I have an app that stores credentials locally, the file is encrypted. I'm trying to understand the encryption that the app is using with the goal of modifying the file directly, bypassing the app.

The app imports quite a few libraries, most of which come from System32, I assume I can get the key or at least some hint by positioning myself between the app and the library.

Naturally, I found out about DLL hijacking. Two of the imports are CRYPT32.dll and ADVAPI32.dll. Even though CRYPT32.dll seems to mostly be certificate stuff I decided to go with it.

I'll skip the part where I also had to learn that there are calls to load strictly from System32, the important thing is that it forced (at least seemingly so) me to rename the import of the app with PE-bear.

I created a C++ DLL project in VS, created a definition file that exports all the functions that the app seeks to import. I also created an executable to test the forwarding. I placed the custom DLL into System32 and renamed it accordingly with the new import name.

For my test app the forwarding worked fine, however, the app in question seems to be exiting silently.

When I tried using WinDbg to at least get some idea I got (the caption is the same, but instead of "Themida" the title is simply the process name):

So the app is resisting debugging, which makes me think that it also somehow detects the modifications. Either to the import table itself or by the library being forwarded.

Does anyone have any idea how I could proceed here?

Today, we are monitoring new research from Anthropic that explores the potential emergence of self-replicating "AI worms."

• Anthropic researchers demonstrated a proof-of-concept "AI worm" capable of spreading across internet-connected devices by distributing its computing workload among multiple smart TVs.
• The research suggests that smaller AI models could become capable of autonomous self-replication on vulnerable IoT devices, such as smart TVs, streaming boxes, and smart appliances, within the next several months if current AI progress continues.
• Unlike traditional malware, an AI worm could identify new devices, adapt to unfamiliar environments, and continue propagating with minimal human involvement.
• Security experts are concerned because many IoT devices have weak security controls and are difficult to patch at scale.
• Some researchers argue the threat is real and warrants preparation now, while others note that Anthropic's demonstrations relied on simplified conditions and do not yet represent real-world autonomous infections.
• The concept draws comparisons to historic worms such as the Morris worm, WannaCry, and NotPetya, which caused widespread disruption and financial damage.
• Experts emphasize that strong passwords, multi-factor authentication, and improved device security remain effective defenses against these potential threats.

A full article can be found in The Guardian.

Over the last few weeks we collected the confirmed security incidents involving AI coding agents, agents in CI and MCP servers that we could find, going back to July 2025. A case only went in if the affected company, the vendor, an official advisory or a research team confirmed it. That left 20 incidents, plus 12 research disclosures nobody has seen exploited.

What stood out for security teams:

The agent was rarely the entry point. 13 of the 20 started with something a developer installed: an npm or PyPI package, an MCP server, an agent skill, an editor extension. Shai-Hulud 2.0 hit official MCP server packages. The LiteLLM releases on PyPI were backdoored after a compromised scanner leaked the publish token.

Agent tokens are now on infostealer shopping lists. Families like Amatera, Remus and CallbackBeaver collect coding-agent tokens, MCP configs and prompt histories alongside browser data. A replayable session token can let an attacker in without repeating the password or MFA.

The destructive ones had no attacker. Three cases were an agent doing routine work with far more access than it needed. A Cursor agent found an over-scoped Railway token in an unrelated file and deleted PocketOS’s production volume (the data was later restored). Claude Code unpacked an old Terraform archive and, with the developer letting it run, destroyed DataTalks.Club’s production stack.

Twice, the malware used the developer’s own agent. It started the local coding agent with its safety flags off and asked it to find credentials, .env files and SSH keys.

Questions worth asking internally:

Are agent session token files treated like any other credential?

Who knows which MCP servers developers have installed?

Could the tokens an agent can reach delete production?

Every entry links to its CVE, post-mortem or report: https://node9.ai/incidents

If you know of a confirmed incident we missed, drop the source and I’ll add it.

https://youtu.be/VSYCZWtw4Ts?si=YpBKIg6XduBrpqc3 Wondering how to change your Yahoo Mail background on Chrome now that custom themes are missing? In this step-by-step tutorial, I’ll show you a quick extension workaround using Stylus to get full custom backgrounds, colors, and themes back on Yahoo Mail!

TIMESTAMPS:
0:00 - The Problem: Yahoo Mail's New Plain Black & White View
0:19 - Step 1: Installing & Pinning the Stylus Extension
0:56 - Step 2: Where to Get the Custom CSS Code
1:28 - Step 3: Editing the Style for Yahoo Mail
2:03 - Step 4: Pasting, Saving & Enjoying Your New Background!

I'm trying to send an email with a custom from address for a prank. The domain's SPF is ?all and DMARC is p=none (verified with dig), so receiving servers should deliver it even if SPF/DKIM fail, but I can't change the DNS. The problem I’m running into is the sending side: Gmail SMTP rewrites the From to my own address, and SMTP2GO/Mailgun both want domain verification. I'm considering a VPS with Postfix or cheap shared hosting with PHP mail(). Does anyone know which approach is best, or a provider that still allows custom From addresses without DNS changes? Thank you!

Hi, I hope this is the right place to ask because i feel like i'm out of options. If it's not i'd appreaciate it if someone could show me where to look fo help.

I have a problem regarding an account where i want to change my Email adress from an old one, which i do not longer have acess to, to my current one. However there seems to be no way to show proof of ownership to the support except with email... (which is stupid)

Now out of options i was thinking if it would be possible to get the verification code in the Email by other means?

It is a .gmail adress and the Email is still active after years.

Does anyone have any idea that could help me here? Maybe someone knows where i can look more into such stuff?

Just wondering

Recently used GitHub pages to make locating specific captive portals from my repo easier.

Hey, so i live in a rehab center, and the only network acces point of the house is in my room, i needed to disconnect it, and the network was still broadecasting though without an internet connection. I needed to reset the router physically in order to regain connection, though it seems that now there are 2 networks to the house, the router one and whatever else that is broadcasting (without an internet connection)

There are 3 floors to house and I've used a signal strength app to locate where the signal was coming from and it seems that its coming from the upper and lower electricty pannels, And the signal coverage is extremly wide.

To me it seems incredibly odd, anyone has any ideas?

Update: Well, it turnes out there were range extenders right next to the electricty boards that I somehow havent noticed. Case solved!

I’m the author of Super Trouper, a single-Go-binary stdio MCP server exposing Frida for authorized app reverse engineering.

I’ve just released v0.5.0 with the following changes:

• Updates the Frida Core DevKit to v17.23.2.
• Adds minimal, metadata, and full scope arguments to app_find and app_frontmost.
• Adds package_install for installing npm packages used by script_create imports, plus package_list for viewing packages in the shared workspace.
• Adds Frida's new Pattern lifecycle tools: pattern_create, pattern_list, pattern_read, and pattern_delete. • Adds pattern_describe to compile patterns and return types and diagnostics. • Adds pattern_decode to decode target memory using declared Pattern types.

Recent context: - v0.4.0 added memory_read, memory_write, module_list, and thread_list; introduced minimal, metadata, and full query scopes for app_list; renamed MCP tools for clearer namespaces; and updated the Frida Core DevKit to v17.19.0.
- v0.3.0 added npm installation support, Frida CodeShare snippet search/use support, and general cleanup and improvements.

I’d appreciate practical feedback on the package and Pattern workflows, especially where the current tools are missing useful reverse-engineering steps. Feature requests are welcome too.

A new monthly Chrome UX Report dataset is available in Chrome UX Report Dumps!

The 202609 release contains 10 non-cumulative rank buckets with 18,376,044 entries and 95.1 MiB of compressed data. The repository now holds 68 monthly datasets across 585 files: 1,082,630,540 total entries and 5.41 GiB compressed.

These are ranked website lists extracted from Chrome UX Report data, split into non-overlapping rank buckets for practical downloading and processing. Totals across months are not counts of unique websites; the same sites can appear in multiple monthly datasets.

Feedback and feature requests are welcome.