Lightnews — Scholar-powered news

Browser Hijacking: Three Technique Studies

December 21, 2025 at 1:02 PM

Karsten Hahn

@struppigel.bsky.social

New blog: Browser Hijacking techniques -- when malware has different preferences than you

www.gdatasoftware.com/blog/2025/11...

#GDATA #GDATATechblog #BrowserHijacking

If you are searching for technical information on how browser hijacking works, there does not seem to be much out there apart from generic removal instructions. This might be an educational gap we sho...

hedgehog-tools/RenPy at main · struppigel/hedgehog-tools

December 15, 2025 at 6:52 AM

Karsten Hahn

@struppigel.bsky.social

I added a RenPy archive (.rpa, .rpi) extractor to my tools repo

github.com/struppigel/h...

Contribute to struppigel/hedgehog-tools development by creating an account on GitHub.

github.com

December 13, 2025 at 5:47 AM

Karsten Hahn

@struppigel.bsky.social

My colleague Banu wrote about a new infostealer Arkanix
www.gdatasoftware.com/blog/2025/12...

Arkanix: New Infostealer grabs Browser Data, Wifi Logins, Cryptowallets

G DATA researcher Banu Ramakrishnan has discovered a previously undocumented infostealer malware called Arkanix. Learn about the details in the G DATA blog!

Malware Analysis - Defeating ConfuserEx Anti-Analysis with Hooking

December 1, 2025 at 4:13 PM

Karsten Hahn

@struppigel.bsky.social

🦔📹 New Video: Modifying string decrypter for a ConfuserEx2 variant
➡️ Defeating antis with Harmony hooks
➡️ AsmResolver
➡️ .NET string deobfuscation
#MalwareAnalysisForHedgehogs
www.youtube.com/watch?v=sARn...

malwareanalysis-for-hedgehogs.learnworlds.com

November 30, 2025 at 11:01 AM

Karsten Hahn

@struppigel.bsky.social

Black Friday offers:
60% off for 2 malware analysis courses (beginner & intermediate)
Or 40% off for single course

malwareanalysis-for-hedgehogs.learnworlds.com/courses

Courses

November 28, 2025 at 6:41 AM

Karsten Hahn

@struppigel.bsky.social

Lecture on Anti Tamper by Tim Blazytko www.youtube.com/watch?v=hQi9...

SP25: Anti Tamper

YouTube video by mr_phrazer

Rhadamanthys Loader Deobfuscation | cyber.wtf

November 22, 2025 at 7:00 AM

Karsten Hahn

@struppigel.bsky.social

Rhadamanthys loader deobfuscation
cyber.wtf/2025/11/19/r...

cyber.wtf

November 19, 2025 at 12:14 PM

Karsten Hahn

@struppigel.bsky.social

I am suggesting a new malware type: the browser remote access tool (BRAT)

It's a form of browser hijacker that remotely controls your browser based on server commands.

Typical form: press key combos for copy-pasting URLs, opening tabs, context menu, downloading files etc

November 17, 2025 at 11:43 AM

Karsten Hahn

@struppigel.bsky.social

For anyone who wants to understand certificates better and how to spot abuse,
this is a great read
certcentral.org/training

November 13, 2025 at 3:12 PM

Karsten Hahn

@struppigel.bsky.social

🦔 📹 Video: Analysis of malicious NordVPN setup
➡️ beginner-suitable
➡️ sorry, no spoilers here ;)

www.youtube.com/watch?v=5-OY...

#MalwareAnalysisForHedgehogs

Malware Analysis - Trojanized NordVPN Setup, Beginner Sample

Infected Steam game downloads malware disguised as patch

October 26, 2025 at 6:02 AM

Karsten Hahn

@struppigel.bsky.social

I am looking for good resources for Linux malware analysis, including books and courses.
If you have any recommendations please let me know.

October 15, 2025 at 3:33 PM

Karsten Hahn

@struppigel.bsky.social

My #VirusBulletin2025 loot 😍
I also met someone from vxunderground and all I got was this lousy sticker

September 30, 2025 at 12:20 PM

Karsten Hahn

@struppigel.bsky.social

Steam game BlockBlasters downloads malware
written by Arvin Tan

#GDATATechblog @GDATA #GDATA
www.gdatasoftware.com/blog/2025/09...

A 2D platformer game called BlockBlasters has recently started showing signs of malicious activity after a patch release on August 30. While the user is playing the game, various bits of information a...

AppSuite, OneStart & ManualFinder: The Nexus of Deception

September 22, 2025 at 9:04 AM

Karsten Hahn

@struppigel.bsky.social

My colleague Banu wrote about the connection between AppSuite, OneStart and ManualFinder

www.gdatasoftware.com/blog/2025/09...

Having taken a look at AppSuite in one of our last articles, we have started pulling on a few loose threads to see where it would take us. It turns out that there are relationships with other maliciou...

Malware Theory - What breakpoints to set for unpacking

September 17, 2025 at 2:30 AM

Karsten Hahn

@struppigel.bsky.social

🦔 📹 New video: What breakpoints to set for unpacking malware?
➡️ Steps of unpacking stub
➡️ Breakpoint targets
➡️ VirtualAlloc from user to kernel mode

#MalwareAnalysisForHedgehogs #Unpacking
www.youtube.com/watch?v=fn8r...

Tritt dem MalwareAnalysisForHedgehogs-Discord-Server bei!

September 8, 2025 at 7:12 AM

Karsten Hahn

@struppigel.bsky.social

In light of the new course, I created a Discord server for MalwareAnalysisForHedghogs to discuss malware analysis related topics.

You can join here--this is for every malware enthusiast, not only course members: discord.gg/3evhC4cj

Sieh dir die MalwareAnalysisForHedgehogs-Community auf Discord an – häng mit 3 anderen Mitgliedern ab und freu dich über kostenlose Sprach- und Textchats.

discord.gg

September 2, 2025 at 6:55 AM

Karsten Hahn

@struppigel.bsky.social

My intermediate level malware analysis course is there.
60% off for the next two weeks.

malwareanalysis-for-hedgehogs.learnworlds.com/course/inter...

Malware Analysis - Intermediate Level

Signature writing, deobfuscation, dynamic API resolving, syscalls, hooking, shellcode analysis and more

malwareanalysis-for-hedgehogs.learnworlds.com

September 1, 2025 at 3:17 PM

Karsten Hahn

@struppigel.bsky.social

This blog post about impostor certificates by @SquiblydooBlog is a gem and very relevant right now.

Or: How threat actors impersonate companies to obtain authenticode certificates for signing their malware.
And why revokation is important.

squiblydoo.blog/2024/05/13/i...

Impostor Certificates

It is common for malware to be signed with code signing certificates. How is this possible? Impostors receive the cert directly and sign malware. In this blog-post, we look at 100 certs used by Sol…

squiblydoo.blog

August 31, 2025 at 7:48 PM

Karsten Hahn

@struppigel.bsky.social

Our technical deep-dive about AppSuite PDF Editor backdoor is out 📝👇

www.gdatasoftware.com/blog/2025/08...
#GDATA #GDATATechblog #AppSuite

Backdoor in "AppSuite PDF Editor": A Detailed Technical Analysis

Some threat actors are bold enough to submit their own malware as false positive to antivirus companies and demand removal of the detection. This is exactly what happened with AppSuite PDF Editor.