Topic

Anti-analysis and evasion engineering

Sandbox scoring, indirect syscalls, PEB-based API resolution, string encryption and challenge gates designed to defeat automated analysis.

Current clusters

security1 publisher

PavokwiLoader buries its logic in more than 2,000 mixed boolean-arithmetic predicates

Malbear Labs found PavokwiLoader resolves the 48 ntdll functions it uses by hash while importing 68 KERNEL32 functions it never calls. Static and import-based detection see nothing, so reading it means emulating the loader's own resolver.

Publishers:malbearlabs.com

Reality

Evidence58
Adoption: Insufficient
Hype gap+5
Incentives: Insufficient
Confidence55

security2 publishers

RevStealer spread via fake free Claude Opus 5 desktop build on GitHub

Morphisec says a repo posing as a free Anthropic model delivers a Windows infostealer that keeps a spare command server address in a Polygon smart contract, so taking the primary host down does not end operator control.

Publishers:helpnetsecurity.comscworld.com

Reality

Evidence58
Adoption32
Hype gap+15
Incentives70
Confidence55