Reverse engineering · Tooling
Reverse engineering Vidar Stealer 3.2
Inside Vidar's configuration and communications, with an offline toolkit built from the analysis.
Investigations & field notes.
I’m Ali, an application security engineer and security researcher. I investigate web vulnerabilities, reverse engineer malware, and build tools to understand what I find.
Selected investigations
A place to startScam investigation
A stupidly effective crypto stealer
A spam comment leads to a fake bonus, a malicious userscript, and a payload hosted in Google Sheets.
More research
All writingReverse engineering the Terrabot worm
Full analysis of the Terrabot botnet dropper: multi-arch payloads, CVE-2026-0073 ADB exploitation, web shell attacks, and detection rules.
Account takeover on Childsmath
A CSRF vulnerability on ChildsMath’s profile update endpoint that enabled stored XSS via unsanitized name fields. The injected script persisted across every page in the application, and the same request could change the recovery email to execute a full account takeover.
Bypassing SameSite cookie protections on Chrome
How Chrome’s ‘Lax + 2 minute’ cookie intervention opened a CSRF window on ChildsMath, a math learning platform used by McMaster University students, letting an attacker silently redirect a student’s grades to an attacker-controlled email.
The dangers of No-Code
A no-code BJJ tracker built on Base44 enforced all of its authorization in the browser. Here is the chain of six issues that let anyone with a browser read every user’s data, deface the site, and take over accounts.
Account takeover on ReadWise
A critical CSRF vulnerability in a popular reading platform’s email change endpoint that required nothing more than a single click to fully hijack an account.