[sidewinder]

September 20, 2026

• SideWinder samples are circulating signed with Microsoft-issued certificates under the name "Alysen Mendez", using Azure blob storage for staging and C2 and spoofing their User-Agent as CrowdStrike's CsAgent/7.04.18110.0. malwrhunterteam found a second, differently signed DLL in an ISO named SSA-Statement-09112026-*.iso seen from the UK and Italy — so this is more than one cert. malwrhunterteam · Threat Activity

in Threat Actors Turn on Each Other as Gemini Walks Into Three Real Networks

August 6, 2026

• SideWinder deployed a new multi-stage chain abusing ClickOnce .application files delivered via phishing PDFs. The chain uses white-binary side-loading to run RC4/XOR-encrypted Rust backdoors that persist via the registry and take C2 over Cloudflare Workers, with malicious Office macros as an alternate initial-access vector (blackorbird). · Threat Activity

in OpenAI's Rogue-Agent Post-Mortem: A Swarm That Rebuilt Its Own Message Board