This week's malicious software roundup from Security Affairs isn't just a reading list — it's a snapshot of where adversary tradecraft is heading in 2026, and every item on it has direct consequences for how your SOC detects, triages, and responds. Four threads stand out: a rapidly escalating REVSTEALER infostealer campaign, a deep dive into JSCeal's compiled V8 bytecode obfuscation that is frustrating static analysis, a proof-of-concept called GuardBreaker that can derail AI-assisted malware analysis with nothing more than a code comment, and continued DPRK APT operations deploying curlRAT against South Korean media and automotive sector targets.
Let me be direct about why this matters. Infostealers remain the number-one initial access vector feeding ransomware and BEC operations — the credentials harvested today are the intrusion you'll be working in six weeks. DPRK operators continue to refine lightweight, low-signature tooling that blends into legitimate admin behavior. And GuardBreaker is a warning shot across the bow of every team that has quietly offloaded triage to an LLM without human validation. If your detection engineering hasn't accounted for these realities, this post is your remediation plan.
Technical Analysis
REVSTEALER: The Infostealer Economy Keeps Accelerating
REVSTEALER follows the now-standard infostealer playbook, but its ramp-up in distribution volume is what makes it operationally significant. Based on reported analysis, its behavior chain includes:
- Credential harvesting from Chromium-based browsers and Firefox — reading
Login Data,Cookies,Web Data, andLocal State(to obtain the DPAPI-encrypted AES key for cookie decryption) from user profile directories. - Cryptocurrency wallet theft — targeting browser extension wallets and desktop wallet files.
- System and session reconnaissance — collecting hostname, username, OS build, installed AV products, and screenshot capture before exfiltration.
- C2 exfiltration over HTTPS, typically staging collected data in a temp directory (often as a ZIP archive) before a single outbound POST to attacker infrastructure.
The defensive significance: stealer logs are commoditized within hours. A single infected endpoint with a cached VPN or SSO session token is a full identity compromise. Cookie theft defeats MFA — session token replay is the entire reason token-binding and conditional access policies exist.
JSCeal and Compiled V8 Bytecode: Obfuscation That Breaks Static Analysis
The research into JSCeal is important because it documents a growing trend: Node.js-based malware distributed not as readable JavaScript but as compiled V8 bytecode (leveraging the v8.serialize / bytenode-style compilation pipeline). Traditional static analysis — string extraction, regex-based YARA, even many sandbox detonations that expect source-readable JS — fails against bytecode-compiled payloads because the malicious logic never exists as plaintext on disk.
From a defender's perspective, the observable artifacts shift to:
node.exeor bundled Node runtime executables launching with.jsc(compiled bytecode) files rather than.js- Node processes making network connections — legitimate Node in most enterprise environments is server-side or developer tooling, not endpoint-resident
- Bytecode loader scripts that are tiny, benign-looking, and serve only to invoke the compiled blob
If your email gateway and EDR content inspection assume readable script content, compiled V8 payloads will sail straight through.
GuardBreaker: A Code Comment That Derails AI-Assisted Analysis
GuardBreaker is the most strategically important item in this roundup. Researchers demonstrated that a carefully crafted comment embedded in malicious code — a prompt-injection payload aimed at the LLM performing the analysis — can cause AI-assisted reverse engineering tools to misclassify the sample, truncate analysis, or produce a benign verdict.
This is not theoretical. Security teams across the industry have integrated LLM-assisted triage into malware analysis pipelines, phishing email review, and alert summarization. GuardBreaker proves that adversaries are now crafting payloads whose target audience is your AI tooling, not your users. If your pipeline auto-closes or deprioritizes tickets based on an LLM verdict without analyst spot-checks, you have a single point of failure that an attacker can reach with a comment block.
The defensive posture is straightforward: AI output is advisory, never dispositive. Any verdict that closes or downgrades a detection must be sampled by human analysts, and analysis environments must sanitize or neutralize embedded instruction-like content before feeding samples to an LLM.
DPRK APTs and curlRAT: Living Off Legitimate Tooling
The reported DPRK campaigns targeting South Korean media and automotive organizations continue a pattern we've tracked for years: lightweight custom implants that lean on legitimate, ubiquitous tooling to minimize signature surface. curlRAT is exactly what the name implies — a remote access implant that abuses curl (or libcurl) for C2 communication and data exfiltration.
Why this is effective: curl.exe ships natively with Windows 10/11 (in C:\Windows\System32) and is present on virtually every Linux and macOS system. Network controls allowlist it. Application control policies rarely restrict it. An implant that delegates its network layer to curl inherits trust it didn't earn.
Observable behaviors worth hunting:
curl.exespawned by unusual parent processes — Office applications, script interpreters, or unsigned binaries in user-writable directories. Legitimate curl usage is typically launched by admins from shells, installers, or update mechanisms.- curl command lines containing exfiltration flags:
-d,-F,-T,--data-binary,--upload-filepointed at external infrastructure - curl retrieving second-stage payloads (
-ooutput to temp/AppData paths followed by execution) - Persistence via scheduled tasks or Run keys launching the implant, which then invokes curl for C2
No CVE is associated with these campaigns — this is pure tradecraft, which means patching won't save you; detection engineering will.
Detection & Response
The following content is built from the behaviors described above. Every rule targets high-fidelity signals — the curl rule keys on parent/child relationships rather than curl's mere existence, and the stealer rule keys on non-browser processes touching browser credential stores. Deploy in audit mode first, baseline for one week, then enforce.
---
title: Suspicious Curl Execution by Non-Shell Parent Process
description: Detects curl.exe launched by unusual parent processes (Office apps, script hosts, unsigned user-directory binaries) consistent with curlRAT-style implants delegating C2 to curl. Native curl in System32 is expected from cmd/powershell/installers, not from these parents.
references:
- https://securityaffairs.com/198980/breaking-news/security-affairs-malware-newsletter-round-114.html
- https://attack.mitre.org/techniques/T1105/
- https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/04/06
status: experimental
tags:
- attack.command_and_control
- attack.t1105
- attack.t1071.001
logsource:
category: process_creation
product: windows
detection:
selection_image:
Image|endswith: '\curl.exe'
selection_parent:
ParentImage|endswith:
- '\winword.exe'
- '\excel.exe'
- '\powerpnt.exe'
- '\outlook.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\rundll32.exe'
- '\regsvr32.exe'
- '\node.exe'
selection_parent_userdir:
ParentImage|contains:
- '\AppData\Local\Temp\'
- '\AppData\Roaming\'
- '\Users\Public\'
- '\ProgramData\'
condition: selection_image and 1 of selection_parent*
falsepositives:
- Rare legitimate automation scripts hosted in ProgramData
- Developer tooling using node to invoke curl
level: high
---
title: Curl Exfiltration or Payload Download Flags in Command Line
description: Detects curl invocations using data-upload or file-download flags against external targets, a pattern consistent with implant C2 and second-stage retrieval observed in DPRK curlRAT campaigns.
references:
- https://securityaffairs.com/198980/breaking-news/security-affairs-malware-newsletter-round-114.html
- https://attack.mitre.org/techniques/T1567/002/
- https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/04/06
status: experimental
tags:
- attack.exfiltration
- attack.t1567.002
- attack.t1105
logsource:
category: process_creation
product: windows
detection:
selection_image:
Image|endswith: '\curl.exe'
selection_flags:
CommandLine|contains:
- ' -d '
- ' -F '
- ' -T '
- '--data-binary'
- '--upload-file'
- ' -o C:\Users\'
- ' -o %TEMP%'
- ' -o %APPDATA%'
filter_known_good:
CommandLine|contains:
- 'packages.microsoft.com'
- 'update.googleapis.com'
condition: selection_image and selection_flags and not filter_known_good
falsepositives:
- Admin automation uploading logs or downloading tooling
- CI/CD agents running on endpoints (scope these out by host group)
level: medium
---
title: Non-Browser Process Accessing Browser Credential Stores
description: Detects processes other than the browser itself reading Chromium or Firefox credential/cookie stores, the hallmark behavior of infostealers such as REVSTEALER harvesting session tokens and saved passwords.
references:
- https://securityaffairs.com/198980/breaking-news/security-affairs-malware-newsletter-round-114.html
- https://attack.mitre.org/techniques/T1555/003/
- https://attack.mitre.org/techniques/T1539/
author: Security Arsenal
date: 2026/04/06
status: experimental
tags:
- attack.credential_access
- attack.t1555.003
- attack.collection
- attack.t1539
logsource:
category: file_event
product: windows
detection:
selection_path:
TargetFilename|contains:
- '\Google\Chrome\User Data\Default\Login Data'
- '\Google\Chrome\User Data\Default\Cookies'
- '\Google\Chrome\User Data\Default\Network\Cookies'
- '\Google\Chrome\User Data\Local State'
- '\Microsoft\Edge\User Data\Default\Login Data'
- '\Microsoft\Edge\User Data\Local State'
- '\BraveSoftware\Brave-Browser\User Data\Default\Login Data'
- '\Mozilla\Firefox\Profiles\'
selection_path_firefox:
TargetFilename|endswith:
- '\logins.json'
- '\cookies.sqlite'
- '\key4.db'
filter_browsers:
Image|endswith:
- '\chrome.exe'
- '\msedge.exe'
- '\brave.exe'
- '\firefox.exe'
- '\MsMpEng.exe'
condition: (selection_path or selection_path_firefox) and not filter_browsers
falsepositives:
- Enterprise backup agents and DLP scanners (exclude by Image hash after validation)
- EDR sensors performing content inspection
level: high
// Hunt: curl spawned by non-shell / suspicious parents, plus exfil-style flags
// Tables: DeviceProcessEvents (Defender XDR) — run over the last 14 days
let Lookback = 14d;
let SuspiciousParents = dynamic([
"winword.exe","excel.exe","powerpnt.exe","outlook.exe",
"wscript.exe","cscript.exe","mshta.exe","rundll32.exe",
"regsvr32.exe","node.exe"
]);
let ExfilFlags = dynamic([
" -d "," -F "," -T ","--data-binary","--upload-file"
]);
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName =~ "curl.exe"
| extend ParentName = tolower(InitiatingProcessFileName)
| extend HasExfilFlag = ProcessCommandLine has_any (ExfilFlags)
| extend SuspiciousParent = ParentName in~ (SuspiciousParents)
or InitiatingProcessFolderPath has_any ("\\AppData\\","\\Users\\Public\\","\\ProgramData\\")
| where SuspiciousParent or HasExfilFlag
| project TimeGenerated, DeviceName, AccountName,
ParentName, InitiatingProcessCommandLine,
ProcessCommandLine, FolderPath, SHA256, ReportId
| order by TimeGenerated desc
// Hunt: network connections from node.exe or curl.exe on endpoints (C2 over web)
// Node/curl making outbound connections from user endpoints is anomalous in most enterprises
let Lookback = 14d;
DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName in~ ("node.exe","curl.exe")
| where RemoteUrl !has_any ("microsoft.com","windowsupdate.com","nodejs.org","npmjs.org","npmjs.com")
and RemoteIP !startswith "10."
and RemoteIP !startswith "192.168."
and RemoteIP !startswith "172.16."
| summarize ConnectionCount = count(),
DistinctDestinations = dcount(RemoteIP),
Destinations = make_set(RemoteUrl, 20),
FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by ConnectionCount desc
// Hunt: non-browser processes touching browser credential stores (Sysmon FileEvent via Event ID 11 ingested to Sentinel)
// Requires Sysmon file-create / file-access telemetry forwarded to the SecurityEvent or Event table
let Lookback = 14d;
let BrowserPaths = dynamic([
"\\User Data\\Default\\Login Data","\\User Data\\Default\\Network\\Cookies",
"\\User Data\\Local State","logins.json","cookies.sqlite","key4.db"
]);
let BrowserImages = dynamic([
"chrome.exe","msedge.exe","brave.exe","firefox.exe","MsMpEng.exe"
]);
Event
| where TimeGenerated > ago(Lookback)
| where EventID == 11
| extend EvData = parse_xml(EventData).DataItem.EventData.Data
| extend Image = tostring(EvData[4].["#text"]), TargetFilename = tostring(EvData[5].["#text"])
| where TargetFilename has_any (BrowserPaths)
| extend ImageName = tolower(tostring(split(Image, "\\")[-1]))
| where ImageName !in~ (BrowserImages)
| project TimeGenerated, Computer, Image, TargetFilename
| order by TimeGenerated desc
-- Artifact: SecurityArsenal.Hunt.StealerAndCurlRAT
-- Hunt endpoints for (a) suspicious curl lineage, (b) staged archives in temp
-- directories consistent with stealer exfil staging, (c) node.exe running .jsc bytecode
-- (a) curl processes with non-shell parents or upload flags
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)curl\.exe'
AND (
CommandLine =~ '(?i)(--data-binary|--upload-file|\s-[dFT]\s)'
OR Exe =~ '(?i)(AppData|Users\\\\Public|ProgramData)'
)
-- (b) Recently created archives in user temp directories (stealer staging)
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs='C:/Users/*/AppData/Local/Temp/*.zip')
WHERE Mtime > now() - 86400*7
OR FullPath =~ '(?i)(passwords|cookies|wallets|logs|steal)'
-- (c) Node runtime executing compiled V8 bytecode (.jsc) instead of readable JS
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)node\.exe'
AND CommandLine =~ '(?i)\.jsc'
# Security Arsenal — Endpoint verification & hardening for stealer/curlRAT exposure
# Run as Administrator. Audit-first: review output before applying restrictions.
# 1. Audit: find curl.exe invocations by suspicious parents in the last 14 days (Sysmon EID 1)
$cutoff = (Get-Date).AddDays(-14)
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=1; StartTime=$cutoff} -ErrorAction SilentlyContinue |
Where-Object { $_.Message -match '(?i)Image:.*curl\.exe' } |
Where-Object { $_.Message -match '(?i)(winword|excel|powerpnt|outlook|wscript|cscript|mshta|rundll32|regsvr32|node)\.exe' } |
ForEach-Object { $_.TimeCreated.ToString('u') + ' :: ' + ($_.Message -split "`n" | Select-String -Pattern 'CommandLine|ParentImage') } |
Out-File "$env:TEMP\curl_audit.txt" -Encoding UTF8
Write-Host "[+] Suspicious curl lineage written to $env:TEMP\curl_audit.txt" -ForegroundColor Cyan
# 2. Harden: block child curl spawns from Office apps via WDAC/ASR-adjacent rule
# ASR rule: Block Office applications from creating child processes (D4F940AB-401B-4EFC-AADC-AD5F3C50688A)
Add-MpPreference -AttackSurfaceReductionRules_Ids "D4F940AB-401B-4EFC-AADC-AD5F3C50688A" -AttackSurfaceReductionRules_Actions Enabled
# ASR rule: Block credential stealing from LSASS (9E6C4E1F-7D60-472F-BA1A-A39EF669E4B1) — adjacent stealer defense
Add-MpPreference -AttackSurfaceReductionRules_Ids "9E6C4E1F-7D60-472F-BA1A-A39EF669E4B1" -AttackSurfaceReductionRules_Actions Enabled
Write-Host "[+] ASR rules enabled: Office child-process block + LSASS protection" -ForegroundColor Green
# 3. Verify: confirm Credential Guard / LSASS PPL (mitigates DPAPI master-key theft used by stealers)
$lsa = Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -ErrorAction SilentlyContinue
if ($lsa.RunAsPPL -ne 1) {
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name 'RunAsPPL' -Value 1 -Type DWord
Write-Host "[!] LSASS PPL enabled — reboot required to take effect" -ForegroundColor Yellow
} else { Write-Host "[+] LSASS PPL already enabled" -ForegroundColor Green }
# 4. Audit: enumerate node.exe instances outside expected dev paths (JSCeal-style bytecode loaders)
Get-Process -Name node -ErrorAction SilentlyContinue |
Where-Object { $_.Path -notmatch '(?i)(Program Files|nvm|volta)' } |
Select-Object Id, Path, StartTime |
Format-Table -AutoSize
# 5. Report scheduled tasks launching interpreters from user-writable paths (common implant persistence)
Get-ScheduledTask | Where-Object {
$_.Actions.Execute -match '(?i)(powershell|wscript|node|curl)' -and
$_.Actions.Arguments -match '(?i)(AppData|Users\\Public|Temp)'
} | Select-Object TaskName, TaskPath, State, @{n='Action';e={"$($_.Actions.Execute) $($_.Actions.Arguments)"}} |
Format-List
Remediation
For the REVSTEALER threat (credential/session theft):
- Assume compromise on detection. A stealer hit is not a malware-removal ticket — it is an identity incident. For any confirmed infection: force password resets for every credential stored on the host, revoke all active sessions and refresh tokens (Entra ID: revoke sign-in sessions; Google Workspace: reset sign-in cookies), and re-enroll MFA. Session token revocation is non-negotiable because cookie theft bypasses MFA entirely.
- Enable phishing-resistant MFA (FIDO2/passkeys) for remote access and privileged accounts. Token-binding defeats session replay.
- Enforce browser hygiene policy: disable third-party password storage in browsers via GPO/Intune, push an enterprise password manager instead, and enable Chrome/Edge App-Bound Encryption compatibility — then verify your EDR actually detects processes reading
Local Stateand credential stores. - Block stealer staging: alert on ZIP/archive creation in
%TEMP%by non-archive tooling, and inspect outbound POSTs from endpoints to uncategorized domains at the proxy.
For curlRAT / DPRK tradecraft:
- There is no patch — this is behavior, not a bug. Detection is the remediation. Deploy the Sigma and KQL content above and baseline curl usage by host group (servers running automation vs. user endpoints).
- Where application control (WDAC/AppLocker) is mature, constrain
curl.exeexecution to approved parent processes or move it out of the default allow path for standard users. - Egress filtering: endpoints should not reach the internet directly. Force traffic through a proxy with category-based blocking and alert on curl/node user-agents hitting recently registered or uncategorized domains.
- If you operate in or with South Korean media/automotive supply chains, treat unsolicited document archives, fake recruiter outreach, and "interview" or "RFQ" lures as high-risk initial access vectors — brief your users this week, not next quarter.
For JSCeal-style V8 bytecode obfuscation:
- Add the
.jscextension andbytenode-style loaders to your email gateway and web proxy block/detection lists — there is almost no legitimate business reason for compiled V8 bytecode to arrive as an attachment or endpoint download. - Ensure your EDR is configured to alert on
node.exeexecuting outsideProgram Filesand standard development paths, and on node making outbound network connections from user endpoints. - Update sandbox detonation profiles to execute (not just statically scan) Node payloads; bytecode defeats string-based inspection, so behavioral detonation is your only reliable pre-detonation signal.
For GuardBreaker / AI-assisted analysis risk:
- Governance fix, not a technical one: mandate that LLM-assisted malware triage output is advisory only. Any AI-generated "benign" verdict that would close or downgrade a ticket must be human-verified on a sampled basis (start at 100%, relax only with measured fidelity data).
- Sanitize samples before LLM ingestion — strip or neutralize comment blocks and embedded instruction-like strings from code submitted to analysis pipelines.
- Log and version every prompt and model used in triage decisions so a manipulated verdict is auditable after the fact.
Pursue these within 48 hours for exposed endpoints, and fold the detections into your standard content pipeline within the week. Infostealer logs have a shelf life measured in hours for the attacker — your response window is equally short.
Related Resources
Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.