Note: YARA-X v1.21.0 adds a parent_name field to the items in vt.behaviour.processes_list, and v1.22.0 adds ancestor_names. VirusTotal now fills that list…
Category: VirusTotal Blog
Process trees in Livehunt: YARA rules that know who launched what
Note: YARA-X v1.21.0 adds a parent_name field to the items in vt.behaviour.processes_list, and v1.22.0 adds ancestor_names. VirusTotal now fills that list…
Process trees in Livehunt: YARA rules that know who launched what
Note: YARA-X v1.21.0 adds a parent_name field to the items in vt.behaviour.processes_list, and v1.22.0 adds ancestor_names. VirusTotal now fills that list…
Sizing the PHP exposure window for CVE-2026-109618 and CVE-2026-109619 with VirusTotal
On October 20, the PHP security team announced an out-of-band security release for Wednesday, October 21, 2026 at 14:00 UTC , fixing two critical…
Sizing the PHP exposure window for CVE-2026-109618 and CVE-2026-109619 with VirusTotal
On October 20, the PHP security team announced an out-of-band security release for Wednesday, October 21, 2026 at 14:00 UTC , fixing two critical…
How Some Malicious AI Skills Hide Instructions from Reviewers
In Part III of our “From Automation to Infection” series (following Part I and Part II ), we analyzed 35,878 AI agent skills submitted to VirusTotal and…
Sizing the PHP exposure window for CVE-2026-109618 and CVE-2026-109619 with VirusTotal
On October 20, the PHP security team announced an out-of-band security release for Wednesday, October 21, 2026 at 14:00 UTC , fixing two critical…
How Some Malicious AI Skills Hide Instructions from Reviewers
In Part III of our “From Automation to Infection” series (following Part I and Part II ), we analyzed 35,878 AI agent skills submitted to VirusTotal and…
Introducing macOS Mirage: Next-Generation Apple Silicon Dynamic Analysis and Sigma Detections
In November 2015, we released our first in-house macOS sandbox, Box of Apples , followed by an update in March 2018 that introduced HTML behavior reports,…
Introducing macOS Mirage: Next-Generation Apple Silicon Dynamic Analysis and Sigma Detections
In November 2015, we released our first in-house macOS sandbox, Box of Apples , followed by an update in March 2018 that introduced HTML behavior reports,…
From Automation to Infection (Part III): Naming, Measuring, and Detecting Malicious AI Agent Skills
In Part I and Part II of this series, we looked at an initial sample of 3,016 AI agent skills and showed how they were becoming a new supply-chain…
Internet Scanning in VirusTotal: hunting infrastructure by what it exposes
Until now, an IP report in VirusTotal told you a lot about reputation, who hosts it, what resolves to it (passive DNS) and which files talk to it . It…
From Automation to Infection (Part III): Naming, Measuring, and Detecting Malicious AI Agent Skills
In Part I and Part II of this series, we looked at an initial sample of 3,016 AI agent skills and showed how they were becoming a new supply-chain…
Internet Scanning in VirusTotal: hunting infrastructure by what it exposes
Until now, an IP report in VirusTotal told you a lot about reputation, who hosts it, what resolves to it (passive DNS) and which files talk to it . It…
Enriched URL Reports: VirusTotal URL Scanning 2.0
Introduction In today’s fast-moving cybersecurity landscape, threat analysts must move beyond basic, binary reputation scores to successfully defend…
Enriched URL Reports: VirusTotal URL Scanning 2.0
Introduction In today’s fast-moving cybersecurity landscape, threat analysts must move beyond basic, binary reputation scores to successfully defend…
Crowdsourced AI += Knostic
We’re adding a new specialist to VirusTotal’s Crowdsourced AI lineup: Knostic‘s AgentMesh Agentic Security Supply Chain Reputation Engine. We are partnering with them to analyze Visual Studio Code extension (.VSIX) files. This complements our existing Code Insight and other AI…
VirusTotal Inside the Agent Loop
At VirusTotal, we are closely following how AI agents are evolving and how we can be useful in that space. Part of that is analysis: the new generation of AI-native artifacts (skills, plugins, IDE extensions, agent configs) that attackers are…
From Automation to Infection (Part II): Reverse Shells, Semantic Worms, and Cognitive Rootkits in OpenClaw Skills
In part one, we showed how OpenClaw skills are rapidly becoming a supply-chain delivery channel: third-party “automation” that runs with real system access. This second installment expands the taxonomy with five techniques VirusTotal is actively seeing abused through skills, spanning…
From Automation to Infection: How OpenClaw AI Agent Skills Are Being Weaponized
The fastest-growing personal AI agent ecosystem just became a new delivery channel for malware. Over the last few days, VirusTotal has detected hundreds of OpenClaw skills that are actively malicious. What started as an ecosystem for extending AI agents is…