_jamsec

security analyst

[_jamsec @_jamsec]

top text

[Schneier Blog @schneierblog]

New Open SSH Vulnerability https://t.co/kyo7MDgDdu

[Sucuri Security @sucurisecurity]

How does a legitimate-looking Google #Chrome update turn into a gateway for #ransomware attacks?

Learn more in our latest post. Research by @_jamsec and @unmaskparasites.

#website-malware #malware #trojans

https://t.co/hsE1jGAGbj

[Sucuri Security @sucurisecurity]

🔍 Magecart malware hidden in plain sight?
In our latest post, security analyst @_jamsec reveals how ecommerce malware designed to skim sensitive credit card details from webstores is concealed through pixels and images.
#magecart #malware #magento

https://t.co/dKRAku0ogw

[Sucuri Security @sucurisecurity]

🕵️‍♂️ What is that, wingdings?!

Attackers are using #unicode and peculiar file extensions to avoid detection in #WordPress backdoors. Research by @_jamsec.

#websitesecurity

https://t.co/0EuF3tYsVA

[Sucuri Security @sucurisecurity]

🚨 Essential Addons for #Elementor vuln = new #malware taste, classic #Balada flavor. Over 6k detections by SiteCheck already.

Patch ASAP to mitigate risk. Research by @_jamsec & @unmaskparasites.

https://t.co/VBHWWHfp8D

[Denis @unmaskparasites]

Analysis of the recent massive Balada Injector wave (cdn.scriptsplatform[.]com) that started right after the Essential Addons for Elementor plugin vulnerability disclosure.
https://t.co/TiAs8rdQZ4

Had the privilege to contribute to this post with @_jamsec

[Sucuri Security @sucurisecurity]

🌐 It's raining water company defacements! ⛈️ 💧Our latest blog post explores the strange trend of Belarusian bottled water content appearing on #hacked #websites. Research by @_jamsec.

#defacement #website-security
https://t.co/qdcGPQxLjd

[Denis @unmaskparasites]

Double GTM skimmer: https://t.co/Kqy3907hVL
GTM-KTGCVGT loads GTM-55SBK75 which loads a skimmer from gojqueryajax[.com/common.css
and previously codesejquery[.com/gtm.js

Related domains https://t.co/pHrSCWloLY
jspixjqurey[.com
jspqurey[.com
gojqwejs[.com

Thanks @_jamsec

[Denis @unmaskparasites]

The long lasting massive WordPress infection campaign finally gets a name. Meet the Balada Injector and its 9 major approaches to compromising WordPress sites. https://t.co/WB5O0LZxzB

Re: https://t.co/zFaAVtEURx

[Sucuri Security @sucurisecurity]

🚨 Our 2022 Website Threat Research Report is here! 🚨

Key findings:
- 50.58% of CMS applications outdated at point of infection
- 69.63% of compromised sites had at least 1 backdoor
- 46.76% of all infected sites had SEO spam

https://t.co/fWmTpoRZli
#WebsiteSecurity #Malware

[Denis @unmaskparasites]

Server-side part of the Kritec skimmers found by @_jamsec in vendor/magento/framework/View/Page/Config/Renderer.php
shotsmob[.]sbs in this sample
We also find this malware in WordPress database (theme settings)
Re: https://t.co/SmGA9OIC2L

[Sucuri Security @sucurisecurity]

Found small unwanted ads on your #WordPress website? Might want to check for hex2bin or other encoded #malware #injections in your database. Research by @_jamsec

https://t.co/xRydOt7zMX

[Sucuri Security @sucurisecurity]

Malicious cron jobs can be aggressive. If your site keeps getting reinfected, make sure to check your #hosting control panel or use the crontab -l command.

#malware #infosec #websitesecurity

https://t.co/bMg1MvndxX

[Denis @unmaskparasites]

Two weeks after "dns.firstblackphase[.com", we have the "get.sortyellowapples[.com" wave.
https://t.co/nsU5rOBkza
Infected: index.php, .js files + backdoors
Thanks @_jamsec for spotting it!

Re: https://t.co/ZWXbAXV0S1

[Sucuri Security @sucurisecurity]

75+ new #domains pretending to be #URL shorteners are being used to redirect thousands of #hacked sites to fake #crypto Q&A sites and boost #AdSense revenues. By @_jamsec and @unmaskparasites.

#websitesecurity #infosec
https://t.co/yhunpbuq6B

[Sucuri Security @sucurisecurity]

Found the core-stab or task-controller #plugin installed on your #WordPress #website? These are most likely #backdoors that you'll want to remove ASAP.

#websitesecurity #malware

https://t.co/FGC7UdjzyQ

[Sucuri Security @sucurisecurity]

Shady #browser #extensions, stealers downloads from #Discord, unwanted #redirects — thousands of hacked #WordPress sites with track.violetlovelines[.com injection work as a platform for a black hat ad network. Research by @unmaskparasites and @_jamsec.

https://t.co/qF94TD9AWk

[Sucuri Security @sucurisecurity]

This new #SocGholish variant loads #malware from a zipped template and encoded #WordPress database record. Research by @_jamsec and @unmaskparasites.

#infosec #websitesecurity

https://t.co/H91QugCCFl

[Sucuri Security @sucurisecurity]

@publicww results show nearly 15,000 #websites have been affected by this #Malware. Research by @_jamsec and @unmaskparasites.

#infosec #websitesecurity

https://t.co/8QQyumSexm

[Sucuri Security @sucurisecurity]

When #hackers are able to compromise an environment, they can tamper with important #security controls to evade detection and execute #malicious behavior. Research by @_jamsec

#infosec #NCSAM2022 #websitesecurity #SEO
https://t.co/F1g6Y8DQ7n