j4rviser

[j4rviser @Chakrit_Arm]

@sam4nexpl01t3r Out of Office

[j4rviser @Chakrit_Arm]

@_0b1d1 PDF pls.

[The Hacker News @TheHackersNews]

🚨 Two new cyber campaigns are live:

1️⃣ MostereRAT — phishing emails targeting Japan.
Disables Windows security, hijacks TrustedInstaller, installs AnyDesk/TigerVNC, logs keystrokes, and even adds hidden admins.

2️⃣ ClickFix 2.0 — fake AnyDesk + Cloudflare page tricking users into opening File Explorer → drops MetaStealer.

Hackers are raising the bar. Stay alert.

Read → https://t.co/nCjqYiwwKz

[Florian Roth ⚡️ @cyb3rops]

An open-source YARA rule from @SEKOIA_IO triggered on the sample – and it’s part of their public repo.
The attribution in the rule name is probably misleading though, given this kind of obfuscation comes from public tools.

The rule has been included in the YARA Forge set for a while already.
Use it with any YARA scanner.
(If yours also scans archives – like THOR Lite – you’ll catch this stuff inside packages too.)

Rule: https://t.co/l6rFDNscFG

YARA Forge intro: https://t.co/S1FocXF9Lk

[ACE Responder @ACEResponder]

Windows startup sequence

#ThreatHunting #DFIR

[ᴍʀᴄʀʏᴘ ㉿ ᴘʀɪᴠ/ᴀᴄᴄ @MrCrypPrivacy]

Think turning off your phone protects you?

Your device carries two unique codes that follow you everywhere.
You can’t change them. You can’t hide them.
IMEI and IMSI.

Every time your phone connects to a mobile network, it leaves a trace.
No apps needed. No browsing. Just sitting in your pocket.

These IDs reveal:
- What phone you use
- Which tower you connect to
- Where you are
- Which line is yours
- When you swap SIMs
- Even who was nearby

This thread explains what IMEI and IMSI are, why they’re dangerous for your privacy, how they track you, and how to reduce that risk.

Let’s go 🧵👇

[Florian Roth ⚡️ @cyb3rops]

Windows SMB Client Elevation of Privilege Vulnerability

CVSS Score: 8.8

Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low
User Interaction: None

Do I have to say more?

https://t.co/SbFqsTWTSN

[John Hammond @_JohnHammond]

I got a proof-of-concept working for CVE-2025-30406, recently added to CISA's KEV. It's point and shoot 🙃

[Maddy 🐝 @Cyb3rMaddy]

How HACKERS Send Malware

Analyzing some DNS Spoofing in Wireshark!

https://t.co/xtRZnLVQT8

[j4rviser @Chakrit_Arm]

I participated in the Huntress 2024 CTF! Thanks @HuntressLabs @_JohnHammond @HuskyHacksMK @_BensonBoy23 @sudo_Rem @IzzyBoopFPV @Kaspertame and all others involved! #HuntressCTF

[X @TheMsterDoctor1]

Some Shodan Dorks that might useful in Bug Bounty.

1. org:"http://target. com"
2. http.status:"<status_code>"
3. product:"<Product_Name>"
4. port:<Port_Number> “Service_Message”
5. port:<Port_Number> “Service_Name”
6. http.component:"<Component_Name>"
7. http.component_category:"<Component_Category>
8. http.waf:"<firewall_name>"
9. http.html:"<Name>"
10. http.title:"<Title_Name>"
11. ssl.alpn:"<Protocol>"
12. http.favicon.hash:"<Favicon_Hash>"
13. net:"<Net_Range>" (for e.g. 104.16.100.52/32)
14. https://t.co/tE2v0P1g7C:"<http://Domain .com>"
15. asn:"<ASnumber>"
16. hostname:"<hosthame>"
17. ip:"<IP_Address>"
18. all:"<Keyword>"
19. “Set-Cookie: phpMyAdmin”
20. “Set-Cookie: lang="
21. “Set-Cookie: PHPSESSID"
22. “Set-Cookie: webvpn”
23. “Set-Cookie:webvpnlogin=1"
24. “Set-Cookie:webvpnLang=en”
25. “Set-Cookie: mongo-express="
26. “Set-Cookie: user_id="
27. “Set-Cookie: phpMyAdmin="
28. “Set-Cookie: _gitlab_session”
29. “X-elastic-product: Elasticsearch”
30. “x-drupal-cache”
31. “access-control-allow-origin”
32. “WWW-Authenticate”
33. “X-Magento-Cache-Debug”
34. “kbn-name: kibana”

[Security Trybe @SecurityTrybe]

How To Fix Any Computer 🌚

[LetsDefend @LetsDefendIO]

Reverse Shell vs Bind Shell

[Steve Weis @sweis]

This iMessage exploit is crazy. TrueType vulnerability that has existed since the 90s, 2 kernel exploits, a browser exploit, and an undocumented hardware feature that was not used in shipped software:
https://t.co/YJdY6alLbV

[Grzegorz Tworek @0gtweet]

#LOLBin in my favorite built-in tool ? I am seriously disappointed now. 😭
Requires Windows 11, as it's related to a new set of features related to "fsutil trace" command.

[Requiem @Requiem_fr]

⚠️SANS released their new Memory Forensics class (FOR532).
As @SANSInstitute talk about #volatility 3 in this class and to comply with the vol3 license:
‼️SANS published all @volatility 3 related content for free!
Slides:https://t.co/0metSbLiaX
Labs:https://t.co/qebcp4m88Y
#DFIR

[Huntress @HuntressLabs]

Drum roll please 🥁 Congratulations to the winners! It truly went right up to the last challenge.

That's a wrap on the Cybersecurity Awareness Month #HuntressCTF! What was your favorite challenge from the month?

[OSINT 🪙 @0xtechrock]

OSINT TIP #227🔍

Open Source Surveillance - real-time intelligence gathering tool, free to register for everyone. It contains only three modules - Flickr, Surveillance Cameras and Road Traffic.

🔗https://t.co/OE6zmf1WEr

@the_wojciech 🔥

#OSINT #CyberSecurity

[Mari Degrazia @maridegrazia]

I have a new blog post up detailing per app registry hives for analysis in #DFIR investigations related to MSIX Registry Redirection. These hives can contain additional information that may not be found in other locations. @ZeroFox @sansforensics https://t.co/re9KDpz63g

[HackGit @hack_git]

Dark-Shell

A versatile and user-friendly penetration testing tool designed to simplify the process of generating Reverse Shells for ethical hacking and security testing purposes. With "Dark-Shell," users can effortlessly create customized Reverse Shells by providing essential parameters such as IP address, port number, output file name, and preferred programming language.

https://t.co/IfxSsomV9z

#cybersecurity #infosec #pentesting #redteam