F3D ツ

i used to break things.

[Cleafy LABS @cleafylabs]

[1/4] 🚨 We tracked Mirax, a new Android RAT and banking malware operating as a private MaaS. First promoted on underground forums in December 2025, it's been actively targeting Spanish-speaking countries through Meta ad campaigns, reaching over 200,000 accounts.

[F3D ツ @f3d__]

@0xabc0 still too many gaps to be filled, tbh

[F3D ツ @f3d__]

🥶

[Cleafy LABS @cleafylabs]

(1/6) 🚨 Our team tracked a large-scale MaaS operation that deployed PlayPraetor to infect over 11,000 Android devices globally. PlayPraetor is an Android RAT that facilitates On-Device Fraud (ODF) by giving operators complete real-time control over compromised devices.

[F3D ツ @f3d__]

@Rolf_Govers Nice, I'll be there as a speaker. Let's meet up!

[F3D ツ @f3d__]

@Sh4dow3x3 @credem @500mk500 @guelfoweb @marsomx_ @ShadowOpCode @JAMESWT_WT bingomod

[F3D ツ @f3d__]

@0xabc0 premium service starting soon? 👀

[F3D ツ @f3d__]

@LukasStefanko Another medal 🥇😂

[F3D ツ @f3d__]

@fs0c131y "it's OSINT time"? 👀

[Cleafy LABS @cleafylabs]

(1/5)‼️ Our team has dissected "SuperCard X," a novel Android malware leveraging NFC relay for fraudulent cash-out. This MaaS campaign, attributed to Chinese-speaking threat actors, presents an intriguing case study in evolving mobile fraud techniques.

[F3D ツ @f3d__]

@Gi7w0rm @JAMESWT_MHT @nexipayments @guelfoweb @marsomx_ @illegalFawn @AndreaDraghetti @dubstard I did 😂

[F3D ツ @f3d__]

@dimitribest @500mk500 @ValidinLLC smells like
https://t.co/4s9bXRytr7

[fernando @entdark_]

#Zanubis guys back at it again, with another debug build

https://t.co/40wmZS8Utb
147.78.103.19
https://t.co/LVaer0XGlY
seems like they gave up on encryption and just base64 everything

[F3D ツ @f3d__]

@9823f_ Interesting. Could you share samples of the 2023 campaigns?

[F3D ツ @f3d__]

[Update] All the messages from their official TG channel have been removed 🧐

[Cleafy LABS @cleafylabs]

[1/7] 🚨 We tracked a new Android banking trojan fraud operation dubbed DroidBot. We were able to observe active campaigns against UK, Italy, France, Turkey, Spain and Portugal targeting 77 distinct entities, including banking institutions and crypto-exchanges.

[F3D ツ @f3d__]

Our latest investigation 🇨🇳

[Cleafy LABS @cleafylabs]

[1/6] 🚨We tracked a new Android banking trojan fraud operation dubbed ToxicPanda, which has intriguing connections with tgToxic. According to our investigation, TAs are currently targeting European and LATAM countries.

[F3D ツ @f3d__]

@500mk500 Turkish skids.
Related: b2542ff1f2e3d4a145f4ef9f9eca6781

[F3D ツ @f3d__]

@fs0c131y @TheJusticeDept The #OSINT time format has been one of the best to follow on X lately. Great job, Robert! 🫡

[F3D ツ @f3d__]

icon-sha1: 18a1e1aaf557cef773b7987e7653c43f309e9432 👀

[Cleafy LABS @cleafylabs]

‼️ (1/5) On October 7th, 2024, we identified a new dropper associated with the TeaBot banking trojan within the Google Play Store. The initial stage of infection originates from the following application (com.mastercreativestudio.documanagerandpdf):

[Cleafy LABS @cleafylabs]

(1/5) 🚨The Cleafy TIR team identified some campaigns involving a new variant of the Android malware TrickMo, incorporating new anti-analysis mechanisms. The variant uses malformed ZIP files and JSONPacker, and is distributed via a dropper disguised as the Google Chrome browser.

[Cleafy LABS @cleafylabs]

(1/6) 🚨 The Cleafy TIR team identified some campaigns involving an evolved version of the Android malware #Octo, also known as #Coper. This was confirmed by several posts, in an underground forum, in which the malware developer mentioned the keyword #Octo2