Insights, research findings, and security best practices from the front lines of cybersecurity.
Subscribe via RSSThe forged VS Code manifest, the TRON-to-BSC payload resolver and its five-step decode, the App-Bound Encryption bypass, the NetSupport kit, a gateway that obeys any server, 1.28 TB across two unauthenticated stores, and the five claims this analysis withdrew together with the control tests that killed them.
A campaign tracked as DEV#POPPER since 2024 is still recruiting developers through hiring platforms. The intrusion fires on npm run dev, the payload is retrieved from a public blockchain, and two unauthenticated servers holding about 1.28 TB remain reachable.
A coding interview repo is a request to run unknown code on a machine that holds your browser sessions, SSH keys, GitHub tokens, and cloud credentials. This checklist covers what to check before the call, what to look for in the repo, and what to do if you already ran it.
Five trojanized browser extensions extracted Google profile identity through chrome.identity and routed it through an Aptos blockchain dead drop. Before any wallet artifact moved, the extension asked Chrome who owned the browser.
OtterCookie is a separate JavaScript / Node.js RAT running beside BeaverTail in the Contagious Interview operation. Its Socket.IO control plane maintains a live roster of connected developer workstations and broadcasts it on a thirty-second clock. Part VIII breaks down the protocol, the collection profile, the uid/userKey batch labels, the npm and Vercel delivery layer, and the operational shift from stored-data theft to live surveillance of developer machines.
Red Asgard identified an internet-exposed Jenkins server used as both a fake cryptocurrency-exchange deployment hub and a build environment for FCCCall trojanized video-conferencing installers. Eighteen FCCCall installers were produced from the same hub in a single five-and-a-half-hour window; thirteen named fake-exchange brands were deployed from the same environment. At preparation time, the infrastructure was not meaningfully represented in public malware-intelligence tooling. This note publishes sanitized indicators and detection guidance for defenders.
The Hetzner host at 195.201.104.53 was known as the BeaverTail FTP exfiltration sink. A scan of its non-standard ports found six Express.js services on the same machine, two of them OtterCookie command-and-control nodes – one live broadcasting macOS victim state, one silent predecessor still listening – plus a Linux deployment leaking a Windows development path on every request. One host. Multiple campaigns. Multiple malware families. Shared substrate.
Five operator workstations appeared in the campaign's own victim database. The same exfiltration pipeline that harvested developer credentials, wallet material, and source-repository tokens had ingested the staff who ran it — the supervisor, a persona operator, a test workstation, a provisioning workstation, and an operator infection that persisted sixty-eight days.
A new Red Asgard podcast, The Fake Interview, brings the Contagious Interview investigation into audio: the operators, the personas, the infrastructure, the victims, and the operational mistakes that exposed more than the attackers intended.
Most AI security discussion focuses on models, prompts, and jailbreaks. In practice, the most consequential failures happen where AI systems connect to operational infrastructure.
Forensic examination of an active Lazarus Group operator machine: a target list of nearly 17,000 developers, six drained wallets, and a plaintext file containing his own keys.
We burned through our Claude MAX weekly quota two days before renewal. So we gave Codex a try. Here's what happened.
You're paying $200/month for unlimited AI assistance. Except it's not unlimited, the limits keep changing without notice, and nobody can tell you how close you are to hitting them.
It has been only days since we published Part III—where we asked whether we were hunting Lazarus or walking into a honeypot. We did not expect to be back this soon. But what we found makes everything before it look like a prologue.
We discovered a second malware family, mapped approximately 20 ghost servers with consistent configurations, attempted to exploit the C2 infrastructure—and ended up questioning whether we were hunting them, or they were hunting us.
The attackers couldn't keep their Pastebin accounts online. So they moved their payload delivery to infrastructure that can't be taken down.
We found North Korean malware in a client's Upwork project. Then we spent five days mapping the attackers' infrastructure.
For most of software engineering history, the hardest skill was translating intent into correct syntax. Syntax mastery became a proxy for competence itself. Large language models quietly break that assumption - and force the industry to confront what engineering skill has always actually been.
Most organizations testing their AI systems are doing it wrong. This five-level maturity framework provides structure for understanding where you are, what capabilities you need next, and how much it will cost to get there.
Web3 AI agents control millions in crypto assets with irreversible transaction finality. Traditional prompt injection barely scratches the attack surface. This guide introduces context manipulation - a comprehensive offensive methodology targeting the memory, oracles, and input channels that autonomous agents trust.
The protocol that's becoming the standard interface between AI and enterprise systems has security gaps most organizations haven't yet learned to see.
Preliminary forensic analysis of the Nov 3, 2025 Balancer V2 exploit with on-chain verification and a per-chain verification plan. Official disclosure pending.
Red Asgard's threat-intel provides multi-source threat aggregation, CVE integration, and automated risk assessment for security operations teams.
Red Asgard releases quantum-shield, implementing NIST-standardized post-quantum algorithms (Kyber, Dilithium) for hybrid quantum-resistant encryption and signatures.
Introducing path-security, Red Asgard's comprehensive Rust library defending against 85+ path traversal attack vectors including unicode, encoding, and exotic bypasses.
Red Asgard releases module-registry, a powerful Rust crate enabling compile-time discovery and runtime instantiation of plugins with type safety guarantees.
Red Asgard releases blockchain-runtime, a powerful Rust crate for dynamic blockchain analysis, testing, and simulation across multiple chains without vendor lock-in.
Red Asgard releases llm-security, an open-source Rust crate providing defense-in-depth protection against prompt injection, jailbreaks, and LLM manipulation attacks.
Introducing our new security research blog where we share insights, vulnerabilities, and best practices from the front lines of cybersecurity.