A Fifteen-Year-Old Virus Still Rides a Fresh HTML Template
A Sality file infector first seen in 2010 is still being caught fresh in 2026, delivered through an HTML dropper template reused eight months apart at zero detections. The mismatch between a heavily-flagged payload and an invisible front door is the campaign's real tradecraft signature.
A Sality file infector first captured in mid-2010 is still circulating today, and the html page delivering it isn't old at all — it's a template reused just eight months apart, sitting at zero detections both times. The pairing is the real story here: a payload so well-documented that 56 of 76 engines flag it on sight, fed through a delivery artifact so unremarkable that VirusTotal's entire detection industry walks past it.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read