 'Zombie Zip' exploitation. Learn how archive header discrepancies bypass security scanners and how to defend your perimeter.Wed, 11 Mar 2026 12:23:06 GMTCVE-2026-0866Zombie ZipArchive EvasionMalware DeliveryEvasion TTPs