xi0

FrontEnd Developer + BackEnd Hacker, “according to a source familiar with the situation” #cybersecurity #hacking #infosec

[xi0 @Iiteco]

International MetaMask ** hacked my account this morning. Support help desk(s) needed to recover.

*phishing pass phrase recovery site.

#cybersecurity #phishing *
@MetaMask ** @MetaMaskSupport

[vx-underground @vxunderground]

Microsoft Security Response Center put out a blog post today about Eclipse Nightmare guy

Basically they think he's super mean and totally not cool he's dropping zero days. They say you're a jerk if you do this stuff because it's dangerous and stuff

https://t.co/Bg5iFxI3lc

[vxdb @vxdb]

POSTING ZERO DAYS OR EXPLOITS PUBLICLY DOES NOT MAKE YOU A CRIMINAL

Microsoft has pissed off the entire security community once again

[BleepingComputer @BleepinComputer]

CISA gives feds 4 days to patch actively exploited cPanel plugin flaw
https://t.co/K3rn6LIGNU

https://t.co/K3rn6LIGNU

[BleepingComputer @BleepinComputer]

KnowledgeDeliver flaw exploited as a zero-day to install web shells
https://t.co/Bqm2o0Ek8T

https://t.co/Bqm2o0Ek8T

[Dominic Alvieri @AlvieriD]

Might have a new ShinyHunters clearnet

/shinyhunte[.]red

Unconfirmed but live…

[Dominic Alvieri @AlvieriD]

Broadcasting giant Charter Communications has been breached by ShinyHunters

Charter has 32 million customers and there are 42 million records containing customer PII allegedly at risk

@CharterNewsroom @Ask_Spectrum

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft is investigating a new, emerging Mini Shai-Hulud npm supply chain attack targeting antv packages.

Attackers compromised an antv maintainer account and published malicious versions of multiple widely used packages (for example, antv/g2). As these packages are widely used as dependencies, the compromise propagated into downstream libraries like echarts-for-react, impacting a much broader set of applications and continuous integration (CI) environments.

All compromised packages contain a byte-identical, obfuscated credential-stealing payload delivered via a preinstall hook (Bun). The malware targets high-value secrets including:
- GitHub personal access tokens (PATs) and OpenID Connect (OIDC) tokens
- npm / Amazon Web Service (AWS) credentials and Security Token Service (STS) sessions
- Secure Shell (SSH) keys, kubeconfigs, and .env / .npmrc files
- Software-as-a-service (SaaS) tokens (Slack, Stripe, Vault)

Exfiltration occurs over HTTPS with Transport Layer Security (TLS) validation disabled. The payload also abuses stolen OIDC tokens to forge Supply-chain Levels for Software Artifacts (SLSA) provenance and propagate malicious releases, exhibiting worm-like behavior across repositories.

Malicious files distributed through npm packages are detected by Microsoft Defender as Trojan:AIGen/NPMStealer , "Suspicious Node.js process behavior", or “Credential access attempt”, preventing credential theft and malicious post-install execution.

Mitigation:
- Audit dependencies for affected antv and related packages; pin or downgrade to known-good versions (pre-2025-05-18).
- Revoke and rotate exposed credentials (GitHub, npm, cloud tokens, SSH keys).
- Validate integrity of CI pipelines and recent build artifacts.
- Network IOC: Stolen credentials are exfiltrated over HTTPS to t.m-kosche[.]com:443. Block at egress and review network logs for outbound connections.

[Dominic Alvieri @AlvieriD]

Trellix was breached by RansomHouse

@Trellix

[FalconFeeds.io @FalconFeedsio]

🚨 Ransomware Alert 🚨

We started monitoring a new ransomware group named “Bavacai ”. They have listed 16 victims on their dark web portal.

* Rayco Lighting 🇺🇸
* CEAGESP 🇧🇷
* COLEGIO MARÍA INMACULADA 🇨🇱
* Académie de Montpellier🇫🇷
* Palmers Relocations 🇦🇺
* ActionAid 🇹🇿
* CourtSmart Digital, Inc 🇺🇸
* Desert Christian Schools 🇺🇸
* SIT Group 🇮🇹
* Robusta Ltd 🇧🇬
* Atencio Engineering, Inc 🇺🇸
* Trimble Inc. 🇺🇸
* Magnolia Jewellery 🇮🇱
* Strategic Imports Pty Ltd 🇦🇺
* Bandeirante Supermercados 🇧🇷
* Elken Sdn Bhd 🇲🇾

[Dark Web Informer @DarkWebInformer]

‼️ watchTowr Labs released a write-up and detection script on the cPanel/WHM vulnerability.

GitHub: https://t.co/tA8E1hxSQF

Write-up: https://t.co/xKos4fPP15

[BleepingComputer @BleepinComputer]

Instructure confirms data breach, ShinyHunters claims attack
https://t.co/F5vZcTNyDP

https://t.co/F5vZcTNyDP

[BleepingComputer @BleepinComputer]

Hackers arrested for hijacking and selling 610,000 Roblox accounts
https://t.co/TEe31i5DdD

https://t.co/TEe31i5DdD

[Ebrahem Hegazy 🇵🇸 @Zigoo0]

#Udemy data breach confirmed.

After refusing to pay the ransom, hackers released data of 1.4M users, including personal and financial details.

We @DarkEntryAms launched a lookup tool so you can check if you’re affected:

https://t.co/w4c1WdcQl8

#DataBreach #Ransomware

[Dominic Alvieri @AlvieriD]

BREAKING

Vimeo breached by ShinyHunters

Google BigQuery and Snowflake instances claimed via Anodot AI

Vimeo has over 287 million users @Vimeo

[vx-underground @vxunderground]

I was reading this and I double checked my blood pressure to make sure I wasn't having a stroke or hallucinating from a brain aneurysm

[vx-underground @vxunderground]

Toronto Police launched Project Lighthouse in November, 2025 after police were tipped off about an unknown person(s) operating an SMS Blaster in downtown Toronto.

Watch the video for an actual explanation. The fancy Detective lady gives a run down on what happened.

tl;dr three chinese dudes some how built a custom made portable cell phone tower thingie in a van, drove around toronto with it. peoples cell phones automagically connected it to (its literally a cell phone tower thingie). when a cell phone connected to their portable cell tower thingie it would automatically send the connected phone a text which appeared to be from their bank or somewhere important. they interupted real cell phone towers 13m times lmfao. they were trying to steal passwords and stuff. no details released on how three random nerds managed to do this

[xi0 @Iiteco]

RT @AlvieriD: ADT Security has been breached by ShinyHunters

Over 10 million records containing personally identifiable information

@ADT…

[Zscaler ThreatLabz @Threatlabz]

Zscaler ThreatLabz has published a technical analysis on activity we believe to be orchestrated by Tropic Trooper, using military-themed lures and a trojanized SumatraPDF to deploy AdaptixC2 with a custom GitHub-based C2, then pivoting to Visual Studio Code tunnels for remote access.

Read more: https://t.co/myj0VbDZYr