If you analyze Android banking trojans, droppers, or spyware, you've probably run into samples where:

• classes*.dex declares native methods, but lib/*.so has 0 exported Java_* symbols and wiped ELF section headers.
• JNI_OnLoad constructs strings on the stack (MOVZ/MOVK), uses an OLLVM CSEL + BR X8 state machine, and registers JNI handlers dynamically.
• Attaching Frida immediately crashes the app due to /proc/self/maps or libc prologue checks.

I released JNISleuth-MCP (Apache 2.0) to automate this part of Android malware triage: https://github.com/nighthawkk/JNISleuth-MCP

• Recovers static JNINativeMethod triplets from .rodata / .data.rel.ro (with PT_LOAD fallback for section-stripped ELFs).
• Extracts MOVZ/MOVK stack strings and XOR-encoded C2 strings from JNI_OnLoad / .init_array.
• Resolves & patches ARM64 OLLVM CSEL + BR X8 indirect branches and .rodata jump tables.
• Includes a C++/NDK Dobby agent that hooks RegisterNatives mid-function (+0x10) and dumps in-memory DEX payloads from art::DexFileLoader::OpenCommon without triggering standard Frida detections.
• Syncs all 233 JNIEnv* vtable types and C signatures into Ghidra and IDA Pro 9.0, plus includes an MCP/LLM server.

Ships with a synthetic dropper APK (samples/banker_dropper.apk) so you can test all features offline.

Toolkit dump from a captured open directory: a renamed GodPotato (two builds and source), an eight-line PowerShell stager that reassembles the payload in memory, a small Python upload receiver, a full unmodified Impacket environment, and the operator's own transfer and access logs. Hashes, named-pipe path, and the base64 command/fragment paths are all in the post.

I'm the author. The full technical report, including the artifact links and validation records, is here:

https://papers.lisdex.sh/hermes/report.pdf

Happy to answer questions about the analysis.

Probably not the best week to be dropping research, i know alot of ya'll in the industry are working hard right now - stay safe out their!

Tracking a new campaign by PHISHLETS 10k phaas kit dropped in August in the wild..

Given the increasing reliance/uptake of AI models and this year's bonanza of PyPI supply chain attacks: thought it would be worthwhile looking at an attack that combines the two: Rank-One Model Editing (ROME) attacks + later some thoughts on detecting this particularly evasive supply chain attacks.

ROME attacks:

Supply chain attack is likely prerequisite to get malicious python to the model / GPU, though there's many avenues for that.

Once a library is injected into PyTorch, it performs surgical weight rewrites (vs retraining) and changes specific outputs without a process being spawned, no new files and no network calls made. (Which obviously makes this rather difficult to catch with security tools living above the driver)

Attack methodology originally published as a piece of research Locating and Editing Factual Associations in GPT: Kevin Meng, David Bau, Alex Andonian and Yonatan Belinkov.

There's a deep dive blog from cyber org Stealthium that covers both the attack & GPU-side detection via tracing CUDA kernels (eBPF) and hypothesises on further detection posssibilities.

Welcome the communities thoughts? Reckon any of these model corruption attacks are in the wild and not yet been caught/seen?

(((Also while the blog example is soviet propaganda, anybody aware of other nations that like both model development, influence campaigns and rewriting history? Just sayin...)))

+ shout out to the folks at Mithril Security for their PoisonGPT work a while back that explored this threat vector IRL with an upload to HF.

Not a malware sample, but a full offensive toolkit recovered from an exposed open directory: a Java payload builder, serialized CommonsBeanutils2 gadgets, a shell stager, and the orchestration script that tied them together.

Seven of the eight exploit directories were unmodified public PoCs. Hashes and the full toolkit breakdown are in the writeup.

https://hunt.io/blog/ukraine-state-data-exchange-graylog-log4shell

Everyone is hungry for tokens!

• Claude, ChatGPT are the most abused AI tools (see how Gemini isn't mentioned? :D)
• Based on telemetry, at least 45% of them attempt to social engineer the user into executing a malicious ClickFix command
• It's not always suspicious domains / URLs hosting the malicious site; attackers leverage GitHub sites, Cloudflare pages, Google sites and chatgpt.com specific chat sites. It is not uncommon for attackers to abuse Google ads too.

Some other notable delivery methods:

• Fake CLI install (InstallFix)
• Abused AI chat being shared and promoted on Google ads
• Fake download page & ClickFix
• Trojanized installer (impersonated official website, combined with SEO manipulation)
• Trojanized installer via GitHub

Such outcome is executing an infostealer or a remote access malware. Read whole article at https://any.run/cybersecurity-blog/fake-ai-tools-us-companies/ :)

Researchers at Palo Alto Networks Unit 42 published an investigation into a sophisticated attack against a telecommunications provider.

The original intrusion occurred in September 2024, but the newly published analysis documents previously unreported malware.

Attackers initially exploited CVE-2024-47575 to compromise a FortiManager management appliance.

They obtained configuration files and sensitive information associated with more than 500 FortiGate firewalls.

The attackers subsequently deployed malware called PEERSTITCH.

Its unusual feature is that it operates inside the memory of legitimate firewall processes rather than maintaining a conventional malware file on disk.

The implant could manipulate VPN security checks while blending into normal network activity.

The researchers did not establish that all 500 managed firewalls were compromised.

This is an excellent example of why traditional antivirus scanning cannot detect every attack.

Malware operating in memory may leave fewer conventional file-based indicators.

A formatter, minifier or deobfuscator can be made abused to change the entire logic.

You can go try out all 186 techniques with this script: https://divergence.trustsig.eu/

Or try the Tetris-Snake demo here (Tetris runs normally, copy the formatted output from even just DevTools and it becomes Snake): https://divergence-game.trustsig.eu/

Blog/writeup post: trustsig.eu/blog/javascript-divergence/

Three open directories on the PaperCut campaign server exposed the operator's full toolkit.

The tooling included four custom Rust Windows binaries for LSA secret collection and registry hive dumping, Python scripts for offline NT hash recovery and service credential parsing, and a chisel-based Linux persistence mechanism with cron. The exploit framework had three variants targeting different PaperCut versions, with version auto-detection and automatic cleanup of modified config values after each run.

The whole operation was orchestrated by a DeepSeek AI model through the OpenAI Codex harness, with a 19KB instruction file directing up to 25 concurrent subagents.

MD5 hashes and full analysis: https://hunt.io/blog/papercut-attacker-ai-toolkit-exploit-code-second-rce

Hi All, This interesting malware came to my attention. I have analysed it and so far discovered the following: You run the masked .exe file; it checks if the machine is not ARM or running in VMware environment, and then it executes itself. It possibly executes directly into RAM. I am still going through ram dump but its interesting as its masking the IP from Cloudfare - 172.67.168.69 Has anyone seen this or similar one ?