Malware News

MG1937/ASC: ASC is a super FAST Android decompiler front-end designed for Agents/Mobile Researchers. https://github.com/MG1937/ASC 🎖@malwr

Inside a multi stage toll fraud operation targeting Poland CERT Polska uncovered a toll fraud operation targeting Polish users through deceptive Meta advertisements and malicious applications distributed via Google Play. We preserved 1235 ads, linked 852 to 17 applications through code or infrastructure, reconstructed the complete execution chain, and observed live premium SMS and carrier billing tasking. https://cert.pl/en/posts/2026/09/tollfraud-analysis/ 🎖@malwr

https://medium.com/@Root0ne/muddywaters-rented-arsenal-and-its-traces-in-the-russian-maas-market-d58965401f15 🎖@malwr

TwoSevenOneT/InjectSetConsole: Proof of Concept for Process Code Injection Without Using WriteProcessMemory https://github.com/TwoSevenOneT/InjectSetConsole 🎖@malwr

Uncovering a SectopRAT Variant Embedded in Legitimate Software | FortiGuard Labs Analysis of a SectopRAT variant hidden in tampered legitimate software that steals credentials and enables remote system control… https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software 🎖@malwr

NeedyMantis: Unpacking a post-compromise malware family used in targeted operations | Microsoft Security Blog Microsoft Threat Intelligence identified NeedyMantis, a modular post-compromise malware framework used in targeted intrusions that combines custom loaders, encrypted archives, and extensible components to maintain long-term access and support follow-on operations. https://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/ 🎖@malwr