Reported by 2 outlets

Timeline

1. original reporting

   Cybercriminals Can Now Rent Malware That Re-Encrypts Itself to Keep Evading Antivirus

   cyberpress.org · 60d ago · August 14th, 2026

   Cybercriminals are renting services that help malware change its appearance and avoid detection. Cruciferra, a crypter-as-a-service platform linked to campaigns that used tax-themed emails to target victims, including Indian taxpayers and finance professionals. The service is not the final malware. Instead, it wraps harmful programs in a protective layer, making them harder for antivirus products to recognize before execution. This model lowers the barrier for crime. An operator can buy or rent access, upload a remote-access trojan , information stealer, or ransomware payload, and receive a protected file. The criminal does not need to build advanced evasion code from scratch. That turns specialist tradecraft into a subscription product and lets unrelated groups use the same hiding service. Rental Malware Defeats Antivirus A crypter encrypts or obscures the real payload. When a victim opens the file, a small component called a stub decrypts the payload and loads it, often directly into memory. Traditional antivirus tools commonly rely on known file patterns, hashes, and signatures. If the outer file changes for every build, those fixed indicators become less useful. The most advanced services do more than use one encryption key. They can create different decryption routines, alter code flow, add harmless-looking data, and modify how Windows functions are called. MITRE ATT&CK Enterprise tactics and techniques described in crypting advertisements (Source: Recorded Future) This

2. update from gbhackers.com

   24 Malware Crypter Sellers Turn EDR Evasion and In-Memory Execution Into Paid Services

   gbhackers.com · 60d ago · August 14th, 2026

   A growing underground market is turning mature malware-evasion techniques into subscription products. An analysis of 24 active crypting-service vendors shows that customers can now buy payload obfuscation, in-memory execution, anti-analysis controls, process injection, persistence, and rapid “re-crypting” as packaged services rather than develop them internally. Crypting traditionally refers to encrypting or obfuscating a customer-supplied malicious […] The post 24 Malware Crypter Sellers Turn EDR Evasion and In-Memory Execution Into Paid Services appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .