Netcrook
11 June 2026
Go-Fluent, Memory-Only, and Built for Theft: Why This Loader Matters
A Go-written loader that runs payloads in memory is a reminder that cybercrime often wins through reuse, not originality.
Overlay Tricks, In-Memory Execution, and the Loader Behind Multiple Stealers
GoFlateLoader stands out not for flashy evasion, but for a simple packaging pattern that helps multiple infostealers reach the execution stage.
OnyxC2 Turns Windows Tricks Into a Low-Cost Stealer Economy
Researchers describe a $250-a-month malware package built around broad application targeting and familiar Windows evasion tactics, a reminder that commodity theft is becoming more technically disciplined.
AI Lures, PowerShell Moves: Fake Claude Code Guides Become a Windows Trap for AsyncRAT
AI-branded decoys, Windows scripting, and Defender exclusions form a familiar abuse chain that ends with AsyncRAT.
When Home IPs Become a Cloak: Why Botnets Love Residential Proxies
DNS telemetry tied to Kimwolf-related activity shows how consumer-looking proxy layers can blur the line between ordinary traffic and hostile infrastructure.
BLUERABBIT Turns a Windows Foothold Into a Destructive Toolkit
A Golang backdoor tied to Windows environments now stands out for combining theft, file encryption, and wiping logic in one intrusion package.
Fake Mac Installers Are Turning Disk Images Into a Quiet Theft Channel
Malicious DMG files are being used to lure macOS users into opening lookalike installers, a simple trick that can put passwords and other secrets at risk.
BLUERABBIT Blends Theft, Encryption, and Wiping in One Windows Intrusion Tool
The Golang-based backdoor is reported to combine remote access, reconnaissance, cloud-assisted exfiltration, file encryption, and destructive disk wiping on Windows hosts.
Mac Users Are Being Tricked Into Opening the Trapdoor
Weaponized DMG installers are turning a normal macOS software flow into a fast credential-theft path, with infostealers built to grab browser sessions and wallet data before defenders notice.
Hijacked Edge Devices Are Turning into the Internet’s Quiet Scouting Grid
JDY has reappeared as a centrally controlled scanner across more than 1,500 SOHO and IoT devices, showing how compromised edge hardware can be repurposed for fast reconnaissance.
Relay Nets That Refuse to Die: The JDY Botnet and the Edge-Device Problem
A botnet tied to roughly 1,500 compromised devices shows how exposed infrastructure can outlast disruption and keep serving as a covert relay layer.