🎯 Payload obfuscation

The items that name it 3

• Four incident-response decisions from the Hugging Face breach
  article2026-07-29

  Payloads were chunked, compressed, encoded and sometimes sent over raw sockets

• Exploitation in the Wild of wp2shell
  writeup2026-07-20

  Hex-encoded string concatenation and gzip-compressed base64 encoding, unpacked at runtime via eval(gzuncompress(base64_decode(...))).

• StepSecurity + Endor Labs: Mini-Shai-Hulud Wave 2
  writeup2026-05-19

  javascript-obfuscator format with a 1,728-entry string table, PBKDF2-seeded Fisher-Yates rotation, plus per-string cipher (PBKDF2-SHA256, 200,000 iterations, per-byte substitution via SHA256-seeded stream RNG); cipher key/salt differ per payload but algorithm identical across campaign.