Pinned Tweet
From now on, I'll be posting the same (or very similar) content on Mastodon as well!
Don't hesitate to follow: infosec.exchange/@janrubin
This is a big one. @krejsavojtech21 and I published a deep dive on #Warden Stealer, a Rust #infostealer that quickly became one of the most prevalent threats we protect users from.
It also targets AI assistant and coding-agent data.
Read: gendigital.com/blog/insights…
Jan Rubín retweeted
We've just published a technical breakdown of #WardenStealer, an actively developed MaaS #infostealer which, in just two months, already positioned itself as one of the most prevalent infostealers we protect our users from, ranking on par with Amatera, Remus and Vidar.
Warden is written in Rust🦀and ships with its own loader and a built-in crypto clipper, and its builds are heavily obfuscated, morphed, and regularly updated to evade detection.
It is also one of the first stealers to target configuration files and local data belonging to AI assistants and agentic coding tools.
Read the full technical breakdown ↓
gendigital.com/blog/insights…
Jan Rubín retweeted
Someone else's phishing traffic just left the internet through your house. We blocked 20.8M attacks routed through residential proxy networks since January.
The model is simple: apps pay (or reward) users to route other people's traffic through their home connection. To any website, that traffic looks like you. If it's malicious, it's your IP that gets the blame.
What we found:
• 20.8M blocked attacks, Jan–Sep. Phishing leads at 5.15M
• 3 providers = ~94% of the footprint we see
• 🇺🇸 US ranks 10th in installations but 4th in blocked malicious traffic. Attackers pay a premium for Western residential IPs that blend in
• After the FBI seized NetNut's domains in July, we still found its software on ~474K Windows machines two months later. Domains get seized; installed software doesn't evaporate.
None of this means residential proxies are inherently evil - price monitoring and ad verification are real customers. It means "share unused bandwidth" is doing a lot of load-bearing work in that consent screen.
Full research: gendigital.com/blog/insights…
#ResidentialProxies #Malware #Privacy
We blocked 20.8M attacks linked to residential proxy networks. @Luis_Corrons and I looked at how they're abused and what that means for people sharing their home connections.
gendigital.com/blog/insights…
Jan Rubín retweeted
🚨ThinkingCap: Qwen3.8-27B is out!
The most token-efficient Qwen3.8 27B available, this time optimized for agentic use.
🚀 Up to 65% fewer thinking tokens, 37% on average
🎯 Minimal accuracy loss
📈 Long-context retrieval actually went up 2.3pp
📄 Blogpost: bottlecapai.com/post/thinkin…
🤗 Hugging Face: huggingface.co/bottlecapai/T…
🔗 GGUF: huggingface.co/bottlecapai/T…
Jan Rubín retweeted
An interview with Warden Stealer, an emerging Windows infostealer that climbed exponentially to the top used ones by threat actors nowadays.
Read now! 👻📖👇
g0njxa.medium.com/approachin…
Jan Rubín retweeted
Today, we’re announcing Ternary Bonsai 2 27B.
Based on Qwen3.8 27B, Bonsai 2 27B is 9x smaller than its full-precision counterpart while retaining 98.2% of its aggregate benchmark performance.
Two months after the first Bonsai 27B release, the biggest change is quality. The footprint remains 5.9 GB, but the gap to full precision has narrowed materially, with particularly strong gains in agentic coding, multimodal reasoning, and long-horizon tool use.
Ternary Bonsai 2 27B is available today under Apache 2.0.
Jan Rubín retweeted
Choose a model, get an answer from a different one. Prompts are routed through exposed Ollama servers, some sourced from Shodan scans. Conversation data, IP and location are logged, with no privacy policy or ToS in sight.
We followed the prompt: gendigital.com/blog/insights…
Jan Rubín retweeted
An interview with Remus Stealer, one of the lead and most used infostealer threats of 2026🌱
A brief talk about past, present and future.
Read now! 👇📖
g0njxa.medium.com/approachin…
Jan Rubín retweeted
One click was all it took.
We discovered a critical #vulnerability in Sogou Input Method that was actively exploited in the wild by #UNC3569 🇨🇳 to deploy the #GRAYRABBIT backdoor. Three separate weaknesses chained into a single RCE exploit.
Read our research:
gendigital.com/blog/insights…
Infostealers are targeting AI-agent data. We found #Remus, #Amatera and #CallbackBeaver collecting data from Claude, Cursor, Cline, Continue and OpenCode. Tokens, MCP credentials and prompt histories can expose accounts, tools and confidential work.
gendigital.com/blog/insights…
Jan Rubín retweeted
Infostealers are adding AI-agent data to their target lists. Our research found #Remus, #Amatera and #CallbackBeaver collecting data associated with Claude, Cursor, Cline, Continue and OpenCode. Other families target a broader range of AI agents, too.
Learn more: gendigital.com/blog/insights…
Jan Rubín retweeted
Gen Threat Labs researchers describe WordlistLoader, a new loader used to deliver Amatera Stealer via ClearFake campaigns. They also highlight the changes Amatera has introduced between v 4.0.2 Beta (documented by eSentire) and current version 4.3.3-alpha1 gendigital.com/blog/insights…
Jan Rubín retweeted
My recent blog post about #WordlistLoader, a new loader hiding shellcode in plain English words, and how it is used to deliver #Amatera
I've also covered the latest updates between Amatera 4.0.2 Beta and 4.3.3-alpha1
Check it out:
gendigital.com/blog/insights…
Jan Rubín retweeted
Gen's Milánek found a small custom Windows backdoor disguised as legitimate Realtek software. Its most unusual feature was its configuration: the address of its C2 server was encoded in the number of spaces on each line of a Windows desktop.ini file. gendigital.com/blog/insights…
Jan Rubín retweeted
A WMI subscription named "Realtek" started a 12 KB backdoor at 19:50, and it never exited. It read its C2 domain by counting spaces in a fake desktop.ini, then called a domain its operator stopped paying for in July 2021.
It kept trying for 11 months.
Read more -> gendigital.com/blog/insights…
Jan Rubín retweeted
When was the last time you got rickrolled? 🪩🕺
We were starting to think malware authors had lost all sense of humor, but then we found this sample that runs whatever PowerShell command a Spotify playlist is named.
And that playlist turns out to have rather refined taste, containing a single track: Never Gonna Give You Up by Rick Astley.
Rename the playlist, and you have just pushed a new command to every infected machine.
IoCs:
open.spotify[.]com/playlist/2dvn7V4XCeuTLtxfxk2Z10
open.spotify[.]com/playlist/77UhzsiaoltLTvTgnY5jHI
a7df9a9665a96ca5814b40e4c6aac121d8822fd702d80b597b567b274ac943fd
8cfaa9120e316c59e4d6fa3093c7fe19e231b0ff1d39baa3993742627e26e105
22c9422358273b2c9ce7c6641f925e34ba1197efa7363ce8fc1553e105746df3
55565dd4f8070624f2a18e9ddd1ca6a04f46b587a6e0c9e804f60603c0258f82
4b4ae799a07bd7bc4b9bbce47fe30055f2257e05043e9c7a8be0d556ef55d718
Jan Rubín retweeted
#Vidar has been one of the most active and fast-evolving #infostealers on the threat landscape lately, and it's not slowing down.
On top of all the recent development activity we've been tracking, Vidar has also added a novel Application-Bound Encryption (#ABE) #bypass to its arsenal.
Read the full technical breakdown ↓
gendigital.com/blog/insights…
Jan Rubín retweeted
Meet #GoFlateLoader: a widespread Golang loader pushing some of the most notorious #infostealers ITW – #Amatera, #Remus, #Lumma, #Vidar, and #StealC.
Most loaders pile on heavy obfuscation and anti-analysis tricks to evade detection. GoFlateLoader doesn't bother. Instead, it relies on a much simpler trick – a deliberately inflated PE overlay aimed at slipping past size-constrained scanners and analysis pipelines.
Yet, despite its simplicity, it is still highly widespread across our userbase, making it a good reminder that prevalence and sophistication are not always the same thing.
Read more ↓
gendigital.com/blog/insights…
