My research involves malware reverse engineering, cybercrime and scam investigations, as well as open-source software security. It’s easiest to find my most recent write-ups on the following news outlets and tech blogs:

https://www.bleepingcomputer.com/author/ax-sharma/

https://sonatype.com/blog/author/ax-sharma

https://www.csoonline.com/profile/ax-sharma/

https://www.wired.com/author/ax-sharma/

https://arstechnica.com/author/axsharma/

https://techcrunch.com/author/ax-sharma/

Malware discovery and analyses:

  1. Revived CryptoJS Library: A Crypto Stealer in Disguise 
  2. Open source components hijacked and turned into infostealers
  3. Fake Microsoft VS Code extensions abusing ScreenConnect to deploy spyware
  4. Python cryptomining malware on PyPI registry aka “Warehouse”
  5. Exploit creator selling 250+ malicious components on Telegram.
  6. Fake “Browserify” component with Linux, macOS zero-detection ELF malware
  7. Malicious dependency confusion copycats exfiltrating /etc/shadow and .bash_history targeting Amazon, Lyft, Zillow, Slack, etc.
  8. Discovered/analyzed “an0n-chat-lib“, “discord-fix”, “sonatype” typosquatting malware from CursedGrabber malware authors
  9. Malicious RubyGems “ruby-bitcoin” and “pretty_color” laced with cryptocurrency (Bitcoin, Monero, ETH) stealing malware
  10. njRAT/Bladabindi Windows malware discovery/analysis on npm registry in “jdb.js” and “db-json.js” packages.
  11. CursedGrabber Windows malware analysis (“xpc.js”) with Sonatype Security Research team
  12. “discord.dll“, “discord.app”, “ac-addon”, “wsbd.js” malware discovery and analysis
  13. “twilio-npm” brandjacking malware
  14. “electorn“, “loadyaml” typosquatting malware analysis
  15. “fallguys” malware technical analysis

Vulnerability deep-dive analysis and blogging

  1. GitHub-hosted malware calculates Cobalt Strike payload from an Imgur picture
  2. Bouncy Castle authentication bypass due to incorrect password hash matching algorithm
  3. NodeJS module downloaded 7M times lets hackers inject code
  4. Linux malware authors use Ezuri Golang crypter for zero detection
  5. PoC exploits for Apache Flink Path Traversal vulnerabilities
  6. Why streaming a video could freeze Microsoft IIS servers?
    .
    .
  7. Many many many more on BleepingComputer and Security Report.

Reported CVEs and Vulnerabilities:

NOTE: This may not be an exhaustive list because of “good faith” responsible disclosure agreements and ongoing vulnerability research pending disclosure.

Published Papers and miscellaneous works: