A behavioral verdict tells you what a process did. It doesn't tell you what the file is, what else it can do, or who else is running it. Spectra Analyze gives every CrowdStrike Falcon detection a second opinion that doesn't expire. Learn more: www.reversinglabs.com/blog/extend-... #SecOps

Extend CrowdStrike Falcon With Permanent Intelligence | RL Blog

ReversingLabs built a Spectra Analyze integration with CrowdStrike Falcon. The connector is available now as part of Spectra Analyze v9.6.0.

reversinglabs.com

1/ Three infostealer families, one business model. AuraStealer, ACRStealer/Amatera, and Remus Stealer are all sold as malware-as-a-service, and ReversingLabs tracked all three across July and August.

When the user becomes the vulnerability, new threats emerge. No exploits, just trust breaches. Dive into our #ClickFix report by Toni Dujmović for more insights! #CyberAwareness #ReversingLabs youtube.com/shorts/MHm4K...

ClickFix: The Fake CAPTCHA That Hijacks Your Clipboard

YouTube video by ReversingLabs

youtube.com

📢 New ReversingLabs research: Copy, Paste, Compromise: The Tale of ClickFix The complete #ClickFix attack chain, the MaaS economy behind it, and an open-source #YARA rule validated against 4K+ samples — 123 of them lures that evaded every #Antivirus engine. 👇 www.reversinglabs.com/clickfix

ClickFix Threat Report: Copy, Paste, Compromise | ReversingLabs | ReversingLabs

Original RL research on ClickFix: the attack chain, the MaaS economy behind it, and the YARA detection strategy that catches what AV and EDR miss.

reversinglabs.com

Gartner just defined a new market — and that matters more than it sounds. ReversingLabs was named a Visionary in the new Gartner® Magic Quadrant™ for the category we helped build. www.reversinglabs.com/blog/gartner... #SoftwareSupplyChain

This Report from Gartner Defines the Software Supply Chain Security Market | RL Blog

Explore the new Gartner® Magic Quadrant™ for software supply chain security and learn why ReversingLabs is recognized.

reversinglabs.com

The question is no longer "Is this software secure?" It's "Can this software be trusted?" Trust should be verified, not assumed. Download your copy of the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security report here: www.reversinglabs.com/2026-gartner...

npm v12 turns off install script execution by default — the vector Shai-Hulud, Mini Shai-Hulud, and Miasma all relied on. Security experts break down what it fixes and what attackers are already doing instead: www.reversinglabs.com/blog/npm-v12...

npm v12 blocks install scripts: What it means for software supply chain security | RL Blog

By disabling install scripts by default, it closes the vector worms like Shai-Hulud rely on. Here's what the update fixes — and what it doesn't.

reversinglabs.com

Threat actors are using #TikTok & #Instagram tutorials to deliver #Vidarstealer. One video hit 100K views and 1,700 saves — because attackers know which metrics move the algorithm. Research breakdown + IoCs: www.reversinglabs.com/blog/social-... #SocialEngineering #Phishing

Phishing Attacks Leverage TikTok, Instragram Reels | RL Blog

RL has discovered two social engineering attack techniques targeting users via short-form videos. Here’s how they work.

reversinglabs.com

48,000 CVEs in 2025. Only 58 posed a real, exploitable threat to enterprise supply chains. "Patch everything" is mathematically dead. The signal that matters: malware, tampering, exposed secrets. Go from noise to signal: www.reversinglabs.com/blog/noise-t... #AppSec #SoftwareSupplyChainSecurity

CVE noise drowns out software supply chain threats | RL Blog

48,000 CVEs were reported in 2025 — but just 58 were critical. A new report highlights why signal-to-noise ratio matters for AppSec.

reversinglabs.com

🚨 Supply Chain Attack Alert! 🚨 31 @redhat-cloud-services hashtag#npm packages backdoored in 72 seconds! ReversingLabs has confirmed a large-scale, coordinated supply chain attack targeting the "@redhat-cloud-services" npm scope.

Megalodon compromised GitHub Actions YAML files across dozens of repos — base64-encoded credential stealer, C2 on RouterHosting LLC. RL retrohunted to a related campaign 2 weeks earlier. Same C2 pattern. Same adversary. IOCs + YARA rule published: hubs.ly/Q04hVW-v0

Researcher's Notebook: Hunting Megalodon Fossils | RL Blog

Analyzing C2 responses from compromised GitHub Actions linked a current threat to an earlier one, showing the value of retrohunting.

hubs.ly

RL documented 163 samples of the Dirty Frag Linux exploit (formerly Copy Fail), active malware — and developed YARA rules for identification. Patch the kernel. Run the queries. Deploy the rules. The detection gap is now. www.reversinglabs.com/blog/dirtyfr...

How Dirty Frag rose from the Linux exploit Copy Fail | RL Blog

RL researchers documented 163 samples tied to CVE-2026-31431, identified active malware adoption — and developed YARA rules to identify them.

reversinglabs.com

Is frontier #AI risk keeping your #AppSec team up at night? Doug Levin shares the facts on #ClaudeMythos. Doug also lays out the case for why a layered #AppSec framework is essential — and what it should look like. 👇 www.reversinglabs.com/blog/how-myt...

How Claude Mythos changes the application security calculus | ReversingLabs

Here are the facts on Mythos — and why your organization must adopt a layered security framework to match the new frontier models.

reversinglabs.com

A new class of #AI-derived threats is raising red flags: #MCP post-deployment drift ("rug pull") attacks. They exploit trust of agents over time rather than at the initial point of compromise, which requires deeper visibility. Here's what you need to know. hubs.ly/Q04fhLR30

MCP client rug-pull attack worries mount for AppSec | ReversingLabs

This class of AI tool supply chain attack highlights how trust of agents can be exploited by threat actors.

hubs.ly

Malware is evolving—and targeting AI workflows. Our research on the PromptMink campaign shows how attackers are abusing AI coding agents like Claude to deliver crypto-stealing malware. This isn’t just prompt injection. It’s supply chain risk in a new form. Read: www.reversinglabs.com/blog/claude-...

Claude adds PromptMink malicious dependency to crypto agent | ReversingLabs

The malicious npm package has evolved into a dependency that allows attackers to access users’ crypto wallets and funds.

reversinglabs.com

It looks like #TeamPCP has again compromised #Checkmarx #VSCode extensions and #Docker images. Newly published VSCode extensions checkmarx.cx-dev-assist (1.17.0 & 1.19.0) and checkmarx.ast-results (2.63.0 & 2.66.0) contain malicious code. secure.software/vscode/packa...

It’s no secret modern #AppDev relies on #OpenSource — what’s catching up is how teams secure it. RL’s free Spectra Assure Community helps teams make smarter decisions about the software they use and ship. 👇 www.reversinglabs.com/blog/why-rl-...

Securing the Village: Why RL Built Spectra Assure Community | ReversingLabs

ReversingLabs built it to help development and AppSec teams secure open source dependencies, detect malware — and prevent supply chain attacks.

reversinglabs.com

High-end AppSec isn’t just for the Fortune 500. Spectra Assure Community gives devs, AppSec teams & OSS maintainers pro-grade supply chain security insights — without the cost or complexity. Move beyond blind trust 👉 secure.software/user/signup

CTA Member @reversinglabs.com on a fake recruiter campaign: www.reversinglabs.com/blog/graphal... #cybersecurity #scam #fakerecruiter

🚨 New RL #ThreatResearch: The #Graphalgo fake developer recruiter interview campaign is back. RL researchers have uncovered a broader network of fake companies tied to this fake recruiter operation — plus new attacker techniques. Read what the RL team found: www.reversinglabs.com/blog/graphal...

The axios supply chain attack should be front an center for #AppSec teams given it's wide reach. Here's RL's immediate-response checklist — and best practices for ongoing defense. Also learn how RL’s xBOM and Spectra Assure Community can help. 👇 www.reversinglabs.com/blog/axios-a...

Axios supply chain attack: How AppSec teams should respond | ReversingLabs

Here's an incident-response checklist and ongoing best practices. Plus: How RL’s xBOM and Spectra Assure Community can help.

reversinglabs.com

At #RSAC, JPMorgan Chase CISO Patrick Opet revisited third-party risk — and the supplier changes that followed. Is your organization learning the lesson on “trust debt”? Learn how to move beyond blind trust: www.reversinglabs.com/blog/opet-jp...

How JPMorgan Chase tackles third-party software ‘trust debt’ | ReversingLabs

JPMC CISO Patrick Opet discussed his open letter on third-party software risk — and the changes suppliers have made since.

reversinglabs.com

🚨 RL Research Alert! Look out for the compromised versions 1.14.1 and 0.30.4 of axios npm package with almost 11 billion downloads. secure.software/npm/packages...

axios@1.14.1 - npm | ReversingLabs Spectra Assure Community

Supply chain risk analysis for axios@1.14.1. Learn more about package security, deployment risks, vulnerabilities, popularity, versions, and more with ReversingLabs.

secure.software

Look out for compromised versions 4.87.1 and 4.87.2 of telnyx PyPI package with more than 3.75 million downloads. secure.software/pypi/package...

telnyx@4.87.2 - PyPI | ReversingLabs Spectra Assure Community

Supply chain risk analysis for telnyx@4.87.2. Learn more about package security, deployment risks, vulnerabilities, popularity, versions, and more with ReversingLabs.

secure.software

📢 Just dropped: New RL research! 👻 Ghost campaign returns via malicious #npm packages ⚠️ Phishes sudo passwords + hides behind fake install logs 🔍 www.reversinglabs.com/blog/npm-fak... 🛡️ Ask us about it — + Spectra Assure Community — at Booth #4328 #RSAC2026

Malicious npm packages use fake install logs to load RAT | ReversingLabs

The final-stage malware in the Ghost campaign is a RAT designed to steal crypto wallets and sensitive data.

reversinglabs.com

Security Advisory: our research team is tracking threat actor #TeamPCP, who hacked the #Trivy supply chain and infected over 140 npm packages with self-propagating malware #CanisterWorm. View our platform's analysis of a known infected package here: secure.software/npm/packages...

@teale.io/eslint-config@1.8.9 - npm | ReversingLabs Spectra Assure Community

Supply chain risk analysis for @teale.io/eslint-config@1.8.9. Learn more about package security, deployment risks, vulnerabilities, popularity, versions, and more with ReversingLabs.

secure.software

"Ambiguous package names & fragmented tracking methods leave organizations vulnerable to sophisticated supply chain attacks. By demanding PURLs in your SBOMs, you enforce a strict standard of visibility and accountability" www.reversinglabs.com/blog/why-you... #cybersecurity #SBOM @reversinglabs.com

How to Make Your SBOMs Actionable with PURLs | ReversingLabs

Package URLs give software components an exact address to improve vulnerability matching, which reduces alert fatigue and simplifies compliance.

reversinglabs.com

BSIMM16 reinforces that #AIcoding is the new reality — and it will further destabilize #softwaresupplychainsecurity. So step up your #AppSec. 👇 www.reversinglabs.com/blog/bsimm16...

BSIMM16 confirms it: AI redefines the AppSec landscape | ReversingLabs

AI coding is the new reality — and it will further destabilize software supply chain security. So step up your AppSec.

reversinglabs.com

🚨 RL researchers discovered a malicious package impersonating a legitimate Stripe package on #NuGet — marking a move away from blockchain-related targets while staying focused on financial development tools. Read here: www.reversinglabs.com/blog/malicio...

Malicious NuGet package targets Stripe | ReversingLabs

In this latest incident, threat actors target developers with a bogus package — a shift away from cryptocurrency development targets.

reversinglabs.com

ReversingLabs' Ashlee Benge shares how to use YARA retrohunting for detection engineering by leverageing RL's dynamic analysis of "pkr_mtsi" for defense in Spectra Analyze. 👉 hubs.ly/Q043qJY-0 #yararules #detectionengineering #malwareanalysis

How to Use YARA Retrohunting for Detection Engineering | ReversingLabs

Learn how to leverage ReversingLabs’s dynamic analysis of <em>pkr_mtsi</em> for defense using YARA Rules in Spectra Analyze.

hubs.ly