NoxHunt

NoxHunt is a 🇫🇷 cybersecurity company specializing in offensive security, threat investigation, and continuous monitoring.

[NoxHunt @NoxHuntFr]

Fake personas passing as web developers, brand impersonation, use of AI copilots for job interview...

Following @ZachXBT’s DPRK workers investigation, we used our STEALINT platform to see what infostealers could uncover.

Here are our findings: https://t.co/Bhqt2glXtb
#dprk

[NoxHunt @NoxHuntFr]

#TeamPCP and the Breached[.]st guys just announced a supply chain competition after open-sourcing the Shai Hulud npm worm.
#supplychain #shaihulud #npm

[NoxHunt @NoxHuntFr]

Other malicious domains from this 🇰🇵 campaign:
precommit-nyx.vercel[.]app
precommit-chk-one.vercel[.]app
tanxilabs[.]com
code-beautify[.]com
precommit-chk.vercel[.]app
gitconfig-nyx.vercel[.]app

Some of them were also used in phishing attacks.
#dprk #malware #github

[blackorbird @blackorbird]

NK hackers are targeting software developers and job applicants with fake coding interview tasks.

They send you a GitHub repository link and ask you to git clone it to complete a programming test.

Inside the repo, they hide a malicious Git Hook (a small script that Git runs automatically).

The hook is placed at .githooks/pre-commit (not in the usual .git/hooks folder).

As soon as you run git commit (a completely normal thing every developer does), the hook triggers automatically.

The script quickly checks your operating system (Mac, Linux, or Windows), then silently downloads and runs the real malware from precommit[.]vercel[.]app.

The downloaded malware belongs to Lazarus’s toolkit InvisibleFerret and Beavertail backdoors.

[NoxHunt @NoxHuntFr]

Someone on Darkforums is allegedly leaking 300,000+ records and 10,000+ users PII from Polymarket. Seems more like an API scrape than a breach though. Comes with some POC scripts and a "redteam" report.
#polymarket #breach #darkweb

[TEAM CYMRU @teamcymru]

DPRK IT workers continue to infiltrate corporate networks using fraudulent identities. Senior Threat Intelligence Analyst Eli Woodward (@ElijahWoodward9) details how these adversaries leverage freelance platforms to bypass traditional hiring controls.

- Network traffic correlates these operations with AI developer tools and platforms like Workana.

- Operators use American and Latvian residential IPs alongside VPNs to mask their true locations.

Read Eli's full briefing: https://t.co/6prMOAKaoJ

#CyberSecurity #ThreatHunting #CyberThreatActors #DPRK #InfoSec

[Dark Web Informer @DarkWebInformer]

‼️ HexDex threat actor posted under his account on DF that they were arrested. 🤷‍♀️

Sus obviously.

[ZachXBT @zachxbt]

1/ Recently an unnamed source shared data exfiltrated from an internal North Korean payment server containing 390 accounts, chat logs, crypto transactions.

I spent long hours going through all of it, none of which has ever been publicly released.

It revealed an intricate ~$1M/month scheme of fraudulent identities, forged legal documents, and crypto-to-fiat conversion.

Enjoy the findings!

[NoxHunt @NoxHuntFr]

The BF(.)ac crew announced that they just launched a brand new forum called LeaksForums. BF(.)ac had been down for some days.

[NoxHunt @NoxHuntFr]

Des centaines de milliers de documents et de photos d'identité dans la nature... l'hémorragie chez les fédérations françaises de sport se poursuit : découvrez notre Hebdo Cybercrime du 2 mars !

https://t.co/eyzCdQN4S6

[Antonin Garrone @antonin_garrone]

Les données disponibles sur https://t.co/Yz6AmwMTfb sont désormais interrogeables via un serveur MCP dédié en experimentation, vos retours sont bienvenus !

💻 Le code est ouvert et accessible sur GitHub :
https://t.co/AmY04V22TH

Pour en savoir plus : https://t.co/V7UJrc6uUq

[NoxHunt @NoxHuntFr]

Comment utiliser VSCode et Sliver dans vos audits redteam :
#redteam #sliver #vscode
https://t.co/pjGs0XCuId

[NoxHunt @NoxHuntFr]

Unlucky Chucky: Uncovering Solonik's personas and origin
#darkweb #leak #infostealer
https://t.co/5A4ATnkdSb

[Fusion Intelligence Center @ StealthMole @stealthmole_int]

Following BadBox 2.0 Artifacts: The Zhu Zhiyu Trail

https://t.co/PaOjlKN2lS

[NoxHunt @NoxHuntFr]

MANOMANO piraté, des données personnelles de députés et de sénateurs publiées... Découvrez notre Hebdo Cybercrime du 9 février !

https://t.co/xUX0O7D6m0
#darkweb #ransomware #0apt #leak

[OSINT Industries @OSINTindustries]

https://t.co/vvS7N74Ufi

[Georgy Kucherin @kucher1n]

It turned out there are many more payloads used in the Notepad++ attack! To stay undetected, its masterminds were COMPLETELY changing execution chains about every month.

Here are more IPs used in the attack:
45.76.155[.]202
45.32.144[.]255

Read below for many other IoCs! [1/8]

[NoxHunt @NoxHuntFr]

Rapid7 confirms the supply chain attack was used to deliver the Chrysalis backdoor which they attribute to the Chinese APT group Lotus Blossom. Technical report and IOCs: https://t.co/4tAL3h3pwL
#supplychainattack #lotusblossom

[NoxHunt @NoxHuntFr]

🚨Notepad++ targeted in supply chain attack: its update infrastructure was hijacked, letting attackers redirect some of the update traffic to malicious servers between June–Dec 2025. Infrastructure is now secured according to the Notepad++ team.
https://t.co/sp8QOUbIku

[NoxHunt @NoxHuntFr]

🏴 Encore une semaine noire pour les données françaises... Nous venons de publier notre Hebdo Cybercrime du 2 février ! Vous y trouverez les événements liés au cybercrime ayant impacté la France ces sept derniers jours.
https://t.co/PkQvW44j3V
#darkweb #stealer #leak #ransomware

[NoxHunt @NoxHuntFr]

Someone is allegedly selling an access to an extranet portal of the main french telecom company Orange, where you can lookup phones and view customers information. Price is very cheap so not sure if legit.
#darkweb #access #Orange