Tagged: malware

The words DRIVE-BY DOWNLOAD in monospace with an orange underline bar

Malware delivery via the browser: drive-by downloads and the exploit-kit era

Traces how a browser or plugin bug turned a page visit into code execution: the redirect chain, landing-page fingerprinting, the Flash and Java exploit-kit economy of 2010-2016, and the decline as browsers and Adobe killed the attack surface.

malware web-security history

Mon, November 10, 2025 · 21 min read

The words EXPLOIT KIT in mono type over a black field with an orange underline and the line fingerprint, then exploit, then drop

Browser exploit kits: the rise and fall of Angler, Nuclear, and RIG

A primary-source history of the exploit-kit era: the fingerprint-then-exploit flow, the rental economy behind Angler, Nuclear, RIG and Magnitude, the 2016 Angler takedown, and the collapse that followed Flash's death.

malware web-security history

Sun, November 9, 2025 · 19 min read

Malicious redirects and traffic-distribution systems in the malvertising economy

How traffic distribution systems gate and route victims through the malvertising chain: Keitaro-style filtering, server- and client-side cloaking, malicious ad injection, and the fingerprinting that hides payloads from researchers.

malware ad-fraud web-security

Sat, November 8, 2025 · 21 min read

Fingerprinting for evasion: how malware checks if it's in a sandbox

A reference on how malware fingerprints its runtime to decide whether it's being analyzed: CPUID and RDTSC timing, VM artifacts, mouse geometry, uptime, and sandbox hostnames, and why it stays dormant when the signals line up.

malware fingerprinting reverse-engineering

Fri, November 7, 2025 · 19 min read

The phrase DGA in monospace with a generated domain string and an orange accent

Domain generation algorithms: how malware finds its C2 without hardcoded domains

How malware generates thousands of pseudo-random rendezvous domains from a shared seed, traced from Kraken and Conficker through Torpig and GameOver Zeus, and how defenders sinkhole and classify them.

malware dns threat-intel

Thu, November 6, 2025 · 20 min read

The words fast flux in mono type over a black field with an orange underline and a DNS A record with a 120-second TTL

Fast-flux networks: how botnets hide C2 behind rotating DNS

How fast flux rotates A and NS records over a bot proxy layer to hide C2 and phishing infrastructure, the flux-score and TTL signals that detect it, and what the 2025 CISA advisory adds.

malware dns botnet

Wed, November 5, 2025 · 21 min read

The word cloaking in monospace with an orange split between a benign decoy and a credential form

How phishing kits fingerprint and cloak from security scanners

Traces the anti-analysis layer inside modern phishing kits: how IP, user-agent, and referrer checks serve a benign decoy to scanners while showing the credential form to victims, the anti-bot-as-a-service market, and how anti-phishing crawlers crawl back.

malware fingerprinting web-security

Mon, November 3, 2025 · 22 min read

The phrase ClickFix in monospace with an orange cursor and a fake verify-you-are-human checkbox

Captcha-gated malware: when threat actors borrow anti-bot tech

Traces the 2024-2025 ClickFix and fake-CAPTCHA wave: how attackers dress malware delivery in Cloudflare and reCAPTCHA UX, push commands through the clipboard, and gate payloads so automated analysis sees nothing.

malware captcha threat-intel

Sun, November 2, 2025 · 21 min read

The word BOTNET in mono type over black with an orange underline and a timeline from 1999 IRC to 2025 residential proxies

The history of the botnet: from EarthLink Spammer to Mirai and beyond

A primary-source history of the botnet, from 1990s IRC bots and the EarthLink Spammer through Storm, Conficker, Zeus, Mirai's IoT swarm, and the residential-proxy networks that now launder scraping and fraud.

history botnet malware

Thu, October 23, 2025 · 20 min read