Author
10 posts
Key judgments Background: DarkSword and Coruna DarkSword is an exploit chain for iOS that Google Threat Intelligence Group (GTIG) first documented publicly in March 2026. The chain attacks WebKit and JavaScriptCore to gain code execution, escapes the browser sandbox, escalates to kernel privileges, and injects into SpringBoard, the iOS process that manages app […]
ERMAC and HookBot are two branches of one Android banking trojan sold as a service. They forked from a shared code base and each evolved in the direction its developers took it, but the core they run is close enough that a single constant in the source decides which name the panel shows. […]
Censys ARC noticed a recent spike in DarkSword hosts and web properties. Here are the IOCs and pivots you need to track the growing threat.
Censys ARC found 412 web properties across 236 hosts running AdaptixC2, an open-source post-exploit framework. Get the IOCs + full breakdown.
Discover how ResidentBat, a Belarusian KGB Android spyware, targets journalists. Explore its C2 infrastructure, capabilities, and threat intelligence findings.
Discover how Odyssey Stealer targets macOS users to steal crypto wallets via a MaaS affiliate model. Expert threat intelligence on its C2 infrastructure and tactics.
Discover how ErrTraffic powers ClickFix campaigns with fake error pages & malware delivery. Censys research reveals source code, C2 infrastructure & threat intelligence insights.
Investigating the massive E-ZPass & toll road SMS phishing scam hitting thousands of U.S. drivers. See how Censys tracked fake domains, patterns, and the infrastructure behind these fraud campaigns.
**Discover how BADBOX botnet infects 190K+ Android devices via supply chain compromise. Learn how Censys tracked C2 infrastructure using SSL certificates and SSH keys.**
Discover how Censys Search uncovered XehookStealer's link to Agniane Stealer through C2 fingerprinting, favicon pivoting, and adversary infrastructure analysis.
