Inside a LuaJIT-to-Remcos infection chain
Krizzh reverse engineers the JScript dropper, Lua loader, Donut wrapper and Remcos 7.3.1 Pro payload, with 28 figures, configuration recovery and evidence-qualified detection findings.
Write-ups, advisories and tooling notes from the team. Vulnerabilities are published only after coordinated disclosure, and never with anything that identifies a client.
All research
OmniStealer: an npm supply-chain investigation
Ashlynn traces a malicious npm dependency through a staged JavaScript and Python stealer, infrastructure research, exfiltration and a qualified DPRK attribution assessment.
BrowserSwap: browser-side cryptocurrency address hijacking
An investigation of a browser-side Bitcoin replacement campaign: Google Sheets delivery, obfuscation, exchange-specific manipulation, wallet indicators and detection guidance.
Uncovering an extension botnet
Eoka compares JiffyReader releases, investigates added request interception and proxy functionality, and documents the developers' responses and disclosure concerns.
The Beaver and the Ferret
A historical investigation following a recruitment lure through BeaverTail, InvisibleFerret, credential theft and additional payloads, with the original screenshots, code excerpts and indicators.
How we disclose
When we find a vulnerability in someone else's product, we report it to the vendor privately first and give them time to fix it before anything is published.
Found something in our systems? Please follow our responsible disclosure policy.
Want us to look into something?
Tell us what you'd like investigated and we'll say whether it's something we can help with.