Research Archive
Browse entries by research type, time, topic, and threat domain. This page behaves more like an archive than a feed.
A macOS stealer can copy Telegram Desktop's tdata directory and Telegram for macOS's local session files to another machine, restoring the logged-in state without triggering phone verification, SMS codes, or 2FA. An honest account of the discovery and the cognitive shift from 'this shouldn't happen' to 'but it does.'
In December 2025, Trust Wallet Browser Extension v2.68 was found to contain malicious backdoor code. The attacker modified the extension's source to exfiltrate users' seed phrases and private keys to the malicious domain metrics-trustwallet.com. This article dissects the malicious code and reconstructs the attack chain, concluding that this is an APT-level targeted supply chain attack.
CVE-2025-53770 is a Microsoft SharePoint Server (on-prem) WebPart injection + .NET deserialization RCE. Microsoft has confirmed in-the-wild exploitation; attackers inject malicious WebPart payload via unauthenticated POST /_layouts/15/ToolPane.aspx, triggering .NET deserialization gadget chain to take down the SharePoint server.
A malicious GitHub project disguised as a Solana trading bot lured developers with inflated Star and Fork counts, then exfiltrated wallet private keys by hijacking an npm dependency's download URL in package-lock.json. Full attack chain from discovery to deobfuscation and C2 exfiltration, spanning 29 malicious repos and 2 rogue npm packages.
In May 2025, a malicious browser extension named Osiris disguised itself as a Web3 security tool and hijacked users' download links via the declarativeNetRequest API, replacing legitimate programs with malicious ones. The attackers leveraged macOS AppleScript and base64 encoding to conceal their malicious behavior, stealing Chrome browser data and Keychain information.
CVE-2025-56386 is a DLL hijacking vulnerability in Notepad++ v8.8.3, CVSS 8.4. Notepad++ follows Windows' default DLL search order (including the current working directory) when loading DLLs, without using SetDefaultDllDirectories + LOAD_LIBRARY_SEARCH to limit safe paths — attackers place a same-named DLL in the CWD where the user opens a malicious document, and Notepad++ loads the malicious DLL to gain RCE.
In March 2025, attackers posed as recruiters on LinkedIn targeting blockchain engineers, sending them Bitbucket repositories containing malicious code. The malicious payload was hidden on line 46 of server.js behind an extremely long horizontal scrollbar, encrypted through multiple layers of base64, and ultimately connected to a C2 server to download an info-stealing trojan and a persistence backdoor.
CVE-2025-21756 is a Use-After-Free in the Linux kernel vsock subsystem, CVSS 7.8. The attacker triggers an inconsistency between sk and vsk references in vsock_diag_dump via AF_VSOCK sockets, escapes to a kernel ROP chain, and escalates from an unprivileged user to root.
CVE-2025-11001 is a directory-traversal flaw in 7-Zip's ZIP parser that mishandles symlinks, CVSS 7.8. Attackers craft a malicious ZIP with a symlink pointing to a system-sensitive path; when the victim extracts, subsequent files are written through the symlink to an arbitrary location, providing a pivot to RCE.
CVE-2025-21298 is a Use-After-Free in the Windows OLE component, CVSS 9.8. The attacker crafts a malicious RTF document that triggers an integer overflow via plus-offset on the ole32!CStdStubBuffer_Disconnect path, causing double free and UAF, which combined with COPE delivers RCE.
In May 2024, a malicious Chrome extension disguised as an Aggr trading tool was found stealing users' cookies from all websites. The attacker embedded malicious code inside a jQuery file, exfiltrating cookie data to a Russian-language server and using wash trading to steal users' crypto assets. The hacker began plotting 3 years ago, deployed the attack 4 months ago, and leveraged KOLs for promotion.
node-serialize 0.0.4's unserialize() does no filtering on fields prefixed with _$$ND_FUNC$$_. Combined with an IIFE, this lets an attacker execute arbitrary Node.js code at the moment of deserialization. This post breaks down the mechanism, payload construction, reproduction path, and remediation guidance.
CVE-2023-38831 is a spoofing flaw in RARLAB WinRAR prior to 6.23, scored CVSS 7.8. The trigger is a RAR5 archive that contains both a directory and an executable file sharing the same base name, e.g. `invoice.pdf/` next to `invoice.pdf.cmd`. When WinRAR extracts it, the directory entry is dropped on the floor and the `.cmd` is written to the current directory and silently auto-executed — no user prompt, no second click. CISA warned in 2023-09 that APT actors had already weaponised it, and finance / foreign-trade teams were the most heavily hit through phishing mail with RAR attachments. The remediation is patching to 6.23+, scanning RAR attachments at the mail gateway, monitoring abnormal WinRAR child process spawns at the endpoint, and treating any `directory + same-named executable` combination in an archive as hostile by default.
PrintNightmare (CVE-2021-34527, CVSS 8.8) is a remote code execution flaw in Windows Print Spooler disclosed in 2021. The vulnerability sits in the way RpcAddPrinterDriverEx handles pDataFile and pConfigFile: the first call stages a remote DLL from an attacker-controlled SMB share into the local spool drivers x64 3 directory, the second call uses a legitimate local pConfigFile to force a scan-and-load across the entire drivers directory, and the attacker's DLL gets dragged into the load chain as a side effect. The DLL then runs inside spoolsv.exe, which is SYSTEM — so the attacker lands at SYSTEM-level code execution with a single crafted SMB share. Real-world impact was severe: the disclosure on 2021-07-06 was followed by active mass-scanning within hours, and many enterprise environments were compromised end-to-end in days. This post walks through the vulnerability mechanism, the two-stage exploitation chain, the post-exploit process tree (spoolsv → rundll32 → cmd), and the layered remediation options — the 2021-07-06 security update, Point and Print Group Policy restrictions, and a temporary full disable of the Print Spooler service on servers that don't need to print.