GachiLoader: Defeating Node.js Malware with API Tracing GachiLoader: Defeating Node.js Malware

Research by: Sven Rath (@eversinc33), Jaromír Hořejší (@JaromirHorejsi) Key Points The YouTube Ghost Network is a malware distribution network that uses compromised accounts to promote malicious videos and spread malware, such as infostealers. One of the observed campaigns uses a new, heavily obfuscated loader malware written in Node.js, which we call GachiLoader. To make it easier to analyze obfuscated Node.js malware,…

Read More

Dynamic EASM Discovery: Continuous Discovery for a Changing Attack Surface

Staying ahead of what’s exposed, automatically. The modern enterprise doesn’t stand still. New domains are registered, acquisitions bring inherited infrastructure, cloud workloads spin up and down daily, and somewhere in the middle of it all, your visible footprint on the internet external attack surface keeps expanding. For CISOs, this constant motion makes one CTEM step…

Read More

People Are Paying to Get Their Chatbots High on ‘Drugs’

Petter Ruddwall knows the idea of AIs becoming sentient and seeking to get high with code-based “drugs” seems “stupid.” But the Swedish creative director couldn’t get it out of his head. So he scraped trip reports and psychological research on the effects of various psychoactive substances, wrote a batch of codes modules to hijack chatbot…

Read More

Transparency, Openness, and Our 2023-2024 Financials

Every year, as required by U.S. federal law for 501(c)(3) nonprofits, the Tor Project completes a Form 990, and as required by contractual obligations and state regulations, an independent audit of our financial statements. After completing standard audits for 2023-2024,* we added our federal tax filings (Form 990) and audited financial statements to our website….

Read More

Navigating Change: Evolving Your Exposure Management Strategy in a Post-Kenna World with Qualys

Key Takeaways Cisco is ending support for it vuln management product (formerly Kenna Security) by June 2028 Risk-based vulnerability management (RBVM) used to be adequate, but is no longer sufficient Exposure assessment platforms allow you to assess risks from all organizational risk surfaces  SOC centralizes post‑attack response, the ROC centralizes pre‑attack exposure management Build your…

Read More