VNVũ Nhật Lâminblog.fiscybersec.com·Jun 8 · 9 min readMSHTA: The Retired Windows Tool Still Running MalwareExecutive Summary A Windows utility most people assume died with Internet Explorer is quietly powering live malware campaigns. Bitdefender reports that since the start of 2026, detections of mshta.exe00
VNVũ Nhật Lâminblog.fiscybersec.com·Apr 28 · 12 min readLumma Stealer + Sectop RAT (ArechClient2): Two-Stage Attack Chain via Fake Cracked SoftwareExecutive Summary On April 17, 2026, SANS Internet Storm Center documented a Lumma Stealer campaign followed by Sectop RAT (ArechClient2) targeting users searching for pirated software. Attackers used00
AMAlberto Maríninmalwareinternals.com·Mar 14 · 20 min readAnalyzing LummaC2 stealer’s novel Anti-Sandbox technique: Leveraging trigonometry for human behavior detectionThe Malware-as-a-Service (MaaS) model, and its readily available scheme, remains to be the preferred method for emerging threat actors to carry out complex and lucrative cyberattacks. Information thef63FDP
AMAlberto Maríninmalwareinternals.com·Mar 14 · 26 min readLummaC2 stealer: Everything you need to knowThere is a huge spike in the popularity and use of information-stealing malware in underground markets. With more stealing capabilities, simplified administration, and ability to remain undetected, st00
LTLưu Tuấn Anhinblog.fiscybersec.com·Sep 17, 2025 · 7 min readBạn có đang cài một extension VSCode của hacker?Trong thời đại lập trình viên ngày càng phụ thuộc vào các extension, một mối đe dọa âm thầm nhưng cực kỳ nguy hiểm đã xuất hiện: nhóm hacker WhiteCobra đã lợi dụng các kho extension của Visual Studio Code để phát tán hàng chục plugin giả mạo. Những e...00
LTLưu Tuấn Anhinblog.fiscybersec.com·Sep 17, 2025 · 5 min readAre you installing a hacker's VSCode extension?In an era where developers increasingly rely on extensions, a silent but extremely dangerous threat has emerged: the WhiteCobra hacker group has exploited Visual Studio Code extension repositories to distribute dozens of fake plugins. These extension...00
