Malware Research Lead

Mei-Lin Chen, page 4

Mei-Lin reverse-engineers commodity and bespoke malware, and writes the technical breakdowns behind our loader and stealer coverage.

77 articlesUpdated 6 Oct 2026Page 4 of 4

Reverse engineeringInfostealersLoaders and droppersLinkedIn

Articles by Mei-Lin Chen

ResearchEducation & Academia
Screening Serpens shipped six RAT builds in ten weeks. The config file is what gives them away
Unit 42 documented six new RAT variants from Iran-nexus Screening Serpens between February and April 2026. The hashes rotate; the AppDomainManager config file does not.
Mei-Lin Chen9 Sep 20266 min read
GuidesCloud & SaaS
Hardening guide: locking down your npm and CI/CD supply chain
A practical, ordered checklist for defending against malicious packages and install-time credential theft — with the exact commands and settings.
Mei-Lin Chen7 Sep 20269 min read
ThreatsCloud & SaaSCritical
ChainDrop worm spreads through hundreds of npm packages, stealing CI/CD secrets
A self-propagating worm compromised hundreds of popular npm packages, harvesting cloud keys and CI tokens then using them to publish further poisoned releases.
Mei-Lin Chen5 Sep 20268 min read
ResearchEducation & Academia
Attackers impersonated hundreds of brands on GitHub to push malware through search results
A campaign beginning in late June 2026 built hundreds of fake brand repositories on GitHub and used SEO to place them at the top of software download searches.
Mei-Lin Chen4 Sep 20266 min read
ThreatsBanking & FintechHigh
Infostealers harvested 1.7 billion credentials in six months as Vidar and Lumma dominate
Researchers logged 7.4 million infected devices between January and June 2026 — a 27% jump — as the infostealer market matured into a fully automated criminal supply chain.
Mei-Lin Chen3 Sep 20267 min read

Articles by Mei-Lin Chen

Screening Serpens shipped six RAT builds in ten weeks. The config file is what gives them away

Hardening guide: locking down your npm and CI/CD supply chain

ChainDrop worm spreads through hundreds of npm packages, stealing CI/CD secrets

Attackers impersonated hundreds of brands on GitHub to push malware through search results

Infostealers harvested 1.7 billion credentials in six months as Vidar and Lumma dominate