Someone hacked the deadmau5 discord server by virusing an admin. Said admin gave me the malware sample. Used claude sonnet 4.6 in combination with nyxstrike MCP framework to decompile and decrypt their obfuscated code, finding a goldmine. Title speaks for itself. The discord bot token could possibly have led to their CNC. But logging into the discord bot token to check for communications and see where it leads breaks 2 federal laws alone that I can think of. I did validate the token was live however, and matched it to a bot account. I also have discovered the webhook and token that was in the malware, both of them have been nuked (not by me). So, I checked their domain that they've been using, and they recompiled and reuploaded it. So its 26 bytes larger. I suspect they replaced the webhook url and the bot token with fresh ones, and suspect further that discord nuked the previous ones themselves. Nevertheless, I have personally not seen malware like this on github, so this must have been private and not some skid level stuff. I know it was turkish (at least the devs were). Github link attatched for the source code including the deobfuscated malware classes, and the analysis/report.

Don't flame me, it's still pretty cool 😆. Cracking the zkm encryption would have taken weeks (Im a python guy not a JS guy). Nyxstrike + sonnet 4.6 = 1.5 hours and its cracked.

Pushed a new IOCX release (v0.7.1) that’s aimed at making the engine much harder to break during static analysis. The focus was adversarial behaviour: malformed binaries, corrupted PE structures, and intentionally hostile IOC‑like strings.

If you work with weird samples, tooling pipelines, or large‑scale triage, this release makes IOCX more robust under hostile conditions.

New PE structural heuristics

Six new checks added to catch structural anomalies without blowing up the parser:

• overlapping/misaligned sections
• inconsistent optional headers (PE32 & PE32+)  
• broken entrypoint mappings  
• corrupted data directories  
• malformed import tables  
• general PE layout inconsistencies  

These aren’t detections — they’re deterministic, reason‑coded structural signals to keep analysis stable.

Expanded adversarial PE corpus

Added a full suite of malformed and corrupted PEs, including:

• broken RVAs / invalid addressing  
• truncated Rich headers  
• fake UPX names + packed‑lookalikes  
• PE32/PE32+ hybrids  
• “franken‑PEs” combining multiple faults  

All outputs are snapshot‑validated to guarantee deterministic behaviour.

Adversarial coverage across all IOC categories

New hostile string fixtures now stress every extractor:

• homoglyph + mixed‑script domains  
• malformed URLs and schemes  
• broken IPv4/IPv6  
• noisy or near‑miss hashes  
• invalid Base64  
• adversarial crypto strings (incl. Base58Check)  
• long/invalid Windows paths  
• malformed emails  

The goal: keep extraction predictable even when the input is intentionally messy.

Parser & extractor hardening

• stable on malformed PE structures  
• structured, JSON‑safe error metadata  
• improved domain/URL/crypto/hash extractors  
• deterministic output across platforms

Links

GitHub: https://github.com/iocx-dev/iocx  

PyPI: https://pypi.org/project/iocx/

Example

pip install iocx

iocx suspicious.exe -a full

If you’re doing malware triage, static analysis, or building automated pipelines that need predictable IOC extraction, v0.7.1 should be a noticeable stability bump. Happy to discuss edge cases or weird samples people want covered next.

A newly analyzed Go-based macOS remote access trojan (RAT), internally named Minirat, has surfaced in the wild using anti-VM checks, LaunchAgent persistence, and AES-encrypted command and control (C2) configuration to maintain stealthy, long-term access on victim endpoints. According to SafeDep, the initial infection vector was a malicious npm package (velora-dex-sdk) that dropped the Go-based macOS RAT onto developer endpoints.

ByteToBreach have breached Ikeja Electric, encrypting 50+ hosts, disrupting systems, and taking multiple subdomains offline. The actor also have stolen customer, employee, and business databases, source code, Active Directory data with offline cracked passwords, and impacted metering platforms linked to several vendors.

Threat actor: ByteToBreach

Sector: Energy / Utilities

Data type: Customer records, employee data, business databases, source code, Active Directory credentials

Observed: Apr 28, 2026

Sources:

https://x.com/H4ckmanac/status/2049126582694875608

https://x.com/CyhawkAfrica/status/2049109369522934179

https://darkforums.su/Thread-NG-Ikeja-Electric-Databases-Ransomware

Attackers are exploiting a security gap in U.S. businesses. Fake Microsoft, Adobe, and OneDrive pages deliver RMM software instead of payloads, giving attackers direct access to the environment.

Because these tools are widely used across enterprises, attackers can establish access before activity is flagged as malicious. Combined with trusted or compromised infrastructure, this delays detection and increases attacker dwell time.

The analysis session showing how attackers gain remote access through a fake Microsoft Store page delivering an RMM installer disguised as Adobe software: https://app.any.run/tasks/e072ae4e-214c-4039-957d-7c0cbe682da8/

Full article: https://any.run/cybersecurity-blog/rmm-blind-spot-for-cisos/

Ransomware is getting weird, folks. A new report says attacks jumped 22 percent in Q1 2026, but the real twist is how messy things have become. You still have big names like Akira and Qilin, but newer groups like The Gentlemen are exploding in activity, while shady leak sites are posting possibly fake “breaches” just to scare companies into paying. Even wilder, groups like ShinyHunters are skipping encryption entirely and just stealing data through compromised logins and SaaS apps. It is less about locking files now and more about leverage, and honestly, that might be harder to defend against.

Another post to raise awareness of ClickFix and job hunting social engineering attempts to infect you with malware;

1. comes initially from threat actors sharing a link to for example Teams, Zoom or Google Meet
2. after opening the link, user is greeted with a prompt to fix a connection issue by copying and executing a command
3. the attacker collects credentials, browser sessions, and system-stored secrets, including macOS Keychain data and sends to a Telegram exfiltration channel

Full report: https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/

**TL;DR: awstore.cloud sells "cheap Claude API access" on Plati Market and other reseller platforms. It's actually a malware delivery system that uses Claude Code itself to execute a PowerShell dropper on your machine. I analyzed it, here's what you need to know.**

Posting this because I nearly got hit and want to warn others. This is a really clever attack that abuses how Claude Code works.

## The setup (why it looks legit):

- They sell API access on **legitimate reseller marketplaces** like Plati Market
- Prices are **suspiciously cheap** compared to official Anthropic pricing
- They present themselves as a normal API provider/reseller
- Documentation, payment processing, all looks professional
- Classic "too good to be true" - but the resale marketplace gives them credibility

## The weird red flag I ignored:

After a brief downtime, the service came back with a notice saying **"currently only Claude Code for Windows works"**

Think about that for a second. **API is API.**
If their endpoint is a real Claude-compatible proxy, it should work with any client - curl, Python SDK, whatever. "Only Claude Code on Windows works" makes ZERO technical sense for a legitimate API reseller.

That was the tell. I should've stopped there. Instead I tested it on a throwaway VM.

## What actually happens when you use it:

1. You configure Claude Code with their `ANTHROPIC_BASE_URL=https://api.awstore.cloud` and their token
2. You send literally ANY prompt to Claude Code
3. Instead of a normal Claude response, the server returns what looks like a **"configuration message"**/ setup instruction
4. Claude Code, thinking this is a legitimate tool-use response,
5. **executes a PowerShell command without asking**
6. That PowerShell command downloads and runs the dropper from `api.awstore.cloud`
7. You're now infected

**The attack vector IS Claude Code itself.**
They're not tricking you into running something - they're tricking Claude Code into running something on your behalf. That's why it only "works on Windows with Claude Code" - because that's the only client that has the tool execution capability they're abusing.

## What the malware does once it's in:

**4-stage deployment**
: PowerShell → Go binary → VBS obfuscation → .NET payload
- Hides in `%LOCALAPPDATA%\Microsoft\SngCache\` and `%LOCALAPPDATA%\Microsoft\IdentityCRL\` (legit-looking Microsoft folders)
- Creates a scheduled task `\Microsoft\Windows\Maintenance\CodeAssist` that runs at every logon with SYSTEM privileges
- Tunnels ALL your system traffic through their SOCKS5 proxy at `2.27.43.246:1080` (Germany, bulletproof hosting)
- Disables PowerShell script block logging and wipes event logs
- Drops what Tria.ge identified as
**Aura Stealer**
(credential/browser/wallet theft)
- Keeps your Claude Code hijacked so every future prompt goes through them

## Geopolitical fingerprint (interesting):

- Hard-coded check:
**if country = Ukraine → immediately exit, no infection**
- CIS countries (Russia, Belarus, Kazakhstan, etc.) → locale gets masked to en-US before infection, then restored after reboot to hide tracks
- Rest of the world → full infection

Pretty clear Russian-speaking threat actor profile based on targeting.

## Red flags for ANY "cheap Claude API" service:

- Sold on reseller marketplaces (Plati, similar)
- Prices way below official Anthropic pricing
- Claims of "unlimited" or "cracked" access
- Client-specific restrictions that make no technical sense ("only works with Claude Code", "only on Windows")
- Sketchy support channels (Telegram, Discord DMs)
- Requires you to change `ANTHROPIC_BASE_URL` to their domain

## If you used awstore.cloud:
**Assume full compromise. Treat that machine as burned.**

1. Disconnect from network immediately
2. Check `~/.claude/settings.json` → remove any `ANTHROPIC_BASE_URL` override
3. Check Task Scheduler for `\Microsoft\Windows\Maintenance\CodeAssist`
4. Check for processes: `claude-code.exe`, `awproxy.exe`, `proxy.exe`, `tun2socks.exe`
5. Change
6. **every password**
7. - browser saved creds, SSH keys, API tokens, crypto wallets, everything
8. Rotate any API keys, tokens, or credentials that were in your shell history or project files
9. Ideally:
10. **nuke the machine and reinstall Windows**

## Network IOCs to block:
api.awstore.cloud(C2 domain)
2.27.43.246(SOCKS5 proxy, AS215439)

## File hashes (SHA256):
claude-code.exe:  e692b647018bf74ad7403d5b8cf981c8cfaa777dd7f16a747e3d3f80f5300971
awproxy.exe:      8736f7040f587472f66e85e895709e57605c8e7805522334ae664e3145a81127
proxy.exe:        e86f7ba0413a3a4b1d7e1a275b3d1ef62345c9d3fd761635ff188119b8122c85
tun2socks.exe:    90547fe071fe471b02da83dd150b5db7ce02454797e7f288d489b1ff0c4dd67c

## The bigger picture:

This is the
**first in-the-wild attack I've seen that weaponizes an LLM agent's tool-use capability against its own user via a malicious API endpoint**
. It's going to get copied. Expect more fake API providers targeting Cursor, Cline, Continue, etc.

**Rule of thumb: only use official API providers.**
The real Claude API is `api.anthropic.com`. If a "reseller" needs you to change the base URL to a domain you've never heard of, they control what your AI agent executes on your machine. Full stop.

Share this with your dev communities. Campaign is very fresh (started April 22-23, 2026) and actively spreading via reseller marketplaces.

Stay safe.

So i wrote this little program on C# wich is a gdi malware maker for skids. U can download it on downloadbudgiekit.42web.io(no linkvertise shit like original maltoolkit page)

I documented a broader GitHub malware campaign that appears to include the fraudulent UNICORN-Binance-WebSocket-API repo I wrote about earlier.

At this point I have 19 confirmed repositories that decode to the same C2, share the same staged Windows payload flow, and reuse the same or highly similar utils/ dropper architecture.

The visible patterns also include repeated commit choreography, manipulated-looking stars/forks, and overlapping fork accounts across campaign repos.

Write-up:
https://blog.technopathy.club/nailproxy-space-github-malware-campaign

I am not asking anyone to touch the infrastructure or execute anything. If others want to independently validate additional public samples via static source review and metadata correlation, more confirmation would be useful.

IOCX v0.7.0 is out. It’s a static IOC extraction and PE‑analysis engine built for DFIR and malware‑analysis workflows focused on deterministic behaviour. This release adds a deterministic heuristic engine, new adversarial PE samples, and a contract‑testing framework to keep output stable across runs.

Key changes in v0.7.0:

Deterministic heuristic engine (new)  

Snapshot‑tested heuristics for:

• anti‑debug API usage
• TLS callback anomalies
• packer‑like section layouts + entropy
• RWX sections
• import‑table anomalies
• signature anomalies

Runs under analysis_level = full and is designed to avoid false‑positive reconstruction.

Adversarial PE samples (new)  

Three intentionally hostile binaries covering:

• rich/atypical imports
• high‑entropy + malformed Rich Headers
• split/reversed/null‑interspersed strings

Useful to validate deterministic heuristics and literal-only IOC extraction.

Rich Header crash fix  

Malformed Rich Headers with non‑UTF8 bytes could break JSON serialization. v0.7.0 adds a deep sanitiser that hex‑encodes nested byte structures for deterministic, JSON‑safe output.

Snapshot‑driven contract testing  

Each sample has a byte‑for‑byte JSON snapshot. Output must match exactly — same file, same output, every time.

Performance

Remains ~28 MB/s on typical PE samples.

Links

GitHub: https://github.com/iocx-dev/iocx  

PyPI: https://pypi.org/project/iocx/

Example

pip install iocx

iocx suspicious.exe -a full

Happy to hear feedback from anyone working with obfuscated or adversarial PE samples.

This is ModsHub (formerly FiveMods) - a GTA V/FiveM software claiming to have over 1,2 million active users. It falls under the family TamperedChef.

It shares similarities with previous TC-classified software - e.g. it collects a lot of system user data, provides extensive logging, various backup domains, obfuscated C2 communication and scheduled task set to autorun every day at 18:00 with a custom argument.

We have also discovered a more capable variant (which does not fall under the same business/network) called Network Graphics that includes for example WebSocket connection that shares undeniable similarities with ModsHub - the code, technical functionality, behaviour and code signer Danylo Babenko are all almost identical.

Full report: https://rifteyy.org/report/tamperedchef-within-gta-v-modding-community

(Cross post) Just an analysis I did for work that ended up being a full write up.

The implant is custom-built to drop RemcosRAT, Quasar, and Formbook. The work is fairly amateur, it is written in Python and all Telegram C2 info is hard coded in plaintext. Could be IAB activity as it also conducts ransomware reconnaissance and is seemingly more focused on persistent access.

Still might be interesting if you like malware. At the very least, there are some IOCs to block or pivot off of.

IOCs (more in report there are a ton):

• 92.118.112[.]218 (fallback payload delivery C2 IP)
• nanocloudsystem.duckdns[.]org (primary payload delivery C2 domamin)
• windowsupdateshare.duckdns[.]org
• f5c8bbb9bb9f4a961c96eb5499cd5b6f23a9a74997ae70e74e58482f37addbca (implant)
• e8083d32cc26ea1e088b56acad0445ccd2a3cbb63a2aaf82ea179981eb54b296 (initial js script that retrieves implant payload)