@MsmCode

Malware analyst. Cofounder of @p4_team. No independent thought: ALL opinions belong to my employers, cats. and friends. [email protected] https://xitter.cf/t.co/AeZd6IJwQe

 https://msm.lt
tailcall.net
Joined February 2016
  • Tweets139
  • Following67
  • Followers1.7K
18Media
Finally, some easy to use software for local CA/PKI management🙏.
Michał Leszczyński@icedevmlApr 18
Now live: a GUI for Step CA that allows to visualize all issued certificates; it also allows to create "invitations" to easily onboard (even non-technical) people onto your private CA through a friendly web-based flow. GitHub icedevml/tinypki: github.com/icedevml/tinypki
6
437
We have just published a new blog article on the topic of ClickFix/fake CAPTCHA campaigns. Step-by-step overview of the infection, malware analysis, IoCs and YARA rules to help secure your own infrastructure. 🔗 cert.pl/en/posts/2026/02/fak…

ClickFix in action: how fake captcha can lead to a company-wide infection

We assisted a large organisation in the investigation and remediation of a live malware infection caused by a successful Fake Captcha attack. In this report, we summarize our observations and publish...

cert.pl
12
41
4,293
My short blog post on ClickFix threats (with focus on malware used in recent campaigns): cert.pl/en/posts/2026/02/fak…

ClickFix in action: how fake captcha can lead to a company-wide infection

We assisted a large organisation in the investigation and remediation of a live malware infection caused by a successful Fake Captcha attack. In this report, we summarize our observations and publish...

cert.pl
1
4
261
Logowanie do #KSeF z poziomu Pythona przez klucz zgodny z PKCS#11, np. podpis/pieczęć kwalifikowaną w formie karty, tokena USB albo HSMa. Umożliwia też hostowanie kluczy od certyfikatów wydanych przez KSeF w HSMie, albo kluczem na dysku w formacie PEM. github.com/icedevml/pyksef

GitHub - icedevml/pyksef: KSeF XAdES Authentication with PKCS#11 compatible private keys - Python...

KSeF XAdES Authentication with PKCS#11 compatible private keys - Python library - icedevml/pyksef

github.com
1
5
536
🔍 Have you tried monitoring certificate transparency logs lately and found existing tools or libraries disappointing? ✅ Fear not! We're releasing a better one, with tiled format support, async operations, state persistence and an easy-to-use API. 🔗 github.com/CERT-Polska/ct-mo…

GitHub - CERT-Polska/ct-moniteur: A Python library for monitoring Certificate Transparency (CT)...

A Python library for monitoring Certificate Transparency (CT) logs with support for both classic and modern tiled CT logs. Monitor all public CT logs with async operations, state persistence, and e...

github.com
10
2
40
5,000
My new post about #malware #deobfuscation - cert.pl/en/posts/2025/04/pee…. I focus on the simple - but powerful - technique of local substitutions. Uses #ghidra and ghidralib. Thx @nazywam for review.

Deobfuscation techniques: Peephole deobfuscation

In this article we describe a basic deobfuscation technique by leveraging a code snippet substitution.

cert.pl
1
7
18
1,239
I analyzed thousands of messages from 35+ suspected state-sponsored hacktivist groups using machine learning—uncovering hidden connections through writing styles, language and topics. After a year of research, here’s what we found and how we did it. 👇 research.checkpoint.com/2025… 1/
6
82
4
218
28,950
Ghidralib development continues: py3 support, binary/asm patching, and symbolic propagation: github.com/msm-code/ghidrali…. I also write docs for people who want to try it. Newest chapter: emulation msm-code.github.io/ghidralib… #ghidra #reverseengineering
1
17
1,207
RULECOMPILE - Undocumented Ghidra decompiler rule language. A blog post about how frustration with poor decompilation led me to dive deep into Ghidra's decompiler to discover (and reverse-engineer) - an obscure, undocumented DSL msm.lt/re/ghidra/rulecompile… #reverseengineering #ghidra
A image that shows a piece of code. On top there is an expression (param_1 & 1) * 2 + (param_1 ^ 1). On the bottom is a deobfuscated version, param_1 + 1. In the middle there is a custom Ghidra DSL, explained in the post.

ALT A image that shows a piece of code. On top there is an expression (param_1 & 1) * 2 + (param_1 ^ 1). On the bottom is a deobfuscated version, param_1 + 1. In the middle there is a custom Ghidra DSL, explained in the post.

2
12
1
38
2,115
🚀Excited to announce ghidralib - a library that makes #Ghidra scripts drastically shorter and easier to write. I've been using it daily for #reverseengineering and decided it’s time to share! Check it out: github.com/msm-code/ghidrali… And the docs: msm-code.github.io/ghidralib… #infosec
2
91
1
300
17,283
Hi #Ghidra users. I've created a quick search/command palette/launcher plugin called "Ctrl+P". You can search for functions, labels, data, bookmarks, focus windows, launch scripts and trigger available action. github.com/msm-code/GhidraCt… #reversing #reverseengineering #infosec
15
66
5,506
🚨 Uwaga na fałszywe reklamy na dużych platformach internetowych! Oszuści nadal skutecznie omijają mechanizmy weryfikacji, a platformy mają problem z ich powstrzymaniem. Jakie są rodzaje oszustw i dlaczego te mechanizmy zawodzą? 🤔 🔍➡️ cert.pl/posts/2024/11/Oszust…

Oszustwa reklamowe na dużych platformach internetowych

Sekretny sposób na zarabianie pieniędzy wyjawiony przez celebrytę, czy możliwość wzbogacenia się na rządowym programie inwestowania w spółki państwowe - takie informacje umieszczane przez oszustów w...

cert.pl
6
25
5
86
25,738
[PL] Oprócz Paged Out!, wypuściliśmy dzisiaj też wywiad z 𝗣𝗼𝗹𝗮𝗻𝗱 𝗖𝗮𝗻 𝗜𝗻𝘁𝗼 𝗦𝗽𝗮𝗰𝗲, tj. (@p4_team + @DragonSectorCTF + przyjaciele) o HACK-A-SAT 4: ↓↓↓ youtube.com/watch?v=9Gl8ZZDb… ↑↑↑
3
16
61
15,829
Slides (PL) from my yesterday's presentation at @OMHconf #ohmyhack are here: tailcall.net/static/talks/om…. I've talked a bit about my recent research about stealers in a - hopefully - approachable way.
4
17
1,825
I had the pleasure to conduct a 1.5 day #workshop about Threat Intel Pipelines and CTI to a room full of security experts during the #ITU Interregional #Cyberdrill for Europe and Asia-Pacific. I hope everyone had fun and maybe see you at the next Cyberdrill.
1
6
976
CERT Poland's Jarosław Jedynak has posted a detailed and technical description of the XWorm analysis process, including the unpacking. XWorm is a multi-purpose malware family, commonly used as a RAT. cert.pl/en/posts/2023/10/dew…
29
1
62
7,496
I wrote a detailed writeup about #XWorm #Malware reverse-engineering. The stealer itself is nothing fancy, but check it out if you're interested in dissecting malware step by step. And if not, hey I share some code and IoCs too. cert.pl/en/posts/2023/10/dew…

Malware stories: Deworming the XWorm

XWorm is a multi-purpose malware family, commonly used as RAT. This post contains a detailed analysis and walk-through the reverse-engineering process.

cert.pl
1
4
734
Finished my #flareon10 today! Fun fact: I used #Ghidra exclusively (no Ida) to solve almost all challenges (two exceptions: Android and PDP-11 Forth). It works great.
3
31
4,170
What's the first step of dynamically unpacking obfuscated .NET malware? Writing your own debugger, of course. A story of unpacking the recent .NET stealer campaign: cert.pl/en/posts/2023/09/unp…. (Going to start posting more writeups soon, stay tuned)

Unpacking what's packed: DotRunPeX analysis

When, what and why As a national CERT we analyse all kinds of incidents. Some of them involve widespread APT campaigns, othertimes we just focus on everyday threats. Recently we got notified about a...

cert.pl
1
23
1
76
11,980
Better documentation, YARA scanning limitation, easier scaling, better user roles. Those are only some of the changes introduced in mquery 1.4! Full list of changes is available on ⬇️ github.com/CERT-Polska/mquer…

Release Version 1.4 · CERT-Polska/mquery

Version 1.4 Breaking changes [Breaking change] mquery now users typedconfig library instead of the previous config.py file. if you deployed mquery using docker (configurable by environment variabl...

github.com
1
5
1
21
3,892
Load more