![Kb4Threatlabs's tweet photo. 🚨PHISHING ALERT: AI-Powered "Vibe Coding" Phish via Evernote 🚨
KnowBe4 ThreatLabs is tracking an active campaign exploiting Evernote’s legitimate infrastructure to deliver high-fidelity Microsoft credential harvesters. This attack highlights a shifting landscape: threat actors are now leveraging Base44, an AI "vibe coding" platform, to build sophisticated phishing pages without writing a single line of code.
The Attack Flow:
The Hook: Users receive a "Note shared with you" email featuring high-pressure financial lures—payment approvals, contracts, or finance reports.
The Bypass: Sent from no-reply[@]mail[.]evernote[.]com, these emails sail past SPF/DKIM/DMARC authentication.
The Bridge: Links lead to real share.evernote[.]com notes containing a "View Document" CTA.
The AI Twist: The CTA lands on a phishing page built with Base44 AI an AI "vibe coding" platform. These pages are protected by Cloudflare bot-checks to evade sandbox detection.
The Sting: A pixel-perfect M365 login screen designed to harvest credentials in real-time.
Why It Works:
✓ Reputation Hijacking: Sender and initial host are legitimate Evernote domains.
✓ AI-Speed: Base44 allows attackers to spin up unique, professional-grade pages instantly.
✓ Sandbox Evasion: Multi-stage redirects hide the final payload from automated scanners.
Indicators of Compromise (IOCs)
ashrafreda[.]com
atomicurl[.]com
voice0356[.]us
techformulagrayfellowshipinvestments[.]tvwpotalsources[.]vu
easywaytech[.]co[.]ke
enthusiastic-secure-link-go[.]base44[.]app
freight-sync-link[.]base44[.]app
login[.]yum[.]homes
office[.]cotiviti[.]top
hticybernetics[.]com[.]sharepoint[.]com/s/finance/Eba1
berenzweiglaw[.]com[.]sharepoint[.]com/:f:/s/finance/Eba1
serviceamericanreprographicscompany[.]golkppdmansachs[.]vu/
#CyberSecurity #Phishing #M365 #OAuth #KnowBe4 #ThreatIntel #HumanRisk #Evernote #AI](https://pbs.twimg.com/media/HHxgoyqbkAAmGW5.jpg)
![Kb4Threatlabs's tweet photo. 🚨PHISHING ALERT: AI-Powered "Vibe Coding" Phish via Evernote 🚨
KnowBe4 ThreatLabs is tracking an active campaign exploiting Evernote’s legitimate infrastructure to deliver high-fidelity Microsoft credential harvesters. This attack highlights a shifting landscape: threat actors are now leveraging Base44, an AI "vibe coding" platform, to build sophisticated phishing pages without writing a single line of code.
The Attack Flow:
The Hook: Users receive a "Note shared with you" email featuring high-pressure financial lures—payment approvals, contracts, or finance reports.
The Bypass: Sent from no-reply[@]mail[.]evernote[.]com, these emails sail past SPF/DKIM/DMARC authentication.
The Bridge: Links lead to real share.evernote[.]com notes containing a "View Document" CTA.
The AI Twist: The CTA lands on a phishing page built with Base44 AI an AI "vibe coding" platform. These pages are protected by Cloudflare bot-checks to evade sandbox detection.
The Sting: A pixel-perfect M365 login screen designed to harvest credentials in real-time.
Why It Works:
✓ Reputation Hijacking: Sender and initial host are legitimate Evernote domains.
✓ AI-Speed: Base44 allows attackers to spin up unique, professional-grade pages instantly.
✓ Sandbox Evasion: Multi-stage redirects hide the final payload from automated scanners.
Indicators of Compromise (IOCs)
ashrafreda[.]com
atomicurl[.]com
voice0356[.]us
techformulagrayfellowshipinvestments[.]tvwpotalsources[.]vu
easywaytech[.]co[.]ke
enthusiastic-secure-link-go[.]base44[.]app
freight-sync-link[.]base44[.]app
login[.]yum[.]homes
office[.]cotiviti[.]top
hticybernetics[.]com[.]sharepoint[.]com/s/finance/Eba1
berenzweiglaw[.]com[.]sharepoint[.]com/:f:/s/finance/Eba1
serviceamericanreprographicscompany[.]golkppdmansachs[.]vu/
#CyberSecurity #Phishing #M365 #OAuth #KnowBe4 #ThreatIntel #HumanRisk #Evernote #AI](https://pbs.twimg.com/media/HHxgm8_bkAAeZlG.jpg)
![1ZRR4H's tweet photo. ⚠️🇨🇱 Nueva campaña dirigida a Chile conduce a la instalación de software de acceso remoto legítimo y firmado como LogMeIn y Atera.
A pesar del uso recurrente en actividades maliciosas, ni Defender ni muchas otras herramientas de seguridad las clasifican como amenazas 😐
Las descargas se realizan desde un open S3 bucket en: https://subenvio.t3[.]storage[.]dev/. Hasta el momento, van 719 accesos desde 589 organizaciones/correos distintos.
[+] https://t.co/QNjfrrag7w.
El email configurado en el agente Atera nos da pistas sobre el origen de esta operación (🇧🇷)
H/T @Huntr3ssX](https://pbs.twimg.com/media/Gwq0t0EXQAENWE1.jpg)
![1ZRR4H's tweet photo. ⚠️🇨🇱 Nueva campaña dirigida a Chile conduce a la instalación de software de acceso remoto legítimo y firmado como LogMeIn y Atera.
A pesar del uso recurrente en actividades maliciosas, ni Defender ni muchas otras herramientas de seguridad las clasifican como amenazas 😐
Las descargas se realizan desde un open S3 bucket en: https://subenvio.t3[.]storage[.]dev/. Hasta el momento, van 719 accesos desde 589 organizaciones/correos distintos.
[+] https://t.co/QNjfrrag7w.
El email configurado en el agente Atera nos da pistas sobre el origen de esta operación (🇧🇷)
H/T @Huntr3ssX](https://pbs.twimg.com/media/Gwqyo2FWQAAjYsG.png)
![1ZRR4H's tweet photo. ⚠️🇨🇱 Nueva campaña dirigida a Chile conduce a la instalación de software de acceso remoto legítimo y firmado como LogMeIn y Atera.
A pesar del uso recurrente en actividades maliciosas, ni Defender ni muchas otras herramientas de seguridad las clasifican como amenazas 😐
Las descargas se realizan desde un open S3 bucket en: https://subenvio.t3[.]storage[.]dev/. Hasta el momento, van 719 accesos desde 589 organizaciones/correos distintos.
[+] https://t.co/QNjfrrag7w.
El email configurado en el agente Atera nos da pistas sobre el origen de esta operación (🇧🇷)
H/T @Huntr3ssX](https://pbs.twimg.com/media/GwqvHcuWwAA2eIG.png)
Olivia
Online
Alessandro C.
@ackaros
Vengo del caribe 🌴 Me forme como Ing. de Telecom📡 Especializado en TV 📺 He leido algo sobre fotografía📷 Me gusta dibujar letras✒
Santiago de Chile
Joined January 2010
860 Following
547 Followers
18.2K Posts
Es una inmensa falta de respeto, de consideración, un enorme desprecio a la inteligencia de los venezolanos decir que estamos felices con el resultado de la gestión de la dictadora designada Delcy Rodríguez bajo el supuesto tutelaje de los Estados Unidos.
Que chiste
¿Escucharon bien? El régimen dice que el sistema eléctrico colapsa por culpa de tu prosperidad. 💅✨ Según Alcalá( el Ministro) el dinamismo económico hizo que el Venezolano empezara a comprar, neveras, aires y licuadoras a lo loco. O sea, que tener una nevera que medio enfríe es sobrecargar el sistema. Pasaron de culpar al clima a responsabilizar al derroche del venezolano (que sigue más flaco que nunca). ¡No tienen vergüenza!
🚨PHISHING ALERT: AI-Powered "Vibe Coding" Phish via Evernote 🚨
KnowBe4 ThreatLabs is tracking an active campaign exploiting Evernote’s legitimate infrastructure to deliver high-fidelity Microsoft credential harvesters. This attack highlights a shifting landscape: threat actors are now leveraging Base44, an AI "vibe coding" platform, to build sophisticated phishing pages without writing a single line of code.
The Attack Flow:
The Hook: Users receive a "Note shared with you" email featuring high-pressure financial lures—payment approvals, contracts, or finance reports.
The Bypass: Sent from no-reply[@]mail[.]evernote[.]com, these emails sail past SPF/DKIM/DMARC authentication.
The Bridge: Links lead to real share.evernote[.]com notes containing a "View Document" CTA.
The AI Twist: The CTA lands on a phishing page built with Base44 AI an AI "vibe coding" platform. These pages are protected by Cloudflare bot-checks to evade sandbox detection.
The Sting: A pixel-perfect M365 login screen designed to harvest credentials in real-time.
Why It Works:
✓ Reputation Hijacking: Sender and initial host are legitimate Evernote domains.
✓ AI-Speed: Base44 allows attackers to spin up unique, professional-grade pages instantly.
✓ Sandbox Evasion: Multi-stage redirects hide the final payload from automated scanners.
Indicators of Compromise (IOCs)
ashrafreda[.]com
atomicurl[.]com
voice0356[.]us
techformulagrayfellowshipinvestments[.]tvwpotalsources[.]vu
easywaytech[.]co[.]ke
enthusiastic-secure-link-go[.]base44[.]app
freight-sync-link[.]base44[.]app
login[.]yum[.]homes
office[.]cotiviti[.]top
hticybernetics[.]com[.]sharepoint[.]com/s/finance/Eba1
berenzweiglaw[.]com[.]sharepoint[.]com/:f:/s/finance/Eba1
serviceamericanreprographicscompany[.]golkppdmansachs[.]vu/
#CyberSecurity #Phishing #M365 #OAuth #KnowBe4 #ThreatIntel #HumanRisk #Evernote #AI
![Kb4Threatlabs's tweet photo. 🚨PHISHING ALERT: AI-Powered "Vibe Coding" Phish via Evernote 🚨
KnowBe4 ThreatLabs is tracking an active campaign exploiting Evernote’s legitimate infrastructure to deliver high-fidelity Microsoft credential harvesters. This attack highlights a shifting landscape: threat actors are now leveraging Base44, an AI "vibe coding" platform, to build sophisticated phishing pages without writing a single line of code.
The Attack Flow:
The Hook: Users receive a "Note shared with you" email featuring high-pressure financial lures—payment approvals, contracts, or finance reports.
The Bypass: Sent from no-reply[@]mail[.]evernote[.]com, these emails sail past SPF/DKIM/DMARC authentication.
The Bridge: Links lead to real share.evernote[.]com notes containing a "View Document" CTA.
The AI Twist: The CTA lands on a phishing page built with Base44 AI an AI "vibe coding" platform. These pages are protected by Cloudflare bot-checks to evade sandbox detection.
The Sting: A pixel-perfect M365 login screen designed to harvest credentials in real-time.
Why It Works:
✓ Reputation Hijacking: Sender and initial host are legitimate Evernote domains.
✓ AI-Speed: Base44 allows attackers to spin up unique, professional-grade pages instantly.
✓ Sandbox Evasion: Multi-stage redirects hide the final payload from automated scanners.
Indicators of Compromise (IOCs)
ashrafreda[.]com
atomicurl[.]com
voice0356[.]us
techformulagrayfellowshipinvestments[.]tvwpotalsources[.]vu
easywaytech[.]co[.]ke
enthusiastic-secure-link-go[.]base44[.]app
freight-sync-link[.]base44[.]app
login[.]yum[.]homes
office[.]cotiviti[.]top
hticybernetics[.]com[.]sharepoint[.]com/s/finance/Eba1
berenzweiglaw[.]com[.]sharepoint[.]com/:f:/s/finance/Eba1
serviceamericanreprographicscompany[.]golkppdmansachs[.]vu/
#CyberSecurity #Phishing #M365 #OAuth #KnowBe4 #ThreatIntel #HumanRisk #Evernote #AI](https://pbs.twimg.com/media/HHxgp6IbUAAiZy5.jpg)
🚨 CYBERINTEL ALERT: TOTAL COMPROMISE OF THE NATIONAL IDENTITY CORE – SAIME, SAREN, AND BORDER ID SYSTEM [STATUS: DATA DISASTER / CRITICAL] 🇻🇪
VECERT Intelligence monitoring systems have detected the largest data exfiltration in Venezuela's recent history. The threat actor group L4TAMFUCKERS, led by GordonFreeman, has announced the breach and massive exfiltration of the databases belonging to SAIME, SAREN, and the Border ID system.
🏢 Affected Entities:
SAIME (Administrative Service for Identification, Migration, and Foreigners).
SAREN (Autonomous Service of Registries and Notaries).
Border ID (Border mobility system).
👤 Threat Actors: L4TAMFUCKERS (GordonFreeman, Izanagi, YoSoyGroot).
📂 Data Volume: Terabytes of exfiltrated information.
📅 Report Date: May 8, 2026.
📊 Inventory of Exfiltrated Assets
SAIME (Biographical Database – 35.2 Million Records):
Contains identity metadata for practically the entire population holding a national ID card.
Data: National ID number, full names, gender, date of birth, profession, and system registration date.
SAREN (Birth Certificates – 13.4 Million Documents):
Exfiltration of 6 Terabytes of legal documents in PDF format.
Compromise of the nation's civil core: Records establishing filiation, inheritance, and marital status.
Border ID (92,000 Detailed Records):
Complete database including: Foreign ID numbers, email addresses, passwords, phone numbers, and registration dates. 📊 Technical Analysis of the Attack (TTPs)
The L4TAMFUCKERS group exploited structural flaws within the ministerial interconnection architecture:
API Abuse and Blind Trust: The attackers compromised an entry point and utilized internal authentication keys to query other systems, exploiting the fact that the servers automatically trusted one another without requiring additional verification (API Chaining).
Identifier Manipulation (IDOR / BOLA): By manually altering IDs within network requests, the system delivered citizen records without requiring prior authorization.
Exfiltration via Official Tunnels: They utilized the very same government data channels to extract terabytes of information, thereby ensuring that the outbound traffic appeared legitimate and evaded Intrusion Detection Systems (IDS).
🛡️ Emergency Recommendations
🔒 For Citizens: It is recommended that you immediately change your personal email passwords and enable MFA (Multi-Factor Authentication). Remain extremely vigilant regarding any attempts at telephone or digital extortion that utilize specific details regarding your identity or family members.
🏛️ For Institutions: It is imperative to revoke all current API keys and implement a Zero Trust architecture.
Monitor:
https://t.co/wk9bZJ3laQ
#CyberSecurity #Venezuela #SAIME #SAREN #DataBreach #L4TAMFUCKERS #IdentityTheft #VECERT #CyberAlert 🇻🇪🛡️⚠️🚨📂
![VECERTRadar's tweet photo. 🚨 CYBERINTEL ALERT: TOTAL COMPROMISE OF THE NATIONAL IDENTITY CORE – SAIME, SAREN, AND BORDER ID SYSTEM [STATUS: DATA DISASTER / CRITICAL] 🇻🇪
VECERT Intelligence monitoring systems have detected the largest data exfiltration in Venezuela's recent history. The threat actor group L4TAMFUCKERS, led by GordonFreeman, has announced the breach and massive exfiltration of the databases belonging to SAIME, SAREN, and the Border ID system.
🏢 Affected Entities:
SAIME (Administrative Service for Identification, Migration, and Foreigners).
SAREN (Autonomous Service of Registries and Notaries).
Border ID (Border mobility system).
👤 Threat Actors: L4TAMFUCKERS (GordonFreeman, Izanagi, YoSoyGroot).
📂 Data Volume: Terabytes of exfiltrated information.
📅 Report Date: May 8, 2026.
📊 Inventory of Exfiltrated Assets
SAIME (Biographical Database – 35.2 Million Records):
Contains identity metadata for practically the entire population holding a national ID card.
Data: National ID number, full names, gender, date of birth, profession, and system registration date.
SAREN (Birth Certificates – 13.4 Million Documents):
Exfiltration of 6 Terabytes of legal documents in PDF format.
Compromise of the nation's civil core: Records establishing filiation, inheritance, and marital status.
Border ID (92,000 Detailed Records):
Complete database including: Foreign ID numbers, email addresses, passwords, phone numbers, and registration dates. 📊 Technical Analysis of the Attack (TTPs)
The L4TAMFUCKERS group exploited structural flaws within the ministerial interconnection architecture:
API Abuse and Blind Trust: The attackers compromised an entry point and utilized internal authentication keys to query other systems, exploiting the fact that the servers automatically trusted one another without requiring additional verification (API Chaining).
Identifier Manipulation (IDOR / BOLA): By manually altering IDs within network requests, the system delivered citizen records without requiring prior authorization.
Exfiltration via Official Tunnels: They utilized the very same government data channels to extract terabytes of information, thereby ensuring that the outbound traffic appeared legitimate and evaded Intrusion Detection Systems (IDS).
🛡️ Emergency Recommendations
🔒 For Citizens: It is recommended that you immediately change your personal email passwords and enable MFA (Multi-Factor Authentication). Remain extremely vigilant regarding any attempts at telephone or digital extortion that utilize specific details regarding your identity or family members.
🏛️ For Institutions: It is imperative to revoke all current API keys and implement a Zero Trust architecture.
Monitor:
https://t.co/wk9bZJ3laQ
#CyberSecurity #Venezuela #SAIME #SAREN #DataBreach #L4TAMFUCKERS #IdentityTheft #VECERT #CyberAlert 🇻🇪🛡️⚠️🚨📂](https://pbs.twimg.com/media/HH1Hs0qboAAI0DJ.jpg)
Who to follow
Mari Carrero
@MariCarreroCFC
Luis Velasquez
@LuisManuelVA
tengo desodorante y jabón de bañar para zurdos, y gratis como más les gusta, info al dm! 🇻🇪 en 🇦🇷
Ysrael A. Ortega
@YsraelAlberto_
Caracas FC🇾🇪, Vinotinto🇻🇪, River Plate🇵🇱... Y que viva el Fernet🇦🇷. Trance & Electro music❤️🎛️🎧
Ojo, nunca te atrevas a tomar nada de aquí en serio...
@ANCIChile Si bien tienen la noticia en su portal desde el 30/04, su comunicación deja mucho que desear para un organismo del Estado. No tienen manera de suscribirse a un feed RSS para actualización de alertas, ni envío por correo. Sumado a eso hacen publicaciones en redes a destiempo
Aquí recibiendo reportes! Todo marcha bien! Gracias a Dios!
📸2017 - 2026
Misma reja, pero contra estudiantes y contra EEUU 🇺🇸
Llévense a Capriles también porfa
TREMENDO video de la Vinotinto en la previa del gran partido de mañana ante Colombia.
CON LA ILUSIÓN INTACTA 🇻🇪
“Después no quieren que la saluden de beso en el cachete”
El mejor review que leí!
⚠️🇨🇱 Nueva campaña dirigida a Chile conduce a la instalación de software de acceso remoto legítimo y firmado como LogMeIn y Atera.
A pesar del uso recurrente en actividades maliciosas, ni Defender ni muchas otras herramientas de seguridad las clasifican como amenazas 😐
Las descargas se realizan desde un open S3 bucket en: https://subenvio.t3[.]storage[.]dev/. Hasta el momento, van 719 accesos desde 589 organizaciones/correos distintos.
[+] https://t.co/QNjfrrag7w.
El email configurado en el agente Atera nos da pistas sobre el origen de esta operación (🇧🇷)
H/T @Huntr3ssX
![1ZRR4H's tweet photo. ⚠️🇨🇱 Nueva campaña dirigida a Chile conduce a la instalación de software de acceso remoto legítimo y firmado como LogMeIn y Atera.
A pesar del uso recurrente en actividades maliciosas, ni Defender ni muchas otras herramientas de seguridad las clasifican como amenazas 😐
Las descargas se realizan desde un open S3 bucket en: https://subenvio.t3[.]storage[.]dev/. Hasta el momento, van 719 accesos desde 589 organizaciones/correos distintos.
[+] https://t.co/QNjfrrag7w.
El email configurado en el agente Atera nos da pistas sobre el origen de esta operación (🇧🇷)
H/T @Huntr3ssX](https://pbs.twimg.com/media/Gwq12DuXgAEfcnz.png)
Las redes sociales hoy en día se han convertido en un mar de hate. Afortunadamente nos dan las herramientas para silenciar ese hate, aprovéchalas y se selectivo con lo que consumes.
José Gregorio Hernández ya es Santo.
¡Los Venezolanos estamos de fiesta!
Él es de esos íconos necesarios que unen a un País
#Venezuela #josegregoriohernandez
La iguana también emigró #SeFueLaLuz
Que hoy de lo que se hable del festival de viña es de la actuación xenófoba de algunos y no del espectáculo de arte, deja mas en ridículo al país que al artista que es @ElGeorgeHarris porque el seguirá cosechando éxitos y esos seguirán siendo lo que son.
No puedes hacer un show de comedia en una sociedad infeliz.
Confundir el nacionalismo con "pité al extranjero ¿viste?" es una buena señal de que desarrollo económico no es igual a ser primer mundo. A este continente le falta mucho por recorrer.
VÁYANSE DE ESA MIERDA, QUE QUEDE VACIAAAAAAAA
A todas estas los de Bacilos:
La falta de respeto del público de Viña es vergonzoso.
Bien por lo que dice “Pa’ pelearse falta dos”.
Last Seen Users on Sotwe
Most Popular Users
Elon Musk 
@elonmusk
240.6M followers
Barack Obama
@barackobama
119.2M followers
Donald J. Trump
@realdonaldtrump
111.7M followers
Cristiano Ronaldo
@cristiano
110.5M followers
Narendra Modi
@narendramodi
107M followers
Rihanna
@rihanna
97.6M followers
NASA
@nasa
92.2M followers
Justin Bieber
@justinbieber
90.9M followers
KATY PERRY
@katyperry
87.6M followers
Taylor Swift
@taylorswift13
81.4M followers
Lady Gaga
@ladygaga
73M followers
Virat Kohli
@imvkohli
69.8M followers
Kim Kardashian
@kimkardashian
69.8M followers
YouTube
@youtube
68.7M followers
Bill Gates
@billgates
63.9M followers
Neymar Jr
@neymarjr
62.5M followers
The Ellen Show
@theellenshow
62.4M followers
CNN
@cnn
61.9M followers
X
@x
60.8M followers
Selena Gomez
@selenagomez
60.7M followers