Crypt / FUD
Crypting is the service of repacking malware until antivirus engines stop recognizing it. FUD, "fully undetectable", is the advertised result, sold with a guarantee and re-crypts included.
Why it matters to you
A signature is a snapshot of one crypt. This is why detection engineering favors behavior over hashes: the hash changes nightly by design.
Where we meet it
Crypting services advertise their detection rates like a benchmark, and re-crypt on a schedule. Watching the service is more durable than chasing the hashes it produces.
Connected terms
Traffer
The distribution worker of the stealer economy: drives victims to infected downloads via malvertising, fake installers, cracked software and phishing. Organized into teams with quotas and payout shares.
Partnerka
An affiliate program: the franchise model behind ransomware and stealer operations. The operator supplies malware and infrastructure; affiliates supply victims and split the revenue.
C2 panel
The web console an operator uses to run infected machines: victims listed, tasks queued, output collected. Sold with the malware, screenshotted in the advertisement, and often the most revealing artifact a crew produces.
ClickFix
A lure that tells the visitor the page is broken and asks them to fix it: copy this, press these keys, paste, run. The victim performs the delivery by hand, so nothing was downloaded and nothing was blocked.
Read elsewhere
More from the playbook
Adversary-in-the-middle phishing
A phishing page that proxies the real login instead of imitating it. The victim authenticates against the genuine site through the attacker's server, completes multi-factor as normal, and the attacker keeps the resulting session cookie.
Business Email Compromise (BEC)
Fraud committed from inside a real mailbox: the attacker reads the thread, waits for an invoice and answers it with different bank details. No malware, no attachment, nothing for a scanner to find.
Callback phishing
An email that carries no link and no attachment, only a plausible invoice or subscription notice and a phone number to dispute it. The attack begins when the victim calls, and the person who answers walks them into installing remote access software.
Checker
A tool that tests stolen credentials against a target service in bulk and sorts the live ones from the dead. The industrialized step between a combolist and an account takeover.