🆕 The Deobfuscation tab decodes more scripts, including code hidden by the virtual-machine obfuscation some phishing kits use and scripts embedded in SVG images
Search
10 results for “scanmalware”
-
🆕 Scan results: the Browser APIs view now notes when a page fingerprints the browser - measuring the audio stack, graphics card, canvas or other device details that can recognise a visitor without cookies - and lists the techniques it used. Anti-bot checks, ads and analytics do this routinely, so it is information, not a verdict. Find such pages with has:browser_fingerprinting
-
🆕 Scan results: the Pivot tab offers more ways to find related pages - hashes of inline scripts, script hashes that still match after a script is reformatted or partly rewritten, the WebAssembly library or vendor module a page runs, URLs revealed by decoding an obfuscated script, how heavily a page's scripts are obfuscated, rarely used browser features and the names of malicious script patterns
https://scanmalware.com/result/3b7500b0-5aab-40d2-9354-188dc263722d#pivot
-
🆕 Improved search: similar_to always includes exact copies of the script it starts from, wasm_host also finds hosts a WebAssembly module reveals when it runs, obfuscator accepts aaencode and jsfuck, and js_feature recognises the browser features added in recent Chrome versions
-
🆕 New detection for several phishing kits, exploit-kit loaders and ClickFix variants, and fewer false matches on articles and research pages that describe these threats
-
🆕 Faster search: very common words, text in screenshots and nameserver wildcards return in seconds, and scan results, screenshots and previews load faster
-
🆕 The Deobfuscation tab decodes more scripts: it opens on a readable copy, unpacks XOR-encrypted loaders and base64-encoded strings into layers of their own, and says why a script stayed encoded. The Obfuscation tab on scan results lists what the deobfuscator found, with a link to each script, and WebAssembly module pages recognise more kinds of modules
-
🆕 Improved Security Verdict and AI Security Verdict accuracy, with fewer false alarms on websites' own sign-in pages and clearer explanations of why a page was flagged
-
24 of 37 websites linked to the Coruna iOS exploit-kit campaign still carry its hidden iframes. We checked all 37 websites. Three findings stood out:
🔹 The same two hidden iframes remain on 24 sites. No visible change to the page-the chain targets iPhones
🔹 One lure routes visitors to two exploit kits: iOS 13-17 to Coruna, iOS 18 to DarkSword
🔹 We found additional infrastructure, including admin panels titled “Coruna 管理后台”.A hunting pivot: the loader reports visitors through POST requests to /api/ip-sync/sync. That endpoint path persists across domain rotation.
ScanMalware now detects the kit’s structure, helping identify newly infected sites without depending on a list of known domains
Full findings: https://scanmalware.com/h/273
#ThreatIntelligence #iOS #Coruna #DarkSword #CyberSecurity #Malware
-
ICYMI: MonsterCloud owner faces 3 fraud counts over $8M in secret ransom payments: One client paid about $150,000 in 2023 for a key bought from hackers for $8,200, prosecutors allege. What did the no-ransom pitch hide from victims and banks? https://ppc.land/monstercloud-owner-faces-3-fraud-counts-over-8m-in-secret-ransom-payments/ #FraudAlert #CyberSecurity #Ransomware #DigitalCrime #ScamAwareness