BLOCKMAGE

Web3 Native Threat Intelligence.

[BLOCKMAGE @BlockmageSec]

For emails, the email referenced in this post is now defunct. New emails should be addressed to: [email protected]

Please refer to the post for the most up-to-date information: https://t.co/UzrppyZjLS

[BLOCKMAGE @BlockmageSec]

👀

[email protected]

53783AD54B35D818 8E76889A6701DFE88BE8B569

https://t.co/1qXMtRawMX

[BLOCKMAGE @BlockmageSec]

We have updated our PGP keys.

The key referenced in this post remains valid, but defunct UIDs have been removed.

The article has been updated to reflect these changes. All keys have been cross-certified (the old with the new, and both with our new hardware master key).

[BLOCKMAGE @BlockmageSec]

Takeaway: Automated scanners are essential for flagging capabilities, but manual verification is the only way to determine intent.

We acted quickly in hopes of preventing harms, but in this case, we were mistaken.

We've removed the post to avoid any confusion (sorry!).

[BLOCKMAGE @BlockmageSec]

Earlier today, we flagged a VS Code extension (rphlmr.vscode-drizzle-orm) based on 21 critical YARA hits from vsix-audit.

After manual inspection and deeper analysis, inspecting the .vsix, and reversing the WASM binaries, we’ve confirmed this is a False Positive.

[BLOCKMAGE @BlockmageSec]

- The SOL wallet identified was actually a character property table in the Oniguruma regex engine.
- The "Dropper" patterns were standard Emscripten/LLHTTP boilerplate.
- The "Stealer" hits were bundled dotenv and undici dependencies.

[Fantasy @0xFantasy]

1/ I've been doing some research into how Unity Packages (similar to Node or Pip packages) could be weaponized for malware delivery

Let me tell you, it doesn't exactly look good... 🧵

[Alchemyst @Alchemyst0x]

Links:

CVE-2025-31201: Apple
CVE-2025-31200: Apple and Google Threat Analysis Group

macOS Sequoia 15.4.1:
https://t.co/t3r8hndiDn

iOS 18.4.1 and iPadOS 18.4.1:
https://t.co/su6XCE0N23

visionOS 2.4.1:
https://t.co/GY4t0NIJWu

[Alchemyst @Alchemyst0x]

No excuses.

These are live use, not theoretical CVEs.

Apple doesn’t push same-day cross-platform updates and delete vulnerable code unless the stakes are real.

Stay sharp. Patch everything. Watch your traffic. 🧙‍♂️

[Alchemyst @Alchemyst0x]

Two #CVE's, patched across every Apple platform, both marked as actively exploited in the wild:

#Apple just released:
- macOS 15.4.1,
- iOS 18.4.1
- iPadOS 18.4.1
- tvOS 18.4.1
- visionOS 2.4.1

— and you should stop what you're doing and update now.

[IOC Investigations @intell_on_chain]

July 2023 #TornadoCash exit worth 1,400 ETH ($2.6M)

Exit via 100 ETH Contract, swaps for USDC, heads out over the Synapse bridge, to Polygon 0xc09d3c2 and get gambled away at @Stake. I see this fairly often when analysing TC.

Tool: @MetaSleuth

[ZachXBT @zachxbt]

@zaingaziani @Ledger @Microsoft Sadly received two messages about this from victims today. Seems another person lost funds in just past few min.

[ZachXBT @zachxbt]

Community Alert: There is currently a fake @Ledger Live app on the official @Microsoft App Store which was resulted in 16.8+ BTC ($588K) stolen

Scammer address
bc1qg05gw43elzqxqnll8vs8x47ukkhudwyncxy64q

[ZachXBT @zachxbt]

1/ An investigation into the Canadian scammer known as Yahya for their involvement in 17+ SIM swaps which resulted in more than $4.5M stolen.

[BLOCKMAGE @BlockmageSec]

@solminingpunk How else would we know what they are up to all the time?

[BLOCKMAGE @BlockmageSec]

Unfortunate but true, web3 sees security as something you pay for once prior to your contract deployment. Brand protection gets sidelined in favor of keeping hype perpetually alive. Not to mention, those who do help, very often get nothing in return, so there's little incentive for professionals, albeit rife with opportunity to improve security across the board. We hardly have a name for the position though, so it can certainly be and feel overwhelming.

That said, its always appreciable seeing the builders and the devs and security techs that are here, reaching out and making such efforts. This has been a constant in the space for years despite any market or trends otherwise. There's a sense of purpose to the whole thing because of this, and it certainly brings a level of quality and enthusiasm that you can't rightly find elsewhere.

Nice post - cheers.

[Fantasy @0xFantasy]

@PeckShieldAlert This is another MakerDAO deposit. Now, I dont understand the exact mechanics of this, but after a bit of digging, funds seem to get withdrawn from Maker as USDC and deposited into Coinbase

https://t.co/sAI8lsi5aO

[Caido @CaidoIO]

It's release time 🎃
- Responses can now be intercepted and modified
- Delete requests from HTTP History
- [Pro] Import/export your projects using our new "backups" page
- [Pro] Add shell commands to your convert workflows with the new "Shell" node
https://t.co/5zKo9NF31G

[BLOCKMAGE @BlockmageSec]

@nft_sec https://t.co/X7pRKNZq8S
or https://t.co/lcl29jLxuy

[IOC Investigations @intell_on_chain]

GM GMers! Tagging people who do great work in this space but I feel are not shown enough love!

Go follow ⬇️
@CryptoaaService @WoAS_Necksus @0xFantasy @0xSaiyanElite @1c4m3by @Plumferno @BlockMageSec @boringsecurity @brookejlacey @ManicalEngineer

Who did I miss? Tag them!

[Vaana❤️ @Vaana2K]

@PocketUniverseZ @1c4m3by @OxSaiyanGod @BlockMageSec @Plumferno @opensea @Server_Forge @1c4m3by saved me the other day 🤝 appreciate your work ♥️