Topic
10 posts
Key judgments Background: DarkSword and Coruna DarkSword is an exploit chain for iOS that Google Threat Intelligence Group (GTIG) first documented publicly in March 2026. The chain attacks WebKit and JavaScriptCore to gain code execution, escapes the browser sandbox, escalates to kernel privileges, and injects into SpringBoard, the iOS process that manages app […]
Censys tracks 131 hosts exposing Mythic to the public Internet. Learn about the C2 framework and how to defend against it.
Censys ARC examines the kit that hides malicious payloads within a fake MP4 file that can pass file-type checks. Here's how it works.
A deep look at how Mirai and its descendents have evolved over the past decade — and why the botnet's methodology still works today.
Censys ARC noticed a recent spike in DarkSword hosts and web properties. Here are the IOCs and pivots you need to track the growing threat.
Censys ARC found 412 web properties across 236 hosts running AdaptixC2, an open-source post-exploit framework. Get the IOCs + full breakdown.
Discover how Fake Captcha and ClickFix lures exploit trusted web infrastructure to deliver malware. New research reveals fragmented delivery models behind visually uniform campaigns.
Discover how ErrTraffic powers ClickFix campaigns with fake error pages & malware delivery. Censys research reveals source code, C2 infrastructure & threat intelligence insights.
**Discover how BADBOX botnet infects 190K+ Android devices via supply chain compromise. Learn how Censys tracked C2 infrastructure using SSL certificates and SSH keys.**
Murdoc Mirai botnet targets AVTECH cameras & Huawei HG532 routers via known CVEs. See live infection data, C2 servers, and steps to secure exposed devices.
