ShadowOpCode

Malware analyst & reverse engineer 🧠
Threat intel on stealers, RATs, live campaigns 🕵️
Technical analysis. No buzzwords.
📍DM open for research collabs

[ShadowOpCode @ShadowOpCode]

🚨 New #JavaStealer “MaksStealer” uncovered!
Fully in-memory, FUD, DES–Blowfish runtime decryption, WebSockets on 4025/4028/6662.
Author “Max, 17yo” left his signature in the payload 🤯
Full report & IoCs 👉 https://t.co/HHuNMn5FPL
#infosec #malware #ThreatIntel @malwrhunterteam

[ShadowOpCode @ShadowOpCode]

⚠️NEW MALSPAM IN ITALY⚠️
📧"Importante"
Fascicolo Sanitario Elettronico
hxxps://fseitalia[.]es/c/abf99046-6f6c-42d0-bf73-c003eb244993
@AgidCert @guelfoweb @JAMESWT_WT @illegalFawn @AndreaDraghetti

[ShadowOpCode @ShadowOpCode]

@guelfoweb @JAMESWT_WT @tobersotski @illegalFawn @AndreaDraghetti @skocherhan @jamieantisocial thank you @JAMESWT_WT !
I've uploaded more artifacts obtained during reverse engineering of the sample, including a .NET PE embedded and a DLL embedded (matrioska vibes) decrypted at runtime via 3DES and GZip:
https://t.co/8N3lwqhHPR

[ShadowOpCode @ShadowOpCode]

"Avviso di Bonifico Bancario (SEPA)"
eml > 7z > bat > powershell > exe
hxxps://d[.]tmpfile[.]link/public/2026-05-20/5855cc12-9621-4b14-85ae-b935380953bb/ghhjgr.png
Powershell decryption with XOR
Injection (VirtualAlloc)
AutoIt3 decrypt final payload XOR
C2: 151.243.109[.]130:9518

[ShadowOpCode @ShadowOpCode]

https://t.co/GVwMvioaqr
Probable PureLogs Stealer

[ShadowOpCode @ShadowOpCode]

@guelfoweb @JAMESWT_WT @illegalFawn @skocherhan I've seen only now @AgidCert already published it some minutes ago :)
https://t.co/VTdCKAzN2x

[Cert AgID @AgidCert]

🇮🇹 Nuova campagna di phishing a tema "rimborso fiscale" ai danni di #AdE

🎯 Il vero obbiettivo dei criminali è impossessarsi dei dati della carte di credito o debito.

ℹ️ Info e #IoC (via Telegram)👇

🔗https://t.co/G3Ffd6nHCe

[ShadowOpCode @ShadowOpCode]

🚨ALERT🚨
#phishing #AdE 730
📩Comunicazione Ufficiale – Rimborso Imposte 2025–2026
hxxps://tax[.]denzay[.]eu/gov/
hxxps://agenziaentrate[.]grillwestfrentes[.]com[.]ar/rimborso/it/
Exfil credit card number
@guelfoweb @JAMESWT_WT @illegalFawn

[ShadowOpCode @ShadowOpCode]

@IntesaSP_Help #phishing #scam
hxxps://fazexmd[.]com/wordpress/fark/
@illegalFawn @JAMESWT_WT @AgidCert

[ShadowOpCode @ShadowOpCode]

⚠️ALERT⚠️
Fake #Booking #Scam #phishing message
🚨REAL RESERVATION USED AS LURE🚨
hxxps://hotel-stay32181[.]com/
Compromised host?
@illegalFawn @JAMESWT_WT @AgidCert

[ShadowOpCode @ShadowOpCode]

@anyrun_app @JAMESWT_WT @skocherhan @AgidCert @guelfoweb RELATED https://t.co/BQPECECFqU

[ShadowOpCode @ShadowOpCode]

#Booking #ClickFix
📧"General Notification: (5392009143, Complaints Continue to Rise, May, 2026)"
📧info@muraptor[.]com
⛓️‍eml > url > msiexec.exe > #NetSupport
🚫lkhpihf[.]com:443
🚫lkboasprqw[.]com:443
@anyrun_app analysis: https://t.co/XKbmKK8NFz
@JAMESWT_WT

[ShadowOpCode @ShadowOpCode]

🚨ALERT🚨
#Booking #ClickFix #NetSupport Manager RAT seen in Italy.
hxxps://admin-extranet[.]com/start/
👇
ClickFix
👇
hxxp://217.145.226[.]119/book/
👇
lkhpihf[.]com:443
lkboasprqw[.]com:443
@anyrun_app : https://t.co/rJZi7kf04C

[ShadowOpCode @ShadowOpCode]

@anyrun_app @JAMESWT_WT @AgidCert @guelfoweb @illegalFawn @skocherhan stage: hxxp://193.233.113[.]106/book

[ShadowOpCode @ShadowOpCode]

#Booking #ClickFix
📧"General Notification: (5392009143, Complaints Continue to Rise, May, 2026)"
📧info@muraptor[.]com
⛓️‍eml > url > msiexec.exe > #NetSupport
🚫lkhpihf[.]com:443
🚫lkboasprqw[.]com:443
@anyrun_app analysis: https://t.co/XKbmKK8NFz
@JAMESWT_WT

[ShadowOpCode @ShadowOpCode]

#FSE malspam #phishing campaign
hxxps://sfe-2026[.]com/~server10/c/375f4b72-6efb-45f0-a90e-9de7ee504228

[ShadowOpCode @ShadowOpCode]

⚠️ALERT⚠️
#AgentTesla spreading in Italy
📧Purchase Order #10045
📡hxxp://185.29.10[.]77/VbnpIdAHD29.bin
⛔ftp[.]holzbrenzii[.]com
⛔[email protected]
Bazaar: https://t.co/fsahBvCoSO
@anyrun_app: https://t.co/CSWH16lDxD
Thanks @JAMESWT_WT for the other samples

[ShadowOpCode @ShadowOpCode]

🚨ALERT🚨
#Crypto investing scam in #Italy
Using #MarioDraghi and @albmatano image
hxxps://zolviqhub[.]live/pc/15007/?sub1=7zcKg&pid=2jWO3Tyh0ou
@Cloudflare @CloudflareHelp TAKE IT DOWN‼️
@AgidCert @illegalFawn @JAMESWT_WT

[ShadowOpCode @ShadowOpCode]

@RussianPanda9xx Have you ever tried ChatGPT plus? What do you think?

[ShadowOpCode @ShadowOpCode]

🚨ALERT🚨
There is a #DarkCloud #malspam campaign started in novembre 2025 and still active
"Quotation - Labmate Scientific USA"
eml > rar > DarkCloud (UPX packed)
📡C2: mail[.]mokasco[.]com (turkish company)
Sender IP: 31[.]57[.]184[.]57 🇮🇷🦁
bazaar: https://t.co/dm2bS09HmX

[ShadowOpCode @ShadowOpCode]

@JAMESWT_WT @serverplan @smica83 @guelfoweb @marsomx_ @Certego_Intel @D3LabIT @struppigel @c_APT_ure @James_inthe_box @VirITeXplorer @Max_Mal_ username: backup@corella[.]ro
password: I won't tell you 🥱

[ShadowOpCode @ShadowOpCode]

Threat actors are abusing branded PDFs to deliver phishing via malicious QR codes.
📩"Employee Pay Raise and Bonus Allocation"
The QR code redirects users outside the corporate perimeter to a credential harvesting page.
🎣hxxps://crioralo[.]ru

[ShadowOpCode @ShadowOpCode]

@JAMESWT_WT @anyrun_app @guelfoweb @AgidCert @skocherhan @marsomx_ @VirITeXplorer @D3LabIT @Certego_Intel @James_inthe_box @c_APT_ure @struppigel @Max_Mal_ exactly! Seems like a stealer also, it searches for Crypto Wallets and cookies in the system

[ShadowOpCode @ShadowOpCode]

#booking #clickfix #HijackLoader
📧"New notification"
hxxps://admin[.]booking[.]com-complete-captcha[.]info
👇
hxxps://lkgkdsjd[.]com/s.php
👇
hxxps://pulse-srvc[.]com
@anyrun_app : https://t.co/MH82w0c6NC