[blacksee-stealer]

September 24, 2026

• Analysis, YARA rules and IoCs for a DLL sideloading campaign disguised as HWMonitor — multi-stage in-memory obfuscation and encrypted payloads ending in the Blacksee Stealer, with ATT&CK mapping for hunting (GitHub). · New Tools & Releases

in The Exploit Is Public, the Ubuntu Patch Isn't