# VirusTotal

VirusTotal is a service that aggregates antivirus and URL/domain analysis and provides a programmatic API for submitting items and accessing scan reports.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution

DevFeed: [The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](<https://devfeed.tech/articles/the-state-of-ai-enabled-malware-august-2026-from-brand-abuse-to-agentic-execution-7744.md>)

Original publisher: [Read original article](<https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/>)

Author: Sara McBroom

Published: 2026-08-25T10:00:57Z

Content type: article

Language: en

Sources: [Unit 42](<https://devfeed.tech/sources/unit-42.md>)

Topics: [Malware](<https://devfeed.tech/topics/malware.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [Security](<https://devfeed.tech/topics/security.md>), [Endpoint Security & XDR](<https://devfeed.tech/topics/endpoint-security-xdr.md>), [VirusTotal](<https://devfeed.tech/topics/virustotal.md>), [dataset](<https://devfeed.tech/topics/dataset.md>), [data](<https://devfeed.tech/topics/data.md>), [ChatGPT](<https://devfeed.tech/topics/chatgpt.md>), [ransomware](<https://devfeed.tech/topics/ransomware.md>), [Cryptocurrency](<https://devfeed.tech/topics/cryptocurrency.md>)

Tags: [agentic](<https://devfeed.tech/tags/agentic.md>), [ai](<https://devfeed.tech/tags/ai.md>), [analysis](<https://devfeed.tech/tags/analysis.md>), [article](<https://devfeed.tech/tags/article.md>), [backdoor](<https://devfeed.tech/tags/backdoor.md>), [bitcoin](<https://devfeed.tech/tags/bitcoin.md>), [code](<https://devfeed.tech/tags/code.md>), [cryptocurrency](<https://devfeed.tech/tags/cryptocurrency.md>), [data](<https://devfeed.tech/tags/data.md>), [dll-hijacking](<https://devfeed.tech/tags/dll-hijacking.md>), [malware](<https://devfeed.tech/tags/malware.md>), [ransomware](<https://devfeed.tech/tags/ransomware.md>), [research](<https://devfeed.tech/tags/research.md>), [sandbox](<https://devfeed.tech/tags/sandbox.md>), [security](<https://devfeed.tech/tags/security.md>), [threat-research](<https://devfeed.tech/tags/threat-research.md>), [virustotal](<https://devfeed.tech/tags/virustotal.md>)

### AI overview

Unit 42 analyzes 405 malware samples incorporating AI through mechanisms such as brand impersonation, LLM-generated code, and agentic execution loops. The research finds that most samples remain proof-of-concept or sandbox activity, while existing behavioral detection, cloud sandboxing, and endpoint analytics can detect the threats that reach operational environments.

### Source excerpt

Explore Unit 42 research on AI-enabled malware. Learn how existing behavioral detection and endpoint analytics stop AI-authored code before execution. The post The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution appeared first on Unit 42.

## Behind the console: An AiTM phishing kit harvesting AWS console credentials and beyond

DevFeed: [Behind the console: An AiTM phishing kit harvesting AWS console credentials and beyond](<https://devfeed.tech/articles/behind-the-console-an-aitm-phishing-kit-harvesting-aws-console-credentials-and-beyond-8279.md>)

Original publisher: [Read original article](<https://securitylabs.datadoghq.com/articles/behind-the-console-aws-aitm-phishing-kit-and-beyond/>)

Author: Datadog

Published: 2026-06-24T00:00:00Z

Content type: article

Language: en

Sources: [Datadog Security Labs](<https://devfeed.tech/sources/datadog-security-labs.md>)

Topics: [Adversary-in-the-middle (AiTM)](<https://devfeed.tech/topics/adversary-in-the-middle-aitm.md>), [Amazon Web Services](<https://devfeed.tech/topics/aws.md>), [Security](<https://devfeed.tech/topics/security.md>), [MFA](<https://devfeed.tech/topics/mfa.md>), [Cloudflare](<https://devfeed.tech/topics/cloudflare.md>), [JavaScript](<https://devfeed.tech/topics/javascript.md>), [VirusTotal](<https://devfeed.tech/topics/virustotal.md>), [Batch file](<https://devfeed.tech/topics/batch-file.md>), [cURL](<https://devfeed.tech/topics/curl.md>), [Amazon Route 53](<https://devfeed.tech/topics/amazon-route-53.md>)

Tags: [adversary-in-the-middle-aitm](<https://devfeed.tech/tags/adversary-in-the-middle-aitm.md>), [aws](<https://devfeed.tech/tags/aws.md>), [batch](<https://devfeed.tech/tags/batch.md>), [cloudflare](<https://devfeed.tech/tags/cloudflare.md>), [dns](<https://devfeed.tech/tags/dns.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [mfa](<https://devfeed.tech/tags/mfa.md>), [security](<https://devfeed.tech/tags/security.md>), [virustotal](<https://devfeed.tech/tags/virustotal.md>)

### AI overview

Datadog Security Research analyzes a June 2026 campaign using cloned AWS console login pages and adversary-in-the-middle techniques to harvest credentials and MFA codes. The article details the phishing infrastructure, delivery methods, VirusTotal artifact, and JavaScript-based credential-harvesting flow.

### Source excerpt

Datadog Security Research investigates a June 2026 adversary-in-the-middle phishing campaign that cloned the AWS console login page to harvest victim credentials and multi-factor authentication codes.

## Backdoored Cemu release linked to TanStack and Mistral supply chain campaign

DevFeed: [Backdoored Cemu release linked to TanStack and Mistral supply chain campaign](<https://devfeed.tech/articles/backdoored-cemu-release-linked-to-tanstack-and-mistral-supply-chain-campaign-8277.md>)

Original publisher: [Read original article](<https://securitylabs.datadoghq.com/articles/backdoored-cemu-release-teampcp-supply-chain-campaign/>)

Author: Martin McCloskey, Sebastian Obregoso, Rory McCune

Published: 2026-05-14T00:00:00Z

Content type: article

Language: en

Sources: [Datadog Security Labs](<https://devfeed.tech/sources/datadog-security-labs.md>)

Topics: [GitHub](<https://devfeed.tech/topics/github.md>), [npm](<https://devfeed.tech/topics/npm.md>), [Python](<https://devfeed.tech/topics/python.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [VirusTotal](<https://devfeed.tech/topics/virustotal.md>), [payload](<https://devfeed.tech/topics/payload.md>), [REST API](<https://devfeed.tech/topics/rest-api.md>), [releases](<https://devfeed.tech/topics/releases.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [github](<https://devfeed.tech/tags/github.md>), [linux](<https://devfeed.tech/tags/linux.md>), [payload](<https://devfeed.tech/tags/payload.md>), [python](<https://devfeed.tech/tags/python.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [virustotal](<https://devfeed.tech/tags/virustotal.md>)

### AI overview

A coordinated supply chain campaign compromised npm and PyPI packages and backdoored the official Cemu GitHub release. The malicious Linux AppImage reached nearly 20,000 users before detection, while investigation linked the payload across the affected ecosystems.

### Source excerpt

We investigate how a coordinated supply chain campaign that compromised npm and PyPI packages also backdoored the official Cemu Nintendo Wii U emulator GitHub release, reaching nearly 20,000 Linux users.

## Hugging Face and VirusTotal collaborate to strengthen AI security

DevFeed: [Hugging Face and VirusTotal collaborate to strengthen AI security](<https://devfeed.tech/articles/hugging-face-and-virustotal-collaborate-to-strengthen-ai-security-7557.md>)

Original publisher: [Read original article](<https://huggingface.co/blog/virustotal>)

Author: Adrien Carreira; Bernardo Quintero

Published: 2025-10-22T00:00:00Z

Content type: article

Language: en

Sources: [Hugging Face - Blog](<https://devfeed.tech/sources/hugging-face-blog.md>)

Topics: [hugging face](<https://devfeed.tech/topics/hugging-face.md>), [VirusTotal](<https://devfeed.tech/topics/virustotal.md>), [ai security](<https://devfeed.tech/topics/ai-security.md>), [Security](<https://devfeed.tech/topics/security.md>), [Open Source Models & Datasets](<https://devfeed.tech/topics/open-source-models-datasets.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>)

Tags: [ai-models](<https://devfeed.tech/tags/ai-models.md>), [ai-security](<https://devfeed.tech/tags/ai-security.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [hub](<https://devfeed.tech/tags/hub.md>), [hugging-face](<https://devfeed.tech/tags/hugging-face.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [partnerships](<https://devfeed.tech/tags/partnerships.md>), [security](<https://devfeed.tech/tags/security.md>), [virustotal](<https://devfeed.tech/tags/virustotal.md>)

### AI overview

Hugging Face and VirusTotal are collaborating to continuously scan public model and dataset repositories on the Hugging Face Hub. The integration checks file hashes against VirusTotal intelligence without sharing raw file contents, providing malware detections, threat relationships, and related campaign context. Organizations can also use the checks in CI/CD and deployment workflows to reduce the risk of distributing malicious assets.

### Source excerpt

We're on a journey to advance and democratize artificial intelligence through open source and open science.