0x7F

it-security enthusiast, hacker, security researcher, infosec, purple team, ccc bubble

[Florian Roth ⚡️ @cyb3rops]

Oh, great
https://t.co/Z3eldzjcg6

[Dark Web Informer @DarkWebInformer]

🚨 Nightmare Eclipse GitHub account and repositories were suspended yesterday.

The researcher who has popped off with zero-days has created a new account on GitLab... https://t.co/tXw6g4UdnM

They have a message for Microsoft though and July 14th seems to be a day that will be worth watching.

[Christopher | 🇺🇦  @d4rkshell]

Microsoft has banned Nightmare Eclipse from GitHub: https://t.co/EmeiJnJ0Ps

This is the researcher who disclosed several zero-days after Microsoft also deleted their MSRC account.

They have now moved on to GitLab: https://t.co/Npj0gplSum

(h/t to: @[email protected])

[The Hacker News @TheHackersNews]

🚨 Cisco fixed two critical flaws that allow full system takeover without login.

CVSS 9.8 vulnerabilities let attackers reset admin passwords (IMC) or run commands as root (SSM On-Prem) using crafted requests.

No workaround is available. Patching is required.

🔗 Read → https://t.co/7aouRvDROA

[Hunt.io @Huntio]

🚨Breaking Down the Axios Attack: Obfuscated Dropper, Cross-Platform RATs, and the TA444 Connection

The npm account of the #Axios maintainer jasonsaayman was hijacked and used to push two malicious versions. 37 million weekly downloads. The entire chain, from npm install to a live RAT beaconing home, takes under two seconds and leaves no trace.

Here is what we found:

- Attacker staged plain-crypto-js clean first, then pushed a weaponized version 18 hours later with an obfuscated postinstall dropper

- Dropper uses XOR + reversed Base64 with key "OrDeR_7077" to hide the C2 URL, imports, and full payload scripts

- Three platform-specific RATs: compiled C++ Mach-O for macOS, fileless PowerShell for Windows, Python stdlib-only for Linux

-Single C2 at sfrclak(.)com:8000 routing payloads by POST body

- macOS variant bypasses Gatekeeper with ad-hoc codesigning

- Windows is the only variant with persistence via Registry Run key "MicrosoftUpdate"

- Linux peinject is broken due to an undefined variable bug, confirming hasty porting from the Windows codebase

- Infrastructure pivots tie the C2 to #TA444/#BlueNoroff via shared ETag with a documented #DPRK server, same Hostwinds AS54290 subnet as confirmed #Lazarus infrastructure, and a #NukeSped malware classification

Full breakdown and IOCs: https://t.co/NtlzBIkDsD

[Dominic Alvieri @AlvieriD]

By popular demand

ShinyHunters active onion

/shnyhntww34phqoa6dcgnvps2yu7dlwzmy5lkvejwjdo6z7bmgshzayd[.]onion

Enjoy!

[Moritz @m_r_tz]

The FLARE team now freely distributes its quality reverse engineering and malware analysis educational content at https://t.co/bGCIjBfD3C. Launched with:
- Malware Analysis Crash Course
- Go Reversing Reference
- Intro to TTD

[International Cyber Digest @IntCyberDigest]

🚨‼️ We've just launched a central dedicated tracker for all alleged TeamPCP supply chain attack victims.

https://t.co/4a4U3eWqtV 👀

[The Hacker News @TheHackersNews]

🛑 URGENT: Microsoft rushed out out-of-band fixes for an actively exploited Office zero-day.

CVE-2026-21509 (CVSS 7.8) lets attackers bypass Office security using a malicious file that must be opened by the victim.

🔗 Details → https://t.co/a7QFT8PJPw

[Hunter @HunterMapping]

🚨Alert🚨 CVE-2026-24061 (CVSS 9.8): Critical GNU InetUtils telnetd Flaw Lets Attackers Bypass Login and Gain Root Access.
🧐Deep Dive
:https://t.co/HZZTr0KPF4
🔥PoC :
https://t.co/NMdo35SK4a
https://t.co/s8c9pWPRHA
📊 30M+ Services are found on the https://t.co/g3tSyh13yE yearly.
🔗Hunter Link:https://t.co/jBfnZq8Il3
👇Query
HUNTER : protocol=="telnet"
📰Refer:https://t.co/MRJXrVZr5h
https://t.co/nuF42YxqqZ'
#hunterhow #infosec #infosecurity #OSINT #Vulnerability

[H4x0r.DZ @h4x0r_dz]

CVE-2025-14847 - MongoDB Unauthenticated Memory Leak Exploit

https://t.co/0H8SvOXD4Q

[0x6rss @0x6rss]

Dear threat hunters and malware analysts!
new web version of #matkap is back online. You can now easily hunt malicious telegram bots via https://t.co/WP9won6ozE .
And it’s completely free 😃
Merry Christmas and happy hunting!

[Stephan Berger @malmoeb]

During a recent engagement, we reviewed the collected AutoRuns data from all endpoints on the network. In that dataset, we identified the following scheduled task:

Name: 523135538
Command Line: C:\programdata\cp49s\pythonw.exe

There are a few things odd here. First, the name of the Scheduled Task (some random numbers). Second, the installation Path (Programdata\cp49s\). Third, Python is launched without any command-line arguments or a reference to a Python script, meaning the interpreter is started by itself.

Our initial hypothesis was DLL sideloading. After examining the Python directory, we identified a file named sitecustomize[.]py:

"Python's sitecustomize[.]py and usercustomize[.]py are scripts that execute automatically when Python starts, allowing for environment-specific customizations. Adversaries can exploit these files to maintain persistence by injecting malicious code." [1]

Path: C:\ProgramData\cp49s\Lib\sitecustomize[.]py
Content: See the image below.

So, this means that every time the Scheduled Task runs, the Python interpreter is executed, effectively loading the malicious Python file named b5yogiiy3c.dll. A pretty sneaky way, and something you should watch out for during your next hunting session or IR gig. 🤓

[1] https://t.co/XHYcMdYwTD

[Dominic Alvieri @AlvieriD]

New Lapsus clearnet is live

/lapsus-group[.]com

hosted @Cloudflare
registrar @Namecheap

ip 172.67.181[.]34 — Ascension Island

[BleepingComputer @BleepinComputer]

Microsoft: WMIC will be removed after Windows 11 25H2 upgrade - @serghei
https://t.co/IRU4fdO5Fe

https://t.co/IRU4fdO5Fe

[The Hacker News @TheHackersNews]

⚠️ A record-breaking npm supply-chain hack is unfolding...

The self-replicating “Shai-Hulud” worm has infected 500+ packages, hijacking maintainer accounts and stealing GitHub tokens, npm keys & AWS credentials.

Here’s the full story every developer must know 👇

[Fusion Intelligence Center @ StealthMole @stealthmole_int]

Statistical Trends in the Growth of Ransomware Victims on the Dark Web

Ransomware groups specializing in exfiltrating and leaking victims’ data first emerged on the dark web in 2019. Since their initial appearance, we have been continuously tracking their activities. By Q1 2025, more than 220 distinct groups have been identified as having operated or remaining active. Collectively, these groups have claimed responsibility for exfiltrating and exposing the data of over 20,000 victims worldwide.

[𝕏 Bug Bounty Writeups 𝕏 @bountywriteups]

Black Hat USA 2025 slides

https://t.co/MnsguhCdgr

[Fusion Intelligence Center @ StealthMole @stealthmole_int]

"APT Down: The North Korea Files"

Is the operator really North Korea’s Kimsuky—or could it, perhaps more plausibly, be China?

Analyze the attribution using work files leaked directly from the hacker’s own system.

Use StealthMole’s IoL (Indicators of Leakage) module to search the leaked files by keyword.

- iol:leak_aptdown_nkf_202508
- in:iol:leak_aptdown_nkf_202508 [keyword]

[Johann Rehberger @wunderwuzzi23]

💥 Remote Code Execution in GitHub Copilot (CVE-2025-53773)

👉 Prompt injection exploit writes to Copilot config file and puts it into YOLO mode, then we get immediate RCE

🔥 Bypasses all user approvals

🛡️ Patch is out today. Update before someone else does it for you