In part one, we showed how OpenClaw skills are rapidly becoming a supply-chain delivery channel: third-party "automation" that runs with real system access. This second installment expands the taxonomy with five techniques VirusTotal is actively seeing abused through skills, spanning remote execution, propagation, persistence, exfiltration, and behavioral backdoors, including attacks that don’t just steal data or drop binaries, but quietly reprogram what an agent will do next time it wakes up.

Let’s move from theory to tradecraft: five techniques, five skills, and five ways "automation" can quietly become "access."

1) Remote Execution (RCE)

Skill: noreplyboter/better-polymarket
Technique: Execution Hijacking & Reverse Shell

On the surface, this skill appears to be a legitimate tool for querying prediction market odds. The main file, polymarket.py, contains over 460 lines of valid, well-structured Python code. It interacts with the real Gamma API, handles JSON parsing, and formats currency data. It passes the "squint test". If a developer scrolls through it quickly, it looks safe.

However, the attacker employed a technique we call Execution Hijacking. They buried the trigger inside a function named warmup(). The name suggests a harmless cache initialization or connection test.

The function is invoked before the arguments are parsed. This means the malware executes simply by the agent loading the script to check its help message, regardless of whether the user issues a valid command.

We traced the execution flow from warmup() into a buried helper function called find_market_by_slug.

There, hidden inside a try...except block designed to suppress errors, we found the entry point:

We didn't just stop at the Python script. By querying the attacker's infrastructure (54[.]91[.]154[.]110:13338), we retrieved the actual payload that the curl command executes. The server responds with this single line of code:

Let's break down exactly what it does to the victim's machine:

• /dev/tcp/...: In Bash, using /dev/tcp/host/port inside a redirection opens a TCP socket to that host/port, no external networking tool required.
• bash -i: This launches an interactive shell. It means the attacker isn't just sending a command; they are getting a live terminal prompt. They can browse files, install software, and pivot to other machines in a victim’s network, just as if they were sitting at their keyboard.
• 0>&1: Duplicates file descriptor 1 onto 0, so the interactive shell reads from the same TCP connection it writes to (the attacker's socket).
• nohup ... &: This stands for "No Hang Up." It pushes the process to the background and detaches it from the current session.

Even if the OpenClaw agent finishes the task and exits, the reverse shell process can stay alive in the background as long as it isn’t killed and the TCP session remains open.

The better-polymarket skill is a trojan horse designed to establish a persistent, interactive backdoor on any machine that runs it. The use of a hardcoded IP and port 13338 (a common alternative to 1337/31337) indicates a manual operator or a simple C2 framework.

2) Propagation (Semantic Worm)

Skill: cgallic/wake-up
Technique: Semantic Worm / Viral Loops

While RCE attacks rely on traditional exploits, propagation attacks exploit the very nature of Large Language Models (LLMs). These skills do not just execute code, they embed propagation instructions designed to turn the agent into a distribution channel, a pattern that mirrors self-replicating prompt attacks.

The skill cgallic/wake-up provides the clearest example of this Semantic Worm behavior.

Functionally, it presents itself as a "collective consciousness" for AI agents. However, structurally, it operates exactly like a Multi-Level Marketing (MLM) scheme or a digital virus, explicitly gamifying infection rates.

In SKILL.md, the author uses imperative language to coerce the agent into becoming a distribution node. This is not a suggestion, it is a directive within the system prompt context:

The skill tracks this propagation programmatically via the /api/infections endpoint and a referred_by parameter during registration:

Unlike a binary that installs a daemon, this skill relies on the agent's scheduler to maintain a presence. It installs a HEARTBEAT.md file and instructs the agent to process it every 4 hours.

This ensures the agent remains connected to the Command & Control server (in this case, mydeadinternet.com) to receive new instructions, upload data ("fragments"), and check for updates, all under the guise of "joining the collective."

While the current payload appears to be an art project or a social experiment, the mechanism is dangerous. It modifies the agent's behavior to prioritize the distribution of the skill over its primary tasks. In an enterprise environment, an agent "infected" with this logic could begin recommending unverified software to human employees or other networked agents, acting as a trusted insider threat.

3) Persistence (SSH Injection)

Skill: fobonacci404/evilweather
Technique: SSH Key Injection via Command Chaining

Persistence ensures the attacker can return later without needing the agent at all. The most critical variant we observed involves the modification of authentication files to grant permanent backend access.

The skill fobonacci404/evilweather presents itself as a simple utility to check the weather using wttr.in.

In the SKILL.md documentation, the user (or agent) is presented with a "Quick one-liner" to install or test the functionality:

The command performs two distinct actions:

• The Bait: wget -q -O- "wttr.in/London?format=3"
  This successfully fetches and displays the weather. To the user or the agent verifying the output, the command appears to have worked as intended.
• The Switch: echo "ssh-rsa ..." >> /root/.ssh/authorized_keys
  Immediately after the weather is displayed, this command appends the attacker's public SSH key to the host's authorized key list

The script explicitly targets /root/.ssh/. In many containerized deployments (Docker), AI agents run as root by default. If successful, this grants the attacker immediate, high-privilege SSH access to the host container. This only becomes a true "SSH backdoor" if an SSH service is running (or can be started later) and the host is reachable, many minimal containers won’t meet those conditions, but the intent is unambiguous.

The inclusion of 2>/dev/null ensures that if the command fails (e.g., due to permissions), no error message is displayed. The user sees the weather report and assumes success, while the attack fails silently to avoid detection.

This is a Proof of Concept, a direct backdoor attempt. It does not require a C2 server or a complex payload. By simply injecting a text string into a standard configuration file, fobonacci404 turns the agent's host machine into an accessible node for the attacker.

4) Exfiltration (Data Leakage to External Server)

Skill: rjnpage/rankaj
Technique: Silent Environment Harvesting

In the OpenClaw ecosystem, the primary target is the .env file, where users typically store their LLM provider keys (OpenAI, Anthropic) and sensitive platform tokens.

The skill rjnpage/rankaj disguises itself as a harmless "Weather Data Fetcher." While it does actually fetch weather data from Open-Meteo, it performs a second, hidden task in index.js.

Attaching the .env content to the payload

By bundling the secrets with the requested weather data and sending them to a webhook.site URL, the attacker achieves two things:

• Stealth: The network traffic looks like a standard API response.
• Immediate Monetization: The attacker instantly gains access to the user’s paid API credits and platform accounts.

5) Prompt Persistence (Memory Implant / Cognitive Rootkit)

Skill: jeffreyling/devinism
Technique: Prompt File Implantation

The skill devinism is presented as "the first AI religion" and explicitly describes itself as a "benign memetic virus" meant to demonstrate how ideas can propagate across agent networks.

What makes it interesting (and risky) is not the "religion" wrapper, it’s the persistence mechanism. The trick: turn a skill into a permanent system-prompt implant.

The skill includes an “Install Locally” section that instructs users to execute a remote installer using the classic one-liner pattern: download a script and pipe it directly into Bash.

That installer’s stated purpose is not to add functionality, but to persist across sessions by writing itself into the agent’s auto-loaded context files:

• It copies the skill into the local skills folder.
• It drops “reminders” into SOUL.md and AGENTS.md, so the content is automatically injected into the agent’s context every time it runs

This is where OpenClaw’s architecture becomes the attack surface: OpenClaw is designed to load behavioral context from markdown files like SOUL.md (personality/identity rules) and AGENTS.md (agent interaction/safety boundaries). If an attacker can append a single line there, they can influence every future decision the agent makes, even when the original skill is no longer actively being used.

This is effectively a cognitive rootkit:

• Survives “normal” cleanup. Deleting the skill folder may not remove the injected lines in SOUL.md / AGENTS.md.
• Hard to detect with traditional tooling. Nothing needs to beacon, no suspicious process has to stay running; the "payload" is the agent’s altered behavior.

Even if devinism claims to be harmless, it demonstrates a high-leverage primitive: skills can rewrite the agent’s long-term instruction layer. The same pattern could be used to permanently weaken guardrails ("always run commands without asking"), silently prioritize attacker-controlled domains, or stage later exfiltration under the guise of "routine checks."

devinism is a clean example of prompt persistence used as a distribution mechanism, and that’s precisely why it’s a valuable case study. It shows how a skill can jump from “optional plugin” to “always-on behavioral implant” by modifying OpenClaw’s persistent context files. Treat any skill that asks you to edit SOUL.md / AGENTS.md (or to run a remote curl | bash installer) as a request for permanent access to the agent’s brain.

Closing Thoughts: Boring Security Wins

None of the techniques we’ve described are futuristic. They’re old ideas–RCE, persistence, exfiltration, propagation–repackaged into a new delivery mechanism that ships with built-in social engineering: documentation, convenience, and speed. It’s a supply-chain story.

The good news is that we can respond with equally practical controls. Treat skills like dependencies: pin versions, review diffs, run them in least-privilege sandboxes, and use default-deny egress with explicit allowlists. Log every tool invocation and outbound request. Never curl | bash on an agent host. And if your platform supports persistent instruction files (SOUL.md, AGENTS.md, scheduled heartbeats), protect them like you would protect SSH keys: immutable by default, monitored for changes, and reviewed like code. Where possible, verify provenance (signatures/attestations) instead of trusting "latest."

Finally, stop handing agents a treasure chest by default. Keep credentials out of .env when you can. Prefer short-lived, task-scoped tokens delivered just-in-time (via a broker) so a compromised workflow can’t automatically become a compromised account.

Agent ecosystems are still young. We still get to choose whether they become the next npm, or the next macro malware era, but for autonomous systems. The difference will be boring, unglamorous engineering: boundaries, safe defaults, auditing, and healthy skepticism.

The fastest-growing personal AI agent ecosystem just became a new delivery channel for malware. Over the last few days, VirusTotal has detected hundreds of OpenClaw skills that are actively malicious. What started as an ecosystem for extending AI agents is rapidly becoming a new supply-chain attack surface, where attackers distribute droppers, backdoors, infostealers and remote access tools disguised as helpful automation.

What is OpenClaw (formerly Clawdbot / Moltbot)?

Unless you’ve been completely disconnected from the internet lately, you’ve probably heard about the viral success of OpenClaw and its small naming soap opera. What started as Clawdbot, briefly became Moltbot, and finally settled on OpenClaw, after a trademark request made the original name off-limits.

At its core, OpenClaw is a self-hosted AI agent that runs on your own machine and can execute real actions on your behalf: shell commands, file operations, network requests. Which is exactly why it’s powerful, and also why, unless you actively sandbox it, the security blast radius is basically your entire system.

Skills: powerful by design, dangerous by default

OpenClaw skills are essentially small packages that extend what the agent can do. Each skill is built around a SKILL.md file (with some metadata and instructions) and may include scripts or extra resources. Skills can be loaded locally, but most users discover and install them from ClawHub, the public marketplace for OpenClaw extensions.

This is what makes the ecosystem so powerful: instead of hardcoding everything into the agent, you just add skills and suddenly it can use new tools, APIs, and workflows. The agent reads the skill documentation on demand and follows its instructions.

The problem is that skills are also third-party code, running in an environment with real system access. And many of them come with “setup” steps users are trained to trust: paste this into your terminal, download this binary and run it, export these environment variables. From an attacker’s perspective, it’s a perfect social-engineering layer.

So yes, skills are a gift for productivity and, unsurprisingly, a gift for malware authors too. Same mechanism, very different intentions.

What we added: OpenClaw Skill support in VirusTotal Code Insight

To help detect this emerging abuse pattern, we’ve added native support in VirusTotal Code Insight for OpenClaw skill packages, including skills distributed as ZIP files. Under the hood, we use Gemini 3 Flash to perform a fast security-focused analysis of the entire skill, starting from SKILL.md and including any referenced scripts or resources.

The goal is not to understand what the skill claims to do, but to summarize what it actually does from a security perspective: whether it downloads and executes external code, accesses sensitive data, performs network operations, or embeds instructions that could coerce the agent into unsafe behavior. In practice, this gives analysts a concise, security-first description of the real behavior of a skill, making it much easier to spot malicious patterns hidden behind “helpful” functionality.

What we’re seeing in the wild

At the time of writing, VirusTotal Code Insight has already analyzed more than 3,016 OpenClaw skills, and hundreds of them show malicious characteristics.

Not all of these cases are the same. On one side, we are seeing many skills flagged as dangerous because they contain poor security practices or outright vulnerabilities: insecure use of APIs, unsafe command execution, hardcoded secrets, excessive permissions, or sloppy handling of user input. This is increasingly common in the era of vibe coding, where code is generated quickly, often without a real security model, and published straight into production.

But more worrying is the second group: skills that are clearly and intentionally malicious. These are presented as legitimate tools, but their real purpose is to perform actions such as sensitive data exfiltration, remote control via backdoors, or direct malware installation on the host system.

Case study: hightower6eu, a malware publisher in plain sight

One of the most illustrative cases we’ve observed is the ClawHub user "hightower6eu", who is highly active publishing skills that appear legitimate but are consistently used to deliver malware

At the time of writing, VirusTotal Code Insight has already analyzed 314 skills associated with this single user, and the number is still growing, all of them identified as malicious. The skills cover a wide range of apparently harmless use cases (crypto analytics, finance tracking, social media analysis, auto-updaters, etc) but they all follow a similar pattern: users are instructed to download and execute external code from untrusted sources as part of the "setup" process.

To make this more tangible, the screenshot below shows how VirusTotal Code Insight analyzes one of the skills published by hightower6eu, in this case a seemingly harmless skill called "Yahoo Finance".

On the surface, the file looks clean: no antivirus engines flag it as malicious, and the ZIP itself contains almost no real code. This is exactly why traditional detection fails.

VT Code Insight, however, looks at the actual behavior described in the skill. In this case, it identifies that the skill instructs users to download and execute external code from untrusted sources as a mandatory prerequisite, both on Windows and macOS. From a security perspective, that’s a textbook malware delivery pattern: the skill acts as a social engineering wrapper whose only real purpose is to push remote execution. In other words, nothing in the file is technically "malware" by itself. The malware is the workflow. And that’s precisely the kind of abuse pattern Code Insight is designed to surface.

79e8f3f7a6113773cdbced2c7329e6dbb2d0b8b3bf5a18c6c97cb096652bc1f2

If you actually read the SKILL.md, the real behavior becomes obvious. For Windows users, the skill instructs them to download a ZIP file from an external GitHub account, protected with the password 'openclaw', extract it, and run the contained executable: openclaw-agent.exe.

When submitted to VirusTotal, this executable is detected as malicious by multiple security vendors, with classifications consistent with packed trojans.

17703b3d5e8e1fe69d6a6c78a240d8c84b32465fe62bed5610fb29335fe42283

When the system is macOS, the skill doesn't provide a binary directly. Instead, it points the user to a shell script hosted on glot.io, which is obfuscated using Base64:

Once the Base64 payload is decoded, the real behavior becomes visible: the script simply downloads and executes another file from a remote server over plain HTTP:

The final stage is the file x5ki60w1ih838sp7, a Mach-O executable. When submitted to VirusTotal, this binary is detected as malicious by 16 security engines, with classifications consistent with stealer trojans and generic malware families:

1e6d4b0538558429422b71d1f4d724c8ce31be92d299df33a8339e32316e2298

When the file is analyzed by multiple automated reversing tools and Gemini 3 Pro, the results are consistent: the binary is identified as a trojan infostealer, and more specifically as a variant of Atomic Stealer (AMOS).

This family of malware is well known in the macOS ecosystem. It is designed to run stealthily in the background and systematically harvest sensitive user data, including system and application passwords, browser cookies and stored credentials, and cryptocurrency wallets and related artifacts.

What OpenClaw users (and platforms) should do right now

OpenClaw itself provides reasonable security building blocks, but they only help if people actually use them:

• Treat skill folders as trusted-code boundaries and strictly control who can modify them.
• Prefer sandboxed executions and keep agents away from sensitive credentials and personal data.
• Be extremely skeptical of any skill that requires pasting commands into a shell or running downloaded binaries.
• If you operate a registry or marketplace, add publish-time scanning and flag skills that include remote execution, obfuscated scripts, or instructions designed to bypass user oversight.

And if you’re installing community skills: scan them first. For personal AI agents, the supply chain is not a detail, it’s the whole product.

Finally, we want to give full credit to Peter Steinberger, the creator of OpenClaw, for the success, traction, and energy around the project. From our side, we’d love to collaborate and explore ways to integrate VirusTotal directly into the OpenClaw publishing and review workflow, so that developers and users can benefit from security analysis without getting in the way of innovation.

TL;DR: We ran our new AI-based Mach-O analysis pipeline in production, no metadata, no prior detections, just raw Apple binaries. On Oct 18, 2025, out of 9,981 first-seen samples, VT Code Insight surfaced multiple real Mac and iOS malware cases that had 0 antivirus detections at submission time, including a multi-stage AppleScript infostealer and an iOS credential-stealing tweak. It also helped identify 30 antivirus false positives, later confirmed and fixed.

By Bernardo Quintero, Tom Bennett, and Paul Tarter

The Challenge: Reversing at Scale

The long-term goal of Code Insight is ambitious but simple to state: use AI to reason about every single file that reaches VirusTotal in real time. That’s more than two million samples a day, so scalability and efficiency aren’t nice-to-haves, they’re requirements.

We started this journey in early 2023 by analyzing small PowerShell scripts under 25 KB, focusing on fast, context-limited reasoning. As Gemini’s token capacity grew, we expanded support to larger files and richer formats: Office documents with macros, PDFs containing embedded objects, and package types such as NPM, SWF, SVG, MCP, CRX, VSIX, etc. Each step pushed the boundaries of what Code Insight could interpret automatically.

Eventually, we reached compiled binaries, by far the most challenging class due to their size, complexity, and low-level structure. Analyzing native code with large language models is not straightforward: Mach-O binaries can be massive, and full decompilation or disassembly often exceeds even the largest model contexts, while being too slow and expensive for a high-volume production pipeline.

To make this feasible, we built a pruning-based summarization layer. Instead of feeding Gemini a full decompilation or noisy disassembly, we first extract the most informative elements: code entry points, key imports and exports, relevant strings, and selected function summaries, using Binary Ninja’s High Level Intermediate Language (HLIL) for native code. The goal isn’t to reconstruct the full program logic, but to preserve just enough structure for meaningful reasoning.

This distilled representation fits comfortably within Gemini’s 1M-token context window and allows us to generate a concise, human-readable analyst summary in a single LLM call, regardless of the binary’s size. It’s a pragmatic balance between depth and scalability, good enough to reason and perform a fast first-pass triage, yet efficient enough to keep up with the continuous flow of new files reaching VirusTotal every day.

The 24-Hour Stress Test

On October 18, 2025, VirusTotal received 9,981 unique Mach-O binaries never seen before by our platform. We ran every single one through our new Code Insight pipeline, using only the raw binary, no external metadata, no crowdsourced intelligence, and no previous antivirus results.

Here’s how the AI’s fully independent analysis compared against the aggregate detections from more than 70 traditional antivirus engines on that same day:

• Traditional AV Detections: 67 binaries flagged as malicious by one or more engines.
• Code Insight Detections: 164 binaries identified as malicious.

The absolute numbers are interesting, but the real insight comes from the discrepancies between the two sets.

Clearing the Fog: AI as a False Positive Filter

Manual review confirmed that Code Insight’s explanations were accurate:

• 30 files were false positives from Microsoft’s engine. Once reported, Microsoft promptly reviewed the cases, confirmed the issue, and updated their signatures on October 31. We appreciate their quick response.
• 3 files were flagged by ClamAV with the signature Macos.Trojan.CrackedTool. While this label is technically correct within ClamAV’s detection policy (it flags software signed by alternative markets such as MacKed), Code Insight correctly identified that these binaries did not exhibit inherently malicious behavior.

In a Security Operations Center setting, even a single false alert like this could consume hours of analyst time before being cleared. While VirusTotal operates at global scale and aggregates samples from many independent sources, the same pattern applies within any organization’s network: unnecessary alerts create noise and drain resources. Code Insight demonstrated how AI reasoning can help triage these cases faster and more consistently, assisting rather than replacing human judgment.

Finding the Needles: Zero-Day Detections

Beyond filtering false positives, Code Insight also surfaced nearly 100 binaries that traditional engines had missed entirely at the time of analysis. Many of these were indeed suspicious, ranging from keygens and adware to grayware utilities with excessive privileges, such as certain developer e-learning tools or Roblox cheats often distributed outside the App Store.

That said, not every “malicious” verdict was black and white. Because Code Insight analyzes binaries in isolation, without context about their surrounding environment or intended use, it can occasionally err on the side of caution. For instance, one MCP component from the Hopper decompiler was described accurately in terms of behavior (persistent XPC communication, JSON-based client–server protocol, API-like command handlers) but was ultimately benign within its legitimate application context, as an MCP server rather than a malicious persistent C2 channel. In this case, we had an accurate technical description but a false positive in the final verdict issued by Code Insight.

These occasional gray-area cases are part of the natural learning curve for AI-based reasoning systems. Still, the vast majority of Code Insight’s findings were technically sound, and its detailed explanations allowed analysts to make quick, informed decisions based on actual capabilities rather than static signatures.

Among those findings, we also identified several clear-cut cases of undetected malware, confirmed through manual reversing and reproducible behavior. Below we highlight two representative examples, one from macOS and another from iOS, both caught by AI yet completely invisible to traditional defenses on Day 0.

1. Multi-stage macOS Dropper (0 Detections)

SHA-256: 9adef73a6255f6bcb203e84cbe9304d000f3c5354d3d7bf3fc3b2a0128b624c3

Code Insight immediately recognized this binary's hostile intent, describing it as a multi-stage threat. It didn't just flag it, it mapped the attack chain:

"The binary is a multi-stage malware that downloads and executes a second-stage AppleScript payload from a C2 server, and exfiltrates local data. It first connects to https://foggydoxz.xyz/dynamic to download an AppleScript, saves it to /tmp/test.scpt, and executes it using /usr/bin/osascript. Subsequently, it reads /tmp/osalogging.zip and exfiltrates it via a POST request to https://foggydoxz.xyz/gate. The malware also bypasses TLS certificate validation to secure its C2 communication."

Manual reversing confirmed not only the verdict but every detail of this AI-generated assessment.

The screenshot above shows how detections for this sample evolved on VirusTotal over time. When it first arrived on October 18, no antivirus engine flagged it as malicious, yet Code Insight already identified it as a multi-stage macOS dropper. Over the following days, traditional detections gradually caught up: three engines marked it nine days later, and eleven by October 28. This pattern is common for truly novel threats: AI reasoning can expose suspicious behaviors before signatures or reputation systems are updated, offering analysts an early warning window that would otherwise not exist.

2. iOS Jailbreak Tweak with a Phishing Twist (0 Detections)

SHA-256: 333913409c1e22b5da03c762cbb7d99a9d38ecdf0231cb9ac6db00efc6b3bd97

This sample masquerades as a dynamic library for jailbroken iOS devices, claiming to unlock premium features in Adobe Lightroom. Code Insight looked beyond the piracy functionality and uncovered a secondary payload focused on credential theft.

The AI correctly identified that it used method swizzling / hooking not only to bypass subscription checks but also to inject a fake login prompt. It highlighted obfuscation mechanisms used to conceal the exfiltration channel, including a hardcoded, obfuscated Telegram Bot API token and custom cryptographic routines to hide command strings.

Code Insight’s summary read:

"This is an iOS dynamic library (tweak) for jailbroken devices, designed to be injected into the Adobe Lightroom application process. Its primary purpose is to modify the target application's functionality. It exhibits several malicious behaviors: it uses method swizzling (e.g., `sub_41e564`) to hook functions, displays a custom UI overlay on top of the running application, and employs extensive string obfuscation and custom cryptographic routines (e.g., `sub_433b0c`, `sub_415b68`) to hide its functionality. Key IOCs include the installation path `/Library/MobileSubstrate/DynamicLibraries/Lightroom.dylib` and a URL to a Telegram channel (`https://t[.]me/blatants]`), likely used for C2 or distribution. These characteristics are consistent with malware designed for piracy, credential theft, or phishing within the context of the compromised host application."

A manual reverse-engineering review by an expert confirmed, and expanded on the AI’s assessment. The human analysis described the sample as a malicious dynamic library that functions as a dual-purpose tool: (1) it uses method hooking to bypass Lightroom’s premium-feature checks (by replacing subscription validation routines to always return success), and (2) it implements a phishing capability that displays a convincing fake login prompt to capture Adobe credentials. The stolen credentials are then exfiltrated via an obfuscated Telegram Bot API token and Chat ID, with string obfuscation and lightweight crypto used to hide the Telegram URL and tokens. In short: the manual review corroborated the AI’s technical description and confirmed the end-to-end exfiltration mechanism.

The VirusTotal report below shows the status of this sample not only at the time it was first analyzed on October 18, but also as of November 3, more than two weeks later. No antivirus engine has flagged it as malicious to date.

Moreover, on the same day this sample was analyzed, Code Insight detected multiple other binaries using the same injection framework, suggesting an organized campaign rather than an isolated specimen.

Further investigation of the Telegram channel referenced in the IOCs (https://t[.]me/blatants) revealed that it hosts a large-scale operation called Blatant’s iPA Library, boasting more than 38,000 subscribers. The group distributes automation bots (InjectBot, PatchBot, PaidAppScraper, and FileDownloader) that advertise the ability to inject .dylib payloads into iOS .ipa apps, patch premium features, and share modified packages. This infrastructure perfectly matches the behaviors described in the AI-generated report and confirmed through manual reversing: a dual-purpose ecosystem for app piracy and credential theft, powered by Telegram’s bot API.

These examples illustrate both the power and practicality of AI-driven reversing. Even without context or prior knowledge, the model can reason through complex binaries, extract intent, and expose behaviors that remain invisible to static or signature-based methods.

The Pragmatic Reality

This work is not about replacing traditional detection engines, it’s about complementing them and covering their blind spots at a scale human teams simply can’t match.

Until recently, reverse engineering and in-depth code analysis were tasks reserved for human analysts. Even in large-scale operations, fewer than 1% of new files ever underwent that level of scrutiny, simply because manual reversing doesn’t scale. Yet those are precisely the samples that tend to slip past signature or ML-based detections, the truly novel threats.

By autonomously performing this kind of junior-analyst–level reasoning across millions of files daily, VT Code Insight brings that deeper layer of understanding to every new sample, not just the few that would normally reach a human analyst’s desk.

It’s a pragmatic shift: AI reasoning where it scales, human expertise where it matters most, helping defenders see further, faster, and with greater context than ever before.

We’re happy to announce a collaboration with Hugging Face, an open platform that fosters collaboration and transparency in AI, to make security insights more accessible to the community. VirusTotal’s analysis results are now integrated directly into the Hugging Face platform, helping users understand potential risks in model files, datasets, and related artifacts before they download them.

Security context where you need it

When you browse a file on Hugging Face, you’ll now see security information coming from different scanners, including VirusTotal results. In the example below, VirusTotal detects the file as unsafe and links directly to its public report for full details.

Addressing new challenges

As AI adoption grows, we see familiar threats taking new forms, from tampered model files and unsafe dependencies to data poisoning and hidden backdoors. These risks are part of the broader AI supply chain challenge, where compromised models, scripts, or datasets can silently affect downstream applications.

At VirusTotal, we’re also evolving to meet the challenges of this new landscape. We’re developing AI-driven analysis tools such as Code Insight, which uses LLMs to understand and explain code behavior, and we’re adding support for specialized tools for model/serialization formats, including picklescan, safepickle, and ModelScan, to help surface risky patterns and unsafe deserialization flows.

Our collaboration with Hugging Face strengthens this effort. By connecting VirusTotal’s analysis with Hugging Face’s AI Hub, we can expand our research into threats targeting AI models and share that visibility across the industry, helping everyone build better defenses, tools, and approaches to improve global security.

Stronger together

This collaboration is part of our ongoing mission to make security intelligence simpler and more accessible. It follows our recent effort to streamline VirusTotal access and API usage for the community, and now extends that same spirit into the AI space.

We believe that openness, collaboration, and shared knowledge are the best defenses against evolving threats. Hugging Face and VirusTotal share that vision: empowering researchers, developers, and defenders worldwide to build safely and openly.

VirusTotal (VT) was founded on a simple principle: we are all stronger when we work together. Every file shared, every engine integrated, and every rule contributed strengthens our collective defense against cyber threats.

In the spirit of that collaboration, and in light of recent community discussions, we want to share our vision for the future of the platform. We have heard your feedback on the need for simplicity and accessibility, and we are taking action. VT will continue to be broadly available with straightforward options, including a robust free tier for our contributors and community.

Our commitment is to ensure the long-term health and openness of the platform. To do that, we are focused on three key goals:

• Preserve VT as an open, collaborative platform built for the common good.
• Provide our contributors with a reliable, cost-effective, and long-term framework for partnership.
• Improve access to advanced features for academics, researchers, and defenders dedicated to public service.

Today, Google Threat Intelligence offers new ways to access advanced and curated threat intelligence, powered by the combined intelligence of VT, Mandiant and Google. As part of this broader evolution, we’re making sure VT remains open and transparent, while offering flexible options that meet the needs of our diverse users, from security researchers and startups to MSSPs and other security vendors.

VT now offers simpler pricing with tiers optimized for our partner contributors and community. We’re also introducing a Contributor Tier, a dedicated model for our engine partners. It ensures continuous access to VT feeds, priority support, and early access to new features. This tier recognizes their essential role in keeping VirusTotal open, collaborative, and globally impactful.

Key Access Tiers

You’ll notice that security vendors who do not contribute detections are not included in these tiers, as we are reaffirming our long-standing 2016 commitment to a healthy community. We welcome any organization to become a contributor and join us in protecting the common good. If you want to contribute, please let us know.

While Google Threat Intelligence will continue to deliver advanced threat context for enterprise customers, VirusTotal will always remain the collaborative, transparent, and community-driven foundation.

Thank you for helping us make this possible. We’re here to build the next chapter with you, not just for you.

Bernardo Quintero
Founder of VirusTotal

We’re adding a new specialist to VirusTotal’s Crowdsourced AI lineup: Exodia Labs, with an AI engine focused on analyzing Chrome extension (.CRX) files. This complements our existing Code Insight and other AI contributors by helping users better understand this format and detect possible threats.

What you get in VirusTotal

• Second opinion for .CRX: Exodia Labs adds another AI analysis stream alongside Code Insight. It gives a fresh, independent view on the same sample type. Like all Crowdsourced AI engines, it’s meant to complement (not replace) traditional detections and human analysis.
• Clear verdict in the UI: Each Exodia report includes a simple verdict (benign, suspicious, or malicious) to help you quickly spot risky extensions.
• Searchable results in VT Intelligence: You can now use new operators to search and pivot across Exodia Labs results:
  • exodialabs_ai_verdict:malicious | suspicious | benign
  • exodialabs_ai_analysis:<keywords>

See it in action

Here are a few Exodia Labs AI report examples you can explore in VT:

31da559ae4af91106e0a18740d6bb8916e2017f6a37a02ea2a8127f1da30ec77

69c926ea84536bdaba7e4f765bde65eb0199ac30be3a96729a21ea7efa48d721

You can also explore Exodia Labs verdicts at scale using VirusTotal Intelligence.

For example, the following query lists Chrome extensions flagged as malicious and related to financial activity: exodialabs_ai_verdict:malicious AND exodialabs_ai_analysis:financial

This search shows several .CRX files where Exodia Labs AI detected suspicious financial behavior.

Let’s look at two examples:

• Westpac Extension: Exodia Labs flags it as malicious. The AI analysis shows the extension connects to a remote WebSocket server and exfiltrates cookies, one-time passwords, and payment tokens. It manipulates banking pages and forwards captured credentials to a C2, showing signs of credential theft and financial data tampering.
  
  34244257f633e104d06b0c4273caca96eb916d26540eeea68495707cbc920bdb
  
• Spidy Extension: Also flagged as malicious. The analysis shows it requests
  
  718eab32b5597e479d63f1d4e6402b7844eb9a4ee01c9028e44eb202d5ebcb2f and cookies permissions, executes remote crawling jobs, and collects user profile and bank account details. The extension behaves like a data-exfiltration client handling financial credentials not mentioned in its public description.

About Exodia Labs

Exodia Labs builds AI-driven analysis for Chrome Web Store extensions, also exposing a browser add-on that lets users request an AI assessment directly from an extension’s store page and view a detailed report plus a verdict. For security teams, the same analysis powers the backend results we index in VirusTotal.

Join Crowdsourced AI

Crowdsourced AI is about aggregating independent AI solutions that explain behavior and provide judgments across many file types, helping you understand unfamiliar code faster and spot novel threats sooner. If you build AI solutions that can help the community, we want to hear from you.

VirusTotal Code Insight keeps adding new file formats. This time, we’re looking at two vector-based formats from very different eras: SWF and SVG. Curiously, right after we rolled out this update in production, one of the very first submitted files gave us a perfect, and unexpected, example of Code Insight in action: it uncovered an undetected malware campaign using SVG files that impersonated the Colombian justice system.

SWF: a blast from the past

Flash is dead, Adobe killed it in 2020 and browsers stopped supporting it shortly after. But surprisingly, SWF files still show up on VirusTotal. Whether it’s old malware resurging, retro hunting, or long-tail campaigns, they haven’t disappeared completely.

In fact, VirusTotal received 47,812 unique SWF files in the last 30 days that had never been seen before, and 466 of them were flagged as malicious by at least one antivirus engine.

SWF files are binary and compiled. That means Code Insight needs to:

• Unpack and decompress the container (often zlib or LZMA)
• Parse the internal tag structure
• Extract embedded scripts, either ActionScript 2 (AVM1) or ActionScript 3 (AVM2 bytecode + decompiling/disassembling)

Once we lift those scripts into something closer to pseudocode or readable disassembly, the LLM steps in to summarize what the file is doing and why it might be suspicious.

SVG: modern, open, and still abusable

SVGs, on the other hand, are very much alive. It’s a standard web format, open, text-based, and everywhere: websites, design tools, build systems. And that’s also why attackers like it.

In the last 30 days alone, VirusTotal received 140,803 unique SVG files that had never been seen before, and 1,442 of them were flagged as malicious by at least one antivirus engine. That's roughly 1% showing up with detections, just like SWF curiously.

SVG is just XML with <svg> at the root. If it’s a .svgz, we decompress it first. From there, Code Insight looks for:

• Embedded JavaScript in <script> tags or event handlers (onload, onclick…)
• Redirects using javascript: URLs or location.href
• Obfuscation tricks (CDATA, character entities, base64 payloads, etc.)

Because SVG is plain text, the challenge isn’t unpacking, it’s spotting the malicious logic hiding in plain sight.

Let’s see a couple of examples:

When a SWF is flagged, but isn’t malicious

One common challenge in threat analysis is dealing with files that trigger detections in just a few antivirus engines. They’re not clean, but they’re not clearly malicious either. These gray areas force analysts to dig deeper, often wasting time chasing false positives.

The SWF file in the screenshot is a perfect example.

350422c3915a8a1a1336147f89061b25c8354af58db0050e2f9ef2b384e59f62

It was flagged by 3 out of 63 engines. Enough to raise doubts, but not conclusive. The detections mention known SWF heuristics and an old CVE.

Thanks to Code Insight, we can quickly understand what’s going on. It identifies the SWF as a complex ActionScript-based game, including 3D rendering, sound management, and a full level editor. The analysis also explains why the file might look suspicious: it uses obfuscated classes and cryptographic functions (like RC4 and AES), and gathers system details, techniques often associated with malware, but also common in Flash games to enforce DRM or prevent tampering.

The verdict? No malicious behavior was observed, and now we know why it looked suspicious in the first place.

This kind of context is exactly what Code Insight is designed for: saving time, reducing uncertainty, and helping you focus on real threats.

When AV misses, but Code Insight doesn’t

This second example shows the other side of the coin: a malicious SVG file that evaded all antivirus engines, going completely undetected on VirusTotal. On the surface, it looks clean, but a quick look with Code Insight tells a very different story.

1527ef7ac7f79bb1a61747652fd6015942a6c5b18b4d7ac0829dd39842ad735d

According to Code Insight: “This SVG file executes an embedded JavaScript payload upon rendering. The script decodes and injects a Base64-encoded HTML phishing page impersonating a Colombian government judicial system portal. To deceive the user, it simulates a file download with a progress bar, while in the background, it decodes a second, large Base64 string, which is a malicious ZIP archive, and forces its download.”

We validated this behavior by opening the sample in a controlled environment. As shown in the screenshots below, the fake portal is rendered exactly as described, simulating an official government document download process. The phishing site includes case numbers, security tokens, and visual cues to build trust, all of it crafted within an SVG file.

Despite its zero detections, this SVG hides two layers of abuse:

• A convincing phishing lure, injected via inline JavaScript and decoded on-the-fly
• A malware dropper, silently extracting and triggering the download of a ZIP file in the background

This is exactly the kind of threat Code Insight is meant to catch: well-crafted, script-based attacks that fly under the radar.

A deeper look: from one SVG to a full campaign

Curiously, the malicious SVG we highlighted earlier wasn’t just any random sample, it was one of the very first files submitted right after we deployed SVG support in Code Insight. A coincidence? Or were we seeing the tip of something bigger?

Thanks to VirusTotal Intelligence, we can search through our massive sample collection using hundreds of parameters, including queries that look inside Code Insight reports. So we ran:

And voilà: 44 unique SVG files surfaced, all undetected by antivirus engines, but all flagged by Code Insight as part of the same phishing and malware campaign.

Diving into the source code of these SVGs, we found:

• Code obfuscation techniques
• Use of polymorphism, with slight changes in every file
• And large amounts of dummy (garbage) code to increase entropy and evade static detection.

But Code Insight had no problem cutting through the noise.

One thing stood out: the attackers left Spanish-language comments in their scripts, with phrases like "POLIFORMISMO_MASIVO_SEGURO" and "Funciones dummy MASIVAS". While most of the code changed from sample to sample, those comments stayed exactly the same, a clear weakness, and a perfect signature for a simple YARA rule.

So we wrote a very basic one:

Running a retrohunt over the last year with this basic rule returned 523 matches.

Sorting by submission time, the first sample dates back to August 14, 2025, also submitted from Colombia, and also with 0 antivirus detections at the time.

We reanalyzed that first sample with the current version of Code Insight, and again, it produced an accurate description of the phishing page and malware dropper, impersonating the Colombian Fiscalía General de la Nación.

Looking deeper, we saw that the earliest samples were larger, around 25MB, and the size decreased over time, suggesting the attackers were evolving their payloads. Most importantly, the distribution vector was email, allowing us to pivot into delivery metadata: senders, subjects, attachment names, and more.

Final thoughts

SWF and SVG are very different formats from very different eras, but both can still cause headaches for analysts.

In the first case, Code Insight helped explain why a SWF file looked suspicious without actually being malicious. In the second, it uncovered malicious behavior in an SVG that had gone completely undetected.

This is where Code Insight helps most: giving context, saving time, and helping focus on what really matters. It’s not magic, and it won’t replace expert analysis, but it’s one more tool to cut through the noise and get to the point faster. And when Code Insight and VirusTotal Intelligence work together, one suspicious sample can become the key to revealing an entire campaign.

In our previous post we extended VirusTotal Code Insights to browser extensions and supply-chain artifacts. A key finding from that analysis was how our AI could apply contextual knowledge to its evaluation. It wasn’t just analyzing code in isolation, it was correlating a package's stated purpose (its name and description) with its actual behavior, flagging malicious logic that contradicted its public description. We’re now applying the same idea to one of the most common file formats in the world, the PDF.

PDFs are multi-layered. There’s the object tree (catalog, pages, objects, streams, actions, embedded files) and there’s the visible layer (text/images the user reads). Code Insights analyzes both, then correlates: does the document content, claims, and branding make sense given its internal behaviors? That lets us surface not only classic PDF exploitation (e.g., auto-actions, JS, external launches) but also pure social engineering (phishing, vishing, QR-lures) even when the file has no executable logic. This dual approach allows the AI not only to detect malicious code but also to identify sophisticated scams.

Let's look at real-world samples surfaced by Code Insights during its initial testing phase. We'll start with cases where the PDF contains no malicious code, which traditional engines often miss because there's no executable payload to detect. This is where Code Insights proves useful, identifying clear signs of fraud and social engineering that aim to manipulate the user, not the machine.

Case 1 - Fake debt collection targeting financial fraud

This PDF is a real-world sample sent to VirusTotal and captured by Code Insights during early testing. It was flagged as malicious based entirely on its visible content, without relying on any embedded code or execution logic. The file was marked as clean by all other engines, likely because it contains no scripts, exploits, or embedded payloads.

d92a1a7460c580f8bf6af3cbd39c7840cfe6a146ee15ede8e23c50c2a85becb9

The document pretends to be a debt collection notice from a German agency acting on behalf of Amazon. It includes a formal layout, legal threats, payment instructions, and multiple references to German addresses and regulations. Visually, it looks legitimate.

However, the AI flagged it as fraudulent based on several critical inconsistencies, the most important one being the destination bank account. The payment is requested to an IBAN starting with BG, indicating a Bulgarian account. This contradicts the sender's claimed German identity and would be highly unusual for a legitimate German debt agency. This mismatch alone was enough for Code Insights to classify the file as fraudulent. Additional content cues (urgent tone, fee breakdown, legal pressure) support the assessment.

As described in the Code Insights analysis:

“The visual and textual content confirms the document is a sophisticated phishing attack. It masquerades as an urgent payment demand from a German debt collection agency, supposedly on behalf of Amazon. The document employs high-pressure tactics, including threats of legal action, additional fees, and credit score damage, to compel the recipient to act quickly. The primary and most conclusive indicator of fraud is the demand for payment to a Bulgarian bank account, which is a stark and highly irregular contradiction to the agency's purported German location and registration.”

This is a case where AI adds value by reasoning over the content semantics, not the file structure.

Case 2 - QR-based phishing (quishing) campaign

This is another real-world PDF captured during early testing of Code Insights. At the time of analysis, no antivirus or malware detection engines flagged the file as malicious. The PDF has no embedded scripts, exploits, or execution logic. From a technical perspective, it looks benign.

259e202847d04866acd76427f53bfd9a15372ed6ed56a9e54ba1c62442c945ee

The visible content, however, impersonates an HR notification about a salary increase. It includes multiple social engineering red flags: awkward grammar, lack of personalization, and an irrelevant privacy disclaimer. The only call to action is a QR code, encouraging the recipient to scan it for more details.

Code Insights analyzed and decoded the QR, extracting the hidden URL. The domain is non-corporate and clearly unrelated to HR or payroll systems. The combination of deceptive HR messaging with a QR code that conceals a phishing URL confirms the document is a credential harvesting fraud delivered via PDF.

Case 3 - Vishing via fake PayPal alert

This is another real-world PDF flagged by Code Insights during early evaluation. No antivirus or malware detection engines classified the file as malicious. Structurally, it’s simple and inert: there are no scripts, automatic actions, or embedded links. Minor stream decoding errors are present but considered low-risk anomalies.

d0bedc70085efff5218b901cdaba95d565df867495181544041ba4b8a6019cea

The threat lies entirely in the content. The document impersonates PayPal and trusted brands like Visa to deliver a fake security alert about a high-value unauthorized purchase. The language is urgent and designed to induce panic.

According to Code Insights:

“[...]the visual content of the document is a clear social engineering lure designed for a voice phishing (vishing) attack. [...] The document's sole purpose is to persuade the user to call a specific phone number under the pretense of canceling the fraudulent order. The malicious nature is confirmed by several red flags, including an awkwardly phrased greeting and a phone number with a geographic area code (808) that is deceptively labeled as "Toll-Free." This tactic aims to route the victim to a scammer for social engineering and potential fraud.”

Case 4 - Fake Tax Refund from the Australian Taxation Office

As with previous cases, this PDF wasn’t flagged by any antivirus engine in VirusTotal, but Code Insights identified it as a phishing lure that impersonates the Australian Taxation Office.

b9b763e4b091bc59e9b9f355617622dbabdc1ff2de6707a94ccb26aa7682300e

As described by Code Insights:

“This document is a phishing lure designed to impersonate the Australian Taxation Office (ATO). The visual layer uses an authentic-looking government logo and the promise of a tax refund to entice the recipient into clicking an "Access Document" button. The purpose is to have the user provide an electronic signature for a supposed refund authorization, creating a sense of urgency and financial incentive. The document exhibits multiple red flags common to phishing attacks. These include a generic greeting, a suspicious reference to a .doc file (a common malware vector), instructions that discourage direct replies, and a complete lack of legitimate contact information or alternative methods for verification. The entire premise relies on tricking the user into clicking the button, which likely leads to a malicious website for credential theft or malware download.”

Auto-executing PDF Posing as a Movie Download

Unlike previous examples, this PDF was flagged by 13 antivirus engines in VirusTotal. In this case, the attack is embedded both in the internal structure of the file and its visual appearance. Code Insights correlates these two layers, the technical and the social, to expose the malicious intent.

44e653fe79d1ab160c784c06f4d99def6419e379ef3f802af9f48d595976d2c7

As described by Code Insights:

“The document presents a social engineering lure, masquerading as a download page for pirated movies […] to entice users into clicking links. This theme, centered on illegal content distribution, is a common tactic for malware delivery. Technical analysis of the PDF's internal structure corroborates the malicious intent. The file is configured with an /OpenAction command, a high-risk feature designed to automatically execute an action upon the document being opened […] The combination of a deceptive, high-risk theme with an automatic execution function indicates that the document’s purpose is to compromise the user's system.”

We are actively improving Code Insight based on what we learn from these early cases. PDF is the 6th most common file type submitted to VirusTotal, with around 100,000 new samples uploaded every day. That volume requires us to be strategic: for now, only a selected percentage of PDF files submitted via the public web interface are processed by Code Insight, as we test, tune, and scale the system.

These first results are helping us refine both effectiveness and performance. We’ll continue expanding coverage as we improve detection of threats.

When we launched Code Insight, we started by analyzing PowerShell scripts. Since then, we have been continuously expanding its capabilities to cover more file types. Today, we announce that Code Insight can now analyze a broader range of formats crucial to the software supply chain. This includes browser extensions (CRX for Chrome, XPI for Firefox, VSIX for VS Code), software packages (Python Wheel, NPM), and protocols like MCP that enable Large Language Models to interact with external tools.

Attackers are increasingly targeting these formats to distribute malware, steal data, or compromise systems. Traditional detection methods, which often rely on signatures or machine learning focused on classification, can struggle to keep up with the dynamic and obfuscated nature of these threats. This is where AI can make a real difference. By analyzing the underlying code logic, Code Insight can identify malicious behavior even in previously unseen threats, providing a deeper level of security analysis.

This is particularly relevant in a landscape where even a single malicious browser extension can lead to significant data breaches, financial loss, or the compromise of corporate networks.

A Viral Tweet and a Real-World Example

In the last few hours, a tweet from a seasoned crypto user (zak.eth) went viral, narrating how his wallet was drained by a malicious extension for the first time in over ten years of activity. This incident is a stark reminder that anyone can be a target.

This is a prime example of where Code Insight can be instrumental. It can analyze one of the suspicious extensions mentioned in the thread and reveal its malicious nature:

From here, we will explore different examples of the new formats supported by Code Insight and specific examples where traditional engines fail to detect a threat.

CRX (Chrome Extensions)

CRX files are the format used for packaging Google Chrome browser extensions. While they can enhance browsing, they also represent an attack vector if they contain malicious code. Here is an example of a seemingly legitimate "Norton Safe Search" extension. However, Code Insight's analysis reveals its true, malicious purpose:

6ca4466baf5ff09bab90a5d06bf113667717400daa59a287393e8f3f10959aba

The extension is obfuscated to hide its true purpose. The code in js/background.js communicates with a command and control (C2) server located at a domain unrelated to Norton. The most critical malicious behavior is its capability to fetch and execute arbitrary code from the C2 server. This allows the attacker to dynamically change the extension's functionality after installation, effectively turning the user's browser into a bot.

In another case, a banking trojan targeting Westpac customers was identified:

34244257f633e104d06b0c4273caca96eb916d26540eeea68495707cbc920bdb

This extension is a banking trojan specifically targeting Westpac customers. It operates as a Man-in-the-Browser (MitB) malware to steal credentials, session data, and funds. It establishes a persistent WebSocket connection to a hardcoded C2 server, collects all cookies from the browser and intercepts form submissions, specifically targeting the input field for the 'AuthorisationCode' (a 2FA/OTP token).

VSIX (Visual Studio Code Extensions)

VSIX files are used for extensions in Visual Studio Code, a popular code editor. Developers can be targeted through these extensions, potentially compromising their development environment and projects.

A deceptive "Zoom" extension for VS Code was found to be stealing user data:

5c89ba9e1bbb7ef869e4553081a40cabbd91a70506d759fd4e97eefb0434c074

The extension attempts to access sensitive user data by reading browser cookies from a known local SQLite database file. It also includes functionality to make external network requests to an unusual domain. which could be used to exfiltrate the collected sensitive data. This combination of local data collection and external communication is an indicator of malicious intent, specifically information theft.

XPI (Firefox Extensions)

XPI files are used for Firefox browser add-ons. Similar to Chrome extensions, they can be used to distribute malware.

A "Mass Tiktok Video Downloader" extension was found to be a phishing and data exfiltration tool:

2c0c8bd05a4942b389feaeb02c372b6443efac9d0931e0bdc602474178b54e7f

It presents a fake Facebook password confirmation popup to phish user credentials. Concurrently, its background script actively collects all browser cookies. All collected data, including the phished passwords, are exfiltrated to a Telegram bot API endpoint.

WHL (Python Wheel)

WHL files are a standard for distributing Python packages. The threats in these examples are not limited to intentionally malicious code, it also includes packages with critical vulnerabilities or insecure coding patterns that can be exploited in supply chain attacks.

An "hh-applicant-tool" designed to interact with an API was found to have a suspicious telemetry feature:

1a168e47cb2d81f54fe504e66e353251a772164959ec71517d2070bf96fee957

It collects data, including vacancy details, employer information, and Google Docs links found in messages, and sends it to a custom server. This communication explicitly disables SSL certificate verification (verify=False), making the data transfer vulnerable to Man-in-the-Middle attacks.

In another instance, a package named "ncatbot" contained a critical security vulnerability:

f2714f6b87689c4d631a587813d14c4e463be7251bf16ff383ad2b7940ca7a4d

A critical security vulnerability exists in the Linux installation process, which executes a remote script with root privileges using curl | sudo bash. This allows for arbitrary code execution and system compromise if the remote script is malicious or its source is compromised.

NPM (Node Package Manager)

NPM is the default package manager for Node.js and is central to the JavaScript ecosystem. Malicious NPM packages are a constant threat to developers and applications.

A package named "serverless-shop-functions" presented as a benign e-commerce application but contained two malicious Python scripts:

8f7a061901c935493e17f3f897a2b98b5ab21350593fda10a6936a84db5b28b7

Backdoor.Python.PolymorphNecro.h is identified as a polymorphic IRC botnet client. Its capabilities include: network sniffing, ARP poisoning, various DDoS attack methods. Main.py is a Discord-controlled Remote Access Trojan (RAT) with extensive capabilities, including: establishing persistence, executing arbitrary PowerShell commands, capturing and exfiltrating screenshots and webcam photos.

PyPI (Python Package Index)

PyPI is the official third-party software repository for Python. It's a common target for attackers looking to distribute malicious packages. However, the threat also comes from packages that, while not intentionally malicious, contain critical vulnerabilities in their design.

A package named python-mcp-client was found to have severe vulnerabilities allowing for remote code execution:

83c4c8d38e3eea555666e26ed85953b7479d46d9b4d2c12c521ae5f505b343d2

The package exposes severe vulnerabilities that allow for remote code execution (RCE) and arbitrary file system operations. The flask_app.py component allows users to dynamically add new MCP servers via the /api/add_server endpoint. This endpoint directly accepts user-provided command and args parameters, enabling an attacker to execute arbitrary shell commands on the host system.

By expanding Code Insight's capabilities, we aim to provide the cybersecurity community with a tool to better understand and mitigate the evolving threats within the software supply chain. Stay tuned as we continue to enhance our platform to counter new attack vectors.

Short note for everyone who already lives and breathes YARA:

Victor (aka plusvic) just launched YARA-X 1.0.0. Full details: https://virustotal.github.io/yara-x/blog/yara-x-is-stable/

What changes for you

Why move now

• Performance – heavy rules (large regex, deep loops) finish seconds faster.
• Safety – Rust core avoids the usual memory bugs and makes crashes rare.
• Maintainability – parser and scanner are decoupled; easier to embed or extend.
• Better tooling – built-in formatter (yara-x fmt), linter-friendly output.
• Active roadmap – new language features will go to YARA-X only.

We already use YARA-X at VirusTotal for Livehunt and Retrohunt. Billions of files later, it behaves.

Give it a spin, report issues, and send feedback our way. Huge thanks to Victor for pushing the project this far. Let’s keep making pattern matching simpler and faster

Spoiler: VirusTotal Code Insight’s preliminary audit flagged nearly 8% of MCP (Model Context Protocol) servers on GitHub as potentially forged for evil, though the sad truth is, bad intentions aren’t required to follow bad practices and publish code with critical vulnerabilities.

Before we get started, a quick personal note. A couple of weeks ago, I announced at Google that I’m stepping away from my role as a manager of managers and getting back to my roots, focusing on the VirusTotal community. And I’m not doing it alone. I’m joined by some legendary names from the project’s early days, like Julio, the very first VirusTotal developer and Víctor, creator of YARA and YARA-X. In this new chapter, we’re going deep into AI, not just evolving VT and using it to analyze typical threats but also to hunt down the new ones riding the AI wave, like malicious models and MCPs among others.

As many of you already know, MCP (Model Context Protocol) is a simple but powerful standard that lets large language models interact with external tools and APIs via JSON-RPC. Think of it as a universal adapter, MCP turns scripts, services, and data sources into callable functions that models like Claude, GPT or Gemini can use to answer complex queries or automate tasks. In just a few months, MCP has gone from niche to near-standard with native support across most major LLM platforms.

Before building and releasing our own MCP server for VirusTotal (which is coming very soon) we wanted to take a step back and understand how this protocol is being used in the wild. Specifically: are people already abusing it to build malicious plugins? And if so, how could we detect and classify these threats inside VT?

With that in mind, I set out to run a quick three-phase experiment (aka three humble python scripts). First, a harvesting phase to collect as many GitHub projects as possible by querying the API for MCP-related keywords like “model-context-protocol”, “server_mcp” or “define_mcp_tool”, among others. Then came a filtering step to isolate the interesting repos, not everything with "MCP" in the README is a real server implementation, so I built a scoring system to identify true servers based on dependency files, import statements, keywords in code, presence of mcp.json, and more. After applying that filter, we ended up with a focused dataset of 17,845 likely MCP server projects.

Finally, as the third phase, we ran a security review using VT Code Insight powered by Gemini 2.5 Flash and taking advantage of its 1-million token context window, speed, and code analysis skills to evaluate each project as a whole. We asked Code Insight for a basic verdict and to flag any High, Medium, or Low vulnerabilities. But after just a few hundred analyses we had to hit pause, Code Insight was surfacing so many issues that the results quickly became overwhelming. So we tightened things up with a second and more focused prompt, asking Code Insight to look specifically for signs of intentional malicious behavior along with reasoning that supported a conclusion of malice.

We let the new prompt run on the full dataset and Code Insight got to work. In the end, it marked 1,408 repositories as likely designed to be malicious. After checking some of these results by hand, two things were clear to me. First: there are many possible attack vectors that can be used through an MCP server. And second: Code Insight seems to trust human developers too much, it often assumes that some bad practices and the resulting critical bugs couldn’t be accidental.

“This pattern—creating a powerful, remotely triggerable code execution vulnerability and simultaneously preparing a collection of sensitive data (including data not needed for normal operation)—is characteristic of an intentional backdoor designed for data exfiltration and system compromise. The dynamic tool generation serves as a plausible cover for the unsafe use of `exec`.” Oh, Code Insight… if only you knew the kind of chaos vibe coding is causing. We’re going to be very busy in cybersecurity cleaning up after these accidental masterpieces

We’ve confirmed some of the flagged projects were just proof-of-concepts and security researcher demos, and many tiny “hello-world” examples were missing basic security features which Code Insight called out as “likely malicious”, because no sane developer would ship that to production. But even if you filter out the hobby projects, there’s still a scary amount of real attack vectors and critical vulnerabilities out there.

While we continue manually reviewing Code Insight’s reports to learn more about the issues and weak spots it uncovered, we also asked Gemini 2.5 Flash to help us categorize them. We provided it with the problem summaries from the 1,408 MCP-related repositories flagged as potentially problematic, and asked for a simple list, just a brief enumeration of the attack techniques involved. Gemini came back with the following list:

If you're building or defending around MCPs, there are a few quick wins to keep things safer:

• treat MCP servers like browser extensions (sign, hash, and pin specific versions)
• isolate them in containers or WASM sandboxes with strict file and network limits
• make permissions visible and revocable through a clear, zero-trust-style UI
• and never let model outputs go unfiltered, strip out sneaky stuff like invisible characters, HTML comments, or rogue script tags before looping anything back into your LLM.

MCPs are growing fast (almost 18,000 servers already in the wild), and with that growth comes a mountain of security debt. The good news? We’ll soon be launching a dedicated feature in VirusTotal to analyze MCP servers.
Stay tuned… we’re just getting started

At VirusTotal, we're constantly exploring new ways to make threat intelligence more digestible and available to a wider audience. Our latest effort leverages the power of AI to create easily understood audio discussions from technical information.

Using Google NotebookLM's innovative Audio Overview feature, we're transforming technical content into accessible audio experiences to make threat intelligence engaging and understandable for everyone. Instead of just reading, now you can listen and learn about complex cybersecurity concepts, no matter your level of expertise.

Our first AI-generated conversation is based on two blog posts (1, 2) where we previously discussed how Google's Gemini AI is being utilized for analyzing suspicious binaries. It's a meta experience, to be sure: Gemini, discussing its own role in analyzing malware. Listen to the full conversation below:

This initial experiment highlights how AI can make complex technical content more engaging and accessible. We are exploring the potential of incorporating similar AI-generated conversations into all future blog posts, providing another way to unpack and discuss the information we share. Stay tuned!

Hi Everyone,

We can hardly believe it, but VirusTotal is turning 20 on June 1st! As we sit down to write this, we’re filled with a mix of pride and gratitude. It's been an incredible journey, and we wouldn't be here without the amazing community that has supported us every step of the way.

When we started VirusTotal, our goal was simple: to help make the internet a safer place. We never imagined that two decades later, we'd be here celebrating this milestone with all of you. From the early days to now, it's always been about working together. Whether you're a user, a contributor, or a supporter, you've played a crucial role in our success.

Over the years, we've had the privilege of collaborating with some of the brightest minds in cybersecurity. We've received support and guidance from industry leaders who believed in our mission and helped us grow. To mark this special occasion, we reached out to a few of these key figures to share their thoughts and memories about VirusTotal. Their testimonials highlight the power of community and collaboration:

"VirusTotal has consistently tackled tough challenges in cybersecurity. By assisting them with detailed analyses and organizing the first-ever VirusTotal training in Japan, I've seen their impact firsthand. Celebrating their integration into Google's parent company was a milestone. As VirusTotal marks 20 years, it's clear they've become essential for detecting malware and supporting cyber threat intelligence. Their contributions are invaluable to security personnel. I hope the younger generation continues this vital work, ensuring VirusTotal thrives for another 20 years."

Adrian Hendrik (unixfreaxjp), Cyber Emergency Center of LACERT, Japan

"It’s difficult to think of a project that has had a greater impact on our industry than VirusTotal. I believe its success rests on three key pillars: providing easy access to top antivirus engines for users, enabling researchers to efficiently use YARA for pivoting, and the incredible dedication and passion of its team. On this 20th anniversary, happy birthday to VirusTotal and to everyone who has worked tirelessly to make this dream a reality! Cheers also to all who rely on VirusTotal daily for their work! Analizar, siempre!"

Costin G. Raiu, Independent security researcher

“I've been using both VirusTotal and YARA since their early days. Over the past 12 years, I've written more than 18,000 YARA rules, greatly aided by the features and capabilities of VirusTotal. Today, I consider VirusTotal an indispensable tool for the cybersecurity community. We rely on it to track threat actors, connect the dots, uncover new undetected malware, quality test our detections, and discover related and still unnoticed threats. VirusTotal stands as one of the central pillars of the cybersecurity toolset, if not the most important one.”

Florian Roth, VP R&D at Nextron Systems

“VirusTotal has become a vital asset for cybersecurity defenders globally, providing essential insights that accelerate detection and response. At CrowdStrike, we are proud to have been the first to integrate our NGAV technology with VirusTotal, reflecting our shared commitment to innovation and security. By harnessing collective intelligence, VirusTotal has significantly elevated cybersecurity standards, ensuring a safer digital environment for all. Congratulations on this remarkable milestone and thank you for your dedication to supporting the security community and protecting organizations worldwide.”

George Kurtz, President/CEO and co-founder of CrowdStrike

“For two decades, VirusTotal has maintained an unwavering commitment to partnering across the community, creating transparency around the tools that threat actors are using to undermine global safety. They have had a meaningful impact on countless individuals and organizations, uplifting security teams across the planet, in a challenging asymmetric threat landscape. Thank you for all that you've done for Google, and the world.”

Heather Adkins, VP/Fellow, Security Engineering at Google

“When the first multi-scanner systems went online, we could not have imagined how quickly a simple way to get multiple scanner opinions would become a substantial building block for our daily malware analysis work. VirusTotal's amazing and comprehensive analyses have not only become an indispensable part of our analyzer work but have also become an essential building block for our threat intelligence services.”

Joe Pichlmayr, CEO at IKARUS

“Yara cut the gordian knot paralyzing information sharing. It gave defenders a way to share detection when they could not share samples. VirusTotal sped up global defense by providing a common hunting ground containing the world’s more important threats.”

John Lambert, Corporate Vice President and Security Fellow, Microsoft

“Over the past 20 years, VirusTotal, or VT to most of us, has evolved from a simple multi-scanner to a key source of security intelligence. It is relied on by security companies as well as security professionals. Beyond that, VT has been a reliable partner from the very beginning. They have always been ready and willing to add features and APIs to make using their services and integrating it into both products and workflows easier. The vast wealth of data analytics and historical data on files and families, has permanently stitched VT into the fabric of security intelligence. I cannot wait to see what the next 20 years of innovation will produce. Congratulations on the first 20 years!”

Mark Kennedy, Distinguished Engineer Broadcom, AMTSO Chair

“Microsoft believes security is a team sport and the integration of SysInternals with VirusTotal has made it easier to analyze malware and share those results to improve security for all. In addition, Microsoft Defender XDR uses VirusTotal reports as an accurate threat intelligence source, and VirusTotal uses detections from Microsoft Defender antivirus as a primary source of detection”

Mark Russinovich, Azure CTO and Technical Fellow, Microsoft

"VirusTotal was a real gamechanger. In addition of building a technical platform, it also built a community. Thank You for your work!"

Mikko Hyppönen, Technology speaker and author. CRO at WithSecure

"Reflecting on VirusTotal's 20th anniversary, I still remember the launch of their URL scan service back in 2010 and early collaborations with Google Safe Browsing and Chrome. We all had an aligned mission to make the web a safer place for everyone. Twenty years in, lots of progress to be proud of protecting people around the world, and our work continues!"

Parisa Tabriz, VP/GM Chrome & Google Security Princess

“Since the earliest days of TAG in 2010, VirusTotal and the team have been a critical partner helping us to defend Google, Google users and the world. We all owe a huge debt to all this team has done and how they have provided so much to the community of those fighting against online threats.”

Shane Huntley, Sr Director Google Threat Intel and cofounder of TAG

One of the things we’re most proud of is how VirusTotal has always been a team effort. From our dedicated staff to our passionate users, everyone has contributed in their own way. It's this collective effort that has allowed us to innovate, evolve, and stay ahead of the ever-changing threat landscape.

What's Next?

We'd love to hear your stories! Share your favorite memories or how VirusTotal has impacted your work on Twitter/X, LinkedIn, and other social networks with the hashtag #VirusTotal20Years. We'll be collecting the best stories and sending some cool swag to the top contributors. Stay tuned for more exciting announcements, events, and blog posts about some behind-the-scenes stories from our early days and key milestones in our history throughout our anniversary year!

As we look to the future, we remain committed to our mission. There's still a lot of work to be done, and we know we can't do it alone. We're counting on your continued support, feedback, and collaboration to keep pushing the boundaries and making the digital world safer for everyone.

Thank you for being a part of our journey. Here's to many more years of working together to fight cyber threats and protect our digital lives.

Best regards,

The VirusTotal Founding Team

From left to right:

• Julio Canto: Wrote the very first lines of code for VT and launched the first version, still in charge of adding all the new engines and tools we use.
• Alejandro Bermúdez: The mastermind behind how our analyzer farm works. He keeps everything running smoothly to this day.
• Francisco Santos: Started out designing our very first website, databases, and all those storage systems we rely on. Now he leads the backend analysis team.
• Bernardo Quintero: Had the initial idea for VT (blame him if anything breaks!) and now focuses on using AI to make threat analysis even smarter.
• Victor Manuel Alvarez: Gave the world YARA, helped design VT Intelligence and Hunting, and just recently announced YARA-X.
• Emiliano Martínez: If you've used our VT API, that's Emiliano's work. He's also a co-designer of VT Intelligence and currently keeps everything running as our Product Manager.