Karsten Hahn
@struppigel.bsky.social
BlueMoon exploit kit allows to infect systems if a user opens a link via Chrome or Chromium based browsers via v8 sandbox escape and RCE on Windows.
www.proofpoint.com/us/blog/thre...
www.proofpoint.com/us/blog/thre...
Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days | Proofpoint US
Analyst note: Proofpoint uses the UNK_ designator to define clusters of activity that are still developing and have not been observed for long enough to receive a numerical TA designation.
www.proofpoint.com
September 10, 2026 at 6:44 AM
BlueMoon exploit kit allows to infect systems if a user opens a link via Chrome or Chromium based browsers via v8 sandbox escape and RCE on Windows.
www.proofpoint.com/us/blog/thre...
www.proofpoint.com/us/blog/thre...
🦔 📹 New Video: Hooking V8 JavaScript
➡️ compiled V8
➡️ we write a reusable hook script
➡️ we overcome basic anti-hooking
#MalwareAnalysisForHedgehogs #V8 #JavaScript
www.youtube.com/watch?v=Y8_A...
➡️ compiled V8
➡️ we write a reusable hook script
➡️ we overcome basic anti-hooking
#MalwareAnalysisForHedgehogs #V8 #JavaScript
www.youtube.com/watch?v=Y8_A...
Malware Analysis - Hooking V8 JavaScript bytecode
YouTube video by MalwareAnalysisForHedgehogs
www.youtube.com
September 6, 2026 at 6:00 AM
🦔 📹 New Video: Hooking V8 JavaScript
➡️ compiled V8
➡️ we write a reusable hook script
➡️ we overcome basic anti-hooking
#MalwareAnalysisForHedgehogs #V8 #JavaScript
www.youtube.com/watch?v=Y8_A...
➡️ compiled V8
➡️ we write a reusable hook script
➡️ we overcome basic anti-hooking
#MalwareAnalysisForHedgehogs #V8 #JavaScript
www.youtube.com/watch?v=Y8_A...
Blog: "Bad advice and myths around malware prevention"
If you ever heard or said "visiting websites can't infect you", "PDFs aren't malicious" or "exploits are rare and always targeted" this article might be for you.
blog.gdatasoftware.com/2026/07/3846...
#GDATATechBlog #GDATA
If you ever heard or said "visiting websites can't infect you", "PDFs aren't malicious" or "exploits are rare and always targeted" this article might be for you.
blog.gdatasoftware.com/2026/07/3846...
#GDATATechBlog #GDATA
Bad Advice and Myths Around Malware Prevention
Bad advice about malware prevention creates false confidence. Nuanced advice matters! Learn why websites, old exploits, and PDF files can still pose risks.
blog.gdatasoftware.com
August 19, 2026 at 4:22 AM
Blog: "Bad advice and myths around malware prevention"
If you ever heard or said "visiting websites can't infect you", "PDFs aren't malicious" or "exploits are rare and always targeted" this article might be for you.
blog.gdatasoftware.com/2026/07/3846...
#GDATATechBlog #GDATA
If you ever heard or said "visiting websites can't infect you", "PDFs aren't malicious" or "exploits are rare and always targeted" this article might be for you.
blog.gdatasoftware.com/2026/07/3846...
#GDATATechBlog #GDATA
New video: Compiled V8 JavaScript for reversers 🎥
➡️ V8 compilation pipeline
➡️ bytecode caching
➡️ how bytenode abuses caching for protection
www.youtube.com/watch?v=YSSC...
#MalwareAnalysisForHedgehogs #JavaScript #V8
➡️ V8 compilation pipeline
➡️ bytecode caching
➡️ how bytenode abuses caching for protection
www.youtube.com/watch?v=YSSC...
#MalwareAnalysisForHedgehogs #JavaScript #V8
Compiled JavaScript - V8 compilation pipeline and Bytenode
YouTube video by MalwareAnalysisForHedgehogs
www.youtube.com
August 12, 2026 at 5:27 AM
New video: Compiled V8 JavaScript for reversers 🎥
➡️ V8 compilation pipeline
➡️ bytecode caching
➡️ how bytenode abuses caching for protection
www.youtube.com/watch?v=YSSC...
#MalwareAnalysisForHedgehogs #JavaScript #V8
➡️ V8 compilation pipeline
➡️ bytecode caching
➡️ how bytenode abuses caching for protection
www.youtube.com/watch?v=YSSC...
#MalwareAnalysisForHedgehogs #JavaScript #V8
Do you remember the BlockBlasters Steam game that was used to steal from a man with cancer?
FBI arrested the threat actor
www.techspot.com/news/113163-...
FBI arrested the threat actor
www.techspot.com/news/113163-...
FBI arrests 21-year-old accused of infecting 8,000 PCs with malware through fake Steam games
The suspect, identified by the FBI as Zyaire Dontaevious Zamarion Wilkins, is accused of running a sophisticated cybercrime operation with unnamed co-conspirators for nearly two years. The...
www.techspot.com
July 24, 2026 at 12:54 PM
Do you remember the BlockBlasters Steam game that was used to steal from a man with cancer?
FBI arrested the threat actor
www.techspot.com/news/113163-...
FBI arrested the threat actor
www.techspot.com/news/113163-...
I asked a clanker to make me a prompt that I can use to generate images of malware, like literal pictures that represent malware such as the ones used in samplepedia, not PE images.
I got a warning for cyber abuse with threats to shut down my account o.O
I got a warning for cyber abuse with threats to shut down my account o.O
June 21, 2026 at 3:17 AM
I asked a clanker to make me a prompt that I can use to generate images of malware, like literal pictures that represent malware such as the ones used in samplepedia, not PE images.
I got a warning for cyber abuse with threats to shut down my account o.O
I got a warning for cyber abuse with threats to shut down my account o.O
I published an API tracer for kernel mode drivers using speakeasy emulation
AI notice: It's vibe-coded.
I manually analyzed ~20 drivers to verify and improve the output and tested with a corpus of ~100 drivers.
github.com/struppigel/h...
AI notice: It's vibe-coded.
I manually analyzed ~20 drivers to verify and improve the output and tested with a corpus of ~100 drivers.
github.com/struppigel/h...
June 20, 2026 at 4:54 AM
I published an API tracer for kernel mode drivers using speakeasy emulation
AI notice: It's vibe-coded.
I manually analyzed ~20 drivers to verify and improve the output and tested with a corpus of ~100 drivers.
github.com/struppigel/h...
AI notice: It's vibe-coded.
I manually analyzed ~20 drivers to verify and improve the output and tested with a corpus of ~100 drivers.
github.com/struppigel/h...
New trainings sample on samplepedia
Backdoor, obfuscated Python bytecode.
0/60 on Virustotal, which means it's still fresh.
www.virustotal.com/gui/file/4ad...
samplepedia.cc/sample/4ada6...
Backdoor, obfuscated Python bytecode.
0/60 on Virustotal, which means it's still fresh.
www.virustotal.com/gui/file/4ad...
samplepedia.cc/sample/4ada6...
June 19, 2026 at 3:03 PM
New trainings sample on samplepedia
Backdoor, obfuscated Python bytecode.
0/60 on Virustotal, which means it's still fresh.
www.virustotal.com/gui/file/4ad...
samplepedia.cc/sample/4ada6...
Backdoor, obfuscated Python bytecode.
0/60 on Virustotal, which means it's still fresh.
www.virustotal.com/gui/file/4ad...
samplepedia.cc/sample/4ada6...
🦔 📹 Poison X kernel mode rootkit analysis
➡️ kernel mode driver theory
➡️ Ghidra markup
➡️ basic string deobfuscation
#MalwareAnalysisForHedgehogs
www.youtube.com/watch?v=yx6A...
➡️ kernel mode driver theory
➡️ Ghidra markup
➡️ basic string deobfuscation
#MalwareAnalysisForHedgehogs
www.youtube.com/watch?v=yx6A...
Malware Analysis - PoisonX rootkit, Kernel driver rootkit markup in Ghidra
YouTube video by MalwareAnalysisForHedgehogs
www.youtube.com
June 14, 2026 at 6:25 AM
🦔 📹 Poison X kernel mode rootkit analysis
➡️ kernel mode driver theory
➡️ Ghidra markup
➡️ basic string deobfuscation
#MalwareAnalysisForHedgehogs
www.youtube.com/watch?v=yx6A...
➡️ kernel mode driver theory
➡️ Ghidra markup
➡️ basic string deobfuscation
#MalwareAnalysisForHedgehogs
www.youtube.com/watch?v=yx6A...
I submitted a new sample to samplepedia.cc
PoisonX rootkit.
Video solution follows the next days.
samplepedia.cc/sample/db5d2...
PoisonX rootkit.
Video solution follows the next days.
samplepedia.cc/sample/db5d2...
June 13, 2026 at 3:26 AM
I submitted a new sample to samplepedia.cc
PoisonX rootkit.
Video solution follows the next days.
samplepedia.cc/sample/db5d2...
PoisonX rootkit.
Video solution follows the next days.
samplepedia.cc/sample/db5d2...
This seems to be a prevalent issue now: People vibe code security applications and the LLM generates real malware for testing.
The generated test files rely on real threat actor infrastructure to download or exfiltrate.
hxxps://github.com/DataDog/guarddog/blob/main/tests
The generated test files rely on real threat actor infrastructure to download or exfiltrate.
hxxps://github.com/DataDog/guarddog/blob/main/tests
June 12, 2026 at 5:54 AM
This seems to be a prevalent issue now: People vibe code security applications and the LLM generates real malware for testing.
The generated test files rely on real threat actor infrastructure to download or exfiltrate.
hxxps://github.com/DataDog/guarddog/blob/main/tests
The generated test files rely on real threat actor infrastructure to download or exfiltrate.
hxxps://github.com/DataDog/guarddog/blob/main/tests
😂 @rifteyy just pointed me to this gem in the VT comment section for the empty file
www.virustotal.com/gui/file/e3b...
www.virustotal.com/gui/file/e3b...
May 7, 2026 at 2:31 PM
😂 @rifteyy just pointed me to this gem in the VT comment section for the empty file
www.virustotal.com/gui/file/e3b...
www.virustotal.com/gui/file/e3b...
New Video: Build your own LLM dynamic analysis lab 🦔🎥
➡️ AI debugs and unpacks with x64dbg
➡️ AI can access powershell terminal
www.youtube.com/watch?v=QrWz...
➡️ AI debugs and unpacks with x64dbg
➡️ AI can access powershell terminal
www.youtube.com/watch?v=QrWz...
Build your own AI based Dynamic Reversing Lab, x64dbg automate
YouTube video by MalwareAnalysisForHedgehogs
www.youtube.com
April 19, 2026 at 7:06 AM
New Video: Build your own LLM dynamic analysis lab 🦔🎥
➡️ AI debugs and unpacks with x64dbg
➡️ AI can access powershell terminal
www.youtube.com/watch?v=QrWz...
➡️ AI debugs and unpacks with x64dbg
➡️ AI can access powershell terminal
www.youtube.com/watch?v=QrWz...
My malware analysis courses have now a new certificate design.
malwareanalysis-for-hedgehogs.learnworlds.com/courses
malwareanalysis-for-hedgehogs.learnworlds.com/courses
March 24, 2026 at 4:55 AM
My malware analysis courses have now a new certificate design.
malwareanalysis-for-hedgehogs.learnworlds.com/courses
malwareanalysis-for-hedgehogs.learnworlds.com/courses
March 23, 2026 at 2:27 PM
I wrote an article about SugarSMP Minecraft scams, Spark stealer, extortion and hacked accounts.
After a brief contact to the threat actor, we talked to two victims and followed the trail.
Analysis in collaboration with @rifteyy
#GDATATechblog #GDATA
blog.gdatasoftware.com/2026/03/3839...
After a brief contact to the threat actor, we talked to two victims and followed the trail.
Analysis in collaboration with @rifteyy
#GDATATechblog #GDATA
blog.gdatasoftware.com/2026/03/3839...
Minecraft: SugarSMP's Dark Tale of Scams, Malware & Extortion
Some Minecraft players were looking for safe haven away from griefers, but found an elaborate web of malware, deception and extortion.
blog.gdatasoftware.com
March 17, 2026 at 9:26 AM
I wrote an article about SugarSMP Minecraft scams, Spark stealer, extortion and hacked accounts.
After a brief contact to the threat actor, we talked to two victims and followed the trail.
Analysis in collaboration with @rifteyy
#GDATATechblog #GDATA
blog.gdatasoftware.com/2026/03/3839...
After a brief contact to the threat actor, we talked to two victims and followed the trail.
Analysis in collaboration with @rifteyy
#GDATATechblog #GDATA
blog.gdatasoftware.com/2026/03/3839...
🦔 📹 Video: Building your own AI Malware Analysis Lab
➡️ old system, 16 GB RAM
➡️ using Remnux
#MalwareAnalysisForHedgehogs #LLM
www.youtube.com/watch?v=YOdu...
➡️ old system, 16 GB RAM
➡️ using Remnux
#MalwareAnalysisForHedgehogs #LLM
www.youtube.com/watch?v=YOdu...
Build your own AI Malware Analysis Lab with Remnux
YouTube video by MalwareAnalysisForHedgehogs
www.youtube.com
March 15, 2026 at 8:45 AM
🦔 📹 Video: Building your own AI Malware Analysis Lab
➡️ old system, 16 GB RAM
➡️ using Remnux
#MalwareAnalysisForHedgehogs #LLM
www.youtube.com/watch?v=YOdu...
➡️ old system, 16 GB RAM
➡️ using Remnux
#MalwareAnalysisForHedgehogs #LLM
www.youtube.com/watch?v=YOdu...
🦔 📹 New video: NodeJs analysis when deobfuscator fails
➡️ #MythJs stealer sample
➡️ pkg VFS exploration tool
➡️ js-confuser
#MalwareAnalysisForHedgehogs
www.youtube.com/watch?v=gtLq...
➡️ #MythJs stealer sample
➡️ pkg VFS exploration tool
➡️ js-confuser
#MalwareAnalysisForHedgehogs
www.youtube.com/watch?v=gtLq...
Malware Analysis - Deobfuscating NodeJs pkg packed stealer MythJs
YouTube video by MalwareAnalysisForHedgehogs
www.youtube.com
March 7, 2026 at 6:55 AM
🦔 📹 New video: NodeJs analysis when deobfuscator fails
➡️ #MythJs stealer sample
➡️ pkg VFS exploration tool
➡️ js-confuser
#MalwareAnalysisForHedgehogs
www.youtube.com/watch?v=gtLq...
➡️ #MythJs stealer sample
➡️ pkg VFS exploration tool
➡️ js-confuser
#MalwareAnalysisForHedgehogs
www.youtube.com/watch?v=gtLq...
New blog: Using LLMs the right way for malware analysis
💡Tips for building an autonomous AI analysis lab on a 12 yo laptop and getting stuff done faster without loss of accuracy.
blog.gdatasoftware.com/2026/03/3838...
💡Tips for building an autonomous AI analysis lab on a 12 yo laptop and getting stuff done faster without loss of accuracy.
blog.gdatasoftware.com/2026/03/3838...
March 3, 2026 at 4:34 PM
New blog: Using LLMs the right way for malware analysis
💡Tips for building an autonomous AI analysis lab on a 12 yo laptop and getting stuff done faster without loss of accuracy.
blog.gdatasoftware.com/2026/03/3838...
💡Tips for building an autonomous AI analysis lab on a 12 yo laptop and getting stuff done faster without loss of accuracy.
blog.gdatasoftware.com/2026/03/3838...
GuvercinInstaller.exe 1/72
#kurdishmyth stealer, NodeJS
➡️Infects discord_desktop_core\index.js
➡️Steals various browser and discord data.
➡️Exfiltrates via discord webhook.
The code references kurdishmyth and mythprivate
www.virustotal.com/gui/file/496...
#kurdishmyth stealer, NodeJS
➡️Infects discord_desktop_core\index.js
➡️Steals various browser and discord data.
➡️Exfiltrates via discord webhook.
The code references kurdishmyth and mythprivate
www.virustotal.com/gui/file/496...
February 28, 2026 at 3:39 PM
GuvercinInstaller.exe 1/72
#kurdishmyth stealer, NodeJS
➡️Infects discord_desktop_core\index.js
➡️Steals various browser and discord data.
➡️Exfiltrates via discord webhook.
The code references kurdishmyth and mythprivate
www.virustotal.com/gui/file/496...
#kurdishmyth stealer, NodeJS
➡️Infects discord_desktop_core\index.js
➡️Steals various browser and discord data.
➡️Exfiltrates via discord webhook.
The code references kurdishmyth and mythprivate
www.virustotal.com/gui/file/496...
We wrote about HijackLoader. Not exactly a new topic, but certainly an interesting journey.
It provides some tools for HijackLoader too.
blog.gdatasoftware.com/2026/02/3837...
It provides some tools for HijackLoader too.
blog.gdatasoftware.com/2026/02/3837...
Free Games, Costly Consequences, and Loads of Malware
The Spanish games platform PiviGames is being abused as a malware distribution hub. This was discovered after someone looked for help on Reddit.
blog.gdatasoftware.com
February 26, 2026 at 11:24 AM
We wrote about HijackLoader. Not exactly a new topic, but certainly an interesting journey.
It provides some tools for HijackLoader too.
blog.gdatasoftware.com/2026/02/3837...
It provides some tools for HijackLoader too.
blog.gdatasoftware.com/2026/02/3837...
samplepedia.cc update:
You have now a new "My articles" overview (see profile dropdown menu), which allows you to add article drafts and manage articles.
You can decide to publish such a draft as a solution later.
You have now a new "My articles" overview (see profile dropdown menu), which allows you to add article drafts and manage articles.
You can decide to publish such a draft as a solution later.
February 21, 2026 at 10:53 AM
samplepedia.cc update:
You have now a new "My articles" overview (see profile dropdown menu), which allows you to add article drafts and manage articles.
You can decide to publish such a draft as a solution later.
You have now a new "My articles" overview (see profile dropdown menu), which allows you to add article drafts and manage articles.
You can decide to publish such a draft as a solution later.
February 21, 2026 at 6:28 AM
Looks like the dev told an LLM to generate test files for a Shai Hulud detection app.
The LLM complied and generated malicious test files...
github.com/Cobenian/sha...
The LLM complied and generated malicious test files...
github.com/Cobenian/sha...
February 10, 2026 at 2:42 PM
Looks like the dev told an LLM to generate test files for a Shai Hulud detection app.
The LLM complied and generated malicious test files...
github.com/Cobenian/sha...
The LLM complied and generated malicious test files...
github.com/Cobenian/sha...
I created an extraction script for custom PyInstaller applications as seen in suspected EvilAI PDF apps.
Script (modified pyinstxtractor-ng): github.com/struppigel/h...
Article: samplepedia.cc/sample/8c9d9...
Script (modified pyinstxtractor-ng): github.com/struppigel/h...
Article: samplepedia.cc/sample/8c9d9...
February 1, 2026 at 12:23 PM
I created an extraction script for custom PyInstaller applications as seen in suspected EvilAI PDF apps.
Script (modified pyinstxtractor-ng): github.com/struppigel/h...
Article: samplepedia.cc/sample/8c9d9...
Script (modified pyinstxtractor-ng): github.com/struppigel/h...
Article: samplepedia.cc/sample/8c9d9...