RL Blog

Securing Frontier AI: ReversingLabs Is Part of Anthropic’s Expanded Cyber Verification Program

As an early participant in Anthropic's Cyber Verification Program, ReversingLabs is helping advance a new approach to AI-powered cyber defense—combining frontier AI capabilities with deep file and software intelligence.

The AI Cyberattack Surge Hasn't Arrived. But the Warning Signs Are Growing.

New ReversingLabs data finds that LLM API references in malicious files remain uncommon even as their counts rise. The clearest signals are in specific attack steps—not an autonomous cybercrime takeover.

Binance heist: a fake interview, a trojanized pyenv, and what RL sees

Updated November 4, 2026: Binance’s disclosed intrusion chain mapped to ATT&CK, the FBI attribution, and what RL data confirms, contradicts or adds.

The Sky Is Falling (Again): What PHP2Shell Says About AI, The Disclosure Process, and Security

Threat Researcher’s Notebook: How Attackers Redirect Crypto Payments

This blog discusses the general trend of Clipbanker malware, why they can be successful, what specific samples look like, and how to avoid them.

Researchers Break Into Anthropic’s Systems in Just 12 Hours—Through Third-Party Software

AI-powered security researchers gained access to sensitive Anthropic business systems through third-party applications, highlighting a growing enterprise security blind spot.

Graphalgo campaign moves upstream into infrastructure as code

First reported by ReversingLabs in February, the malware has moved to Terraform providers and Go modules. Here’s what you need to know.

Why the Tools You Already Own Won’t Make You PQC-Ready

Source scanners, SBOMs, certificate managers and questionnaires all answer a different question — and none of them inspects the software that shipped.

How RL mapped a Midnight Blizzard-linked campaign from two hashes

ReversingLabs expanded the published hashes into a staging server, five stagers, two lure files and the domain-to-server links.

The Next MOVEit May Already Be in Your File Transfer Queue

MFT and other trusted systems collect files, access and connections. Patching and inspecting what moves through it are separate defenses.

What a CBOM Is — and Why an SBOM Won't Answer the Quantum Question

Post-quantum readiness depends on knowing where cryptography lives in the software you run, and a list of components can't tell you that.

AI coding agents expose developer screenshots on GitHub repos

PixelLeak exposures included many sensitive documents, highlighting why inventories of what agents can reach and publish are needed.

What RL Found Before Anthropic’s Midnight Blizzard Report

ReversingLabs identified and classified the malware weeks before the report was published — showing why behavioral intelligence and historical telemetry matter in the AI age.

CRA compliance will be judged by the binary you ship

With the EU Cyber Resilience Act’s Article 14 reporting requirements now live, executives need evidence drawn from the final software artifact.

Dependency installation security measure already defeated on npm

New btree malware bypasses the install script, negating the popular repo's measure barely two months after adoption.