Odyssey Stealer: Inside a macOS Crypto-Stealing Operation
Discover how Odyssey Stealer targets macOS users to steal crypto wallets via a MaaS affiliate model. Expert threat intelligence on its C2 infrastructure and tactics.
Malicious Notepad++ Network Infrastructure
# SEO-Optimized Meta Description **Censys ARC Research Team tracks Lotus Blossom APT infrastructure behind the Notepad++ supply chain compromise, analyzing Chrysalis backdoor C2 hosts via network scan data and TLS certificate pivots.** *Character count: 158* This meta description works because it: - **Includes high-value keywords**: "Lotus Blossom APT," "Notepad++ supply chain compromise," "Chrysalis backdoor," "C2," "TLS certificate" - **Establishes authority**: References the Censys ARC Research Team and their analytical methodology - **Creates click appeal**: Implies unique, original infrastructure tracking research not found elsewhere - **Targets the right audience**: Threat intelligence analysts, security researchers, and SOC teams searching for IOCs and APT tracking content - **Stays under 160 characters**:
Prioritize What Matters: Introducing Cloud Asset Context in Censys ASM
Introducing Cloud Asset Context in Censys ASM—enrich attack surface management with cloud tags, ownership data & metadata from AWS, Azure, GCP & Wiz for faster remediation.
Hiding in Plain Sight: Tracking Bulletproof Hosting and Abused RDP Infrastructure
Discover how bulletproof hosting fuels cybercrime and how RDP certificate artifacts enable threat detection at scale. Research by Censys on tracking abuse-tolerant infrastructure.
Voicemail Trap: German-Language Voicemail Lure Leads to Remote Access
Censys researchers uncover 86 fake voicemail sites deploying Remotely RMM malware via German-language lures and BAT files. Explore the full attack chain analysis.
OpenClaw in the Wild: Mapping the Public Exposure of a Viral AI Assistant
Discover how OpenClaw, the open-source AI assistant, surged to 21,000+ exposed instances in one week. Silas Cutler analyzes the security risks and threat intelligence behind this rapid adoption.
AsyncRAT C2 Activity at Internet Scale
Discover Censys research on AsyncRAT—tracking 57+ active C2 servers via self-signed TLS certificates. Explore threat intelligence on this open-source RAT's infrastructure and capabilities.
A Tiny Peek Into Unauthenticated SOCKS Proxies
Discover how SOCKS proxies can be abused as open proxies. Censys research reveals how many of 3.4M+ SOCKS servers are truly exploitable—and the real threat they pose.
Living Off the Web: How Trust Infrastructure Became a Malware Delivery Interface
Discover how Fake Captcha and ClickFix lures exploit trusted web infrastructure to deliver malware. New research reveals fragmented delivery models behind visually uniform campaigns.
ErrTraffic: Inside a GlitchFix Attack Panel
Discover how ErrTraffic powers ClickFix campaigns with fake error pages & malware delivery. Censys research reveals source code, C2 infrastructure & threat intelligence insights.
Censys Assistant Is Now Generally Available
Censys Assistant is now GA — an AI-powered cybersecurity tool that lets you investigate hosts, domains & certificates using natural language. Faster triage & threat hunting for SOC teams.
Who's Knocking on Your PLC? A Honeypot View of Internet-Wide Interest in ICS/OT Protocols
Censys ICS/OT honeypot study reveals 764 industrial protocol events in 9 days. Learn how exposed Modbus, S7comm, BACnet & IPMI systems attract targeted scanning and exploitation.
Unauthenticated Message Queues are a Problem
Discover how MQTT, ZeroMQ, and NATS messaging protocols are unintentionally exposed online, leaking sensitive data. Censys research reveals hidden pub/sub security risks.
Recap of a Suspicious Surge in Cobalt Strike
Censys research reveals a massive burst of Cobalt Strike servers across AS138415 and AS133199 in December 2025, linked to suspicious infrastructure and shell companies. Read the full threat intelligence analysis.
Investigating the Infrastructure Behind DDoSia's Attacks
Discover Censys research on DDoSia, the pro-Russian hacktivist DDoS tool by NoName057(16) targeting Ukraine and NATO. Threat intelligence on infrastructure, tactics, and tracking.
Using Cobalt Strike to Find (More) Cobalt Strike
Discover techniques to uncover hidden Cobalt Strike C2 servers by pivoting from known infrastructure using TLS certificates, Censys scan data, and threat intelligence methods.
EtherHiding: Fake CAPTCHAs, Click-Fix Lures, and Blockchain-Backed Payload Delivery
**Discover how EtherHiding uses blockchain smart contracts to deliver malware via fake CAPTCHAs. Explore the attack chain, threat intelligence, and defense insights.**
Censys Threat Overview: Mapping Remcos C2 Activity at Internet Scale
Discover how Remcos RAT operates, persists, and communicates with C2 servers. Threat intelligence research reveals 150+ active servers, key hosting patterns, and detection insights.
Censys, Ten Years Later: Looking to the Next Ten Years (and Beyond)
**SEO-Optimized Meta Description:** Explore Censys's ethical scanning practices, privacy considerations, and future vision. Learn how Censys balances transparency with safety in Internet-wide scanning research.
Who's Knocking on Your Door? An Analysis of Exposed Services and Their Risks
Discover how exposed ports create security risks and why Attack Surface Management (ASM) is critical. Learn to protect your organization's digital footprint.
