❌

Reading view

There are new articles available, click to refresh the page.

A Stock Fell 20%. I Used Claude to Investigate Why

A real case of Claude stock analysis: Rambus fell 21% after earnings. I pulled prices, news and EPS data from EODHD to separate facts from explanations.

When a stock drops 20% in one day, the internet gives you an answer within the hour.

The problem is that it gives you five of them. And they don’t agree.

On April 28, 2026, Rambus (RMBS) closed at $111.27. One session earlier it was at $141.31. Two sessions earlier, it was sitting at an all-time high of $158.40.

By the afternoon, the explanations were everywhere: earnings miss, analyst downgrade, AI bubble, OpenAI, memory shortage, “sell the news.”

So I ran an experiment. Instead of picking the story I liked best, I used Claude stock analysis on top of raw market data to answer one question:

What do we actually know, and what are we just guessing?

If you’re:

  • building AI agents for investment research,
  • writing a newsletter that explains market moves,
  • or just holding a stock that fell off a cliff,

this is the workflow worth stealing.

Why “Why Is This Stock Down Today?” Is the Wrong First Question

Most people start with the news. That’s backwards.

News is written after the price moves. Journalists see a red candle, call a few sources, look for a catalyst and publish. The headline is a hypothesis dressed up as a fact.

Here’s what happened when I pulled the RMBS news feed from EODHD for April 20 to May 5:

Look at the shape.

One article a day before the drop. Seven on earnings day. Eighteen on the crash day. Six the day after.

The news didn’t cause the move. The move caused the news.

And notice the numbers above the bars. EODHD’s normalized sentiment score for RMBS stayed positive the entire time, including +0.81 on the day the stock lost a fifth of its value. Most of the articles described a company with solid results, growing product revenue and strong cash generation.

Sentiment said “fine.” Price said “get out.”

That gap is where the real investigation starts.

The Reframe: Separate Facts From Explanations

An investigation into a price drop needs three buckets:

  1. Facts. Things the data proves. Prices, dates, reported numbers, documented events.
  2. Plausible explanations. Hypotheses consistent with the facts. Each one should come with what would confirm or refute it.
  3. Noise. Claims that don’t explain the move, or that contradict the data.

Humans are bad at keeping these apart. We read a convincing headline and promote it straight to bucket one.

Claude is good at this, if you give it the raw data and force the structure. Without data, an LLM will happily write you a confident story. With data, it becomes a very fast, very patient analyst that checks every claim against the numbers.

The model is not the edge.

The data layer is.

AI Stock Analysis Needs a Data Layer First

For this investigation I connected Claude to EODHD through its MCP server, so it could pull data directly during the conversation. Four datasets did all the work:

  • End-of-day prices for RMBS and a sector benchmark (SMH, the VanEck Semiconductor ETF)
  • Earnings calendar with actual EPS, consensus estimates and surprise %
  • Financial news API with full article text tagged by ticker
  • Sentiment API with a daily normalized score and article count

That’s it. No terminal, no scraping, no 15 browser tabs.

Want to run the same investigation on your own watchlist?
EODHD gives you prices, fundamentals, earnings, news and sentiment from one API (and an MCP server for Claude).
→ Try EODHD APIs

Step 1: Measure the Move Against the Sector

A 20% drop means nothing on its own. If the whole sector fell 18%, Rambus didn’t have a problem. The market did.

So the first thing I asked Claude to do was index RMBS against SMH.

This chart changed the whole story.

From March 27 to April 24, Rambus went up 76.5%. The semiconductor ETF went up 35.3%. From the March 30 low, RMBS had almost doubled (+98.7%) in four weeks.

The fall only makes sense next to the rise.

Then I zoomed in on daily returns:

Two things jump out:

  • Friday, April 24: RMBS +14.4% in a single day, ahead of earnings. The sector was up 5.1%.
  • Monday, April 27: RMBS fell 10.8% during regular trading. The earnings report came out after the close. The sector was flat (-0.04%).

That second point is the one most headlines skipped. A big chunk of the drop happened before anyone saw the numbers.

Peak to trough over two sessions: -29.8%. Against the sector, Rambus underperformed by 10.8 points on Monday and 18.3 points on Tuesday.

Step 2: Check What the Earnings Actually Said

Here’s what Rambus reported for Q1 2026 (after the close on April 27):

Management said results were “in line with guidance.” Q2 guidance implied roughly 11% sequential product revenue growth.

That doesn’t read like a disaster.

So I asked Claude to compare the numbers against consensus. And this is where it got interesting.

The sources didn’t agree on what “consensus” was.

  • EODHD’s earnings calendar: estimate $0.64, actual $0.63. A miss of 1 cent (-1.6%).
  • One widely syndicated analysis: estimate $0.62. A beat.
  • A Zacks headline the same evening: “Q1 Earnings and Revenues Beat Estimates.”

Same quarter. Same company. Miss or beat depending on who you read.

Claude flagged a second conflict on valuation: one article said RMBS was trading at roughly 48x this year’s earnings estimates, another said 63x forward earnings. Different estimate sets, different denominators.

And a third one, in a pre-earnings preview: it claimed Rambus’s product revenue guidance of $84M to $90M implied a “46 to 50 percent decline” from $166.7M a year earlier. But $166.7M was total revenue, not product revenue. Product revenue actually grew 15%. Claude caught the apples-to-oranges comparison in seconds because it had the reported figures right next to the claim.

This is the most useful thing an AI does in stock analysis. Not predicting. Cross-checking.

The 1-cent difference can’t explain a 21% drop. Whatever happened, it wasn’t the EPS number.

Step 3: Let Claude Sort the Evidence

With prices, earnings, news and sentiment loaded, I gave Claude one instruction: classify everything into facts, plausible explanations and noise. Here’s a condensed version of the output.

Facts (the data proves it)

  • RMBS rose 76.5% in four weeks into earnings, more than twice the semiconductor ETF.
  • It fell 10.8% on April 27 before the report, with the sector flat.
  • It fell another 21.3% on April 28, while SMH fell 3.0% and the Nasdaq 100 fell 1.0%.
  • Q1 EPS was within one cent of every consensus figure published.
  • Baird downgraded RMBS from Outperform to Neutral on April 28, with a $120 price target. Their reasoning: growing DRAM shortages could slow RDIMM unit growth into 2027, and Rambus is “a unit-driven top-line” without the benefit of higher pricing.
  • Late on April 27, a Wall Street Journal report said OpenAI had missed internal user and revenue goals. On April 28 the PHLX Semiconductor Index fell more than 3% intraday, after an 18-day winning streak.

Plausible explanations (ranked)

1. Positioning: buy the rumor, sell the news.
The stock priced in perfection. A +14% day right before earnings means buyers were paying for a blowout, not a solid quarter. “In line” was a disappointment relative to price.
Would confirm: other high-momentum chip names falling hard on the same day without bad results.
Would refute: RMBS falling while its peers rallied.

2. A forward-looking supply risk, made visible by the Baird note.
Management itself said back-end supply tightness would persist into 2027 and that the MRDIMM ramp depends on Intel and AMD platform timing. The downgrade gave the market a clean narrative for something already in the call.
Would confirm: weakness in later quarters tied to units, not demand.
Would refute: product revenue accelerating in Q2 and Q3.

3. Sector de-risking after the OpenAI report.
Yahoo Finance’s markets desk noted the selloff hit “the names that had already run the hardest”: Rambus, Arm, FormFactor, Navitas, Wolfspeed.
Would confirm: the same high-beta group underperforming together.
Would refute: RMBS being the only one down.

Noise

  • The EPS “miss.” One cent, and contested by other sources.
  • The new CFO appointment on April 29. It came after the drop.
  • “Canary in the coal mine for AI” takes. Possibly right in the long run, but not testable with this data.

Notice what Claude didn’t do: pick a single cause. A 21% drop is almost never one thing. It’s a crowded trade, a reason to sell and a sector mood all arriving at the same time.

Why Do Stocks Fall After Good Earnings?

Because the price already knew.

Earnings move stocks relative to expectations, and expectations live in the price, not in the consensus EPS. When a stock rallies 76% in four weeks, the real bar isn’t $0.64. It’s whatever number justifies the rally.

The best evidence for this came three months later.

On July 27, 2026, Rambus reported Q2 EPS of $0.64 against a $0.58 estimate. A clean 10.3% beat.

The stock fell 9.0% the next day and closed at $82.81 two sessions later.

A tiny miss crashed it. A real beat didn’t save it.

If you only read EPS surprises, this makes no sense. If you read price, positioning and guidance together, it does.

How to Reproduce This Claude Stock Analysis With Python

I ran the investigation interactively, with Claude connected to EODHD’s MCP server. Here’s the reproducible version as a script, using EODHD’s REST API and the Anthropic SDK.

pip install requests pandas anthropic
import os, json
import requests
import pandas as pd
import anthropic
EODHD_KEY = os.getenv("EODHD_API_KEY")
BASE = "https://eodhd.com/api"
TICKER, BENCH = "RMBS.US", "SMH.US"
START, END = "2026-04-17", "2026-05-01"
def get(path, **params):
params.update({"api_token": EODHD_KEY, "fmt": "json"})
r = requests.get(f"{BASE}/{path}", params=params, timeout=30)
r.raise_for_status()
return r.json()
# 1. Prices: stock vs sector
stock = pd.DataFrame(get(f"eod/{TICKER}", **{"from": START, "to": END})).set_index("date")
bench = pd.DataFrame(get(f"eod/{BENCH}", **{"from": START, "to": END})).set_index("date")
rets = pd.DataFrame({
"stock": stock["close"].pct_change() * 100,
"sector": bench["close"].pct_change() * 100,
}).dropna().round(2)
rets["excess"] = rets["stock"] - rets["sector"]
# 2. Earnings, 3. news, 4. sentiment
earnings = get("calendar/earnings", symbols=TICKER, **{"from": "2025-01-01", "to": END})
news = get("news", s=TICKER, limit=50, **{"from": START, "to": END})
sentiment = get("sentiments", s=TICKER, **{"from": START, "to": END})
print(rets)

Output:

stock  sector  excess
date
2026-04-24 14.37 5.10 9.27
2026-04-27 -10.79 -0.04 -10.75
2026-04-28 -21.26 -2.97 -18.29
2026-04-29 0.80 1.70 -0.90
2026-04-30 2.63 1.43 1.20
2026-05-01 -2.76 0.61 -3.37

That table alone kills half the headlines. Now hand the evidence to Claude, with a prompt that forces the structure:

evidence = {
"daily_returns_vs_sector": rets.to_dict(orient="index"),
"earnings_history": earnings["earnings"][-4:],
"sentiment": sentiment.get(TICKER, []),
"news": [{"date": n["date"][:16], "title": n["title"], "excerpt": n["content"][:600]}
for n in news],
}
PROMPT = """You are an equity research assistant. Explain this price move using ONLY the evidence.
Return three sections:
1. FACTS: what the data proves. Cite the field you used.
2. PLAUSIBLE EXPLANATIONS: ranked hypotheses. For each, say what would confirm or refute it.
3. NOISE: claims that don't explain the move or contradict the data.
Flag any number that appears with different values in different sources.
Do not give investment advice."""
client = anthropic.Anthropic()
msg = client.messages.create(
model="claude-sonnet-4-5", # use the latest Claude model on your account
max_tokens=2500,
messages=[{"role": "user", "content": PROMPT + "\n\nEVIDENCE:\n" + json.dumps(evidence, default=str)}],
)
print(msg.content[0].text)

From here you can build:

  • a daily “biggest movers explained” report for your watchlist,
  • an alert that fires when a stock underperforms its sector by more than 10 points,
  • a research agent that writes the first draft of your post-earnings notes.

Key Takeaways

  • Start with price, not news. Index the stock against its sector before reading a single headline.
  • Check the timeline. 10.8% of Rambus’s drop happened before the earnings report was public.
  • Use Claude as a cross-checker, not an oracle. Its biggest value here was catching conflicting numbers across sources, not predicting anything.

Final Thoughts

Rambus didn’t fall 21% because it missed by a penny.

It fell because the price had run far ahead of the story, and the story stopped getting better.

The internet will always give you an explanation within an hour. A good Claude stock analysis workflow gives you something better: the evidence to know which explanations deserve your trust.

FAQs

❓ Can Claude analyze stocks?
✅ Yes, but only as well as the data you give it. Connected to a market data source like EODHD (via API or MCP server), Claude can pull prices, earnings, news and sentiment, then cross-check claims against the numbers. Without data, it can only repeat general knowledge.

❓ Why is a stock down today when the news looks positive?
✅ Price reacts to expectations, not to whether news is good in absolute terms. If a stock rallied hard before the news, “good” may already be priced in. Compare the move against its sector and check what happened in the days before.

❓ Why do stocks fall after good earnings?
✅ Usually because of positioning and guidance. A strong run before the report raises the real bar above published consensus. Rambus beat Q2 2026 EPS estimates by 10% and still fell 9% the next day.

❓ What does “buy the rumor, sell the news” mean?
✅ Traders buy ahead of an expected positive event and sell once it happens, locking in gains. It explains why a stock can drop on results that meet or beat expectations.

❓ Is AI stock analysis reliable?
✅ It’s reliable for organizing evidence, spotting contradictions and summarizing large volumes of news. It’s not reliable for predicting prices. Treat it as a fast research assistant, and always verify the facts it cites.

Investigate the next big mover yourself
Prices, earnings calendar, financial news and sentiment in one API, plus an MCP server that plugs straight into Claude.
→ Get started with EODHD
Need content like this for your API or fintech product?
I write data-driven technical articles that explain products through real use cases, not marketing fluff.
→ Work with me

Looking for technical content for your company? I can help — LinkedIn · kevinmenesesgonzalez@gmail.com


A Stock Fell 20%. I Used Claude to Investigate Why was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.

Digital Forensics: Extracting Credentials with DeadMatter

Welcome back, cyberwarriors!

During pentests, we often run into EDRs and antiviruses protecting endpoints. These mainly stop you from dumping hashes and running malware on the hosts. Although they’re often good at what they do, they still have flaws that make them vulnerable to chokers and killers that can terminate their process.

If you’ve ever tried dumping LSASS or extracting SAM and SYSTEM hives, you’ve seen the EDR block your attempts. There are legit ways to do it, for instance with reg.exe or Task Manager, but these have been abused for so long that they can’t be relied on anymore. Despite all that, dumping hashes is really easy if you do a complete memory dump with forensics tools and pull the hashes from the dump. These tools don’t just target LSASS, they do a full memory dump that includes everything. That’s what’s supposed to happen during incident response procedures, so nothing gets flagged and it won’t, because that would interfere with security work.

Today we want to show you how to use FTK Imager with DeadMatter to extract different credentials. FTK Imager needs a GUI, so if you don’t have it try running DumpIt from CLI instead. It’s available on GitHub.

What is DeadMatter

DeadMatter is written in C# and its whole job is to extract sensitive information from memory dumps. It scans raw data to find patterns associated with credentials, that way you can recover them even when the memory dump is incomplete or the format isn’t predictable. The tool is also lightweight and isn’t flagged by AV/EDR, so you can extract hashes on the victim machine directly without transferring these huge files around. The results include NTLM hashes, DPAPI keys, and other artifacts tied to logon sessions. The tool was first presented at Black Hat USA 2025.

Compiling DeadMatter

The repository for DeadMatter doesn’t include a precompiled binary and you will need to build it yourself. You can do it with Visual Studio or using the .NET Framework.

If you choose to compile it manually, you can clone the repository and execute the build process from PowerShell.

PS > dotnet build -c release
compiling deadmatter

Once it completes, Deadmatter.exe will be in the bin\Release directory. The build process usually completes without issues, if you have the required .NET components installed correctly.

If you prefer not to compile the tool yourself or run into problems during the process, you can use our compiled version to save time. We uploaded the compiled executable to our GitHub.

Capturing RAM

Before moving forward, it is important to understand that this technique relies on the ability to extract credentials from memory, which is significantly affected by the state of Credential Guard. If Credential Guard is enabled, credentials are isolated and you won’t be able to access them.

But in many environments with Windows 10 Pro or Windows Server versions prior to 2025, Credential Guard is often disabled. These systems are still widely used across corporate infrastructures. Newer deployments usually have it enabled by default now. To avoid unnecessary effort you can check the status of Credential Guard before proceeding.

PS > Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard
checking credential guard

If it shows that it’s disabled {0}, you can proceed with memory acquisition.

We used FTK Imager to capture RAM. You just need open the app and click “Capture Memory”

capturing ram

Then you specify the name and the destination path. The default settings are enough.

capturing ram in a raw format

Our next step is exfiltration. Modern systems often have large amounts of RAM. Servers commonly have 16-32GB as a baseline, and systems that have Microsoft Exchange may have significantly more. A raw memory dump of this size can be quite large, but you can compress it with 7z. It’s possible to reduce it from 32GB down to 12 GB, if you don’t want to run DeadMatter directly on the compromised system.

Extracting Credentials

Once the dump is transferred, you can extract creds. To process a full memory dump in raw format using structured parsing and carving, run this:

PS > .\Deadmatter.exe -f memory_dump.raw
extracting ntlm credentials with deadmatter

The output is quite detailed. As you scroll through the results, you will find different credentials associated with active or recently active sessions on the system.

extracting ntlm credentials with deadmatter

If you want to rely purely on carving methods, you can ignore structured parsing and search the raw data directly:

PS > .\Deadmatter.exe -f memory_dump.raw -m carve

When you work with a minidump file and want to use a specific parsing method, you can define the technique and the Windows version:

PS > .\Deadmatter.exe -f lsass.dmp -m mimikatz -w WIN_10_1507 -v

There are also more advanced options available. For instance, you can extract both credentials and DPAPI keys with additional brute-forcing to find initialization vectors within the data:

PS > .\Deadmatter.exe -f memory_dump.raw -b -d

Try different methods and see if you can find more information. 

Defense

To protect yourself from these attacks, make sure Credential Guard is on. It’ll make the credentials inaccessible. It’s also a good idea to monitor which forensic tools are being used. Ideally, keep a whitelist of approved tools that way you can spot someone trying to do a dump without authorization.

Summary

While defenders should have a red team mindset, hackers should have a blue team mindset to know how things work on the other side. Digital forensics is a great field and applies to both sides. Extracting credentials from systems is just one of its uses, more advanced knowledge can help you with behavior analysis and evasion.

If you want to learn more about Digital Forensics, we have training for beginners and for those who want to advance their skills in it.

The post Digital Forensics: Extracting Credentials with DeadMatter first appeared on Hackers Arise.

Hack The Box: DevArea Machine Walkthrough – Medium Difficulty

Just completed the DevArea machine from Hack The Box!

After exploiting a vulnerable Java SOAP service on port 8080, I gained initial access and discovered Hoverfly running on port 8888. Leveraging CVE-2025-54123, I successfully authenticated and delivered a reverse shell, securing the User flag as the dev_ryan user.

For privilege escalation, I took advantage of a sudo permission on the SysWatch management script. By exploiting a symlink attack in the logging functionality, I was able to read /root/root.txt and capture the Root flag.

Really enjoyed this Medium-difficulty box — great mix of Java deserialization/SOAP, API exploitation, and creative Linux privilege escalation!

#HackTheBox #HTB #PenetrationTesting #CyberSecurity #PrivilegeEscalation #CVE #EthicalHacking …

Learn MoreHack The Box: DevArea Machine Walkthrough – Medium Difficulty

The post Hack The Box: DevArea Machine Walkthrough – Medium Difficulty appeared first on Threatninja.net.

❌