Analysis
MicrosoftSystem64: what it is and how to remove it
MicrosoftSystem64 is not part of Windows. It is a remote-access trojan that malicious npm packages install, now found inside working GitHub projects too.
4 min read
Analysis
How PolinRider works and how it changes, read closely from the published research.
November 2026
October 2026
Analysis
PolinRider's fake woff2 font that is really JavaScript
PolinRider hides its loader in files named like Font Awesome fonts, and it has gone by four names this year. The first four bytes give it away.
4 min read
Analysis
Found temp_auto_push.bat in your repository?
temp_auto_push.bat is the script PolinRider uses to rewrite your commits and push them. What it does, why git log hides it and which computer to check first.
4 min read