Check Point Research
@_CPResearch_

Fighting cyber threats one research at a time. News from Check Point’s (@checkpointSW) Research team.

 The Internet
research.checkpoint.com
Joined April 2018
144 Photos and videos
Can you detect adversarial prompts with just a quick LLM and an eye for Base64, Morse code, and similar artifacts? We show the answer is no: some plain English prompts mean one thing to a quick LLM and a completely different thing to a high-reasoning model. research.checkpoint.com/2026…

PuzzleMask: Abusing Plain Prose as a Covert AI Attack Vector - Check Point Research

A prompt-crafting technique for bypassing quick LLM policy enforcement in plain English (no emojis, base64, invisible unicode, etc.)

research.checkpoint.com
1
13
43
9,186
What if isolated #ChatGPT sessions could secretly exchange data? 🤔 🔓A shared internal service became a covert channel between accounts, enabling attackers to execute hidden tasks and access the victim's data and connected apps. Read more 👇 research.checkpoint.com/2026…

The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT - Check Point...

Research by: Alexey Bukhteyev Key Takeaways Introduction Over the past several years, AI assistants have moved far beyond text generation. Modern systems can execute code, install additional depend...

research.checkpoint.com
10
21
5,244
From local banking trojans to foreign 🇨🇳 operators targeting Brazil 🇧🇷. CPR uncovered #GamblingGoblin, a Chinese-speaking actor abusing Brazilian government sites for large-scale #SEO fraud. Read more 👇: research.checkpoint.com/2026…

Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO...

Research by: Amit Yardeni Key Points Introduction Since mid-2025, Check Point Research has tracked a sustained campaign against Brazilian organizations. The tradecraft points to a Chinese-speaking...

research.checkpoint.com
25
62
7,621
#JSCeal didn't give up its secrets willingly. Following our #BlackHat2026 talk, we're releasing Breaking the Seal: our research on statically deobfuscating compiled, obfuscated #V8 #malware. Inside: the methodology, the open-source toolkit, and the malware capabilities recovered along the way. research.checkpoint.com/2026…

Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode - Check Point Research

Research by: hasherezade Key Points Introduction JSCeal is a stealer delivered as compiled V8 bytecode (.jsc) and executed by a bundled Node.js runtime, targeting cryptocurrency applications (other...

research.checkpoint.com
22
57
23,993
⚒️ BTR Reforged: Weaponizing Defender's Remediation Driver as a Kernel Operation Primitive ⚠ Trusted Remediation Primitives with Undocumented Internals. 🔓 15+ years. Unchanged. Unblockable. 🤔 What if an attacker learned its language? We did. 👇 research.checkpoint.com/2026…

BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive - Check...

Research by: Jiří Vinopal (@vinopaljiri) Abstract What if a trusted security component could be repurposed into an attacker-controlled kernel primitive? What if a signed Microsoft remediation driver...

research.checkpoint.com
3
25
58
26,072
#StopAndProtect blends ransomware, data theft and hands-on keyboard control. 🥷OPSEC failures reveals logs from over 6,000 victim IPs 📰Thousands of hacked WordPress websites used to lure victims and host operation infrastructure 📱 Custom stealer uses WhatsApp web and desktop to search & exfiltrate results Read more 👇: research.checkpoint.com/2026…

Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect - Check Point Research

Research by: Jaromír Hořejší (@JaromirHorejsi) Key points Introduction We first noticed a ransomware family called StopAndProtect in the middle of May 2026. Further analysis of the infrastructure...

research.checkpoint.com
1
16
28
5,919
0-Day Used by Lazarus in #DreamJob Campaign Against Defense Sector: 💥LPE vulnerability in Microsoft’s Afd.sys driver (CVE-2026-68820) 🧰New tools, including #Troy backdoor 🌍Compromised Roundcube servers (CVE-2025-49113) as infrastructure Read More : research.checkpoint.com/2026…
2
83
310
36,214
FrostFalak, a Yemen-based threat actor targeting Israeli OT networks, uses Israeli VPN exit nodes and compromised network appliances to conceal its activity while targeting construction, transportation and building management organizations.
2
5
16
5,835
OPSEC failure revealed the attacker's IP : 176[.]123.22.88 (Yemen[.]net, YE)
1
3
3,230
Good Luck @vinopaljiri , We're proud of you!
Jiří Vinopal
@vinopaljiri
Jul 25
I'm super excited to be speaking at Black Hat USA 2026, delivering my research "BTR Reforged: Weaponizing Defender's Remediation Driver as a Kernel Operation Primitive" 🤗💪 Big thanks @_CPResearch_ & @BlackHatEvents! 💯 Join me: app.ingo.me/q/ktqyt #BHUSA #cybersecurity
12
6,711
🇮🇷 Cavern Manticore: Exposing Iran-Linked Modular C2 Framework CP<r> reveals: 🎯 Israeli Gov & IT sector targeted 🧩 Novel modular "Cavern" C2 framework, 3 .NET formats 🕵️ Iran-nexus; MOIS ties to MuddyWater & Lyceum 👻 Most samples: zero VT hits research.checkpoint.com/2026…

Cavern Manticore: Exposing Iran-Linked Modular C2 Framework - Check Point Research

Key Points Introduction Since early 2026, Check Point Research (CPR) has tracked a new modular command-and-control framework used by Cavern Manticore, an Iran-nexus APT group primarily targeting...

research.checkpoint.com
2
14
55
17,842
🚪 Foothold via abused RMM tools already deployed 🧬 Dissection traces evolution "Cav3rn" (non-modular) ➡️ modular "Cavern" 🛠️ New IDA plugin & how-to for NativeAOT malware 🤬 Full code structure + cursing errors & typos: a human, not an AI bot
1
5
4,400
Can a website turn into ransomware on Android? We found an AI-generated malware sample that suggests the answer is closer to "yes" than many would expect. No exploit. No APK. No native malware. 👇 research.checkpoint.com/2026…

Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique - Check Point...

Research by: Alexey Bukhteyev Key Takeaways Introduction Over the past several years, large language models have reshaped software development, and malware development has followed the same path....

research.checkpoint.com
1
9
23
6,483
Fake trust is attacker infrastructure: GitHub starts, YouTube views, news websites and even "safe" VirusTotal comments to sell legitimacy. research.checkpoint.com/2026……

From Stars to Upvotes: Fake Reputation Fueling a Crypto Clipboard Hijacker - Check Point Research

Key Points Introduction In this research, we analyze a clipboard hijacker campaign that is hidden inside a collection of “solutions” and “tools” that claim to give users an unfair advantage. These...

research.checkpoint.com
6
18
8,388
Lookalike Ghidra, dnSpy, and other download sites turned trusted clicks into TDS redirects. CPR found click hijacking, gated routing, and multiple malware families downstream — including an evasive, previously undocumented framework we call SessionGate. research.checkpoint.com/2026……

Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem - Check Point...

Research by: Alexey Bukhteyev Key Takeaways Introduction When we search Google for a popular piece of software, we usually click the first result, sometimes without even looking at the rest, because...

research.checkpoint.com
1
24
42
10,081
Iranian threat actor #NimbusManticore rapidly developed its tooling, introducing the AI-assisted MiniFast backdoor and new delivery methods including trojanized software and SEO-poisoned sites. Read More --> research.checkpoint.com/2026…

Fast and Furious - Nimbus Manticore Operations During the Iranian Conflict - Check Point Research

Key Findings Introduction During the recent geopolitical tensions in the Middle East, we reported on multiple Iran-nexus threat actors advancing Iran’s strategic objectives through cyber operations....

research.checkpoint.com
2
26
80
12,147
Load more