Stef

👋

[Lontz @lontze7]

New blog on @ValidinLLC with @cfotopoulos2000 !

"Hello? I can’t hear you": Investigating UNC1069’s Fake Meeting Tactics

https://t.co/zUHnaMz0yy

[NVISO Labs @NVISO_Labs]

#ConsentFix (#AuthCodeFix) ) is the latest variant of the fix-type phishing attacks. Dive deep into the mechanics of the attack in @_st0pp3r_ latest blog post with #KQL detection queries and mitigations. 👇
https://t.co/7drRf6V6bA

[St0pp3r @_st0pp3r_]

Been looking at malicious browser extensions related to #urbanvpn, #ghostposter, #shadypanda, #zoomstealer, #DarkSpectre.

#kql queries at:

https://t.co/3nDcmBYVmg

https://t.co/dNGVWh8byF

https://t.co/wd7sAFA62u

https://t.co/h2IaiZm4LK

[NVISO Labs @NVISO_Labs]

What makes #Telegram so attractive to adversaries, and how do they abuse it? 🤔
That’s what you will learn in the recent blog post by @lontze7, @nef0sf and @_st0pp3r_ 👇https://t.co/itKwBAJPCJ

[Stef @StefC1993]

@fr0gger_ Thanks for using our blog as one of your visualisation examples. Looks really cool! @lontze7 @bartblaze

[The Hacker News @TheHackersNews]

🚨 North Korean hackers have a new trick.

They’re hiding malware inside fake API keys on GitHub — using JSON Keeper and other legit tools to stay invisible.

The attack installs “BeaverTail” to steal data and drop a Python backdoor.

See how it works ↓ https://t.co/Ra4oGX9ULn

[Stef @StefC1993]

@Kostastsale @jamieantisocial I'm one of the authors of the blog. It's indeed a real service developed and maintained by a single developer.

[Stef @StefC1993]

Together with @bartblaze and @lontze7, we discovered that DPRK #ContagiousInterview threat actors are abusing legitimate JSON storage services to host their first-stage malware

[NVISO @NVISOsecurity]

🚨North Korean threat actors are hiding malware in JSON storage services during fake developer interviews.
With 400+ suspected victims, this campaign is actively targeting developers.
Full analysis on our blog: https://t.co/xJHXSNFmv9

[NVISO @NVISOsecurity]

Our NVISO #IncidentResponse Team has been tracking #VShell campaigns worldwide! More than 1,500 active VShell servers were uncovered, each capable of giving attackers remote control over compromised networks. Read the report here 👇
https://t.co/XjAIIe99UH

[NVISO Labs @NVISO_Labs]

On September 29th, 2025, Broadcom disclosed a local privilege escalation vulnerability, CVE-2025-41244, impacting VMware’s guest service discovery features. NVISO has identified zero-day exploitation in the wild beginning mid-October 2024.

All details - https://t.co/QOjY60sLzr

[Stef @StefC1993]

@WahlenPMattias @SquiblydooBlog @emilstahl @SecurityAura @TeamDreier @JAMESWT_WT @struppigel With correct credit usage, go ahead

[Stef @StefC1993]

@WahlenPMattias @SquiblydooBlog @emilstahl @SecurityAura @TeamDreier @JAMESWT_WT @struppigel Check out my tweet from when this was at it's peak for a screenshot (in Dutch)
https://t.co/hGW6SpLvSS

[Stef @StefC1993]

@struppigel While browsing today, I got a Google ad that blurs the entire webpage you're on and shows the ad in the center of the screen. As I was curious through these cases, I copied the link and ran it through urlscan. Got a hit on pdftraining[.]com
https://t.co/KsqZBVBu1a
(2/2)

[Stef @StefC1993]

@emilstahl @SquiblydooBlog @SecurityAura @TeamDreier @JAMESWT_WT @struppigel Interesting! Any other activity that might explain this? When I took a quick look at the .js file last week I saw that the domain was hardcoded

[Stef @StefC1993]

@emilstahl @struppigel 4th of August. See my tweet from a couple days ago
https://t.co/pl27r2Zjnt

[Stef @StefC1993]

@struppigel Another C2 identified by our SOC. 9mdp5f[.]com
Firdt sighting is currently on the 4th of August

[Stef @StefC1993]

@struppigel Another C2 identified by our SOC. 9mdp5f[.]com
Firdt sighting is currently on the 4th of August

[Stef @StefC1993]

@struppigel We see the domain 5b7crp[.]com as a C2. I haven't seen that mentioned anywhere else yet

[Stef @StefC1993]

@s1dhy @Gootloader @struppigel Most samples we see are already uploaded. I don't any (big) differences with the ones not shared yet.

[Stef @StefC1993]

@struppigel While browsing today, I got a Google ad that blurs the entire webpage you're on and shows the ad in the center of the screen. As I was curious through these cases, I copied the link and ran it through urlscan. Got a hit on pdftraining[.]com
https://t.co/KsqZBVBu1a
(2/2)

[Stef @StefC1993]

@struppigel Our SOC got multiple of these cases this week as well. All PDF-related. Most (if not all) cases have a delay of at least 10 days between initial execution of the downloaded software and execution of malicious .js files. (1/2)

[NVISO Labs @NVISO_Labs]

Ready to uncover the secrets of #PoisonSeed's #PhishingKit? 🤯 Read @lontze7 latest blog post to learn how they bypass MFA and discover essential protection tips against their tactics. 👇
https://t.co/ToJXUQomps