Comprehensive Collection of Malware Analysis and Development Books Released for Security Researchers
A curated selection of books on malware analysis and development has been assembled, covering techniques for both creating and defending against malicious software across Windows, macOS, and Android platforms.
The collection begins with MalDev Academy Complete, a modular course on Windows malware development and offensive security. It guides readers from foundational topics such as C programming, Windows internals, and WinAPI to advanced subjects including PE files, memory manipulation, payload encryption, obfuscation, process injection, APC injection, and shellcode execution.
Its companion, MalDev Academy Extended Modules, expands on the core curriculum with specialized modules on Rust implementations, enhanced evasion tactics, and practical exercises designed to test deeper understanding of malware techniques.
The Art of Mac Malware by Patrick Wardle offers a practical guide to analyzing macOS threats. It covers infection vectors, persistence mechanisms, Mach-O binary analysis, dynamic debugging, and anti-analysis bypasses, concluding with a detailed case study of the EvilQuest malware.
The second volume focuses on building heuristic detection systems for macOS using Endpoint Security frameworks and code signing analysis to reduce false positives.
The Android Malware Handbook examines Android threats through static and dynamic analysis, feature extraction, and machine learning models for classifying banking trojans, ransomware, and spyware.
Classic references include Malware Analyst’s Cookbook, which provides recipes for classification, unpacking, memory forensics with Volatility, and rootkit detection, as well as Practical Malware Analysis, a foundational text on setting up isolated labs, using IDA Pro and WinDbg, and defeating packers and anti-debugging tricks.
The roundup concludes with Evasive Malware by Kyle Cucci, a field guide dedicated to analyzing samples that deliberately evade sandboxes, disassemblers, and forensic tools through context awareness and anti-forensics methods.
Related articles
Armored Likho Expands Arsenal with BusySnake RAT and AI-Driven Malware Development
The cybercrime group Armored Likho has introduced a new multi-platform trojan called BusySnake RAT that targets Windows, Linux, and macOS systems. Researchers at Kaspersky Lab identified three distinct versions of the malware, evolving from a Python implementation using Telegram bots for command-and-control to a GitLab-based variant and finally a fully rewritten Go version. In addition to custom development, the group has incorporated the open-source Kharon RAT to facilitate remote access and data exfiltration. Armored Likho has also shifted its infrastructure to private GitHub and GitLab repositories to hinder analysis. Most notably, the group now leverages large language models not only for initial access but also to generate tools for persistence and post-exploitation activities. Kaspersky security products continue to detect and block activity linked to the group.
Microsoft Removes WMIC from Windows 11 After Years of Abuse as LOLBIN by Ransomware and Attackers
Microsoft has begun permanently removing the legacy WMIC command-line utility from Windows 11, starting with versions 24H2 and 25H2. The tool is no longer available in fresh installations, has been dropped as an optional component, and is absent from the latest beta builds. WMIC provided text-based access to Windows Management Instrumentation for querying hardware, processes, services, and security software, as well as performing administrative tasks. Although the underlying WMI technology remains untouched, Microsoft has deprecated the command shell due to its long-standing use as a LOLBIN in cyberattacks. Ransomware operators have leveraged WMIC to delete shadow copies and hinder recovery, while other attackers used it to enumerate and disable security tools or add exclusions in Microsoft Defender. Administrators are directed to migrate to PowerShell, COM API, .NET libraries, and modern scripting languages, which will require rewriting legacy automation scripts.
Octagon Malware-as-a-Service Platform Targets Android Banking Apps and Crypto Wallets for $1400 Monthly Subscription
Researchers at iVerify have uncovered the previously unknown Octagon platform, a malware-as-a-service offering sold by a Russian-speaking actor under the handle AndroidKitKat. The service first appeared on underground forums on June 1, 2026, with version 1.2 released by June 29, providing a ready-made control panel for account takeovers across banks, crypto exchanges, messengers, and wallets. Infection starts with a disguised APK that requests Accessibility Services permissions, after which the trojan can read UI elements, simulate taps, launch apps, and overlay phishing screens on services such as Trust Wallet, Binance, and MEXC. The malware also intercepts SMS one-time codes, spoofs the system lock screen to steal PINs or patterns, and supports VNC-style remote control while operating on the victim’s own device to evade anti-fraud systems. Three related builds—Octagon, Lifted Dreams, and BahrDate—were identified, with one variant displaying a visual novel to distract users while the spyware runs in the background. The campaign underscores the growing threat of sophisticated Android remote-access trojans sold on a subscription basis.
BTMOB Platform Turns Android Banking Trojan into Customizable Fraud Campaign Constructor
Researchers at QuimeraX have uncovered BTMOB, a platform that evolved from a banking trojan into a full-featured builder for fraudulent Android campaigns. The service allows clients without development skills to select an app name, icon, command-and-control server, permissions, and social-engineering lure, after which the system automatically compiles a ready-to-use APK. The package includes an Android payload, dropper, VB.NET control panel, PHP and MySQL backend, and build tools that enable rapid production of localized copies of streaming services, banking protection modules, parcel trackers, and social networks. One BTMOB 2.5 variant was distributed via a phishing site mimicking the Turkish iNat TV service, while Brazilian operators created fake Google Play pages impersonating Nubank, TikTok, and the government portal Gov.BR. After installation, the trojan requests accessibility permissions and, once granted, grants operators near-complete device control including screen viewing, keystroke capture, audio recording, and real-time WebSocket interaction that lets attackers perform actions directly on the victim’s device. Analysts link BTMOB to the SpySolr family and earlier commercial RATs CypherRAT and CraxsRAT, which had already attracted more than 100 licensees.