Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Daniel Stepanic
New North Korean campaign uses fake coding interviews to steal developer credentials
• DPRK-aligned hackers hid malware inside SVG flag images to backdoor developer job interview coding tests. Not one antivirus vendor caught it. 9 min readThreat Intelligence, Malware Analysis Elastic Security Labs found a new Contagious Interview campaign, tracked as REF9403, hiding malware inside SVG image files using steganography. To our knowledge, this specific infection chain has not been previously documented.
Lost in relocation: analysis of a new loader distributing CASTLESTEALER
A previously undocumented Windows loader tracked as OXLOADER is delivering the CASTLESTEALER infostealer via malicious Google Ads, with low detection rates across static engines and sandbox detonations. The loader uses several obfuscation layers (control-flow flattening, opaque predicates, mixed Boolean-Arithmetic), self-modifying decryption stubs, and abuses the Windows .reloc section to stage shellcode.
TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook
•••• REF3076 uses a trojanized Logitech installer to deploy TCLBANKER, a Brazilian banking trojan with environment-gated payloads, WPF fraud overlays, and self-propagating WhatsApp and Outlook worm modules. 18 min readMalware Analysis, Threat Intelligence Elastic Security Labs identified a new Brazilian banking trojan that we are tracking as TCLBANKER, a malware family we assess is a major update of the MAVERICK/SORVEPOTEL family.
Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT
••• Elastic Security Labs uncovers a novel social engineering campaign that abuses the popular note-taking application, Obsidian's legitimate community plugin ecosystem. The campaign, which we track as REF6598, targets individuals in the financial and cryptocurrency sectors through elaborate social engineering on LinkedIn and Telegram.
From Invitation to Infection: How SILENTCONNECT Delivers ScreenConnect
TrademarksTerms of UsePrivacy This website and all associated content, software, discussion forums, products, and services are intended for professional use only. No consumer use of this website or its content is intended or directed. Elastic, Elasticsearch, and other related marks are trademarks, logos, or registered trademarks of Elasticsearch B.V. in the United States and other countries.
BADIIS to the Bone: New Insights to a Global SEO Poisoning Campaign — Elastic Security Labs
Introduction In November 2025, Elastic Security Labs observed an intrusion affecting a multinational organization based in Southeast Asia. During the analysis of this activity, our team observed various post-compromise techniques and tooling used to deploy BADIIS malware onto a Windows web server. These observations align with previous reporting from Cisco Talos and Trend Micro from last year.
Upward leap: Growing through enriching experiences at NTT DATA
Navigating the professional landscape offers its share of challenges and triumphs. At NTT DATA, I've experienced this journey firsthand, seeing the company evolve while taking part in its growth. And let me tell you — it’s been quite a ride! Over the past 12 years, I’ve seen and been part of many dynamic shifts, including the acquisitions of many companies. And while change can seem daunting, the experience has been enriching for me.
Extract and analyze Cobalt Strike beacon payloads with Elastic
Elastic Security engineers have documented a less tedious way to find network beaconing from Cobalt Strike. In their full analysis ([1] [2]), Elastic Security team researchers Andrew Pease, Derek Ditch, and Daniel Stepanic walk users through the Elastic fleet policy, how to collect the beacon, beacon configuration, how to analyze its activity, and how you can set it up in your organization’s environment.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Daniel
Contact Daniel, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack