Censys outlines a layered approach to finding brand impersonation across certificates, domains, web content, and infrastructure, then clustering related hosts, monitoring findings, and preparing evidence-based takedowns.
Censys added 22 protocol and endpoint scanners in September, highlighting exposed Cisco SD-WAN, fuel controllers, alarm systems, Hikvision recorders, STOMP brokers, and Pigeonhole services, with security risks and advice to check exposure and patch systems.
Censys uncovered live DarkSword/Coruna infrastructure, iOS wallet-theft modules, and evidence of a distinct Chinese-speaking operator. An iOS 26 exploit chain is under development but not deployed.
Censys introduced nine skills that help AI coding assistants use its cencli to support security investigations, including infrastructure pivots, vulnerability exposure checks, and phishing-site discovery.
Censys identified 131 internet-exposed Mythic hosts and analyzed their fingerprints and infrastructure. One cluster showed evidence of custom implant development and Discord-based C2; the article also outlines detection opportunities for defenders.
A Censys scan-based investigation identified AI-built education apps collecting student data, including homework photos, essays, voice, and screen activity. Some lacked privacy policies; one exposed default demo credentials and shared a host with tunneling services.
Censys added 14 protocol and endpoint scanners, including for KNX/IP, Redshift, Tailscale DERP, and TVT camera controls, to help identify internet-exposed systems and prioritize security risks.
Censys reports about 134,000 Internet-exposed ICS hosts in early 2026, with roughly 70% on consumer or mobile networks. Carrier registration data can make it difficult to identify and notify the organizations responsible for exposed devices.
Censys finds about 17,500 NPS servers, mostly in China and Hong Kong. The dual-use tunneling tool has also been deployed alongside other remote access tools in intrusions, so NPS alone is not conclusive evidence of compromise.
A mobile DFIR walkthrough uses fictional Android and iPhone incidents, informed by Censys ARC research, to show how responders can investigate malware, credential theft, and exploit infrastructure through endpoint, identity, and network telemetry.
Censys traced a campaign using PowerShell loaders and unplayable MP4 carriers to deliver NetSupport clients. The analysis identified 18 builds across 40 live endpoints and describes the infection chain, persistence, C2 infrastructure, and detection clues.
Censys found Moobot source code, DDoS tooling, attack records, and a fraudulent identity-verification service in an exposed directory. The recovered code contains dormant download-and-execute functionality, and monitoring indicates ongoing Moobot activity.
Analysis of leaked ERMAC and HookBot code traces their shared lineage, details the Android banking trojans’ infrastructure and capabilities, and finds that a firewall gate leaves the builder exposed to scanning.
Censys finds Mirai-derived botnets recovering after 2026 takedowns, while exposed ADB services and outdated Boa software persist. The analysis links this resilience to insecure IoT supply chains, weak defaults, and limited consumer ability to update devices.
Censys announced Investigator, a closed-beta tool that automates threat-intelligence pivots and infrastructure analysis, returning ranked, evidence-backed findings. It uses AI for orchestration while keeping verdicts deterministic.