Merl

🛡️ Cybersecurity | 🔍 Threat Intel | 🏹 Offensive Hunter | ⚔️ Red Team

Padre de Familia 👨‍👩‍👧

Dobby es un elfo libre 🆓

[Merl @Merlax_]

Gracias a tod@s por acercarse ayer, por la participación y las risas 🤣! El debate post charla estuvo muy bueno.

Para el que se lo perdió, expuse sobre la célula procariota.

Nuevamente gracias ❤️⚔️

[Kaguya’s Top Gal @hayasaka_aryan]

Remember when the ministry sent a chinese spy to literally get Harry Potter arrested

[blackorbird @blackorbird]

#ARTEX infrastructure hunting
https://t.co/MjD9E4OCmd

[Threat.Zone | Holistic Malware Analysis Platform @threatzone_]

This is the future of malware. 👀

VOLTA doesn’t just steal your passwords and crypto wallets.

It packages everything and sends it to Claude Opus 4.6 with this prompt: “You are a forensic intelligence analyst. Rank what this victim is worth.”

If Claude refuses → Kimi K2 → Gemini.

We caught the full chain in the sandbox (including the exact request it sent to the AI)

Stealers are now outsourcing target prioritization to commercial LLMs. 🚨

https://t.co/enXqXAydC2

[Greensboro Police Department @GSO_Police]

If your cocaine dealer shorted you and didn’t supply you with the full amount of product, contact us at 336-373-2222 to file an official complaint.

[Rodolfo D'Onofrio @RodolfoDonofrio]

Que ladrones que son,
Un dia todos van a recibir la sancion que les corresponde.
El futbol argentino no se merece esto.!!!!

[Merl @Merlax_]

Martínez Quarta tuvo como 5 fin de ciclo y por alguna razón sigue en el equipo titular

[nahuelcallalli @nahuelcallalli1]

Alerta🚨 @discoargentina @JumboArg @veasuper La web de Disco, Vea y Jumbo estan infectadas y tienen injectado un codigo en base64 que intenta robar los datos de las tarjetas. Esto podria comprometer a los usuarios que intenten realizar compras por la web.

[ZachXBT @zachxbt]

Update: Stolen funds from the $6.3B Binance exploit and $388M Bitget exploit were commingled at the same address 45 minutes ago, after arriving via THORChain.

This indicates the same actor is likely behind both incidents.

The Bitget exploit was attributed to DPRK-linked TraiderTraitor, which had overlap with other previous exploits such as Kelp DAO.

Commingling address:
0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7

Bitget exploit context: https://t.co/6S31Kwc3HI

[International Cyber Digest @IntCyberDigest]

‼️ UPDATE ON THE BINANCE HACK:

Whoever emptied a Binance hot wallet had 50 authorisations signed with that wallet's own private key, on-chain data shows.

Under Ethereum's EIP-7702, an authorisation is a signed permission that lets a wallet hand control of itself to code.

Each one works only for the wallet's next transaction number, its nonce. Binance's wallet was still sending transactions, so that number kept moving.

The sender didn't know which number would be live, so they packed all 50 into one transaction, Blockaid says. One matched.

That one installed a sweeper contract on the wallet. Blockaid found that only the Tornado Cash-funded sender can operate it.

Minutes later it emptied the wallet of $1.6B in USDT, 167,464 ETH and 60+ other tokens.

Only that key, or the system that holds it, can produce those signatures. How the sender got them is unknown.

Across Ethereum, Bitcoin and Tron, at least $5.57B left Binance-linked wallets.

Binance says user funds are "completely safe" but has not explained how.

[ZachXBT @zachxbt]

BREAKING: Arbitrum Security Council has executed a transaction to freeze ~$30.5M from the Binance Exploit.

Thanks to all other signers involved.

Exploiter address
0x3E2bf1ac6bf0934BBba6456C341c2EcbCED632d5

Trsanction hash: 0xb69c81774f507d46ce776aeaed8b4d31df96dd66ce6fd05073481011835355d6

[vxdb @vxdb]

Update: Binance Hack Estimated to be $5.7B

Per @arkham

[Crypto Banter @crypto_banter]

🚨BREAKING: BINANCE HOT WALLET APPEARS TO BE DRAINED FOR ~$2.53B!

On-chain data shows a large outflow from a Binance hot wallet (Binance 14) involving roughly $2.53 billion across 60+ tokens on Ethereum, including a major ETH transfer.

The transaction that moved the funds was initiated by an address funded via Tornado Cash, with the assets sent to a fresh EOA.

The report remains unconfirmed.

[Merl @Merlax_]

Handlers

Uno de los text inputs pegando numero de cuenta (Nótese que copió mal y se ve un texto en chino):
TEXT_INPUT "银行账号：0000085700[REDACTED]"

[Merl @Merlax_]

#Malware Afectando a varias entidades 🇦🇷🇲🇽

IOCs
novabaprimeapp.]com
ktx123.]net
ktx456.]com
ktxapp.]com
updates.]ktx123.]net

Lista de APPs (Dividida en KEYBOARD_ALLOWLIST_STATE y KEYBOARD_ALLOWLIST_LEARN_REQUEST)
https://t.co/C6G2EkDX5H

[Ernesto @Dkavalanche]

46b8dfab20e40d5d03b7c041822820489bb41e29baf8cdf0bd8f4b14a7b9f05b #malware #LATAM #Mobile

[Valen @ValenSecurity]

ordené mis charlas, slides y papers en un solo lugar. hay próximas fechas, material de las que ya di y una ficha propia para cada una. también lo rehice para que se use bien desde el celular: https://t.co/JDWPKlDWMt

[CyberFinance @CyberFinanceAR]

🕵️‍♀️El manual de Lazarus llega a Brasil: Mikedor y OfDor contra el ecosistema financiero latinoamericano

"Principios de 2026, un banco internacional perdió más de 18 millones de USD. El dinero no salió por SWIFT, sino por Pix..."

🎙️ Fabio Marenghi
🕒 10:30 - 11:15
📍 Sala E

[CyberFinance @CyberFinanceAR]

🏦Sin armas ni rencores - Encadenando vulnerabilidades en un homebanking

¿Puede un IDOR terminar vaciando una cuenta?

🎙️ Diego Ritunnano
🕒 9:45 - 10:30
📍 Sala E

#CyberFinance #Ekoparty #Eko2026

[Merl @Merlax_]

Bullish 🆙

[CyberFinance @CyberFinanceAR]

Y si los desafíos técnicos no son lo tuyo, también podés ganar un badge exclusivo de #CyberFinance
En 2 de nuestras charlas habrá media flag que forman la correcta.
Vení a validarla el dia Jueves 8 a las 12hs en nuestro village 🐮
Gana la primer persona en validarla 😉

[CyberFinance @CyberFinanceAR]

Comienza el #CyberFinance CTF! 🔥

Pasá por el Village 🐮
Preguntá por el CTF ⛳️
Prepará tu celu 🤖📱

Los premios se entregan el viernes a partir de las 16.15 hs

Happy hacking 😎