Detect Maldocs, Document Exploits & AI Prompt Injections in Milliseconds

# Synchronous in-memory scan with zero file retention (?store=false)
curl -X POST "https://api.malwaretracker.com/v1/scan?store=false" \
  -H "X-API-Key: mt_live_YOUR_API_KEY" \
  -F "file=@attachment.pdf"

# Response (38ms):
{
  "verdict": "malicious",
  "rating": 3,
  "score": 29,
  "scan_time_ms": 38.4,
  "zero_retention": true,
  "threat_intel": {
    "cves": ["CVE-2025-8088"],
    "mitre_attack": ["T1059", "T1203"],
    "streams_analyzed": 14
  },
  "ai_safety": {
    "safe": false,
    "prompt_injection_detected": true,
    "findings": [
      {
        "rule": "ai_pdf_invisible_or_zero_font_text",
        "description": "AI/RAG evasion: PDF stream uses invisible text rendering mode (3 Tr)"
      }
    ]
  }
}

// Next.js / Express Upload Verification
export async function verifyUploadedDocument(fileBuffer, filename) {
  const form = new FormData();
  form.append("file", new Blob([fileBuffer]), filename);

  const res = await fetch(
    "https://api.malwaretracker.com/v1/scan?store=false",
    {
      method: "POST",
      headers: { "X-API-Key": process.env.MALWARETRACKER_API_KEY },
      body: form,
    }
  );
  const report = await res.json();
  if (report.verdict !== "clean" || !report.ai_safety.safe) {
    throw new Error(`Upload rejected: ${report.verdict} (${report.threat_intel.cves.join(", ")})`);
  }
  return report;
}

import requests

def scan_document_before_ingestion(file_path: str, api_key: str) -> dict:
    with open(file_path, "rb") as f:
        resp = requests.post(
            "https://api.malwaretracker.com/v1/scan",
            headers={"X-API-Key": api_key},
            params={"store": "false"},
            files={"file": f},
            timeout=15,
        )
    resp.raise_for_status()
    data = resp.json()
    if data["verdict"] != "clean" or not data["ai_safety"]["safe"]:
        raise PermissionError(f"Blocked untrusted document: {data['verdict']}")
    return data

# Tier-0 Static Triage for Tines, Shuffle, n8n, or Cortex XSOAR
curl -X POST "https://api.malwaretracker.com/v1/triage" \
  -H "X-API-Key: mt_live_YOUR_API_KEY" \
  -F "file=@reported_phish.doc"

# Routing Verdict:
{
  "verdict": "malicious",
  "rating": 3,
  "escalate_to_sandbox": true,
  "recommended_action": "quarantine_and_detonate",
  "ai_prompt_injection": false,
  "cves": ["CVE-2025-24071"],
  "mitre_attack": ["T1187", "T1203"],
  "scan_time_ms": 24.1
}

# Download commercial Pro Exploit CVE & AI Safety YARA bundle
curl -sSL "https://api.malwaretracker.com/v1/rules/pro" \
  -H "X-API-Key: mt_live_YOUR_PRO_KEY" \
  -o quicksand_pro_rules.yara

# Run locally with open-source QuickSand CLI:
quicksand -e quicksand_pro_rules.yara suspicious.doc