Animeh Roy

Diagram showing how a trojanized Atera RMM MSI installer disguised as a bank eStatement establishes persistent remote access via AWS IoT Core MQTT and PubNub channels

Dissecting a Weaponized Atera Installer: How a Fake Bank Statement Grants Full Remote Access

A trojanized Atera RMM installer disguised as a bank eStatement PDF grants attackers persistent remote access including terminal, remote desktop, and arbitrary code execution — all through legitimately signed, commercially trusted infrastructure. Zero public detections at time of analysis. Likely Luna Moth / Silent Ransom Group campaign.

Diagram illustrating how TeamPCP compromised Trivy security scanner to backdoor LiteLLM Python package via CI/CD pipeline credential theft

How TeamPCP Poisoned Security Scanners to Backdoor LiteLLM

On March 24, 2026, threat actor TeamPCP published backdoored versions of the LiteLLM Python package (3.4M daily downloads) after compromising Trivy and Checkmarx security scanners to steal PyPI credentials from CI/CD pipelines. The malware harvested credentials, deployed Kubernetes worms, and established persistent C2 — all triggered by a Python .pth file that fires on every interpreter startup.

Poisoned Packages: How npm Lifecycle Scripts Became a Supply Chain Weapon

Microsoft Threat Intelligence published a technique profile on malicious npm lifecycle scripts — the mechanism behind Shai-Hulud 2.0, Contagious Interview, and multiple North Korean campaigns. This post breaks down how lifecycle scripts work as an attack vector, the real-world campaigns exploiting them, and a layered defense strategy for dev teams and CI/CD pipelines.

Coruna iOS exploit kit timeline showing proliferation from surveillance vendor to nation-state actor to financially motivated threat group

Coruna: The iOS Exploit Kit That Went From Spyware Vendor to Mass Crypto Theft

Google GTIG and iVerify independently disclosed Coruna, an iOS exploit kit containing 23 exploits across 5 full chains targeting iOS 13 through 17.2.1. Originally built for a commercial surveillance vendor, it proliferated to a Russian espionage group (UNC6353) for watering hole attacks against Ukraine, then to a Chinese financially motivated actor (UNC6691) mass-deploying it via fake crypto sites to steal wallet credentials. This post breaks down the exploit chains, payload architecture, detection artifacts, and IOCs.

Fake Stewart Title closing document portal hosted on lovable.app with progress bar and Open Document button

Dissecting a Real Estate BEC Phishing Chain: From Fake Stewart Title Closing Docs to Multi-Layer Encrypted AiTM Router

A BEC phishing email impersonating a Stewart Title escrow officer sends fake closing documents via a compromised law firm. Five-stage chain abusing Lovable (AI app builder), a CAPTCHA gate, triple-encrypted JavaScript with anti-debug traps and a remote kill switch, a server-side AiTM credential router, and a pixel-perfect Google Sign-In proxy capturing credentials and session tokens in real-time.

Fake Google Drive phishing page hosted on systeme.io impersonating a Secured Google Drive document sharing interface

Dissecting a BEC Phishing Chain: From Fake Payment Advice to Real-Time Google AiTM Credential Harvester

A real-world BEC phishing email impersonating a payment advice notification. Three-stage attack chain abusing systeme.io, a fake CAPTCHA gate, and a real-time Adversary-in-the-Middle Google credential harvester with full 2FA interception.

Android banking trojan fake eChallan dropper screen showing fake Update Available prompt

Dissecting a Two-Stage Indian Banking Trojan: From Fake eChallan to Full Device Compromise

A fresh Android malware sample masquerading as an RTO eChallan app. Two-stage dropper with NP Protect packer, SMS interception, USSD banking code execution, Firebase FCM C2, and only 11/66 VirusTotal detections.