Cybersecurity articles tagged #Obfuscation on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/polymorphic-phishing-page-analysis-javascript-obfuscation-flawshttps://runtimerebel.com/blog/polymorphic-phishing-page-analysis-javascript-obfuscation-flawsAnalysis of a polymorphic phishing page utilizing heavy JavaScript obfuscation and variable scope bugs that cause browser loops.Tue, 01 Sep 2026 02:51:10 GMTPhishingCredential TheftObfuscationJavaScriptMalware Analysishttps://runtimerebel.com/blog/deobfuscating-malicious-javascript-for-threat-analysishttps://runtimerebel.com/blog/deobfuscating-malicious-javascript-for-threat-analysisUnderstanding JavaScript obfuscation techniques used in phishing and malware. Learn static and dynamic deobfuscation methods to uncover malicious intent.Tue, 01 Sep 2026 02:45:47 GMTJavaScriptObfuscationPhishingMalwareDeobfuscationhttps://runtimerebel.com/blog/detecting-ssrf-hostname-obfuscation-1u-ms-and-cloud-metadatahttps://runtimerebel.com/blog/detecting-ssrf-hostname-obfuscation-1u-ms-and-cloud-metadataAttackers are leveraging hostnames and services like 1u.ms to obfuscate IP addresses (e.g., 169.254.169.254), bypassing traditional SSRF blocklist defenses.Tue, 25 Aug 2026 16:30:00 GMTSSRFObfuscationCloud SecurityThreat Intelligence1u Mshttps://runtimerebel.com/blog/wordlistloader-evades-detection-delivers-amatera-infostealerhttps://runtimerebel.com/blog/wordlistloader-evades-detection-delivers-amatera-infostealerWordlistLoader uses a novel text-based obfuscation to bypass security, deploying the Amatera infostealer in ClickFix-style campaigns, posing a significant threat.Tue, 25 Aug 2026 08:33:21 GMTInfostealerMalwareObfuscationClickFixWordlistLoaderhttps://runtimerebel.com/blog/text-salting-hidden-text-tactics-bypass-ai-email-filtershttps://runtimerebel.com/blog/text-salting-hidden-text-tactics-bypass-ai-email-filtersOver 1 million emails are leveraging text salting techniques, embedding hidden characters to bypass AI and LLM-based email security filters, posing a significant…Thu, 16 Jul 2026 21:02:58 GMTText SaltingPhishingAI SecurityEmail SecurityLLMsObfuscationhttps://runtimerebel.com/blog/linux-process-name-masquerading-analyzing-t1036-obfuscationhttps://runtimerebel.com/blog/linux-process-name-masquerading-analyzing-t1036-obfuscationExplore the technical methods behind Linux process name masquerading (MITRE ATT&CK T1036) used by actors like Velvet Ant to evade detection.Wed, 24 Jun 2026 09:23:19 GMTT1036Linux SecurityVelvet AntProcess MasqueradingObfuscationhttps://runtimerebel.com/blog/excel-vba-macro-obfuscation-how-to-detect-hidden-payloadshttps://runtimerebel.com/blog/excel-vba-macro-obfuscation-how-to-detect-hidden-payloadsLearn how to analyze and detect obfuscated VBA macros in Excel files using oledump.py. Technical guide on character substitution and string reversal techniques.Mon, 08 Jun 2026 05:41:41 GMTVBAExcelOledumpObfuscationPhishinghttps://runtimerebel.com/blog/obfuscating-strings-in-c-implants-detection-and-analysishttps://runtimerebel.com/blog/obfuscating-strings-in-c-implants-detection-and-analysisAnalyze how stack strings help malware authors evade static analysis. Explore the assembly-level mechanics and detection strategies for Windows implants.Sat, 23 May 2026 08:48:07 GMTStack StringsObfuscationWindows ImplantsRed TeamingMalware Analysishttps://runtimerebel.com/blog/analysis-of-cross-platform-npm-stealer-using-discord-webhookshttps://runtimerebel.com/blog/analysis-of-cross-platform-npm-stealer-using-discord-webhooksTechnical teardown of an obfuscated Node.js infostealer targeting Discord tokens, crypto wallets, and browser credentials via cross-platform scripts.Fri, 22 May 2026 09:17:57 GMTNPMNode JsInfostealerDiscord WebhookObfuscationhttps://runtimerebel.com/blog/malicious-pdf-structure-analysis-and-obfuscation-detectionhttps://runtimerebel.com/blog/malicious-pdf-structure-analysis-and-obfuscation-detectionLearn how to detect malicious PDF obfuscation and analyze internal structures like /OpenAction and /JS streams to identify hidden malware payloads.Thu, 21 May 2026 09:17:24 GMTPDF MalwareObfuscationPhishing AnalysisMalware Detectionhttps://runtimerebel.com/blog/detect-obfuscated-javascript-phishing-delivered-via-rar-archiveshttps://runtimerebel.com/blog/detect-obfuscated-javascript-phishing-delivered-via-rar-archivesSecurity researchers identify a new phishing campaign using heavily obfuscated JavaScript within RAR archives to bypass traditional endpoint detection.Fri, 10 Apr 2026 08:43:36 GMTJavaScriptPhishingRARObfuscationWScriptEvasionhttps://runtimerebel.com/blog/emoji-based-c2-threat-actors-adopt-covert-communication-tacticshttps://runtimerebel.com/blog/emoji-based-c2-threat-actors-adopt-covert-communication-tacticsThreat actors are increasingly using emojis for covert Command and Control communications to evade security filters. Learn how to detect these obfuscated TTPs.Thu, 09 Apr 2026 00:35:54 GMTEmojiCovert CommunicationC2Threat Actor TTPsEvasionObfuscationhttps://runtimerebel.com/blog/deepload-malware-leverages-ai-for-evasion-and-credential-thefthttps://runtimerebel.com/blog/deepload-malware-leverages-ai-for-evasion-and-credential-theftDeepLoad, an AI-powered malware, uses massive junk code to evade detection while stealing credentials. Learn its TTPs and mitigation strategies.Tue, 31 Mar 2026 00:40:33 GMTDeepLoadAI MalwareCredential TheftEvasionObfuscationhttps://runtimerebel.com/blog/svg-based-phishing-using-scalable-vector-graphics-for-credential-thefthttps://runtimerebel.com/blog/svg-based-phishing-using-scalable-vector-graphics-for-credential-theftDiscover how threat actors leverage SVG files to bypass email filters and execute credential theft through embedded JavaScript and HTML forms.Wed, 25 Mar 2026 04:43:26 GMTSVG PhishingCredential TheftEmail SecurityObfuscationhttps://runtimerebel.com/blog/exploiting-ipv4-mapped-ipv6-addresses-to-obfuscate-web-scanninghttps://runtimerebel.com/blog/exploiting-ipv4-mapped-ipv6-addresses-to-obfuscate-web-scanningAttackers leverage RFC 4038 IPv4-mapped IPv6 addresses to bypass security filters and obfuscate scanning activities targeting proxy-related URLs.Tue, 17 Mar 2026 12:32:56 GMTRFC 4038IPv6 TransitionWeb ScanningObfuscationLog Normalization