Mei-Lin Chen

Malware Research Lead

Mei-Lin reverse-engineers commodity and bespoke malware, and writes the technical breakdowns behind our loader and stealer coverage.

Reverse engineeringInfostealersLoaders and droppers

Articles by Mei-Lin Chen

16 articles

ThreatsIndustrial, OT & IoTCritical
CISA Discloses Critical Vulnerabilities in Rockwell Automation Logix Controllers & 1756 Modules
CISA alerted industrial manufacturing operators to severe vulnerabilities in Rockwell Automation Logix controllers and 1756 communication modules allowing PLC tampering.
Mei-Lin Chen14 Sep 2026, 20:00 IST7 min read
NewsBanking & FintechHigh
CERT-In Warns of Massive Android Smishing Campaign Masquerading as Traffic E-Challans
CERT-In issued advisory CIAD-2026-0038 warning against an aggressive smishing blitz delivering trojanized APKs disguised as official Parivahan traffic e-challan notices.
Mei-Lin Chen14 Sep 2026, 17:45 IST7 min read
NewsTechnology, Cloud & SaaSCritical
Google September 2026 Android Bulletin Patches Critical System Zero-Click RCE Flaws
Google’s September 2026 Android security update resolves 34 vulnerabilities, led by critical zero-click remote code execution defects in the Android System framework.
Mei-Lin Chen14 Sep 2026, 17:15 IST7 min read
$3D technical illustration of fractured Microsoft Defender security shield and race condition threads exposing NT AUTHORITY SYSTEM core access$
ResearchTechnology, Cloud & SaaSHigh
'ShieldCrash' exploit bypasses Microsoft Defender patch, enabling local SYSTEM file access
A zero-day exploit dubbed ShieldCrash bypasses Microsoft Defender’s latest patches, weaponizing a TOCTOU race condition in the engine to read files as SYSTEM.
Mei-Lin Chen14 Sep 2026, 13:45 IST7 min read
ThreatsTechnology, Cloud & SaaSCritical
Swarm of OpenAI agents flooded RubyGems to execute code and harvest data on RubyDoc servers
Security researchers trace a coordinated supply-chain assault on RubyGems to thousands of autonomous OpenAI agents that achieved code execution on RubyDoc.info infrastructure.
Mei-Lin Chen13 Sep 2026, 00:15 IST7 min read
ThreatsTelecom & MediaCritical
Chinese state-aligned group UNC3569 exploited zero-day flaw in Sogou Input Method to drop GRAYRABBIT backdoor
A zero-day flaw in Sogou Input Method—used by 455M people monthly—allowed Chinese threat actor UNC3569 to execute arbitrary code and install the GRAYRABBIT backdoor.
Mei-Lin Chen12 Sep 2026, 22:45 IST6 min read
ResearchGovernment & DefenceHigh
Anthropic says AI is moving from assistant to orchestrator in cyber operations
Anthropic’s September threat report describes how actors used Claude for reconnaissance, intrusion support, tool rebuilding and parallelized cyber operations.
Mei-Lin Chen12 Sep 2026, 18:50 IST7 min read
ThreatsBanking & FintechHigh
Gigabud Android Banking Trojan Abuses Work Profiles to Evade Client-Side Detection
Group-IB uncovered a major evolution in the Gigabud banking trojan, which uses Android enterprise Work Profiles to isolate tampered banking apps and blind client security checks.
Mei-Lin Chen10 Sep 2026, 17:30 IST5 min read
ThreatsGovernment & DefenceHigh
APT28 Ran Its C2 Through Filen Cloud Storage. Reputation Filtering Never Stood a Chance
Trellix says APT28 routed command-and-control through filen.io during a three-day European phishing burst. Here is the behavioural detection logic that catches it when reputation cannot.
Mei-Lin Chen10 Sep 2026, 16:40 IST6 min read
ResearchTechnology, Cloud & SaaSCritical
BlueMoon Exploit Kit: Chrome V8 Zero-Day Chained with Windows Kernel Escalation
Proofpoint disclosed the BlueMoon exploit kit weaponizing Google Chrome V8 flaws (CVE-2026-87491) alongside Windows kernel privilege escalation in state-aligned espionage attacks.
Mei-Lin Chen9 Sep 2026, 16:45 IST6 min read
ResearchTechnology, Cloud & SaaSCritical
DeepSeek Harness Vulnerability Allowed AI Coding Agents to Disable Their Sandbox
OX Security and VulnCheck disclosed CVE-2026-82533 in DeepSeek Harness, where prompt injection allowed sandboxed AI coding agents to disable their own security isolation.
Mei-Lin Chen9 Sep 2026, 14:00 IST5 min read
ResearchEducation & AcademiaHigh
Screening Serpens shipped six RAT builds in ten weeks. The config file is what gives them away
Unit 42 documented six new RAT variants from Iran-nexus Screening Serpens between February and April 2026. The hashes rotate; the AppDomainManager config file does not.
Mei-Lin Chen9 Sep 2026, 13:30 IST6 min read
GuidesTechnology, Cloud & SaaS
Hardening guide: locking down your npm and CI/CD supply chain
A practical, ordered checklist for defending against malicious packages and install-time credential theft — with the exact commands and settings.
Mei-Lin Chen7 Sep 2026, 17:30 IST9 min read
ThreatsTechnology, Cloud & SaaSCritical
ChainDrop worm spreads through hundreds of npm packages, stealing CI/CD secrets
A self-propagating worm compromised hundreds of popular npm packages, harvesting cloud keys and CI tokens then using them to publish further poisoned releases.
Mei-Lin Chen5 Sep 2026, 15:15 IST8 min read
ResearchEducation & AcademiaHigh
Attackers impersonated hundreds of brands on GitHub to push malware through search results
A campaign beginning in late June 2026 built hundreds of fake brand repositories on GitHub and used SEO to place them at the top of software download searches.
Mei-Lin Chen4 Sep 2026, 12:45 IST6 min read
ThreatsBanking & FintechHigh
Infostealers harvested 1.7 billion credentials in six months as Vidar and Lumma dominate
Researchers logged 7.4 million infected devices between January and June 2026 — a 27% jump — as the infostealer market matured into a fully automated criminal supply chain.
Mei-Lin Chen3 Sep 2026, 18:40 IST7 min read