Malware Research Lead
Mei-Lin reverse-engineers commodity and bespoke malware, and writes the technical breakdowns behind our loader and stealer coverage.
152 articles
Trellix says APT28 routed command-and-control through filen.io during a three-day European phishing burst. Here is the behavioural detection logic that catches it when reputation cannot.
MicrosoftProofpoint disclosed the BlueMoon exploit kit weaponizing Google Chrome V8 flaws (CVE-2026-87491) alongside Windows kernel privilege escalation in state-aligned espionage attacks.
Agentic AIOX Security and VulnCheck disclosed CVE-2026-82533 in DeepSeek Harness, where prompt injection allowed sandboxed AI coding agents to disable their own security isolation.
Deep DiveUnit 42 documented six new RAT variants from Iran-nexus Screening Serpens between February and April 2026. The hashes rotate; the AppDomainManager config file does not.
DevSecOpsA practical, ordered checklist for defending against malicious packages and install-time credential theft — with the exact commands and settings.
DevSecOpsA self-propagating worm compromised hundreds of popular npm packages, harvesting cloud keys and CI tokens then using them to publish further poisoned releases.
DevSecOpsA campaign beginning in late June 2026 built hundreds of fake brand repositories on GitHub and used SEO to place them at the top of software download searches.
Threat IntelResearchers logged 7.4 million infected devices between January and June 2026 — a 27% jump — as the infostealer market matured into a fully automated criminal supply chain.