Lead software engineer at Avast

Our team invests countless hours in the exploration, discovery and investigation of emerging trends such as AI and futuristic technology. Stay informed about the evolving landscape of cyberthreats through our diligent efforts and insights.

Security Evangelist at Gen

Threat Operations Analyst at Gen

Research

<p>A fake invoice in your email is easy to ignore. A fake invoice inside your order history feels different.&nbsp;</p><p>Norton customers have reported fake Norton invoices appearing inside the Shop app, the shopping and order-tracking app from Shopify. Public reports suggest the same technique is not limited to Norton. Similar suspicious Shop app notifications have used McAfee, Apple gift cards, iPhones, PayPal-style payment claims and other high-value purchases as bait. The impersonated brand may change, but the mechanics are familiar: make the user believe they have been charged, then give them a phone number to call.&nbsp;</p><p>That phone number is where the scam really begins.&nbsp;</p><h4>Why the Shop app makes this more believable&nbsp;</h4><p>Shop is a legitimate app. People use it to track packages, check receipts and receive order updates. According to Shop’s own documentation, the app can automatically track orders from several sources, including Gmail, Outlook, the email address linked to the user’s Shop account and orders paid through Shop Pay. If Gmail or Outlook is connected, Shop says it scans recent emails for keywords such as “tracking number” and “track your package” to populate deliveries in the Orders tab.&nbsp;</p>

<p>Shop also supports push notifications for delivery updates, payments and favorite products. So the first alert the victim sees may not be an email, an SMS or a calendar invite. It may be a notification from an app they already use for real purchases.&nbsp;</p><p>That context matters. The scam text is not especially polished. Some of the examples we reviewed contain awkward wording and obvious signs of fraud. But when the message appears inside an order-tracking app, surrounded by real receipts and shipping updates, users may give it more credibility than it deserves.&nbsp;</p><p>The screenshots reported to us show fake orders under generic seller names such as “My Store.” The receipts claim that a Norton or Norton LifeLock subscription has been activated or renewed, usually for several hundred dollars. The phone number appears in the product description, the receipt body or even the shipping address field.&nbsp;</p><p>That is not how a normal receipt should look.&nbsp;</p><h4>The brand is interchangeable&nbsp;</h4><p>Norton is the example we saw through customer reports. Norton support now warns that scammers may abuse Android and iOS shopping platforms or applications to generate fake order notifications that appear to be legitimate Norton purchases. Those notifications may include fake order confirmations, fake charges, trusted third-party app delivery and fake support phone numbers embedded in order details.&nbsp;</p><p>Public user reports point to a wider pattern. One Reddit user described receiving a Shop.app message about a transaction they did not recognize, with no follow-up email confirmation, and a message telling them to call support if the order was not placed by them. Another thread includes reports of unrecognized iPhone purchases under “My Store,” suspicious contact emails and users saying they saw no matching charges on their bank cards. Other reports mention fictitious Apple gift card purchases and iPhone orders using the same kind of wording: “If Order Not Placed By You,” followed by a phone number.&nbsp;</p><p>The choice of brand is part of the social engineering. A fake security subscription charge plays on two fears at once: being billed for something you did not buy, and being left unprotected if you ignore it. Apple products and gift cards create high-value purchase panic. PayPal-style wording makes users worry about payment account abuse. In each case, the fake order is there to push the victim toward a call.&nbsp;</p><h4>What we know, and what we do not&nbsp;</h4><p>We have not found any evidence that any of the impersonated brands have been compromised.&nbsp;&nbsp;</p><p>We also should not claim that Shop or Shopify was breached based on the evidence we have. The exact abuse path still needs confirmation. The fake order may be entering the app through a merchant/order workflow, through email parsing, through account association, or through another legitimate mechanism that scammers have found a way to misuse. Shop’s own documentation shows that orders can populate from multiple sources, so assuming one route would be premature.&nbsp;&nbsp;</p><p>What we can say is narrower and stronger: scammers are placing fake purchase claims inside shopping app order experiences, where users are used to seeing real receipts and order updates. Norton’s own support page now describes this class of shopping app scam, and public reports show similar lures using other brands and products.&nbsp;&nbsp;</p><p>That is enough to warn users without overstating the technical evidence.&nbsp;</p><h4>How the scam works&nbsp;</h4><p>The user receives a notification or sees a new order in the Shop app. The order looks like a receipt for something expensive: a security subscription, an Apple gift card, an iPhone, a MacBook or another high-value purchase.</p>

<p>The receipt says the charge has been processed, the subscription has renewed, or the order is being prepared. Somewhere in the order details, the scammer inserts a phone number, email address or support instruction.&nbsp;</p><p>The wording is often clumsy. We have seen phrases like “If Order Not Place By You” and “If Need Help.” Those errors may look obvious when reviewing a screenshot. They are easier to miss when a phone notification tells you that hundreds of dollars have just been charged.&nbsp;</p><p>If the victim calls, the scam moves off-platform. The person answering may claim to be billing support, Norton support, PayPal support or a cancellation department. The script can vary, but the request usually moves toward credentials, payment data, one-time codes or remote access software.&nbsp;</p><p>By that point, the fake receipt has done its job. It has created enough urgency for the victim to enter a conversation controlled by the scammer.&nbsp;</p><h4>Why this is harder for users to judge&nbsp;</h4><p>Most people understand that email can be spam. They may still fall for phishing, but at least the inbox is a place where scams are expected.&nbsp;</p><p>Order-tracking apps are different. Their purpose is to collect receipts, shipping updates and purchase information in one place. A notification from that environment can feel as if it has already passed through some layer of trust, even when the content inside the order is fraudulent.&nbsp;</p><p>We have seen the same logic with calendar invite scams. The message itself is not always convincing, but the delivery channel changes how people read it. A fake invoice in an inbox is one thing. A fake invoice inside a calendar reminder or shopping app receipt can feel closer to a real event.&nbsp;</p><p>For security products, this also creates a detection problem. The first visible alert may not be an email, SMS or malicious website. It may be a legitimate app notification carrying fraudulent text. The scam still depends on social engineering, but the delivery surface is harder to classify with the usual rules.&nbsp;</p><h4>What to do if you see one&nbsp;</h4><p>Do not call the number in the receipt.&nbsp;</p><p>Check the charge directly. Open your bank or credit card app. Open the official account for the brand being impersonated. If it claims to be Norton, go to your Norton account or official Norton support. If it claims to involve PayPal, open PayPal directly. Do not use the phone number, email address or link inside the suspicious order.&nbsp;</p><p>If there is no matching charge, treat the receipt as a scam attempt.&nbsp;</p><p>Report the suspicious store or message in the Shop app if the option is available. Shop’s help pages say suspicious Shop stores can be reported from the store page through the app, and Shopify also tells users to forward phishing messages to its phishing inbox.&nbsp;&nbsp;</p><p>Norton users can forward suspicious messages to Norton and should verify unexpected charges only through their Norton account or official Norton support channels.&nbsp;&nbsp;</p><p>Opening the receipt does not automatically mean your device was compromised. The risk increases if you call the number, share information, install software or follow instructions from the person on the phone.&nbsp;</p><h4>What to do if you have already called&nbsp;</h4><p>End the call.&nbsp;</p><p>If you shared payment details, contact your bank or card provider immediately using the number on your card or inside your banking app. If you gave away a password, change it from a different device if possible. Start with your email account, Apple ID or Google account, banking account and any account connected to the fake invoice.&nbsp;</p><p>If you installed remote access software, disconnect the device from the internet and remove the software. Run a security scan before using the device again for banking, email or shopping.&nbsp;</p><p>If you gave a one-time code to the caller, treat the related account as compromised. Change the password, review recovery options and check recent login activity.&nbsp;</p><h4>The lesson&nbsp;</h4><p>Scammers keep testing new places to put old tricks. For years, fake invoices were mostly an email problem. Then similar subscription notices appeared in calendar invites. Now we are seeing fake receipts inside shopping app order histories and push notification flows.&nbsp;</p><p>The safest response is to separate the alert from the action. If an app, email, text message or calendar invite says you have been charged, do not use the contact details inside that alert. Go directly to the account or payment provider yourself. Check whether the charge exists. Use official support channels.&nbsp;</p><p>The fake receipt, the fake support number and the fake emergency are all part of the same controlled environment. The moment you verify the charge somewhere else, the scam loses most of its power.&nbsp;</p>

Scammers are using order-tracking apps to place fake receipts where users expect to see real purchases, then pushing them to call fake support numbers. 

Fake invoices are moving from inboxes to shopping apps 

Threat Researcher at Gen

<h2>Introduction&nbsp;</h2><p>Infostealers are constantly evolving, and so are the techniques they use to bypass <a href="https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html" target="_blank" rel="noreferrer noopener">Application-Bound Encryption (ABE)</a>. In recent weeks, Vidar has been among the most actively developed stealers and, apart from <a href="https://x.com/GenThreatLabs/status/2064836539952361976" target="_blank" rel="noreferrer noopener">multiple updates to its string obfuscation</a> and <a href="https://x.com/GenThreatLabs/status/2061462524604649840" target="_blank" rel="noreferrer noopener">a reworked approach to protecting its configuration</a>, it has also introduced a novel technique for bypassing ABE. And while there have been many other changes in Vidar lately, with new versions dropping every week, in this blog post we focus solely on the ABE bypass and its technical aspects.&nbsp;<br>&nbsp;</p><h2>The ABE Bypass&nbsp;</h2><p>From a high-level perspective, Vidar’s approach to bypassing ABE is somewhat similar to that of Remus/Lumma, in that both try to extract the <code>v20_master_key</code> directly from the browser’s memory. What sets them apart, however, is how they achieve it. Since we’ve already covered the inner workings of ABE in earlier posts (<a href="https://www.gendigital.com/blog/insights/research/remus-64bit-variant-of-lumma-stealer" target="_blank" rel="noreferrer noopener">Remus</a>, <a href="https://www.gendigital.com/blog/insights/research/voidstealer-abe-bypass" target="_blank" rel="noreferrer noopener">VoidStealer</a>), we don’t revisit them here and focus instead on the bypass itself. For readers interested in the broader background, we encourage checking those earlier posts.&nbsp;&nbsp;</p><p>In short, the end goal of infostealers is to obtain the <code>v20_master_key</code>, as it alone is sufficient for decrypting any ABE-protected data tied to a specific application. This key can be obtained in one of two ways: either from disk, where it is protected by two layers of <code>CryptProtectData</code> (one applied in the context of the logged-in user and one as <code>NT AUTHORITY\SYSTEM</code>), or from the browser’s memory – the direction Vidar took.&nbsp;</p><p>In memory, however, the key is kept protected with <code>CryptProtectMemory</code> using the <code>CRYPTPROTECTMEMORY_SAME_PROCESS</code> flag. This ensures that even if an attacker manages to read the encrypted form of the key from memory, they cannot simply decrypt it (they would need to invoke the complementary <code>CryptUnprotectMemory</code> function directly from within the browser process). That leaves attackers with two problems to solve: how to find the encrypted key in memory, and how to get it decrypted.&nbsp;</p><h2>Locating the v20_master_key in Browser’s Memory&nbsp;</h2><p>Vidar’s approach to locating the encrypted <code>v20_master_key</code> in memory involves scanning the entire memory of a running browser for a specific pattern. But that first requires a browser process to scan.&nbsp;</p><p>When the target browser is already running, Vidar reuses the existing process. However, it doesn’t read its memory directly. Instead, it creates a fork of it using <code>NtCreateProcessEx</code> with <code>SectionHandle</code> set to <code>NULL</code>, instructing the kernel to clone the address space of the process specified by the <code>ParentProcess</code> as a copy-on-write mapping. The resulting process has no threads and is never resumed – it exists purely as a static memory snapshot.&nbsp;&nbsp;</p><p>To perform the fork, Vidar first opens a handle to the target browser via <code>OpenProcess</code> with <code>PROCESS_QUERY_INFORMATION | PROCESS_CREATE_PROCESS | PROCESS_VM_READ</code>, falling back to <code>PROCESS_CREATE_PROCESS</code> if the initial call fails. It then passes this handle as the <code>ParentProcess</code> argument to <code>NtCreateProcessEx</code>, requesting <code>PROCESS_ALL_ACCESS</code> on the resulting child. If the fork fails, Vidar falls back to scanning the live browser process directly.&nbsp;</p>

<p>If no target browser process is found running, Vidar creates a new isolated desktop via <code>CreateDesktopA</code>, assigns it a name of the form <code>v20_%d</code> (where <code>%d</code> is replaced with the browser’s index in Vidar’s configuration), and launches the target browser in there. In the case of Vidar version 2.1, the browser is launched with the command line <code>--no-first-run --disable-gpu about:blank</code>, although the exact command line varies across versions. Since modern browsers use a multi-process architecture, there are typically multiple processes matching a given browser. Vidar enumerates all of them (up to 64) and applies the fork-and-scan procedure to each one independently.&nbsp;</p>

<p>With a handle to the forked process in hand, Vidar proceeds to enumerate its virtual memory regions using <code>NtQueryVirtualMemory</code>. It iterates through the entire browser’s address space, collecting regions that match a specific profile: committed (<code>MEM_COMMIT</code>), private (<code>MEM_PRIVATE</code>), and either readable (<code>PAGE_READONLY</code>) or read-write (<code>PAGE_READWRITE</code>). Vidar records up to 4096 memory regions matching these requirements, along with their base addresses and sizes.<strong> </strong>The actual pattern scanning is then performed in parallel with up to 64 worker threads, depending on the system.&nbsp;&nbsp;</p>

<p>Each thread scans its assigned regions using <code>NtReadVirtualMemory</code>, searching for a 32-byte pattern. When a match is found, the thread reads 8 bytes at offset +32 from the match, interprets them as a pointer, and validates that it points to committed, private, and readable memory (the expected memory state for the encrypted <code>v20_master_key</code>).&nbsp;&nbsp;</p>

<p>This naturally raises the question of what pattern Vidar searches for. The answer is a 32-byte signature: <code>76 32 30 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 03 00 00 00 00 01 ?? ?? ??</code>, where <code>??</code> denotes a wildcard (Vidar uses the byte <code>AA</code> as the wildcard marker in its internal representation). Notably, the first four bytes correspond to the ASCII <code>v20\x00</code>, which is a common prefix used for ABE-related data.&nbsp;&nbsp;</p>

<p>We assess with high confidence that this pattern is intended to match a node structure within Chromium’s <code>Encryptor::KeyRing</code>, the structure that holds the keys used by the <code>Encryptor</code> class. Now, this part is admittedly a bit tricky as it relies on several assumptions we made about the internal memory layout, as well as on implementation-specific representations of various C++ standard library types <code>(std::map</code>, <code>std::string</code>, <code>std::vector</code>, <code>std::optional</code>), which is why we frame this as a high-confidence rather than a certainty.&nbsp;&nbsp;</p><p>Our reasoning is as follows: <code>KeyRing</code> is <a href="https://github.com/chromium/chromium/blob/cf5d502bcaedb22927e3829a18be1ff6d8b6f598/components/os_crypt/async/common/encryptor.h#L132" target="_blank" rel="noreferrer noopener">defined</a> as <code>std::map&lt;/*tag=*/std::string, std::optional&lt;Key&gt;&gt;</code>, and <code>std::map</code> is typically implemented as a red-black tree, where each tree node stores three pointers (left child, parent, and right child) followed by the key-value pair. In this case, the pair is in the form of <code>std::pair&lt;/*tag=*/std::string, std::optional&lt;Key&gt;&gt;</code>, meaning that the <code>std::string</code> and the <code>Key</code> object might be laid out consecutively in memory within each node. For a <code>v20_master_key</code> entry, the tag corresponds to the string <code>v20</code>, which at 4 bytes including the null terminator fits within the small string optimization (SSO) buffer and is therefore stored inline rather than heap-allocated. The <code>Key</code> class that immediately follows <a href="https://github.com/chromium/chromium/blob/cf5d502bcaedb22927e3829a18be1ff6d8b6f598/components/os_crypt/async/common/encryptor.h#L93-L98" target="_blank" rel="noreferrer noopener">contains three member variables</a>: <code>std::optional&lt;mojom::Algorithm&gt; algorithm_</code>, <code>std::vector&lt;uint8_t&gt; key_</code>, and <code>bool encrypted_ = false</code>.&nbsp;</p><p>Putting it all together and applying it to a concrete example from a browser memory dump, we get the following layout:&nbsp;</p>

<p>Please note that while the exact layout may contain minor inaccuracies on our part, the overall structure should be roughly correct. For easier orientation, the following diagram illustrates how the individual structures are nested within each other:&nbsp;</p>

<p>At this point, it should be clear how the scan pattern maps onto the searched structure. The 32-byte match covers the <code>std::string</code> tag <code>v20\x00</code> and the beginning of the <code>Key</code> object up to and including <code>algorithm_</code>. The pointer at offset +32 from the start of the match then lands precisely on <code>key_.begin</code>, the first member of <code>std::vector&lt;uint8_t&gt;</code> that holds the encrypted <code>v20_master_key</code>.&nbsp;</p><p>Matches from all threads are collected into a shared buffer and subjected to a majority-voting scheme: candidates consisting mostly of zeroes are discarded, the rest are pairwise-compared, and each is scored by the number of identical copies found. This voting is performed independently for each browser process, producing one best candidate per process.&nbsp;</p><h2>Decrypting the v20_master_key via APC Injections&nbsp;</h2><p>For each browser process that produced a match, Vidar now holds a candidate address pointing to a potential encrypted <code>v20_master_key</code>. However, as already noted, since the key is protected with <code>CryptProtectMemory</code> using <code>CRYPTPROTECTMEMORY_SAME_PROCESS</code>, it can only be decrypted by invoking <code>CryptUnprotectMemory</code> from within the browser process itself. Vidar solves this by injecting an Asynchronous Procedure Call (APC) into the live browser process.&nbsp;</p><p>Vidar supports two APC injection methods, selected based on whether ESET or Bitdefender is detected on the system. If either of these products is present, Vidar uses the first method, which it refers to as “classic” (based on decrypted strings) – it creates a suspended thread in the target browser via <code>CreateRemoteThread</code> (with <code>NtTestAlert</code> as the thread start address and the <code>CREATE_SUSPENDED</code> flag), queues an APC using <code>NtQueueApcThread</code>, resumes the thread, and then waits for it to complete via <code>WaitForSingleObject</code> with a randomized timeout. When the thread resumes, it calls <code>NtTestAlert</code>, which flushes the APC queue and executes the injected routine.&nbsp;</p>

<p>If neither product is detected, it uses the “special” method – it finds an existing thread in the target browser using a combination of <code>CreateToolhelp32Snapshot</code> and <code>Thread32First/Thread32Next</code>, opens it via <code>NtOpenThread</code>, and calls <code>NtQueueApcThreadEx2</code> with the <code>QUEUE_USER_APC_FLAGS_SPECIAL_USER_APC</code> flag. Unlike regular APCs, special user APCs execute immediately. Therefore, the target thread does not need to be in an alertable wait state.&nbsp;</p>

<p>In both cases, the APC routine to be executed is <code>CryptUnprotectMemory</code>, called with the following three arguments: the address of the encrypted <code>v20_master_key</code> candidate, its size (32 bytes), and <code>CRYPTPROTECTMEMORY_SAME_PROCESS</code> for the <code>flags</code> parameter.&nbsp;&nbsp;</p><p>Since <code>CryptUnprotectMemory</code> decrypts the data in place, once the APC executes, the key is decrypted directly in the live browser's memory. To read it, Vidar creates a second fork of the browser process and reads the key from the same address using <code>NtReadVirtualMemory</code>. It then compares the result against a snapshot of the encrypted key taken from the first fork before the APC call – if the data is unchanged, decryption failed, and Vidar moves on to the next browser process’s candidate.&nbsp;</p><p>If the data differs, Vidar uses the same second fork to perform an additional verification: it scans the forked process’s memory for the byte sequence <code>v20</code> and, treating each match as a potentially ABE-encrypted entry (cookie, password), attempts AES-256-GCM decryption with the key candidate using <code>BCryptDecrypt</code> (successful GCM tag verification confirms that the key is correct).&nbsp;</p><p>Whenever the data has changed (indicating that decryption of the key took place), Vidar re-encrypts the key in the browser’s memory by injecting another APC with <code>CryptProtectMemory</code> as the routine, preserving the browser’s state. If no candidate produced a successful decryption (i.e., the data remained unchanged after every APC call), Vidar takes a more aggressive approach: it terminates all browser instances, restarts the browser, and repeats the entire scan-decrypt-verify cycle.&nbsp;</p><p>By abusing APC injections instead of the more traditional approach of injecting code via <code>NtWriteVirtualMemory</code> that performs the decryption, Vidar trades one suspicious behavior for another. APC injections are arguably less common and may thus slip past some detection systems, though they are still well-known techniques monitored by AV and EDR solutions. But that is the nature of ABE bypasses – each has its own advantages and disadvantages, and that’s exactly why infostealers keep inventing new ones. &nbsp;</p><h2>Indicator of Compromise (IoC)&nbsp;</h2><p>459daa809751e73f60fbbe4384a7d1653c36bb06945e4eb3635270924241100a (Vidar 2.1)&nbsp;</p>

A Technical Walkthrough of How Vidar Defeats Application-Bound Encryption

Inside Vidar’s ABE Bypass: From Memory Scanning to APC Injections

<p>You have a summer flight booked. You have seen the headlines about jet fuel shortages, cancelled routes and higher travel costs. Then a text message arrives: your flight has been affected, and you need to click a link to confirm your refund or rebook before the offer expires.&nbsp;</p><p>That message feels plausible because the situation around it is real. In April, <a href="https://www.iata.org/en/pressroom/2026-releases/2026-04-17-01/" target="_blank" rel="noreferrer noopener">IATA warned</a> that Europe could start seeing flight cancellations by the end of May if jet fuel shortages materialized. Airlines and governments have since been trying to reassure travelers, while also publishing guidance on passenger rights, refunds and re-routing.&nbsp;&nbsp;</p><p>That is exactly the kind of confusion scammers like. They do not need to cause the disruption, they only need to arrive at the right moment, with the right brand logo and the right sense of urgency.&nbsp;</p><h4>Why travel disruption works so well as a scam hook&nbsp;</h4><p>Most scam messages fail because they arrive out of context. A random refund email from an airline you never use is easy to ignore. A refund message from the airline you are flying with next week, during a period of public travel disruption, is different.&nbsp;</p><p>The scammer’s job is to make you think: “This could be real.”&nbsp;</p><p>That can happen in several ways. You might receive a fake cancellation email that links to a refund form. You might search for an airline’s customer service number and land on a fake support page. You might post publicly on social media asking an airline for help, then receive a reply from an account that looks official. Or you might get a WhatsApp message that knows your hotel name, travel dates or booking reference.&nbsp;</p><p>Each version uses the same pressure point: you are worried about losing money, losing your flight or being stranded.&nbsp;</p><p>Criminals are already using disruption this way. In March, <a href="https://www.theguardian.com/money/2026/mar/15/travel-scam-airline-accounts-fake-refunds-iran-war-flight-disruption" target="_blank" rel="noreferrer noopener">The Guardian reported</a> that fake airline support accounts were targeting travelers affected by Middle East flight disruption. Some victims were looking for help or refunds, then received replies from accounts pretending to represent airlines. The scam moved into direct messages, where victims were asked for details and sent links that led to money being taken instead of refunded.&nbsp;&nbsp;</p><p>The jet fuel story gives scammers another pretext. A message can claim that your flight was cancelled, your fare changed, your fuel surcharge failed, or your refund must be claimed within a few hours. None of those claims needs to be true to be effective.&nbsp;</p><h4>The scam may start before the message arrives&nbsp;</h4><p>A fake travel message becomes much harder to spot when it includes real information.&nbsp;</p><p>This is the idea behind <a href="https://www.gendigital.com/blog/insights/research/reservation-hijack-scam" target="_blank" rel="noreferrer noopener">Reservation Hijack scams</a>, a form of targeted phishing where cybercriminals use real booking details to make a message look legitimate. In some cases, attackers may use information exposed through breaches or compromised travel systems. In other cases, they collect details from emails, social media posts, previous leaks or fake customer service interactions. Gen has previously described Reservation Hijack scams as scams that use real hotel booking details to make fraudulent payment or verification requests feel authentic.&nbsp;&nbsp;</p><p>That distinction matters. A scam message does not need your credit card number to fool you. Knowing your name, your destination, your travel dates and your booking platform may be enough.&nbsp;</p><h4>What these scams can look like&nbsp;</h4><p>A travel disruption scam usually does not begin with a strange offer. It begins with something boring and administrative. That is part of the trick.&nbsp;</p><p>You may see messages like:&nbsp;</p><p>“Your flight has been cancelled due to fuel supply issues. Claim your refund here.”&nbsp;</p><p>“Your rebooking is pending. Confirm passenger details within two hours.”&nbsp;</p><p>“Additional airport tax or fuel surcharge is required to keep your booking.”&nbsp;</p><p>“Your hotel reservation will be cancelled unless payment is verified.”&nbsp;</p><p>“Due to high call volume, please continue this request on WhatsApp.”&nbsp;</p><p>The exact wording changes, but the structure is familiar. There is a problem, a deadline and a link. The message may also move you away from the official channel into SMS, WhatsApp, Telegram, direct messages or a phone call. Once that happens, the scammer controls the conversation.&nbsp;</p><p>There is another detail worth watching: some messages do not ask for money immediately. They start by asking for your booking reference, last name, phone number or one-time password. That can still be dangerous. Those details can help scammers access a booking, impersonate you to customer support, reset an account or make the next message more convincing.&nbsp;</p><h4>Your real passenger rights can be used against you&nbsp;</h4><p>If an airline cancels your flight, you may have rights to a refund, re-routing or assistance, depending on where you are travelling and the rules that apply. The European Commission said passengers affected by cancellations continue to have rights to reimbursement, re-routing or return, airport assistance and compensation for last-minute cancellations in relevant circumstances. It also said airlines cannot retroactively add fuel surcharges to already published final ticket prices.&nbsp;&nbsp;</p><p>That information is useful for travelers, but it is also useful for scammers.&nbsp;</p><p>A fake refund message becomes more believable when people already know refunds are possible. A fake rebooking link becomes more believable when airlines are genuinely changing schedules. A fake “fuel surcharge” demand becomes more dangerous when fuel prices are in the news, even though legitimate retroactive charges may not be allowed in many cases.&nbsp;</p><p>This is why the safest route is not to judge the message only by whether the story sounds plausible. During travel disruption, many scam stories will sound plausible. Judge the channel instead.&nbsp;</p><h4>How to check before you click&nbsp;</h4><p>Start from the airline or booking platform’s official app or website. Do not use the link in the message. Open the app yourself, type the website address yourself, or use the contact details listed on your original booking confirmation.&nbsp;</p><p>Check whether the same cancellation, refund or payment request appears inside your account. If the message is real, the airline or hotel should be able to confirm it through an official channel.&nbsp;</p><p>Be careful with social media support. If an account replies to your public complaint, check whether it is linked from the airline’s official website. Look at the handle carefully. Fake support accounts often copy logos and names, but have small differences in spelling, low follower counts or recently created profiles. The Guardian reported that fraudsters often scan social media for passengers trying to contact legitimate airline accounts and reply to them first, which makes the scam harder to spot.&nbsp;&nbsp;</p><p>Do not share one-time passwords, payment card details or login credentials with anyone who contacts you unexpectedly. A real airline or hotel does not need your banking OTP to send you a refund.&nbsp;</p><p>Be especially suspicious of pressure. “You have 30 minutes to claim your refund” is not customer service. It is a tactic.&nbsp;</p><h4>What to do if you already clicked&nbsp;</h4><p>If you entered payment details, contact your bank or card provider immediately. Ask whether the transaction can be blocked or reversed, and request a new card if needed.&nbsp;</p><p>If you shared login details for an airline, hotel or booking platform, change the password from the official site or app. Use a unique password, not one you use elsewhere. Turn on two-factor authentication where it is available.&nbsp;</p><p>If you shared a one-time password or authentication code, assume the account may have been accessed. Check your booking details, payment methods and recent account activity.&nbsp;</p><p>Report the scam to the airline, hotel or booking platform being impersonated. If the scam came through social media, report the account as impersonation. If money was taken, report it to the relevant fraud authority in your country.&nbsp;</p><h4>The real lesson for summer travel&nbsp;</h4><p>Travel disruption changes how people behave. They search for support numbers in a hurry. They post publicly because customer service queues are long. They accept strange instructions because they are worried about losing a flight or refund.&nbsp;</p><p>Scammers build around that behavior.&nbsp;</p><p>The safest assumption is simple: if a message about your flight, hotel or refund creates urgency and gives you a link, pause. Go back to the official source. A real cancellation will still be there when you check through the airline or booking platform. A scammer needs you to act before you do.&nbsp;</p>

Travel disruption gives scammers the one thing they need most: a believable reason to rush you

Your flight was cancelled. Is the refund message real? 

<p>A fake job interview page is easier to trust than a fake ticket shop.</p><p>In samples reviewed by Gen threat researchers, scammers used branded hiring pages that looked like ordinary recruitment flows: a company logo, a recruiter profile, a 30-minute meeting, and a button to continue with Google or Facebook. There was no attachment to open and no software to install. The credential theft attempt sat inside a step many job applicants already expect: signing in to schedule a call.</p><p>FIFA is an obvious lure ahead of the 2026 World Cup. On May 22, ESET reported fake FIFA-themed websites that copied ticket and merchandise flows to steal money and personal data. Our researchers later found another FIFA-themed domain, hxxps://fifa-mg[.]shop, which followed a naming pattern not mentioned in that report. Domains like these can be short-lived, often appearing for hours or days before they are blocked, abandoned, or taken down.</p><p>Our researchers also found a different kind of FIFA lure: hxxps://fifahiring[.]com, a fake hiring page that encouraged users to schedule a call with an alleged FIFA recruiter. When a user tried to register with a personal Gmail address, the page asked for a business email instead. The page was steering victims toward credentials with more value: accounts that could provide access to a company environment.</p>

<h4>The FIFA hiring page did not point to FIFA</h4><p>The fake page looked believable at first glance.</p>

<p>It used FIFA branding, presented a recruiter identity, and copied parts of the experience users see on legitimate recruiting and scheduling platforms. The recruiter’s name and photo appeared to match a real LinkedIn profile, which made the page feel more credible. For publication, we should keep that person’s identity redacted.</p><p>The domain did not match FIFA’s real hiring infrastructure. FIFA’s legitimate careers pages are jobs.fifa.com and fifa.pinpointhq.com. The fake page used neither. It also loaded the favicon from the real FIFA recruitment site hosted at pinpointhq.com, giving the page a small visual cue borrowed from the legitimate service.</p><p>Other signals pointed in the same direction. The domain and certificate were newly created, from May 23. The site used commodity hosting infrastructure, including Vercel and Render, rather than a corporate environment. Those signs are not enough on their own, but they fit the rest of the evidence.</p><p>The login flow was the clearest part. Credentials were posted to:</p><p>fifeq2026eqbackeq[.]onrender[.]com/api/login</p><p>The Google sign-in prompt was not a real Google authentication window. It was rendered inside the page itself. The visible controls and links did nothing, and the page did not send the user into a genuine Google sign-in flow. According to the analysis, the only Google asset loaded was the favicon, apparently to make the fake window look familiar.</p><p>A page can look like it opened a Google login without ever handing control to Google.</p><p>Researchers also observed hxxps://careers-fifahiring[.]com, which later became inactive, and hxxps://fifajobs[.]com, which showed the same content and was indexed by Google.&nbsp;</p><h4>The recruitment lure went beyond FIFA</h4><p>The FIFA page was one version of a wider recruitment phishing pattern. The brand can change. The flow stays familiar: recruiter profile, meeting prompt, business email, fake sign-in.</p><p>Researchers found similar fake hiring pages abusing other major brands, including <strong>Heineken, Hilton, Coca-Cola, Netflix, PepsiCo, Delta,&nbsp;</strong>and<strong> Spotify</strong>. In the Heineken case, the page appeared to use the identity of someone who, according to LinkedIn, really works as a recruiter at the company.</p>

<p>Additional hunting found two other recruitment-themed kits:</p><p>hxxps://aquent-talent-jobs[.]com<br>hxxps://hays-talent-opportunities[.]com</p><p>The Hays-themed version targeted Facebook credentials instead of Google credentials. Researchers assessed that the Aquent and Hays pages shared code, although they differed from the earlier FIFA examples.</p>

<p>This flexibility makes the campaign harder to frame as a single World Cup scam. FIFA provides the timely hook, but the mechanism is recruitment phishing. A scammer can swap the logo, recruiter name, and sign-in provider while keeping the same basic path to the victim’s credentials.</p><h4>Why fake recruitment pages work</h4><p>Recruitment gives attackers a clean excuse to ask for things that might otherwise raise suspicion.</p><p>A candidate expects to click a scheduling link. They expect a recruiter profile. They expect a calendar prompt. In some cases, they may also expect to use a work email, especially for corporate, contractor, or partner-facing roles.</p><p>The fake login window turns that ordinary flow into credential theft. Users are used to “Continue with Google” and “Continue with Facebook” buttons, but the button itself proves nothing. A genuine authentication flow should take the user to the provider’s domain and controls. A fake page can draw a convincing copy while keeping the victim inside the attacker-controlled site.</p><p>The business email prompt is also a warning sign. A page that rejects a personal email and asks for a work address may be trying to raise the value of the stolen account.</p><h4>What job seekers should check before signing in</h4><p>Start from the company’s official careers page, not from a link in a message, ad, search result, or forwarded post. For FIFA, that means checking jobs.fifa.com or fifa.pinpointhq.com, not trusting a domain because it contains “fifa,” “career,” “hiring,” or “jobs.”</p><p>Look closely at the domain before entering credentials. Scam pages often add plausible hiring words around a brand name: career, talent, jobs, hiring, portal, or connect. A polished page on a new domain is still a new domain.</p><p>Treat the sign-in step as the real checkpoint. If a page offers Google or Facebook login, check whether the flow actually opens a real provider-controlled authentication page. A fake window embedded inside the original site, broken controls, inactive links, or a provider logo used only as decoration should stop the process.</p><p>Use security software that includes web and phishing protection. These tools can block known malicious pages before they load, which is especially useful when scam domains look polished, appear in search results, or are shared through otherwise legitimate channels.</p><h4>What companies can do</h4><p>Recruitment pages are public by design, which makes them easy to copy.</p><p>Security teams should monitor for newly registered domains combining their brand with hiring-related terms. They should also watch for pages that reuse favicons, recruiter photos, job descriptions, and calendar-booking language from legitimate hiring flows.</p><p>HR and recruiting teams should make the official hiring path easy to verify. Candidates should not have to guess whether a domain is legitimate. A clear careers page, consistent recruiter communication, and warnings about unofficial scheduling links can remove some of the ambiguity attackers rely on.</p><h4>Conclusion</h4><p>The fake FIFA hiring page worked because it did not feel unusual. It looked like a normal step in a hiring process.</p><p>Attackers do not need to invent new behavior when they can copy one people already trust. A branded scheduling page, a recruiter profile, and a familiar sign-in button can be enough to move a victim from interest to credential entry.</p><p>The decision point is the login. Before entering a work email or password, check the domain, check where the authentication flow really goes, and verify the role through the company’s official careers site. Security software with web and phishing protection adds another layer, especially against short-lived scam pages that may only stay online for hours or days.</p><p><strong>IOCs:</strong></p><p>hxxps://fifahiring[.]com<br>hxxps://careers-fifahiring[.]com<br>hxxps://fifajobs[.]com<br>hxxps://fifa-mg[.]shop<br>hxxps://heineken-careers[.]com<br>hxxps://aquent-talent-jobs[.]com<br>hxxps://hays-talent-opportunities[.]com<br>fifeq2026eqbackeq[.]onrender[.]com/api/login</p>

Scammers are copying recruitment and calendar-booking flows to make fake Google and Facebook sign-ins look routine. 

Fake hiring pages abuse FIFA and other major brands to steal work credentials 

Threat Research Team Lead

<p>Since January 2026, we have detected 7.4 million malicious incidents tied to residential proxy traffic, affecting 572,000 users in our telemetry. In this model, the household whose connection is being used is often not the buyer of the traffic. It is the exit point.</p><p>That is the uncomfortable part of residential proxy networks. A home router, laptop, phone, smart TV, or other always-on device can quietly become part of a commercial network that routes strangers’ internet traffic through ordinary consumer IP addresses. To the websites on the other end, that traffic looks as if it came from a real household, because it did.</p><p>The technology itself is not inherently malicious. Businesses use residential proxies for market research, ad verification, brand protection, security testing, and services that need to see the web as a real user would. But the same feature that makes these networks useful also makes them attractive for abuse: traffic from a household IP address is hard to block without risking false positives against legitimate users.</p><p>The problem for consumers is simpler. Many people do not realize their device or connection can be enrolled into this kind of network at all. Some users opt in through pay-for-bandwidth apps. Others are enrolled through “free” VPNs, bundled software development kits inside unrelated apps, or unwanted software that installs proxy components without meaningful consent.</p><p>Here is how the market works, who pays for it, and what it can cost the household that unknowingly hosts it.</p><h2>What is a residential proxy</h2><p>A residential proxy is an internet connection – typically a home laptop, phone, smart TV, or router – that has been enrolled into a third-party network and is being used to route someone else's traffic. To the rest of the internet, that traffic looks like it is coming from an ordinary household IP address assigned by a consumer ISP, not from a datacenter or&nbsp;VPN provider.</p><p>Residential proxy networks are sold commercially. The model is two-sided: some people pay to tunnel their traffic out through someone else's connection (much like a VPN, except the exit point is a real home), while others get paid to provide those exit endpoints. Some are structured as paid peer-to-peer networks, where any participant's connection can serve as an exit for any other.</p><p>Buyers pay for access to pools of millions of these "real user" IPs because they are extremely difficult to block, or rather, blocking them carries real consequences: the traffic originates from genuine households, so any block risks shutting out a legitimate user – effectively a false positive.</p><p>Common buyers include market research firms, price-comparison services, brand-protection vendors, security teams testing their own defenses, and consumer privacy tools. At the abusive end of the market, the same infrastructure used by operators running automated purchasing bots, scrapping campaigns, ad fraud, credential stuffing, phishing and other attacks where hiding the true origin of the traffic matters. Demand is also being shaped by large-scale web scraping, including&nbsp;<a href="https://blog.includesecurity.com/2026/06/the-smart-tv-in-your-livingroom-is-a-node-in-the-aiscraping-economy/">scraping for AI training data</a>. As anti-bot systems become better at identifying traffic from datacenters and known VPN providers, residential IP addresses become more attractive because they look like ordinary users. That does not make every residential proxy user malicious. It does mean consumers may be carrying traffic for businesses and actors they have never heard of.</p><h2>How consumer devices end up in these networks</h2><p>There are several ways a home device can become part of a residential proxy network. Some are explicit. Others are easy to miss.</p><p>The most obvious route is the pay-for-bandwidth model. Apps such as Honeygain, IPRoyal Pawns, and PacketStream pay users to share their internet connection. The user opts in, but they may not understand who will buy access to that connection later, what kind of traffic will pass through it, or what happens if that traffic triggers abuse reports.</p><p>A second route is the “free” VPN or proxy app. Instead of charging a subscription, the app monetizes the user’s connection by reselling bandwidth. In practice, the user may think they are getting a privacy tool while also becoming infrastructure for other people’s traffic.</p><p>A third route is through bundled software development kits, or SDKs. A developer adds a third-party component to an otherwise unrelated app, such as a flashlight, wallpaper, game, or utility. The developer gets paid when the app is active. The user sees the host app, not the proxy network behind it.</p><p>The fourth route is malware or potentially unwanted software. In those cases, the proxy component is installed silently or deceptively, with no meaningful user consent at all.</p><h2>Why the "consent" is rarely meaningful</h2><p>Even when consent technically exists, it is often not the kind of consent most people would recognize.</p><p>The disclosure may be buried in a long terms-of-service document. The wording may be vague, with phrases such as “share your unused bandwidth,” “support the app,” or “join our network.” These phrases do not clearly tell the user that arbitrary third parties may route traffic through the user’s home IP address.</p><p>There is also the question of downstream use. Users are rarely told who buys access to the network or what those buyers do with it. Their connection could be used for benign market research. It could also be used for scraping, automated account creation, ad fraud, credential stuffing, or phishing infrastructure.</p><p>The problem gets worse when the proxy component sits inside another app. The host app’s privacy policy may mention a partner SDK by brand name, but that still does not make it clear to a normal user that their device can become a proxy endpoint.</p><p>Uninstalling the visible app may not always resolve the issue cleanly either, especially when proxy components are installed separately or bundled with other unwanted software.</p><h2>The risks consumers actually carry</h2><p>When a household device becomes a residential proxy node, the user takes on risks created by someone else’s traffic.</p><p>The first risk is attribution. Abusive, fraudulent, or illegal activity routed through the device appears to come from the household’s IP address. ISP abuse notices, platform bans, fraud checks, and law enforcement requests point first to the subscriber, not to the person who bought the proxy traffic.</p><p>The second risk is performance. Continuous third-party traffic can consume bandwidth, slow the home network, hit data caps, or violate ISP terms of service. The user may only notice that the internet feels slower, a bill is higher, or a service suddenly blocks access.</p><p>The third risk is security exposure. Proxy clients run persistent background processes and maintain network connections so they can relay traffic. That adds always-on networking software to the device, often with limited visibility for the user.</p><p>The fourth risk is reputation. A home IP address used for abuse can end up on blocklists used by banks, retailers, streaming services, and online platforms. The result can be account friction, failed logins, extra verification steps, or outright blocking from services the household actually uses.</p><p>There is also a family angle. A child or another household member may install a free game, VPN, or utility without understanding the consequences. The legal, financial, and reputational risk still lands on the account holder.</p><h2>What our telemetry shows</h2><p>Since the beginning of 2026, we have detected 7.4 million malicious traffic incidents associated with residential proxy traffic, affecting 572,000 unique users in our user base.&nbsp;<br>This is not a measurement of the entire residential proxy market. It reflects what we observe in our telemetry: malicious traffic, detections, and related activity affecting protected users. The real footprint is far larger, because residential proxy networks span major consumer platforms and many devices outside our visibility.</p><p>The activity is global, but it is concentrated in a smaller set of countries. India leads by a wide margin, with roughly 83,000 affected users, followed by Vietnam with 61,000 and Brazil with 39,000. The Philippines (23,000), Poland (18,000), Indonesia (18,000) and Thailand (14,000) form a second tier, with Egypt, Spain, Ukraine, Argentina, Mexico and Italy each accounting for 10,000 to 13,000. The spread across South and Southeast Asia, Latin America, and Eastern and Southern Europe reflects where the host apps that carry this software are most widely installed.</p><p>That geographic spread likely reflects a combination of app distribution, local install patterns, user appetite for free or pay-for-bandwidth apps, and the economics of bandwidth resale. It should not be read as a simple ranking of where residential proxy abuse originates.</p><p>The chart below breaks down the threats we observed in this proxy-related traffic. Two categories dominate: phishing and malicious advertising. Behind them sits a long tail of consumer-facing fraud, including e-shop scams, generic scams, financial scams, and fake-tutorial pages, alongside outright malware such as trojans and other malicious traffic.&nbsp;</p>

<p>In the malicious proxy traffic we observed, scams and malware dominate. The important point for consumers is not only that their connection may be used by someone else. It is that, when abuse happens, their household IP address can be the return address.</p><h2>What consumers can do</h2><p>Most people will not identify a residential proxy component by name. But there are practical warning signs.</p><p>Review “free” VPNs, proxy apps, bandwidth-sharing apps, and utilities from unknown publishers. Check whether they mention bandwidth sharing, peer-to-peer networking, traffic routing, or network participation in their terms. If an app offers payment for leaving your device online, assume your connection may be resold unless the provider explains exactly how traffic is vetted and who can buy access.</p><p>On phones and computers, remove apps you do not recognize or no longer use. On home routers, check the list of connected devices and look for anything unfamiliar. If your ISP sends abuse notices, websites start blocking you, or your home IP address suddenly fails fraud checks, a proxy component is one possible explanation.</p><p>Security software can also help by detecting unwanted proxy clients, bundled components, and related malicious activity. But this should not be a guessing game for consumers. Software that turns a household connection into a commercial exit node should be named clearly and made easy to remove.</p><h2>The takeaway&nbsp;</h2><p>With residential proxiesthe user’s connection becomes an infrastructure for someone else’s business.</p><p>The issue is not that residential proxy technology exists. It has legitimate uses. The issue is whether people know when their devices are part of it, understand what kind of traffic may pass through their connection, and have a real choice to opt out.</p><p>The fix is not to pretend consumers will read every EULA. This software should be named clearly, shown plainly, and made easy to remove before a household connection becomes someone else’s infrastructure.</p>

Your home connection could be routing traffic for strangers. Here's how residential proxy networks work, how devices get enrolled and what our telemetry reveals about the risks for consumers.

Who's Really Using Your Home Internet Connection?

<p><a href="https://github.com/avast/retdec">RetDec</a> is an open-source machine-code decompiler based on LLVM. It isn’t limited by a target architecture, operating system, or executable file format:</p><ul><li>Runs on Windows, Linux, and macOS.</li><li>Supports all the major object-file formats: Windows PE, Unix ELF, macOS Mach-O.</li><li>Supports all the prevailing architectures: x86, x64, arm, arm64, mips, powerpc.</li></ul><p>Since its initial public release in December 2017, we have released three other stable versions:</p><ul><li><a href="https://github.com/avast/retdec/releases/tag/v3.0">v3.0</a> — The initial public release.</li><li><a href="https://github.com/avast/retdec/releases/tag/v3.1">v3.1</a> — Added macOS support, simplified the repository <a href="https://github.com/avast/retdec/wiki/Project-Repository-Structure">structure</a>, reimplemented recursive traversal decoder.</li><li><a href="https://github.com/avast/retdec/releases/tag/v3.2">v3.2</a> — Replaced all shell scripts with Python and thus made the usage much simpler.</li><li><a href="https://github.com/avast/retdec/releases/tag/v3.3">v3.3</a> — Added x64 architecture, added FreeBSD support (maintainted by the community), deployed a new LLVM-IR-to-BIR converter</li></ul><p>Now, we are glad to announce a new version <a href="https://github.com/avast/retdec/releases/tag/v4.0">4.0</a> release with the following major features:</p><ol><li>added arm64 architecture,</li><li>added JSON output option,</li><li>implemented a new build system, and</li><li>implemented <code>retdec</code> library.</li></ol><p>See <a href="https://github.com/avast/retdec/blob/567c30e3dd4c572fa825d8781ed69652306a961e/CHANGELOG.md#v40-2020-04-07">changelog</a> for the complete list of new features, enhancements, and fixes.</p><h2><strong>1. arm64 architecture</strong></h2><p>This one is clear — now you can decompile arm64 binary files with RetDec!</p><p>Adding a new architecture is isolated to the <a href="https://github.com/avast/retdec/wiki/Capstone2LlvmIr"><code>capstone2llvmir</code></a> library. Thus, it is doable with little knowledge about the rest of RetDec. In fact, the library already also supports mips64 and powerpc64. These aren’t yet enabled by RetDec itself because we haven’t got around to adequately test them. Any architecture included in <a href="http://www.capstone-engine.org/">Capstone</a> could be implemented. We even put together a <a href="https://github.com/avast/retdec/wiki/How-to-add-support-for-a-new-architecture">how-to-do-it</a> wiki page so that anyone can contribute.</p><h2><strong>2. JSON output option</strong></h2><p>As one would expect, RetDec by default produces a C source code as its output. This is fine for consumption by humans, but what if another program wants to make use of it? Parsing high-level-language source code isn’t trivial. Furthermore, additional meta-information may be required to enhance user experience or automated analysis — information that is hard to convey in a traditional high-level language.</p><p>For this reason, we added an option to generate the output as a sequence of annotated lexer tokens. Two output formats are possible:</p><ul><li>Human-readable JSON containing proper indentation (option <code>-f json-human</code>).</li><li>Machine-readable JSON without any indentation (option <code>-f json</code>).</li></ul><p>This means that if you run <code>retdec-decompiler.py -f json-human input</code>, you get the following output:</p>

<p>In addition to the source-code token values, there is meta-information on token types, and even assembly instruction addresses from which these tokens were generated. The addresses are on a per-command basis at the moment, but we plan to make them even more granular in the future. See the <a href="https://github.com/avast/retdec/wiki/Decompiler-outputs">Decompiler outputs</a> wiki page for more details.</p><p>JSON output option is currently used in RetDec’s <a href="https://github.com/avast/retdec-r2plugin">Radare2 plugin</a> and an upcoming <a href="https://github.com/avast/retdec-idaplugin">IDA plugin v1.0</a>. Feel free to use it in your projects as well.</p><h2><strong>3. New build system</strong></h2><p>RetDec is a collection of libraries, executables, and resources. Chained together in a script, we get the decompiler itself — <code>retdec-decompiler.py</code>. But what about all the individual components? Couldn’t they be useful on their own?</p><p>Most definitely they could!</p><p>Until now the RetDec components weren’t easy to use. As of version 4.0, the installation contains all the resources necessary to utilize them in other CMake projects.</p><p>If RetDec is installed into a standard system location (e.g. <code>/usr</code>), its library components can be used as simply as:</p>

<p>If it isn’t installed somewhere where it can be discovered, CMake needs help before <code>find_package()</code> is used. There are generally two ways to do it:</p><ol><li>Add the RetDec installation directory to <code>CMAKE_PREFIX_PATH</code></li></ol>

<p>2. Set the path to installed RetDec CMake scripts to <code>retdec_DIR</code></p><p><br>&nbsp;</p>

<p>It is also possible to configure the build system to produce only the selected component(s). This can significantly speed up compilation. The desired components can be enabled at CMake-configuration time by one of these parameters:</p><ol><li><code>-D RETDEC_ENABLE_&lt;component&gt;=ON [...]</code></li><li><code>-D RETDEC_ENABLE=component[,...]</code></li></ol><p>See <a href="https://github.com/avast/retdec/wiki/Repository-Overview">Repository Overview</a> for the list of available RetDec components, <a href="https://github.com/avast/retdec-build-system-tests">retdec-build-system-tests</a> for component demos, and <a href="https://github.com/avast/retdec#build-and-installation">Build Instructions</a> for the list of possible CMake options.</p><h2><strong>4. </strong><code><strong>retdec</strong></code><strong> library</strong></h2><p>Well, now that we can use various RetDec libraries, can we use the whole RetDec decompiler as a library?</p><p>Not yet. But we should!</p><p>In fact, the vast majority of RetDec functionality is in libraries as it is. The <code>retdec-decompiler.py</code> script and other related scripts are just putting it all together. But they are kinda remnants of the past. There is no reason why even the decompilation itself couldn’t be provided by a library. Then, we could use it in various front-ends, replacing hacked-together Python scripts. Other prime users would be the already mentioned RetDec’s <a href="https://github.com/avast/retdec-idaplugin">IDA</a> and <a href="https://github.com/avast/retdec-r2plugin">Radare2</a> plugins.</p><p>We aren’t there yet, but version 4.0 moves in this direction. It adds a new library called <code>retdec</code>, which will eventually implement a comprehensive decompilation interface. As a first step, it currently offers a disassembling functionality. That is a full recursive traversal decoding of a given input file into an LLVM IR module and structured (functions &amp; basic blocks) Capstone disassembly.</p><p>It also provides us with a good opportunity to demonstrate most of the things this article talked about. The following source code is all that’s needed to get to a complete LLVM IR and Capstone disassembly of an input file:</p>

<p>The CMake script building it looks simply like this:<br>&nbsp;</p>

<p>If RetDec is installed somewhere where it can be discovered, the demo can be built simply with:</p><p><br>&nbsp;</p>

<p>If it is not, one option is to set the path to installed CMake scripts:</p><p><br>&nbsp;</p>

<p>If we are building RetDec ourselves, we can configure CMake to enable only the <code>retdec</code> library with <code>cmake .. -DRETDEC_ENABLE_RETDEC=ON</code>.</p><h2><strong>What’s next?</strong></h2><p>We believe that for effective and efficient manual malware analysis it is best to selectively decompile only the interesting functions. Interact with the results, and gradually compose an understanding of the inspected binary. Such a workflow is enabled by RetDec’s <a href="https://github.com/avast/retdec-idaplugin">IDA</a> and <a href="https://github.com/avast/retdec-r2plugin">Radare2</a> plugins, but no so much by its native one-off mode of operation. Especially when performance on medium-to-large files is still an ongoing issue. We also believe in the ever-increasing role of advanced automated malware analysis.</p><p>For these reasons, RetDec will move further in the direction outlined in the previous section. Having all the decompilation functionality available in a set of libraries will enable us to build better tools for both manual and automated malware analysis.</p><h2><strong>Reversing tools series</strong></h2><p>With this introductory piece, we are starting a series of articles focused on engineering behind reversing. So, if you are interested in the inner workings of such tools, then do look out for new posts in here!</p>

RetDec v4.0 Key Features

RetDec v4.0 is out

<h2><strong>Introduction</strong></h2><p>In <a href="https://en.wikipedia.org/wiki/Software_development">software development</a>, the process of creating <a href="https://en.wikipedia.org/wiki/Distributed_version_control#Pull_requests">merge requests</a> (MRs) and <a href="https://en.wikipedia.org/wiki/Peer_review">peer-reviewing</a> them via <a href="https://en.wikipedia.org/wiki/Code_review">code reviews</a> (CRs) represents a vital practice. Here is a couple of reasons why:</p><ul><li>Finding bugs and other defects. It is better to catch bugs during code review than in production. Apart from bugs, you also want to aim at finding performance issues or security vulnerabilities.</li><li>Slowing down the process of gradual degradation by improving code quality and <a href="https://en.wikipedia.org/wiki/Maintainability">maintainability</a>.</li><li>Learning something new. The author of the code might use something useful that you have not seen yet, like a programming-language feature or library function.</li><li>Getting familiar with code that is new to you. Code reviews help transfer knowledge about the codebase among your peers.</li><li>Increasing the sense of mutual responsibility within your team. This facilitates <a href="https://en.wikipedia.org/wiki/Extreme_programming_practices#Collective_code_ownership">collective code ownership</a>.</li><li>Finding a better solution. The reviewer may be familiar with a library, technique, or algorithm that will allow you to make the code shorter, more efficient, etc.</li><li>Complying with formal requirements (e.g. <a href="https://en.wikipedia.org/wiki/Quality_assurance">QA</a>). Depending on the company policies or business area, CRs may be mandatory.</li><li>Writing better code. I do not know about you, but when I know that someone will review the code that I am writing, I tend to care more about it and generally produce better code.</li></ul><p>Like many other aspects of software engineering, writing MRs and doing CRs is a skill. You can increase your proficiency by gaining more experience and learning new techniques. The present blog post will not help you with the former, experience-related part, but it will be helpful with the latter.</p><p>Before we take a look at tips on creating good MRs, let me address the following question: Why does GitHub call MRs pull requests (PRs)? There are basically <a href="https://www.quora.com/In-GitHub-why-is-the-pull-request-a-request-to-merge-code-into-another-branch-often-Master-called-pull-request-In-GitLab-its-called-%E2%80%9Cmerge-request-which-seems-more-straightforward">two reasons</a>:</p><ul><li>Historical: The PR terminology originates from the <a href="https://git-scm.com/docs/git-request-pull">git request-pull</a> command, which is now rarely used.</li><li>Practical: If the PR was created from a fork, you cannot straightforwardly merge the underlying branch as it is on a different remote. What you need to do is to <em>pull</em> the changes from their repository into your repository via <a href="https://git-scm.com/docs/git-pull">git pull</a>. You can see the exact steps by looking at <a href="https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/checking-out-pull-requests-locally">GitHub’s instructions for merging a PR manually</a>.</li></ul><p>Anyway, from a terminology viewpoint, you <em>merge</em> PRs <a href="https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/merging-a-pull-request">even on GitHub</a>. Since I like the term MR more, I will use it throughout the rest of the blog post. Simply bear in mind that a MR and PR are the same concept.</p><h2><strong>How to Create Merge Requests</strong></h2><p>Our work starts with creating a MR.</p><h3><strong>Do a Self-Review Before Submitting a MR</strong></h3><p>The reviewer is not responsible for your carelessness. Before submitting a MR, you should go over your changes and:</p><ul><li>Ensure that the code works as expected by including tests for all the new and modified code.</li><li>Ensure that the code conforms to coding guidelines, including formatting.</li><li>Proofread variable and function names, comments, strings, etc. and check for grammar and typos.</li></ul><p>In general, when creating a MR, assume that there will not be any CR and the code will go straight into production, i.e. that you are the sole person responsible. That is, take extra care.</p><h3><strong>The Complicated the MR the More Detailed the Description Should Be</strong></h3><p>Try to put yourself into the reviewer’s shoes. If I were to review code, what information would help me in the process? A few examples:</p><ul><li>Describe design and implementation decisions.</li><li>What were the major issues?</li><li>Why did you decide to solve them in a particular way?</li><li>Were there any other options?</li><li>Are there any problems to discuss?</li><li>Is there anything that needs to be done when deploying the code?</li><li>Include any relevant tickets from your bug-tracking system.</li></ul><p>As the author of the code, it is your responsibility to make the MR as reviewable as possible.</p><h3><strong>Make Commits in a MR Read Like a Story</strong></h3><p>Who says that programmers cannot be writers? From my code-reviewing experience, being able to go over the commits from the bottom to the top and seeing the connection between them facilities the review process. Otherwise, it forces the reviewer to look at all changes together, which may be much more difficult if the MR is big.</p><p>This also means that each commit should be <a href="https://www.google.com/search?q=git+atomic+commit">atomic</a>. In short, an atomic change revolves around a single topic and one topic only. This means that you should separate <a href="https://en.wikipedia.org/wiki/Code_refactoring">refactoring</a>, adding new functionality, and fixing the current code into separate commits. The advantages that you get by creating atomic commits are outside the scope of this blog post, so let us move on to the next tip.</p><h3><strong>Do Not Be Afraid to Leave Comments by Yourself</strong></h3><p>If you want to discuss something with the reviewer, leave a comment. Sometimes, you may not be sure about a change or would like to debate over several possible approaches. This is fine. However, leaving a comment is not a way to excuse your negligence. Always do your due diligence and come prepared into discussions.</p><h3><strong>Larger Changes/MRs Should Be Pre-Approved</strong></h3><p>This should be done to minimize the risk of them not being accepted. Before opening a huge or controversial MR, reach out to the authors of the code and get their pre-approval. In this way, it is less likely that your work will come in vain.</p><p>An extra tip: When in doubt, ask for a concept review to verify that the way you have decided to go has potential. In this case, the MR does not have to be complete or have tests. It can only be a draft to show your idea.</p><h3><strong>Every Comment From the Reviewer Should Make You Think</strong></h3><p>Comments from the reviewer should make you wonder: Why have I not thought about that? How can I improve the code, MR, etc. in the future? If your reaction to a comment is <em>“Oh, no, I was afraid that they were going to find out.”</em>, you are wasting reviewer’s time. As advised earlier, if you are honestly not sure about something, you should raise a comment by yourself instead of calculating on not getting caught.</p><h3><strong>Include Only Directly Related Changes</strong></h3><p>Do not include irrelevant fixes of typos, formatting changes, etc. In general, do not solve multiple issues in the same MR. It makes the MR bigger and harder to review (<em>“What is this change doing here? Oh, it fixes a separate issue.”</em>). Also, by putting unrelated changes into separate MRs, you enable reviewers to go over them in parallel. For example, the harder of the two MRs may be reviewed by someone with more experience and the easier one can be reviewed by a junior who is getting familiar with the project. If you put several unrelated changes into the same MR, how would you make that possible?</p><h3><strong>Consider Squashing Minor Fixes via Interactive Rebase</strong></h3><p>Instead of including commits like <em>“Fix typo in the previous commit.”</em>, consider squashing them into the original commit via <a href="https://git-scm.com/book/en/v2/Git-Tools-Rewriting-History">interactive rebase</a>. However, since interactive rebasing changes history, it might be unwanted as it requires you to do a forced push, which can make subsequent reviews harder. It all depends on your preferred way of doing reviews and dealing with comments. Some people like that, some do not.</p><h3><strong>Accept the Fact That Not All MRs Will Be Merged</strong></h3><p>Sometimes, you find that your proposed change is not the way to go. C’est la vie. Learn from that experience and move on.</p><h2><strong>How to Review Merge Requests</strong></h2><p>After a MR has been submitted, it is time to review it.</p><h3><strong>What to Focus On</strong></h3><p>There are lots of areas that you can focus on during a review. What I recommend is to focus on the most important aspects first, and then move to the less-critical ones. Who cares if there is a typo or incorrect indentation when there is a security hole or when the code does not do what it is supposed to do?</p><p>Let me divide the aspects you should focus on into four categories P1 through P4, depending on their priority. Each category also includes sample questions that you should be asking.</p><p><strong>P1:</strong> Does the code do what it should and does not do something it should not do?</p><ul><li>Does the project work and do all the tests pass?</li><li>Are there tests for the new code?</li><li>Has the documentation been updated?</li><li>What about backward compatibility? Are there any specific actions needed, like increasing the version number or changing the database schema?</li></ul><p><strong>P2:</strong> Is the code safe?</p><ul><li>Are errors correctly handled?</li><li>Is it impossible for the program to crash?</li><li>Is the code free of security flaws?</li><li>Is the code thread-safe?</li><li>Are there no resource leaks, like <a href="https://en.wikipedia.org/wiki/Memory_leak">memory leaks</a>?</li></ul><p><strong>P3:</strong> Is the code readable, maintainable, and not needlessly inefficient?</p><ul><li>Does the code fit into the project or was it hacked there (e.g. via <a href="https://en.wikipedia.org/wiki/Shotgun_surgery">shotgun surgery</a>)?</li><li>Is there a more idiomatic way of writing something?</li><li>Can the code be shortened by using existing libraries?</li><li>Is there no duplication?</li><li>Are there no useless things that unnecessarily slow down the code?</li></ul><p><strong>P4:</strong> Does the code conform to project’s coding conventions?</p><ul><li>Spaces vs tabs.</li><li>No useless trailing whitespace.</li><li>Naming of variables (<code>snake_case</code> vs <code>camelCase</code>).</li><li>Code formatting in general (placement of curly braces, line wrapping, etc.).</li><li>Typos and grammar in strings and comments.</li></ul><h3><strong>Be Respectful, but Brutally Honest</strong></h3><p>If there is something wrong, it is your duty to report it, but in a respectful way. Withholding an issue only because you are afraid that the other side might get upset is plain wrong.</p><h3><strong>You Are Reviewing the Code, Not the Person</strong></h3><p>So let us not get personal. For example, instead of <em>“You have made a mistake here.”</em>, write <em>“I believe this should be X because of Y. Could you please verify?”</em>.</p><h3><strong>Strive to Make Useful and Informative Remarks</strong></h3><p>…and leave the useless ones at home. In general:</p><ul><li>Include a reason <em>why</em>. If you do not like the current approach, explain why, and be as specific as possible.</li><li>If you criticize something, include an alternative way to consider. Stay away from mindless bashing.</li><li>Include links to supportive material, like articles or talks. If there is an issue that is described somewhere else, then there is no need to get into details. A simple link suffices. If there is no article and you have already seen the issue several times, consider writing one yourself.</li><li>Ask questions if you do not understand something. Do not pretend that you were able to grasp everything just to save face. Always strive to learn. Also, the fact that you do not understand something can mean that there might be a bug or the code is not self-explanatory enough. Ask for clarification.</li><li>Ask questions to make the MR creator think (e.g. <em>“What happens if this function fails and returns a null pointer?”</em>).</li><li>Report issues properly. Include steps to reproduce, expected behavior, and actual behavior.</li><li>An advanced tip: Consider reporting an issue by crafting a failing test. A failing test includes everything from the point above and allows the other party to directly include it into the codebase.</li></ul><h3><strong>Show Honest Appreciation</strong></h3><p>Remember that it has to be genuine and specific. That is, it should not be cheesy or generic. Examples:</p><ul><li><em>“Cool, I did not know about </em><a href="https://docs.python.org/3/distutils/apiref.html#distutils.util.strtobool"><em>distutils.util.strtobool()</em></a><em>. Nice!”</em></li><li><em>“Thank you for analyzing the referential Perl code, it must have been hard.”</em></li><li><em>“I have learned a new word today (‘spuriously’), thanks!”</em> (From a <em>spurious test fail</em>.)</li></ul><h3><strong>Always Leave a Comment</strong></h3><p>Even if only a plain and simple <em>“LGTM :thumbsup:”</em>. Merging a MR without any comments may leave the impression that you did not even bother looking at the code.</p><h3><strong>Mind the Wording</strong></h3><p>Pay close attention to the words that you choose. Recommendations:</p><ul><li>Use <em>“I suggest”</em> or <em>“Consider”</em> for non-critical issues.</li><li>Use <em>we</em> and <em>us</em> instead of <em>I</em> and <em>you</em> (<a href="https://en.wikipedia.org/wiki/Extreme_programming_practices#Collective_code_ownership">collective code ownership</a>).</li><li>Prefix minor issues with <em>“Nitpick:”</em> so the author sees that you are just being thorough.</li></ul><h3><strong>One MR Can Be Reviewed by Multiple People</strong></h3><p>Changes to critical parts of the code should be reviewed by multiple people. Also, if you have been assigned to review a matter in which you have only limited experience, do not be afraid to ask for help.</p><h3><strong>Finish the Review in a Timely Manner</strong></h3><p>Do not wait a month to do the review. First, it discourages people from contributing to your code. Second, it prolongs the review process as everybody needs to get familiar with the code after not seeing it for a while. If doing a self-review before submitting a MR is the author’s responsibility, finishing reviews in a timely manner is the reviewer’s responsibility.</p><p>Additionally, if you are the author, either respond to the comments on time, or write that you are unable to do so. In that way, project maintainers can either do the changes themselves (if the MR is important) or close the MR.</p><h2><strong>How to Discuss Comments</strong></h2><p>Finally, both the MR author and reviewer need to be able to effectively discuss comments.</p><h3><strong>Show Appreciation</strong></h3><p>It feels good to be appreciated. It also shows the author or reviewer that you welcome their comments. Examples:</p><ul><li><em>“A very good point.”</em></li><li><em>“Nice catch!”</em></li><li><em>“I did not know about that, thank you!”</em></li><li><em>“The proposed alternative is indeed better. Let’s use it.”</em></li></ul><h3><strong>Do Not Take Comments Personally</strong></h3><p>It is (well, should be) the code that is being discussed, not you. So, do not take comments personally. The fact that you have made a bug or missed something does not make you a bad person. Do not feel sad about it. Learn from your mistakes and always try to do better in the future.</p><h3><strong>Do Not Be Afraid to Disagree</strong></h3><p>A CR should be a discussion, not a list of commands. However, should you disagree, explain <em>why</em>. And please, let the reason not be <a href="https://www.flickr.com/photos/72665859@N03/6558098435"><em>“Screw it, I am too lazy to do that”</em></a> or <a href="https://github.com/pypa/twine/issues/153#issuecomment-168131494"><em>“I decided I do not care”</em></a>.</p><h3><strong>Do Not Be Afraid to Ask for Help</strong></h3><p>You can invite other people into the discussion and ask for their opinion. However, beware of the <a href="https://en.wikipedia.org/wiki/Law_of_triviality">Law of triviality</a> (also known as <em>bikeshedding</em>), which states that people give disproportionate weight to trivial issues.</p><h3><strong>Add a Reaction to All Comments and Mark Discussions As Resolved</strong></h3><p>Explain how each issue has been resolved. This is helpful when someone else (or even you) stumbles upon the issue in the future and would like to see how it has been resolved and why.</p><p>For trivial issues, marking the discussion as resolved is enough though. Or even a simple thumbs-up emoji may often suffice.</p><h2><strong>Summary</strong></h2><p>To conclude the post, here is a recap of the most important tips for creating MRs and reviewing them:</p><ul><li>Do a self-review before submitting a MR.</li><li>Try to make the MR as reviewable as possible.</li><li>Every comment from the reviewer should make you think.</li><li>Focus on the most important aspects first.</li><li>Strive to make useful and informative comments.</li><li>Focus on the code and leave personal issues behind.</li><li>Show honest appreciation.</li><li>Do not be afraid to disagree.</li></ul>

The post provides tips for creating and reviewing merge requests (also known as pull requests). These tips will allow you to step up your game and manage the process like a pro.

Petr Zemek

Posts by Petr Zemek

RetDec v4.0 is out

Tips for creating merge requests and doing code reviews