Shachar Gritzman

Security Researcher

[Shachar Gritzman @Gritzman_]

@nav09284172 קצת יותר עיצוב למשוך את האלגוריתם 😀

[Shachar Gritzman @Gritzman_]

11M+ users, 4.4 stars. A decade of trust.
We found that the popular YouTube ad blocker has a hidden path to arbitrary JS execution on any site activated by one server side change. No active exploit seen, but at this scale the capability alone is a big risk
https://t.co/FAfnbrwtpW

[Threat Insight @threatinsight]

Researchers at @Proofpoint expose threat actors’ attempt to hijack thousands of EntraID user accounts across almost 100 cloud tenants by leveraging TeamFiltration, a red teaming framework used by network defenders. https://t.co/EA0peIihIm

[Proofpoint @proofpoint]

Proofpoint researchers have uncovered a new #accounttakeover #bruteforce campaign targeting #Microsoft Azure accounts.

This extensive attack, initiated in early June, utilizes the uncommon 'node-fetch' HTTP client.

#BEC #PasswordSpraying

[Shachar Gritzman @Gritzman_]

@TheNotoriousMMA 🎯

[Virus Bulletin @virusbtn]

Proofpoint researchers observed an increase in account takeovers among tenants that have MFA protection, as threat actors are increasingly employing Adversary-in-the-Middle (AitM) phishing kits (such as EvilProxy). https://t.co/ahPsgb0D5c

[Proofpoint @proofpoint]

Over the last 6 months, our #cloud threat researchers observed a drastic surge in successful cloud #accounttakeover incidents impacting high-level executives at leading companies. Over 100 organizations were targeted globally, representing 1.5 million employees.

[BleepingComputer @BleepinComputer]

EvilProxy phishing campaign targets 120,000 Microsoft 365 users - @billtoulas
https://t.co/X6gYjwa1yh

[Shachar Gritzman @Gritzman_]

In the past 6 months, we observed a drastic surge in Microsoft 365 #accounttakeover affecting top executives from major companies.

Using #EvilProxy, threat actors managed to steal credentials, #MFA and session cookies

https://t.co/XXynwOhqPC

[David Krispin @david_kr3]

New OAuth consent #phishing app (client id: c517e6b9-a1d5-4f7e-8081-dfb2142c056a), same compromised verified publisher, same scopes, different name (new name: Document) and logo (@Microsoft logo impersonation).
Related domain is voii[.]at
@ffforward @MsftSecIntel

[Shahar Tavor @ShaharTavor]

Checkout my recent research into #BrazKing #Mobile #Banker #Malware attacking in Brazil.Gain deep insights about its the features that help #cyber criminals use it in mobile banking fraud.
https://t.co/woUYOibJd2
@mobilesecurity_ @TheHackersNews @malwrhunterteam @campuscodi

[Shachar Gritzman @Gritzman_]

@Kurt_theTurk @IBMSecurity @Bank_Security Yea you can see in the picture 1 emulator that was spoofed to be all of those different OS versions, brands , etc...

[Shachar Gritzman @Gritzman_]

Massive mobile #fraud operation we discovered resulted in the loss of over $10M from #banks within days.

- 20 Mobile Emulators
- Over 16,000 Spoofed Devices
- Customized Advanced Automation Environment

https://t.co/wmzJEIFG0v

@IBMSecurity @Bank_Security

[Shachar Gritzman @Gritzman_]

@GadiShpits @Bank_Security Mobile apps..

[Shachar Gritzman @Gritzman_]

2FA stealer on Google Play targeting users from Spain
https://t.co/zk4HZp7nCd
md5:E6A285CB85CA53C8AF0994A62F3BC528

[Tatyana Shishkova @sh1shk0va]

Banking #Trojan on Google Play targeting Spanish users:
https://t.co/AWDh7RSQHM[.]com/store/apps/details?id=com.fernadimas.maginedamax
Related to the family found by @Gritzman_.
MD5: 698149f695e7d81d5fdbe39991e9ecf7
C2: vigolimone[.]website

[Shachar Gritzman @Gritzman_]

Fake app on @GooglePlay is trying to steal passwords and 2FA from banking users in Spain🇪🇸

https://t.co/FTrtsM1ZCz[.]com/store/apps/details?id=com.kenvomari.managesas
md5: 46bcad9c7c72ec1380598e5fbdb919fa

[Pavel Asinovsky @PAsinovsky]

New blog about #Ginp - has overlays targeting Turkey 🇹🇷

https://t.co/wPjz4AUtD6

@Bank_Security @mobilesecurity_ @sh1shk0va @LukasStefanko @ThreatFabric @virqdroid

[Shachar Gritzman @Gritzman_]

SMS stealer on @GooglePlay targeting #banking #android users in Spain🇪🇸.

package name: "com.veronica"
No Detection on VT

@Bank_Security @malwrhunterteam