Got send a email a couple days ago with a invoice.html that had a base64 encoded payload that would have downloaded invoice.pdf.exe. It was slop as we'll, lots of LLM notes everywhere but the funny part was that the function call to download the payload was commended out.
I learned quite a bit from this actually.
I didn't know Steam was a Chromium app. Hence, you can kill Steam then relaunch it with the "-cef-enable-debugging" flag.
Once you'll launched Steam with this, you can inject Javascript into Steam using Chromium "webSocketDebuggingUrl" stuff.
This malware has a whole pseudo-framework of Javascript that can do:
- Alert Bell (?)
- Block pages
- "Help page" (?)
- Inventory manipulation
- Steam library manipulation
- Profile manipulation
- Steam redirections
Basically, this malware payload switches Steam into a Chromium debug state, then sends web debug requests (kind of like Chrome Dev Tools?) to manipulate the Steam pages. It injects Javascript.
The chat window that spawns is from a remote host they control. This is really cool.
Is it AI slop? Yes
Is this code EXTREMELY easy to reverse engineer? Yes
Did they unironically document their entire code base in Russian because it was (probably) written using Claude and the authors probably speak Russian? Yes
Is this extremely creative and cool? Yes
Special thanks to "pro" from 2c44. He handed me the payload and the decompiled Python. The malware .py was Base64 encoded ... so obtaining the original source was ridiculously easy.
@dashservio Und 6v Cores für alle 3 Stacks, das war unsere CPU last auf 480 vCores verteilt 😅 nichtmal knapp daneben.
Und der NodeJS Worker basiert schon auf uWS, mit ExpressJS geht er direkt in Flammen auf.
@dashservio Hm. APIs mit 1 Mio / Tag
Node 12GB
Python 12GB
GO 11GB
Wir haben 3 seperate Worker Cluster die sich die Arbeit teilen, jeweils 15GB also 45GB für NodeJS
Für nen anderen Endpint hatte unser cGO worker, etwa 30% der Requests und braucht 3x1.2GB
@Lina_Hoshino Even the results could leak where you life if you Google for something in your area it tends to rank them by distance to where you usually go/life
@DrInsensitive In Germany I never had any issue bringing such knives, quite the opposite. The scanner flags it and they check it, when they see it they laugh and say "Well can't stab anyone with that one"
On the return flight, the UK responded with 9 people with MPs pointed at me 😅
Every time I try to edit video on my 8GB Mac it tells me it ran out ot ram. Wants me to close everything - including the video editor
Yes indo use timeline cache and proxy timelines.
🙈
No, an 8GB of ram laptop is not “only for web browsing”
you can code with it
you can do graphic design
you can do video editing
you can run photoshop
you can multitask
Tech bros are subject to a massive bias where not a single one of them has tried an 8 GB of RAM computer in the last 5 to 10 years because they all default to thinking they’re unusable when they’re actually perfectly fine.
it’s fine. mostly.
@PORNFLAAAKES Bei uns waren alle domains in diesen E-Mails unter dem Namen der externen Firma die den Auftrag hat registriert. Hab mir ein Skript geschrieben was diese Mails direkt an die IT weiterleit und mit zufälligen Login Daten zumüllt so waren die immer down bevor jemand draufklicken kan
@MForgeng Naja, ihre Grafik inkludiert jedoch kein freiwilliges Mehrzahlen. Steht ja jedem frei, aus welchem Grund auch immer, mehr zu bezahlen aber beschweren sollte man sich dann nicht.
@Oblivious9021 Duplicate API calls likely only by setting the button to disabled.
On the Backend it didn't matter, either the first payment transaction has completed and the cache is already ready and the second call hits cache or it goes into the DB and fails so I don't care