Malware
34 articles
Malware is any software built to harm, spy on, or take control of a system. These guides cover malware analysis fundamentals, static and dynamic techniques, sandboxing, and the indicators of compromise and YARA rules defenders use to detect and classify threats.
HTML Smuggling: Delivering Payloads Past the Gateway
How HTML smuggling assembles a malicious file inside the browser using JavaScript and Blob APIs, why network inspection misses it, and the endpoint and policy controls that actually stop it.
UEFI Firmware Security: Secure Boot, TPMs and Bootkits
How UEFI Secure Boot verifies the boot chain, what the PK, KEK, db and dbx databases do, how measured boot and the TPM differ from it, and what real UEFI implants have done.
YARA Rules: Pattern Matching for Malware Identification
How YARA rules work: strings, hex patterns with wildcards, condition syntax, the PE and math modules, imphash and entropy checks, plus the mistakes that make a rule slow or useless.
Attacker File Formats: How File Types Get Weaponised
A defensive explainer on how attackers weaponise file formats: scripts, shortcuts, disk images, macro docs, installers, images and archives.
Command and Control: Beaconing, Channels & Detection
How C2 works: beaconing, HTTP, DNS and social-media channels, redirectors, and the traffic patterns defenders use to find implants on a network.
Malware Obfuscation: Packing, Encoding & Evasion
How malware hides from analysis with packing, encoding and encryption, and the behavioural and unpacking methods defenders use to see through it.
Malware Persistence Techniques: How Malware Survives Reboot
How malware survives a reboot using autostart, services, scheduled tasks, and registry keys, plus the process-chain and event-log signals that hunt each one.
Malware Sandbox Evasion: How Samples Dodge Analysis
How malware spots an analysis sandbox and stalls, sleeps, or hides, plus the detection and defensive countermeasures that beat evasion at scale.
Ransomware-as-a-Service: The Affiliate Model
RaaS turns ransomware into a rented product with affiliates and double extortion. How the business works, who plays each role, and where to focus defense.
Backdoor: Hidden Access and Web Shells
A backdoor is a hidden way back into a system that skips normal authentication. How backdoors and web shells work, how they persist, and how to detect them.
Banking Trojan: Overlay & Web-Inject Fraud
Banking trojans steal money by faking login screens and rewriting bank pages mid-session. How overlays and web injects work, plus mobile defense.
Bootkit: Persistence Below the Operating System
A bootkit infects the boot process so it loads before the OS and survives reinstalls. How boot and UEFI-level malware works, and how Secure Boot defends.
Botnet: Command Structures and Takedowns
A botnet is a network of hijacked devices controlled at scale. How command structures work, what botnets do, and how sinkholing takes them down.
Computer Worm: Self-Spreading Malware
A computer worm copies itself across networks with no human help. How worms spread so fast, and how patching and segmentation stop them.
Cryptojacker: Unauthorized Mining Malware
Cryptojackers steal your compute to mine cryptocurrency for someone else. Browser vs host mining, spotting it by resource use, and how to defend.
Loaders and Droppers: First-Stage Malware Delivery
Loaders and droppers are the first-stage malware that plants the real payload. How staged delivery works, how the two differ, and how to detect the hand-off.
Logic Bomb: Trigger-Based Malicious Code
A logic bomb is code that stays dormant until a trigger fires: a date, an event, a missing record. How they work and how to catch them.
RAT: Remote Access Trojans
A remote access trojan gives an attacker hands-on control of your machine: screen, files, webcam, keystrokes. How RATs work, spread, and how to detect them.
Rootkit: Kernel and User-Mode Stealth
A rootkit hides other malware by tampering with the operating system itself. How kernel and user-mode rootkits work, the hiding tricks, and how to detect them.
Trojan Horse: Malware in Disguise
A trojan is malware disguised as something you want to run. How trojans use social engineering to get executed, the payloads they carry, and how to defend.
Wiper: Destructive Malware Disguised as Ransomware
Wipers destroy data with no way to restore it, often disguised as ransomware. How they differ, attacker motives, and how backups make you resilient.
dware: Unwanted Ads, PUPs, and Bundling
Adware floods your device with ads, hijacks your browser, and tracks you. How it sneaks in through bundling, why it counts as a PUP, and how to clean it out.
Infostealer: The Malware Behind Most Breaches
Infostealers grab saved passwords, session cookies and crypto wallets in seconds, then sell the logs. How they work, why cookies defeat MFA, and how to defend.
Cobalt Strike: The Red-Team Tool Criminals Adopted
A defensive explainer on Cobalt Strike: what the framework is, how Beacon works, why criminals abuse cracked copies, and how defenders detect it.
Fileless Malware: Memory-Only Attacks
Fileless malware runs in memory and abuses trusted system tools, so disk scanning misses it. How it works, why signatures fail, and how to detect it.
Metasploit: The Exploitation Framework
A beginner-friendly defensive explainer on Metasploit: what the exploitation framework is, its legitimate and criminal uses, and how to detect it.
Mimikatz: Credential Dumping and How to Stop It
A defensive explainer on Mimikatz: the credential-dumping tool, how it targets LSASS memory, the attacks it enables, and how Credential Guard defends.
Polymorphic Malware: Why Signatures Fail
Polymorphic malware rewrites itself on every copy so no two samples share a signature. Polymorphic vs metamorphic, why hashes fail, and behavioural defence.
Scareware: Fake Alerts, Fake Antivirus, Real Damage
Scareware uses fake virus warnings to panic you into paying or calling a scammer. How the scam works, how it overlaps tech-support fraud, and how to defend.
Spyware: Surveillance Malware and Stalkerware
Spyware is malware built to watch you: keystrokes, screens, location, and messages. How it works, its overlap with stalkerware, and how to detect and remove it.
Best Antivirus Software: Tested and Ranked
We ranked Bitdefender, Norton, Malwarebytes, ESET, and TotalAV against lab data, and explain when free Microsoft Defender is genuinely enough.
Introduction to Malware Analysis
A practical guide to static and dynamic malware analysis, covering PE inspection, sandboxing, strings extraction, and the tools analysts actually use.
Keyloggers: How They Work and How to Detect Them
Keyloggers silently record every keystroke you type. Learn how software and hardware keyloggers work, how to detect them, and how to protect yourself.
Zero-Day Vulnerabilities: What They Are and Why They Matter
Zero-days are the most dangerous class of vulnerability. How they're discovered, traded and exploited, and what you can actually do to protect against them.