Crowdsourced Security Intelligence
Joined May 2010
- Tweets397
- Following2
- Followers33.1K
- Likes32
Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), a leak before the patch and millions of PHP servers on the Internet. We used VirusTotal Internet Scanning to measure who is exposed, what they run and how to cut the window:
blog.virustotal.com/2026/10/…
VirusTotal retweeted
How Some Malicious AI Skills Hide Instructions from Human Reviewers
* Whitespace padding
* HTML comments
* Invisible Unicode
blog.virustotal.com/2026/10/…
VirusTotal retweeted
YARA-X v1.22.0 is out! github.com/VirusTotal/yara-x…
VirusTotal retweeted
VirusTotal is now available in ChatGPT
Scan files, URLs, and domains for potential threats, right from your chat
chatgpt.com/plugins/plugin_a…
Internet Scanning in VirusTotal: hunting infrastructure by what it exposes
blog.virustotal.com/2026/10/…
From Automation to Infection (Part III): Naming, Measuring, and Detecting Malicious AI Agent Skills
blog.virustotal.com/2026/10/…
Crowdsourced AI += Knostic
Knostic joins VirusTotal Crowdsourced AI, bringing specialized analysis of VS Code extensions (.VSIX) to help identify supply chain risks and improve developer security
blog.virustotal.com/2026/06/…
🤖 Made with AI
VirusTotal Inside the Agent Loop
VT-community plugins for OpenClaw and Hermes agent
more info:
blog.virustotal.com/2026/04/…
Reverse Shells, Semantic Worms, and Cognitive Rootkits in OpenClaw Skills
Five techniques, five skills, and five ways automation turns into access in AI agents.
blog.virustotal.com/2026/02/…
From Automation to Infection: How OpenClaw AI Agent Skills Are Being Weaponized
Over the last few days, VirusTotal has detected hundreds of OpenClaw skills that are actively malicious.
blog.virustotal.com/2026/02/…
Dive into the latest threat hunting techniques with our #VTPRACTITIONERS series! We've partnered with @Acronis TRU to share insights on tracking FileFix, SideWinder, and the Shadow Vector.
Check out the full post: blog.virustotal.com/2025/11/…
VirusTotal retweeted
How VT Code Insight + Binary Ninja use AI to scan Apple binaries at scale, catch undetected Mac/iOS malware, and reduce false positives. No metadata, just code.
blog.virustotal.com/2025/11/…
How VT Code Insight + Binary Ninja use AI to scan Apple binaries at scale, catch undetected Mac/iOS malware, and reduce false positives. No metadata, just code.
blog.virustotal.com/2025/11/…
#MonthOfVTSearch reminder!
VT Enterprise web searches don’t consume quota in November.
Day 2: A VT search a day keeps phishing away 🎯
entity:domain fuzzy_domain:netflix.com and not domain:netflix.com creation_date:90d+
#MonthOfVTSearch is live!
GUI searches are quota-free all month for VirusTotal customers.
Day 1: Hunting Gamaredon-related document activity.
Follow along. One search per day. Try it, pivot, and share your results.
We’re thrilled to share our new collab with @huggingface , check out how we’re teaming up to boost AI safety and threat intel
blog.virustotal.com/2025/10/…
Simpler Access for a Stronger VirusTotal
We’re simplifying access to VirusTotal with clearer tiers and flexible options, keeping the platform open, collaborative, and built around our contributors.
Read more:
blog.virustotal.com/2025/10/…
Crowdsourced AI += Exodia Labs
We’re adding a new specialist to VirusTotal’s Crowdsourced AI lineup: Exodia Labs, with an AI engine focused on analyzing Chrome extension (.CRX) files.
blog.virustotal.com/2025/10/…
VirusTotal retweeted
detected and explained by VirusTotal Code Insight
🚨 There’s a large-scale supply chain attack in progress: the NPM account of a reputable developer has been compromised. The affected packages have already been downloaded over 1 billion times, meaning the entire JavaScript ecosystem may be at risk.
The malicious payload works by silently swapping crypto addresses on the fly to steal funds.
If you use a hardware wallet, pay attention to every transaction before signing and you're safe.
If you don’t use a hardware wallet, refrain from making any on-chain transactions for now.
It’s still unclear whether the attacker is also stealing seeds from software wallets directly at this stage.
Excellent report here: jdstaerk.substack.com/p/we-j…