tmechen retweeted
The key to a successful career in InfoSec is having a flaring passion for computers that slowly transmutes into resentment and retreat into the woods where any Turing machine not disemboweled of radios and powered by waterwheel is treated with deep abiding suspicion.
28
124
940
@OX__Security has done some vibe research and apparently I am a criminal now for using hacker cat emoji. Thanks, I guess?
5
2
5
277
⚠️ BREAKING: #TeamPCP Source Code Hits GitHub
Malware source code now in public repos
Likely spread via compromised accounts/tokens
Impact: fuels copycat attacks + rapid spread
Action: audit repos, rotate tokens, enable 2FA ASAP
FULL REPORT: ox.security/blog/shai-hulu…
0
0
0
117
Friendship restored with @codewhitesec - thx for this awesome festival cup :) #ULMageddon #applyIfYouCan
1
0
6
582
Releasing a blogpost about uncovering #ZDI-CAN-25373 - the malicious abuse of MAX_PATH for lnk files "Zero-Day in Widespread APT Campaigns". Here is the trendmicro blog post from ... *checks notes* ... 2017?
---
trendmicro.com/de_de/research…
---
trendmicro.com/de_de/research…
0
1
6
936
tmechen retweeted
New blog post: ScriptBlock Smuggling
dfir.ch/posts/scriptbl…
Recently, @bcsecurity presented a new technique with which PowerShell code can be executed so that it no longer appears in the script block log.
In this blog post, we take a closer look at this technique, particularly e find when attackers utilize ScriptBlock Smuggling.
dfir.ch/posts/scriptbl…
Recently, @bcsecurity presented a new technique with which PowerShell code can be executed so that it no longer appears in the script block log.
In this blog post, we take a closer look at this technique, particularly e find when attackers utilize ScriptBlock Smuggling.
1
56
142
11,295
There is an #LummaC2 malware campaign unfolding on @TeamYouTube right now. Alleged "Helper" Videos, in relation to a wide range of errors and problems - all explaining a "Solution" which results in the user downloading a malicious file which modifies the users registry
3
1
1
470
@TeamYouTube They are up to 19 channels they took over and uploaded 100+ videos spreading malicious link. @TeamYouTube does not react to any reports. what now?
1
0
0
155
@TeamYouTube they use multiple channels, different thumbnails, modular videos with some AI voice. all resulting in the user infecting his own machine and losing all his credentials to these criminals
0
0
0
141
new (old) #LummaC2 campaign via YouTube "help" videos:
>> user downloads .zip (linked in description) (C460633B2265CA2AB49B50A8A94FAA5B728CED9597EBFC8CE5725940DE62BC2F)
>> user downloads .zip (linked in description) (C460633B2265CA2AB49B50A8A94FAA5B728CED9597EBFC8CE5725940DE62BC2F)
3
0
2
297
links migrated to @DropboxSupport - reported 10h ago, but no reaction. nice, are they paying good money you don't want to lose?
1
0
0
104
>> drops additional files from assetdistribution[.]info (B7971B5D452939405CFB8DB0EF47E5C83B6747C8A210D59637B0AC469C5CA5DF) and (5BF36CC6314E62EDCAB7A0EFCBDE3E014540ED8C72B8F53F1B2DCA44AF7417B1) targeting crypto wallets
0
0
0
97
🇩🇪 localized version for @DHLPaket:
(we only get 12h, though)
Sender:
asherparkerxmtu[@]outlook[.]com
URL:
hxxps://dhl.de-ponrn[.]top/Q9djRY
1/n
(we only get 12h, though)
Sender:
asherparkerxmtu[@]outlook[.]com
URL:
hxxps://dhl.de-ponrn[.]top/Q9djRY
1/n
Classic @RoyalMail parcel delivery themed iOS iMessage phish quick investigation thread 🔎🧵
Sender:
alycestroman5hkt[@]gmail[.]com
URL:
hxxps://gb-ryzutt[.]top/postl
1/n
1
0
1
490
Last HTTPS Certificate links another domain: businesspostb[.]top, dating back to 21.02.2024
crt.sh/?q=businesspos…
6/3
crt.sh/?q=businesspos…
6/3
1
0
0
247
censys explore shows same pattern for this domain with generated domains search.censys.io/hosts/43.157.6…
7/7
7/7
0
0
1
184