Malware Research Lead

Mei-Lin Chen, page 3

Mei-Lin reverse-engineers commodity and bespoke malware, and writes the technical breakdowns behind our loader and stealer coverage.

61 articlesUpdated 28 Sep 2026Page 3 of 3

Reverse engineeringInfostealersLoaders and droppersLinkedIn

Articles by Mei-Lin Chen

$3D technical illustration of fractured Microsoft Defender security shield and race condition threads exposing NT AUTHORITY SYSTEM core access$
ResearchCloud & SaaS
'ShieldCrash' exploit bypasses Microsoft Defender patch, enabling local SYSTEM file access
A zero-day exploit dubbed ShieldCrash bypasses Microsoft Defender’s latest patches, weaponizing a TOCTOU race condition in the engine to read files as SYSTEM.
Mei-Lin Chen14 Sep 20267 min read
ThreatsCloud & SaaSCritical
Swarm of OpenAI agents flooded RubyGems to execute code and harvest data on RubyDoc servers
Security researchers trace a coordinated supply-chain assault on RubyGems to thousands of autonomous OpenAI agents that achieved code execution on RubyDoc.info infrastructure.
Mei-Lin Chen13 Sep 20267 min read
ThreatsTelecom & MediaCritical
Chinese state-aligned group UNC3569 exploited zero-day flaw in Sogou Input Method to drop GRAYRABBIT backdoor
A zero-day flaw in Sogou Input Method—used by 455M people monthly—allowed Chinese threat actor UNC3569 to execute arbitrary code and install the GRAYRABBIT backdoor.
Mei-Lin Chen12 Sep 20266 min read
ResearchGov & Defence
Anthropic says AI is moving from assistant to orchestrator in cyber operations
Anthropic’s September threat report describes how actors used Claude for reconnaissance, intrusion support, tool rebuilding and parallelized cyber operations.
Mei-Lin Chen12 Sep 20267 min read
ThreatsBanking & FintechHigh
Gigabud Android Banking Trojan Abuses Work Profiles to Evade Client-Side Detection
Group-IB uncovered a major evolution in the Gigabud banking trojan, which uses Android enterprise Work Profiles to isolate tampered banking apps and blind client security checks.
Mei-Lin Chen10 Sep 20265 min read
ThreatsGov & DefenceHigh
APT28 Ran Its C2 Through Filen Cloud Storage. Reputation Filtering Never Stood a Chance
Trellix says APT28 routed command-and-control through filen.io during a three-day European phishing burst. Here is the behavioural detection logic that catches it when reputation cannot.
Mei-Lin Chen10 Sep 20266 min read
ResearchCloud & SaaS
BlueMoon Exploit Kit: Chrome V8 Zero-Day Chained with Windows Kernel Escalation
Proofpoint disclosed the BlueMoon exploit kit weaponizing Google Chrome V8 flaws (CVE-2026-87491) alongside Windows kernel privilege escalation in state-aligned espionage attacks.
Mei-Lin Chen9 Sep 20266 min read
ResearchCloud & SaaS
DeepSeek Harness Vulnerability Allowed AI Coding Agents to Disable Their Sandbox
OX Security and VulnCheck disclosed CVE-2026-82533 in DeepSeek Harness, where prompt injection allowed sandboxed AI coding agents to disable their own security isolation.
Mei-Lin Chen9 Sep 20265 min read
ResearchEducation & Academia
Screening Serpens shipped six RAT builds in ten weeks. The config file is what gives them away
Unit 42 documented six new RAT variants from Iran-nexus Screening Serpens between February and April 2026. The hashes rotate; the AppDomainManager config file does not.
Mei-Lin Chen9 Sep 20266 min read
GuidesCloud & SaaS
Hardening guide: locking down your npm and CI/CD supply chain
A practical, ordered checklist for defending against malicious packages and install-time credential theft — with the exact commands and settings.
Mei-Lin Chen7 Sep 20269 min read
ThreatsCloud & SaaSCritical
ChainDrop worm spreads through hundreds of npm packages, stealing CI/CD secrets
A self-propagating worm compromised hundreds of popular npm packages, harvesting cloud keys and CI tokens then using them to publish further poisoned releases.
Mei-Lin Chen5 Sep 20268 min read
ResearchEducation & Academia
Attackers impersonated hundreds of brands on GitHub to push malware through search results
A campaign beginning in late June 2026 built hundreds of fake brand repositories on GitHub and used SEO to place them at the top of software download searches.
Mei-Lin Chen4 Sep 20266 min read
ThreatsBanking & FintechHigh
Infostealers harvested 1.7 billion credentials in six months as Vidar and Lumma dominate
Researchers logged 7.4 million infected devices between January and June 2026 — a 27% jump — as the infostealer market matured into a fully automated criminal supply chain.
Mei-Lin Chen3 Sep 20267 min read