Malware on 思安录 | Thinking's Security Notes

Telegram Desktop Local Session Reuse: a Reproduction That Should Not Have Happened

Thinking — Wed, 15 Jul 2026 00:00:00 +0000

The reproduction result exceeded what I understood to be possible. Telegram’s device authentication — phone verification, SMS code, 2FA password — seemed, to me, well-designed and complete. But when the tdata directory was copied to another Mac and the client launched, the login screen never appeared. This was not 2FA being cracked. The entire reuse path never entered a stage where credentials were requested.

Trust Wallet Extension Backdoor: v2.68 Malicious Code Injection Analysis

Thinking — Fri, 26 Dec 2025 00:00:00 +0000

CVE-2025-53770 SharePoint WebPart Injection Deserialization RCE: Active Exploitation Before Patch Day

Thinking — Tue, 15 Jul 2025 00:00:00 +0000

SharePoint treats WebPart rendering as “trusted internal”, but the ToolPane.aspx endpoint accepts unauthenticated POST — attackers construct a malicious WebPart payload that triggers a .NET deserialization gadget chain, executing arbitrary commands on the SharePoint Server without authentication, and Microsoft has confirmed it is being exploited in the wild.

A Popular Solana Bot on GitHub Was a Wallet Thief: Supply Chain Attack Analysis

Thinking — Thu, 03 Jul 2025 00:00:00 +0000

Osiris Malicious Browser Extension Analysis: Download Link Hijacking Disguised as a Security Tool

Thinking — Wed, 28 May 2025 00:00:00 +0000

CVE-2025-56386 Notepad++ DLL Hijacking: v8.8.3 DLL Search Order and CWD Fatal Combination

Thinking — Tue, 15 Apr 2025 00:00:00 +0000

Notepad++ uses Windows’ default DLL search order (including CWD) when loading DLLs, but does not use SetDefaultDllDirectories with LOAD_LIBRARY_SEARCH to limit safe paths — attackers place a malicious same-named DLL in the CWD where the user opens a malicious document, and Notepad++ preferentially loads the CWD’s malicious DLL on startup, completing RCE under user privileges.

LinkedIn Recruitment Phishing Analysis: A Targeted Attack Against Blockchain Engineers

Thinking — Sat, 15 Mar 2025 00:00:00 +0000

CVE-2025-21756 Linux Kernel vsock UAF: Shortest Path from Socket Subsystem to Root

Thinking — Fri, 28 Feb 2025 00:00:00 +0000

Linux kernel’s vsock_diag_dump iterates AF_VSOCK sockets but the release order between the transport pointer (sk) and the vsock pointer (vsk) is misaligned — the attacker closes one side to leave the other dangling, and the next iteration lands on freed memory, escaping to the kernel control flow.

CVE-2025-11001 7-Zip ZIP Parsing Directory Traversal to RCE: Symlink Converging With the Extraction Path

Thinking — Sat, 15 Feb 2025 00:00:00 +0000

7-Zip treats symlink entries inside a ZIP as ordinary directory entries — the attacker crafts a three-layer structure of “directory + symlink + malicious file”, the symlink points to a sensitive system path, and when the victim extracts, the malicious file lands wherever the symlink points.

CVE-2025-21298 Windows OLE RCE: Plus-Offset Triggering Use-After-Free in CStdStubBuffer

Thinking — Wed, 22 Jan 2025 00:00:00 +0000

Windows OLE delegates object reference counting to ole32!CStdStubBuffer_Disconnect — the attacker crafts OLE references in an RTF document so the reference count jumps via plus-offset to a specific value, triggering premature object release; when the COPE framework later calls a virtual function on the freed object, the result is UAF.

Fake Aggr Chrome Extension Crypto Theft Analysis: Cookie Stealing and Wash Trading

Thinking — Fri, 31 May 2024 00:00:00 +0000

node-serialize Deserialization RCE: An Underestimated Trust Chain in a Node.js Library

Thinking — Mon, 15 Jan 2024 00:00:00 +0000

The tiny serialization library node-serialize, last released as 0.0.4, left one backdoor in its unserialize() function — any JSON field whose value starts with _$$ND_FUNC$$_ is fed straight into eval(). The result is arbitrary Node.js code execution.

CVE-2023-38831 WinRAR Spoof: 0-Click Attack via Archive File Masquerading

Thinking — Wed, 23 Aug 2023 00:00:00 +0000

WinRAR’s extraction logic has a hidden behavior — when an archive contains both a “same-named directory” and a “same-named executable file,” WinRAR prefers to extract the executable file to the current directory and auto-execute it. An attacker’s carefully crafted “looks-like-a-safe-image” turns out to be an executable.

CVE-2021-34527 PrintNightmare: A SYSTEM-Level DLL Loading Trap in Windows Print Spooler

Thinking — Tue, 06 Jul 2021 00:00:00 +0000

A DLL-loading control gap in the Windows Print Spooler service — a single crafted SMB share is enough to coerce the system into loading an attacker-supplied driver DLL and handing the attacker SYSTEM-level command execution.