No File, No Fixed C2: Inside NetCon, a WMI Backdoor That Reads Its Command Server Off the Blockchain

A JScript backdoor persists as a WMI ActiveScriptEventConsumer with no file on disk, resolving its C2 address by reading Ethereum smart-contract storage.

Jul 10, 2026 Malware Analysis

Fake Cloudflare 'Human Verification' ClickFix overlay -- EtherHiding campaign

Reading the ledger: how one Polygon smart contract exposed three ClickFix crews and 153 confirmed hacked websites

A ClickFix DLL side-load traced through a Polygon smart contract (EtherHiding) to 18 C2 domains and 153 confirmed hacked sites across three operators.

Jul 8, 2026 Malware Analysis

feintnet: I got tired of FakeNet-NG not running on my ARM box, so I built my own

FakeNet-NG's WinDivert driver wouldn't load on my ARM Windows box, so I built feintnet: a single Go binary that fakes DNS, TLS, and C2 for malware analysis.

Jul 7, 2026 Tooling

Five layers deep for a stealer: reversing the "PuppetKing" ClickFix chain that ended in StealC

Five-stage ClickFix chain reversed statically - game decoy, bitmap stego, custom ConfuserEx, bespoke byte cipher, and StealC v2 with blockchain-rotated C2.

Jun 25, 2026 Malware Analysis

Rogue ScreenConnect campaign -- Telegram exfiltration and competitor eviction

Your RMM Has a Second Owner: Inside a Rogue ScreenConnect Credential Theft Campaign

Three Telegram bots, five named operators, a 3,000-line competitor eviction script -- a newly onboarded host had been compromised for months before the customer onboarded it.

Jun 19, 2026 Malware Analysis

Thirty days of finger commands: three ClickFix families, one TCP/79 delivery vector

25 finger commands over approximately 30 days, three ClickFix families, one TCP/79 delivery vector: IronPython loader, Python RAT lspy, and a pre-positioned DigitalOcean staging cluster.

Jun 17, 2026 Malware Analysis

Lunex stealer C2 panel -- OSINT investigation

The Panel Behind the Prompt: OSINT into a Live Lunex Stealer Network

OSINT follow-up to the ClickFix/CAPTCHA campaign: six confirmed Lunex stealer C2 panels across five countries, including a Cloudflare-hidden instance on a Google-impersonating domain. Cookie theft, credential harvesting, real-time JavaScript injection, browser spoofing, and full remote browser control -- documented from the observable panel interface.

Jun 13, 2026 Malware Analysis

Telegram Handles, Binary-Encoded PHP, and a Relay Shell: Inside a WordPress Webshell Compromise

A compromised WordPress site, eleven hundred lines of IIS logs, a two-stage binary-encoded webshell, and six attempts to deploy a gsocket reverse shell.

Jun 12, 2026 Malware Analysis

They built a dictionary to hide their shellcode: the pishbini90ai ClickFix loader

A ClickFix loader that hides shellcode as 256 English words in .rdata, delivers via WebDAV-over-HTTPS, and executes via Windows fibers. IOCs and YARA inside.

Jun 11, 2026 Malware Analysis

Fake captcha, five layers of RC4, and a Rust stealer with LSA session enumeration and AD recon

Five-layer RC4+gzip ClickFix stager drops a Rust infostealer with browser extension force-install, LSA session enumeration, and AD recon via NetAPI.