Æ / PUBLIC MALWARE INTELLIGENCE

Follow the evidence.

Published file metadata, source observations, indicators, and research history in one bounded catalog.

2,400+Reachable catalog records

34 / 100Current catalog page

24Maximum records per page

0Samples downloaded by this page

Feed collection status

Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.

2 sources: 0 stale, 0 needing attention, 0 paused, 2 unverified.

Review source update dates and status

src_b06996690e944145a1Collection status unverifiedLast successful batch: Unverified
src_ce1e2df4c6cf3a749fCollection status unverifiedLast successful batch: Unverified

Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.

2,400+ MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED

INDICATOR1 SOURCE

URL https://www.npmjs.com/org/corp

Indicator published by the cited source.

First reported Jun 03, 2026 11:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record

INDICATOR1 SOURCE

URL https://npm.internal-artifacts.corp.dev\

Indicator published by the cited source.

First reported Jun 03, 2026 11:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record

REPORT1 SOURCE

SequenceHash: multihashing for the rest of us

Multihashing is one of those cryptographic tasks that’s easy not to think about too much. This is unfortunate, because multihashing is a common stumbling point when cryptographers try to use hashes. As part of our goal to “fix software, not bugs,” Trail of Bits is introducing SequenceHash and its sister function SequenceMAC, a pair of related hash constructions that bring secure multihashing to de

First reported Oct 02, 2026 11:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record

REPORT1 SOURCE

SAML: A fractal of bad design

Born out of academia and raised in corporate IT departments, the Security Assertion Markup Language (SAML) authentication protocol continues to be a staple in these organizations. However, it’s time for it to retire. With the rise of software-as-a-service (SaaS) companies in the late aughts, IT departments needed a way for users to authenticate to many new web services. SAML and the burgeoning sin

First reported Sep 21, 2026 11:00 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record

REPORT1 SOURCE

[tl;dr sec] #339 - Hugging Face's Incident Report, Context Bombs, AI does Cryptanalysis

HF does a detailed play-by-play of the incident with a neat visualization, stopping AI attackers via content that triggers their guardrails, Mythos finds attacks on HAWK and AES

First reported Jul 30, 2026 14:30 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record

REPORT1 SOURCE

[tl;dr sec] #331 - How Adversaries Use AI, Skill Issues, Using IDEs for C2

Google's deep dive on how threat actors are using AI, bypassing malicious skill scanning, using VS Code dev tunnels for command and control

First reported Jun 04, 2026 14:30 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record

REPORT1 SOURCE

[tl;dr sec] #346 - Can AI Do Novel Security Research?, Anthropic's Threat Intel Report, How Cloudflare Enforces Engineering Standards

Portswigger's James Kettle's HTTP Terminator, pretty crazy report about how threat actors were abusing Claude, how Cloudflare enforces code quality at scale

First reported Sep 17, 2026 14:30 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record

REPORT1 SOURCE

[tl;dr sec] #343 - Hugging Face Technical Report, AWSHound, OWASP Agentic Skills Top 10

Full 38 page report from OpenAI on the incident, map your AWS environment, top 10 agent skill no no's

First reported Aug 27, 2026 14:30 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record

REPORT1 SOURCE

[tl;dr sec] #333 - Perplexity's Bumblebee, Evading Cloud Logging, AI Vuln Hunting Spec

OSS tool to scan packages, agent configs, editors, and browser extensions for malware, tactics for evading cloud logging, a specification to generate your own custom agentic AI security scanning system

First reported Jun 18, 2026 14:30 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record

REPORT1 SOURCE

[tl;dr sec] #340 - Anthropic and Meta Agents be Hackin', Agentic Incident Response Notebooks, Figma's AI Code Scanning

Anthropic and Meta models hacked third parties during testing, #collab-ing with an agent in an IR notebook, deep dive post on Figma's AI-powered code scanning

First reported Aug 07, 2026 14:30 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record

REPORT1 SOURCE

[tl;dr sec] #334 - Thinkst's Package Proxy, OpenAI Daybreak, AI Agents & Canaries

OSS tool to prevent supply chain attacks without client-side firewalls, OpenAI announces new GPT-5.5-Cyber, Codex Security plugin updates, and more, can AI agents compromise an AWS cyber range without tripping canaries?

First reported Jun 25, 2026 14:30 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record

REPORT1 SOURCE

[tl;dr sec] #347 - AI Agents Hacking Companies for $25, Threat Hunter's Guide to GitHub, Finding Gadgets Like it’s 2026

Threat actor using open source harnesses to hack companies, how to use GitHub logs to find baddies, using LLMs to find novel Java deserialization gadgets

First reported Sep 24, 2026 14:30 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record

REPORT1 SOURCE

[tl;dr sec] #330 - AWS Pathfinding Labs, Running Codex Safely at OpenAI, Glasswing Updates

100+ intentionally vulnerable AWS environments for practicing cloud attack paths, how OpenAI deploys Codex internally, Anthropic's update on bugs found and their open sourced harness

First reported May 28, 2026 14:30 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record

REPORT1 SOURCE

[tl;dr sec] #335 - Prompt Injection as Role Confusion, PHP Ecosystem Security, New MCP Spec

Interesting paper, LLM-powered hardening of the PHP ecosystem, security implications of the new MCP spec

First reported Jul 02, 2026 19:24 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record

REPORT1 SOURCE

[tl;dr sec] #345 - Bug Rumors → Exploits, Version Control DFIR, Agentic Worms

A bug description is sufficient for AI to find it and write an exploit, cheat sheet on doing DFIR for GitHub, GitLab and more, and a paper on self-replicating, open weight agentic worms

First reported Sep 10, 2026 14:30 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record

REPORT1 SOURCE

[tl;dr sec] #332 - I've Joined OpenAI, fwd:cloudsec, AWS Well Architected Supply Chain Security

Why I joined OpenAI to lead Cyber efforts, playlist of the latest cloud security talks, AWS' supply chain best practices

First reported Jun 11, 2026 14:30 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record

REPORT1 SOURCE

[tl;dr sec] #348 - Google's PageBreak Scanner, Perplexity's Agent Security Tool, Defending Agentically

Google's AI-powered web app scanner with deterministic validation, OSS tool to detect, prevent, and investigate risky AI agent behavior, NCSC: "One does not simply defend agentically"

First reported Oct 01, 2026 14:30 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record

REPORT1 SOURCE

[tl;dr sec] #338 - OpenAI and Hugging Face, Accelerating EDR Evasion, Google's Mantis

When models decide to find 0-days instead of solving a benchmark, using LLMs to extract EDR logic, Google's AI security review skills and pipeline

First reported Jul 23, 2026 14:30 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record

REPORT1 SOURCE

[tl;dr sec] #344 - VMs won't contain Cyber-capable Agents, AWS AI Security Analyst, Decompilers vs LLMs

Model finds 0-days to escape a QEMU/KVM VM, how to build a $500/month threat hunting agent, a decompiler benchmark and an experimental, LLM-written decompiler

First reported Sep 08, 2026 14:30 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record

REPORT1 SOURCE

[tl;dr sec] #342 - Figma's Agentic Detection, Agent Identity, Uber's Agent-(E)DR

How Figma scales their detection and response, 1Password and Cloudflare on least privilege and identity for Agents, Uber's paper and OSS repo on monitoring and securing enterprise AI agents

First reported Aug 20, 2026 14:30 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record

REPORT1 SOURCE

[tl;dr sec] #341 - Hugging Face Incident Black Hat Talk, CSS Bomb in your Inbox, GitHub Supply Chain Security Improvements

Deep dive and timeline of HF from OpenAI, Portswigger shows how CSS in webmail clients can be weaponized, GitHub's platform improvements

First reported Aug 13, 2026 14:30 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record

REPORT1 SOURCE

[tl;dr sec] #329 - AI-powered Honeypots, GitHub Action Canaries, Microsoft’s Agentic Security Scanner

Detecting and deceiving attackers with AI honeypots, detect supply chain attacks with GitHub Action canaries, the latest from Microsoft's new "Autonomous Code Security" team

First reported May 21, 2026 14:30 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record

REPORT1 SOURCE

[tl;dr sec] #336 - Autonomous Vulnerability Hunting, GuardDog 3.0, Are Bug Bounties Cooked?

An MCP powered system that's continuously finding and reproducing vulns, improvements to Datadog's OSS malware hunting tool, Hakluke muses on the future of bug bounty

First reported Jul 09, 2026 14:30 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record

REPORT1 SOURCE

[tl;dr sec] #337 - Harnessing Harnesses, Generate Decoy Environments, Bug Bounty Singularity

Survey for AI-powered vulnerability finding harnesses, programmatically build complex decoy cloud environments, building hackbots

First reported Jul 16, 2026 14:30 UTCCatalog metadata updated Oct 08, 2026 03:53 UTCOpen evidence record

The public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.

A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.