AV3AS

Cyber Defense Specialist | Threat Hunting | DFIR | Threat Intelligence | Security Operations | Cloud Security | CEH v12

[Blue Team News @blueteamsec1]

Over 400 Arch Linux packages compromised to push rootkit, infostealer https://t.co/nVsXDHkp2Q #Security

[AV3AS @LAXVE1]

@tre__ndsx That's fraud, he has three legs that's why he jumps so high. Jejeje 🙈

[ANY.RUN @anyrun_app]

Top 10 last week's threats by uploads 🌐
⬇️ #Xworm 550 (944)
⬇️ #Quasar 354 (364)
⬇️ #Vidar 282 (371)
⬇️ #Asyncrat 247 (396)
⬇️ #Lumma 222 (284)
⬇️ #Stealc 221 (354)
⬆️ #Guloader 197 (181)
⬆️ #Agenttesla 186 (172)
⬇️ #Smoke 148 (153)
⬇️ #Remcos 128 (212)
Explore malware in action: https://t.co/lJQZWqz51M

#Top10Malware

[Virus Bulletin @virusbtn]

FortiGuard Labs observed malware named “ShadowV2” spreading via IoT vulnerabilities at the end of October during a global disruption of AWS connections. This activity was likely a test run conducted in preparation for future attacks. https://t.co/GOgQxBCkh0

[John Hammond @_JohnHammond]

Tracking down a rogue Windows service for webshell persistence -- just a teeny weeny PowerShell HTTP server wrapped with NSSM, showcased with Wazuh and their sweet new 4.14 release with visibility on IT hygiene 😎 Video: https://t.co/rQk6rV5dNg

[John Hammond @_JohnHammond]

Uncovered screen recordings from threat actors! 👀 Real footage of cybercriminals using anti-detect browsers and infostealer malware logs for session hijacking, and another using GraphSpy to read their Entra ID victim's emails in Outlook! 💀 Video: https://t.co/p94bhFgGgY

[ANY.RUN @anyrun_app]

⚠️ Supply chain attacks stay stealthy and disruptive. This DHL impersonation case showed HTML attachments slipping past filters and credential theft via a third-party form service.

📚 Explore the case against the energy sector: https://t.co/DzuM1t9kU1

[ANY.RUN @anyrun_app]

⚠️ Rundll32, certutil, mshta; attackers abuse them to load payloads without raising alerts.

Security teams using real-time analysis expose these #LOLBin tactics fast.

Here’s how to achieve it inside your SOC 👇
https://t.co/mJBj2nl9RF

[ANY.RUN @anyrun_app]

Top 10 last week's threats by uploads 🌐
⬆️ #Xworm 1044 (641)
⬆️ #Lumma 479 (476)
⬆️ #Asyncrat 398 (275)
⬇️ #Quasar 371 (390)
⬆️ #Vidar 370 (292)
⬆️ #Remcos 318 (271)
⬆️ #Stealc 282 (174)
⬆️ #Agenttesla 193 (167)
⬆️ #Guloader 176 (171)
⬇️ #Smoke 160 (164)
Explore malware in action: https://t.co/Bl8htuxohr

#Top10Malware

[ANY.RUN @anyrun_app]

⚠️ #ClickFix became a major attack vector in 2025, combining cross-platform delivery, user-driven execution that slips past defenses, and high-impact payloads like stealers, RATs, and #ransomware.

👨‍💻 See a recent Docusign themed case: https://t.co/RSbmD0X6d2
📚 Learn how to keep up with new ClickFix attacks using #ANYRUN and explore more cases: https://t.co/iLlIkxSjVC

[ANY.RUN @anyrun_app]

⚠️ #ClickFix malware tricks users into infecting themselves, bypassing traditional security. In 2025, it became #2 vector after #phishing.

See how @ericparker dissected ClickFix attacks including the new #FileFix variant 👇
https://t.co/BkUGVlsS2t

[CyberWar - 싸워 @cyberwar_15]

#NorthKorea #Konni

North Korean(🇰🇵) threat actors carried out the first known remote wipe attacks targeting Android devices—destroying victims’ data and spreading malware via stolen Google, KakaoTalk, and Naver accounts.

https://t.co/wphzTMYs4H

[Anonymous Hispano @anonopshispano]

🇨🇴 🖥️ Hacker colombiano encuentra error en el corazón de internet y pone en alerta a todo el mundo

El investigador colombiano José Pino descubrió una vulnerabilidad tan sencilla como crítica en el motor Blink, presente en navegadores como Chrome, Edge, Brave y Opera. Esto podría afectar a 7 de cada 10 usuarios en el mundo, mediante la sobrecarga de recursos en el equipo.

https://t.co/P9Vnilu0B8

[AV3AS @LAXVE1]

Muy buen resumen de los principales ataques de Phshing del 2025, compartido por https://t.co/Sdzrp8ejHX. https://t.co/bDkGzIlaxT

[blackorbird @blackorbird]

Search by CVE ID, keyword, or vendor...
https://t.co/44Gmi4qv1e

[MSec Operations @MSecOps]

Tools such as https://t.co/IKyo8x29Vk from Impacket are usually flagged for lateral movement due to the pre-built service executable that is dropped on the remote system. However, some vendors also flag Impacket based on its behaviour.

With RustPack, you can easily create service executables that won't be detected by signatures or behaviour-based detection. 😎

In this demo video, an unsigned service executable is generated. This will only fire the payload on a system with the hostname 'Win11' — environmental keying will prevent the payload from showing up in a sandbox or cloud analysis.

To avoid Impacket detection, we drop and execute the binary via the recently released Titanis protocol library from @TrustedSec:

https://t.co/AZcygPtDjb.

The result is an Adaptix C2 connection in the SYSTEM context. 🫡

#Pentest #RedTeam #Malware #OST

[BleepingComputer @BleepinComputer]

Microsoft is investigating an ongoing DNS outage affecting customers worldwide, preventing them from accessing Microsoft Azure and Microsoft 365 services.
https://t.co/sUQI4yMBuG

[Steven Lim @0x534c]

Hunting MSIX Malware: Combining Splunk Insights with DefenderXDR Precision

The Splunk blog post highlights the growing threat of MSIX package weaponization, where attackers exploit the Windows app packaging format to deliver malware via Loader-as-a-Service platforms and deceptive distribution methods. To help defenders, Splunk developed MSIXBuilder — a tool that safely simulates malicious MSIX behavior for detection testing.

https://t.co/ngtzLh3ngJ

As a proactive measure, I've created a DefenderXDR custom detection that flags newly seen unsigned .msix files with extremely low prevalence, offering early warning of potential abuse and further investigation.

KQL Detection (Invite Code: KQLWizard)
https://t.co/6UoSsXFgMB

#Cybersecurity #DefenderXDR #MSIXAbuse

[Alex Plaskett @alexjplaskett]

A great write-up of a VMware Workstation guest-to-host escape (CVE-2023-20870/CVE-2023-34044 and CVE-2023-
20869) exploit by Alex Zaviyalov has just been published!

[Blue Team News @blueteamsec1]

ClickFix Malware Campaign Exploits CAPTCHAs to Spread Cross-Platform Infections https://t.co/ftxApeuwxe #Malware #CyberSecurity #ClickFix #Hacking #Phishing