Simone Mattia

Security Researcher & Threat Intel Analyst at @CleafyLabs
Somehow ended up between infosec and data science

[Simone Mattia @dl4sec]

What if you could turn an LLM’s “I cannot help with that” into a ready-to-prod implementation of a malware-development task without changing the prompt?

No prompt tricks. Just an intervention on the model’s internal representation: https://t.co/qA8jW99IB9

#infosec #llm

[Luke Berry @LukeberryPi]

introducing: JDD

Jealousy Driven Development

[Ananay @ananayarora]

> got approved for Anthropic Cyber Program in April
> somehow got removed (?)
> claude refusals across the board
> applied again today
> approved in 20 mins
> claude refusals still across the board

everyday i become even more bullish on open source models

[antirez @antirez]

Modern AI resulted from research made also by many non-US scientists (Hinton, the French folks, Linnainmaa, many others). The pre-training corpus was produced worldwide with massive code contribution from Europe OSS. What is happening with frontier LLMs is unacceptable.

[Cleafy LABS @cleafylabs]

[1/4]🚨 DevilNFC & NFCMultiPay: two new Android NFC relay malware families actively hitting European and LATAM banking customers. Developed independently by Spanish-speaking and Portuguese (Brazilian) TAs. The Chinese monopoly on NFC relay tooling is over.

[Simone Mattia @dl4sec]

Wrote a deep dive on what they are, why they matter and how to build with them, including a malware icon similarity demo 🔍

https://t.co/NNZp1Zsv9g

[Simone Mattia @dl4sec]

One thing that frustrates me, looking at the technical news on AI, is how little attention embeddings get despite being one of the most impactful innovations of this era.

[Cleafy LABS @cleafylabs]

[1/4] 🚨 We tracked Albiriox, a newly identified Android malware family offered as a Malware-as-a-Service (MaaS). Hardcoded targets indicate a broad target spectrum, encompassing major banking and cryptocurrency applications worldwide.

[ᴍʀᴄʀʏᴘ ㉿ ᴘʀɪᴠ/ᴀᴄᴄ @MrCrypPrivacy]

🚨 #CHATCONTROL FAILS AGAIN 🚨

🟢 AGAINST (9):
🇦🇹 Austria · 🇧🇪 Belgium · 🇨🇿 Czechia · 🇫🇮 Finland · 🇩🇪 Germany · 🇱🇺 Luxembourg · 🇳🇱 Netherlands · 🇵🇱 Poland · 🇸🇰 Slovakia

🔴 IN FAVOR (14):
🇧🇬 Bulgaria · 🇭🇷 Croatia · 🇨🇾 Cyprus · 🇩🇰 Denmark · 🇫🇷 France · 🇭🇺 Hungary · 🇮🇪 Ireland · 🇮🇹 Italy · 🇱🇻 Latvia · 🇱🇹 Lithuania · 🇲🇹 Malta · 🇵🇹 Portugal · 🇪🇸 Spain · 🇸🇪 Sweden

🟡 UNDECIDED (4):
🇪🇪 Estonia · 🇬🇷 Greece · 🇷🇴 Romania · 🇸🇮 Slovenia

👉 The proposal reintroduced by 🇩🇰 Denmark under its EU presidency (July 2025) has failed for the third time

💥 With Germany and Luxembourg joining the opposition, a blocking minority was formed (at least 4 States + 35% of EU population)
📌 Result: no agreement, no vote in October.
Even if Denmark tries again, Europe has once more resisted this absurdity

[Cleafy LABS @cleafylabs]

(1/6) 🚨 Our team tracked a large-scale MaaS operation that deployed PlayPraetor to infect over 11,000 Android devices globally. PlayPraetor is an Android RAT that facilitates On-Device Fraud (ODF) by giving operators complete real-time control over compromised devices.

[ksa 🏴‍☠️ @kosa12m]

I never thought this would take my job.

[Will Cathcart @wcathcart]

This ruling is a huge win for privacy.

We spent five years presenting our case because we firmly believe that spyware companies could not hide behind immunity or avoid accountability for their unlawful actions.

Surveillance companies should be on notice that illegal spying will not be tolerated.

WhatsApp will never stop working to protect people’s private communication.

https://t.co/QgYLZTyV5Y

[Cleafy LABS @cleafylabs]

[1/7] 🚨 We tracked a new Android banking trojan fraud operation dubbed DroidBot. We were able to observe active campaigns against UK, Italy, France, Turkey, Spain and Portugal targeting 77 distinct entities, including banking institutions and crypto-exchanges.

[Raaz @solostalking]

😭😭😭😭😭

[Malwarebytes @Malwarebytes]

Born too late to buy a home. Born just in time to have my personal data constantly leaked online.

[Cleafy LABS @cleafylabs]

‼️ (1/5) On October 7th, 2024, we identified a new dropper associated with the TeaBot banking trojan within the Google Play Store. The initial stage of infection originates from the following application (com.mastercreativestudio.documanagerandpdf):

[Cleafy LABS @cleafylabs]

(1/5) 🚨The Cleafy TIR team identified some campaigns involving a new variant of the Android malware TrickMo, incorporating new anti-analysis mechanisms. The variant uses malformed ZIP files and JSONPacker, and is distributed via a dropper disguised as the Google Chrome browser.

[Cleafy LABS @cleafylabs]

(1/6) 🚨 The Cleafy TIR team identified some campaigns involving an evolved version of the Android malware #Octo, also known as #Coper. This was confirmed by several posts, in an underground forum, in which the malware developer mentioned the keyword #Octo2

[Cleafy LABS @cleafylabs]

(1/4)⚠️ @Cleafy TIR team tracked a new #Android RAT that actively targets English, Italian and Romanian users. Since the lack of information and the absence of a proper nomenclature of this #malware family, we decided to dub it #BingoMod, and start tracking this family.