G DATA’s latest loader analysis is part technical, part human. Kiss Loader appears to be a new, actively developed malware that uses Early Bird APC injection; the investigation ended with a rare direct conversation between the analyst & the malware author. blog.gdatasoftware.com/2026/03/38399-…

🐚 Custom Windows shellcode is the ultimate way to learn OS internals and sharpen your assembly skills. 🗺️ Video 1: The Game Plan. We start in C to map out the APIs and logic before hitting the ASM. Watch Part 1: youtu.be/6oeMEzCKXyoGya ✅ Dev/Debug workflows ✅ Position-Independence (PIC) ✅ Module & API hashing ✅ Stack strings & Endianness ✅ XOR obfuscation & Decryption stubs

@neonprimetime Hi, would you be willing to share the legit websites where you observed the ClickFix lures? (Dm is fine.) It would be much appreciated — I recently published research on a previous iteration of this campaign: rapid7.com/blog/post/tr-m…