Netcrook
07 September 2026
When the Perimeter Turns Hostile: PoisonedRefresh and the F5 Gateway Problem
A reported F5 BIG-IP APM exploitation path shows how an unauthenticated flaw at the access edge can turn a security appliance into a long-lived foothold.
The Quiet Botnet Under the Kernel Mask
A Linux malware sample called Tengu shows how familiar botnet mechanics - process camouflage, SSH pressure, proxying, and DDoS tooling - keep resurfacing in systems that should be hard to hide inside.
When a Remote Support Client Becomes the Delivery Vehicle
Modified ScreenConnect clients are tied to a worm-like campaign that uses backdoored instances to transfer and execute payloads on newly connected clients.
The Minecraft Mod Trap: How a Trusted Performance Brand Became a Malware Lure
A trojanized game add-on dressed up as a Lithium companion shows how modding trust can be repurposed into password theft and remote control.
JSCeal and the New Value of a Stolen Browser Session
A compiled V8 JavaScript malware sample is being described as a reminder that once an attacker has a live session cookie, passwords and login prompts may no longer matter.
Trust Was the Attack Surface: A Fake Minecraft Mod Turned a Game Download into Credential Theft
A trojanized Java mod posing as a performance add-on shows how quickly a trusted gaming workflow can become a route to password theft and remote control.