🎯 Obfuscated Files or Information

The items that name it 10

• Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX
  writeup2026-10-02

  Heavily obfuscated, minified JavaScript blob with randomized identifiers, hex escapes, runtime string reconstruction, and zero-width Unicode encoded payload

• Socket: Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
  writeup2026-09-20

  Implant uses seeded character shuffle, decoded string table, word-substitution decompressor, and dynamic Function construction.

• Socket: FUNNULL iOS Spyware Campaign via 13 Malicious Packagist Themes
  writeup2026-09-01

  Custom base64 decoder avoiding native atob, renamed CryptoJS bundle disguised as jquery.core.min.js

• MAJINAHANASHI RANSOMWARE: Yet Another Japanese Locker
  writeup2026-08-14It is written here as Obfuscated Files or Information: Stack Strings (T1027.011).

  Uses stack strings plus XOR obfuscation to hide indicators

• Socket: 737 Malicious VPN/Proxy Chrome Extensions Impersonate 66 Brands
  writeup2026-08-12

  Per-build regeneration of variable names, function names, and comments producing unique file hashes for logically identical files; hardcoded secret key split across four variables in 7 of 10 extensions to defeat string search

• Socket: Operation Muck and Load
  writeup2026-07-16

  Malicious code visually obscured with excessive whitespace; multi-layer encoded scripts.

• Socket: 11 Malicious NuGet Tools Pose as Game Cheats
  writeup2026-07-15It is written here as Obfuscated Files or Information: Software Packing.

  PyInstaller packing and PyArmor runtime protection of gtaobus.pyc in 8 of the 11 payloads

• Socket: Chrome and Firefox VPN Extensions Add Clipboard Stealers via Malicious Updates
  writeup2026-06-30

  Scripts lightly obfuscated with meaningless variable names, escaped property strings, and arithmetic constants (e.g., IP octets built from division expressions like 154/2).

• Socket: Famous Chollima Targets PHP Developers via Compromised Packagist Package
  writeup2026-06-01

  Large whitespace gap hides payload after legitimate Tailwind config; obfuscated JS reconstructs behavior at runtime; global aliases obscure require/module calls

• Socket: 5 Malicious NuGet Packages Target Chinese .NET Developers
  writeup2026-05-07

  .NET Reactor Necrobit encryption of method bodies, string-split API name reassembly, version rotation to invalidate hash-based IOCs.