@0x0be

[@0x0be @blackeko5]

87e20b994c9cf6425557be97f1a212a3
60f27b72d321c19cc35688214a1d7c3a8064152d
c8c6f920d2b8b509425e909e8f1d0f4abfdc21eac6e532267ccb2578a9cdf97b

[Abdelhamid Naceri @MSNightmare2000]

FalconFlank : Crowdstrike Falcon 0day LPE is now public
https://t.co/J0oBnyVkH5

[@0x0be @blackeko5]

Newly registered #clawdbot / #openclaw domains:

/openclaws.io
/openclaws.ai

[crep1x @crep1x]

Around 1,000 malicious domains are hosting webpages impersonating Reddit and WeTransfer, redirecting users to download password-protected archives

These archives contain an AutoIT dropper, we internally named #SelfAU3 Dropper at @sekoia_io, which executes #Lumma Stealer

IoCs ⬇️

[ANY.RUN @anyrun_app]

🚨ALERT: Potential ZERO-DAY, Attackers Use Corrupted Files to Evade Detection 🧵 (1/3)
⚠️ The ongoing attack evades #antivirus software, prevents uploads to sandboxes, and bypasses Outlook's spam filters, allowing the malicious emails to reach your inbox

The #ANYRUN team discovered that as part of this #zeroday attack, threat actors attempt to conceal the file type by deliberately corrupting it, making it difficult for certain security tools to detect

📌 Our sandbox solves this problem thanks to interactivity. It launches these broken files in their corresponding programs, which allows it to identify #malicious behavior
See example:
https://t.co/8MFElzg47r

🚫 Although these files operate successfully within the OS, they remain undetected by most security solutions due to the failure to apply proper procedures for their file types

They were uploaded to VirusTotal, but all antivirus solutions returned "clean" or “Item Not Found” as they couldn't analyze the file properly