Fahad Soror Alotaibi

NDR International Research Hacking Analysing Threats
Advanced 29 Years At Depthing Network Encryption
Software Open Source

[Fahad Soror Alotaibi @fahadsoror]

Fahad Soror Alotaibi #Trojan #Spyware #Malware #Malicious #Ransomware #Phishing #Scams #Exploits #Breaches #DeebFake #Fraud
@fahadsoror
Best Full Testing Website
Test1:https://t.co/3M4I518tUi
Test2:https://t.co/sNluMN5pj2
Test3:https://t.co/6E66UqYDVK
Test4:https://t.co/DCVzAv3GlS
Test5:https://t.co/FyHa4cn4Ey
Test6:https://t.co/gD55qWFJ7u
Best Full Testing Connections Internet Test1:https://t.co/2egpVEyRMv
Test2:https://t.co/hrruxh2faW
Test3:https://t.co/29FqHhaDy8
Test4:https://t.co/R5mRQSJgua
Test5:https://t.co/IqXdC0f299
Test6:https://t.co/cvo6dRiAFP
Best DNS Protected For Ruter And Computer
IP4 Primary DNS:1.1.1.1
IP4 Secondary DNS:1.0.0.1
IP6 Primary DNS:2606:4700:4700::1111
IP6 Secondary DNS:2606:4700:4700::1001
For Mobile Best Setup APN Settings International Open Source Android
Name:internet
APN:*99#
Proxy:None
Port:443
Username:None
Password:None
Server:*99#
MMSC:None
MMS Proxy:None
MMS Port:None
MCC:None
MNC:None
Authentication Type:CHAP
APN Type:Default
APN Protocol:IP4/IP6
APN Roaming Protocol:IP4/IP6
Bearer:NR, LTE, HSPA+
MVNO Type:None
MVNO Value:None
Private DNS:https://t.co/NCc5hQsBd2 https://t.co/T3b3rgFhcg

[International Cyber Digest @IntCyberDigest]

🚨 BREAKING: An Israeli ad firm called Discover-Tech used targeted ads to infect Al Jazeera devices with Candiru spyware. It also targeted NATO and European Parliament networks.

Investigations show the ad firm facilitates multiple mercenary spyware partners.

[Joe Security @joe4security]

🚨🍎 Fake Hopper Disassembler 6.0.11 DMG Delivers macOS Infostealer!

🔬 Joe Reverser uncovered the malicious capabilities through automated deep reverse engineering!

🧬 Universal Mach-O (x86_64 & ARM64)
🔐 Fake System Preferences password prompt
🌐 Harvests browser credentials, cookies & Keychain data
💰 Targets crypto wallets, Ledger Live & Trezor Suite
🕵️ XOR-obfuscated C2 configuration
📡 Chunked exfiltration via cURL HTTP POST
👻 LaunchAgent persistence (`com.hlpr.agent.plist`)
🥷 Stealthy background execution & notification suppression

⚠️ Threat Score: 95/100

🤖 All technical findings, including decoded configurations, C2 mechanisms, credential theft and persistence capabilities, were uncovered by **Joe Reverser**.

🔗 Full Joe Reverser Analysis Report: https://t.co/u90zP2Coyg

#JoeReverser #MalwareAnalysis #macOS #Infostealer #ThreatIntel #CyberSecurity

[ESET Research @ESETresearch]

#ESETresearch has analyzed the evolution of #MATCHBOIL, a C# downloader used by the 🇷🇺 Russia-aligned APT group UAC-0099 to download, install, and persist another payload. @reib3n1 https://t.co/hdWz0uqbQC 1/7

[Aircorridor @_aircorridor]

Open Source Intelligence (OSINT): Gathering Information on a WhatsApp Account

https://t.co/7TrvOk7qdu

[The Hacker News @TheHackersNews]

🔥 Android 17 tightens Advanced Protection around AccessibilityService, a capability abused by banking trojans and spyware.

✓ AccessibilityService limited to verified Accessibility Tools
✓ Intrusion Logging
✓ USB Protection
✓ Disable WebGPU
✓ Failed Authentication Lock
✓ View Supporting Apps

The accessibility restriction applies when Advanced Protection is enabled.

What changed: https://t.co/sp3VV1wUC4

[Joe Security @joe4security]

We found an AI-themed malware lure delivering the shadow-c2 implant through a malicious PyInstaller wrapper, using Claude Setup.exe as the visible decoy 🔎

🎭 The PyInstaller wrapper launches Claude Setup.exe while decoding and executing the hidden shadow-c2 Python implant in memory
🔓 shadow-c2 supports browser and Discord credential theft, keylogging, clipboard monitoring, screen capture, webcam/microphone access, remote shell, and process control
🛡️ It includes VM, sandbox, debugger, and sleep-evasion checks, plus multiple persistence mechanisms
🔐 C2 communication uses WebSockets with RSA-OAEP key exchange and AES-GCM encryption
🌐 The configured C2 is 192.168.1.11:5000/ws, a private/local address — potentially consistent with the sample being one component of a broader intrusion set

Joe Reverser analysis: https://t.co/QN54mooHEf

Joe Sandbox analysis: https://t.co/VrjiHNRzWd

#CyberSecurity #Malware #ThreatIntel #InfoSec #ReverseEngineering #AI

[Florian Roth ⚡️ @cyb3rops]

Oh, boy ... this seems to be serious

"Imminent Zero-Day Attack: #KiteWorks Urges Customers to Shut Down Servers"

fixed version
"the company has fixed all known vulnerabilities in its latest software release, 9.5.1, which it recommends all customers use"

"Large companies and corporations worldwide use KiteWorks products for secure file transfer but also for communication via webmail. In Germany, several state banks and insurance companies, a media group, consulting firms, and well-known automotive suppliers are among the company’s customers."

https://t.co/RcTwXo2tEM

https://t.co/H7S4Mw0sX0

[Lorenzo Franceschi-Bicchierai @lorenzofb]

Italian zero-day maker Dataflow Security generated €63 million in revenue in three years, and the company also has strong ties with former Israeli intelligence veterans, according to an investigation by @RositaRijtano.

https://t.co/BfTlKkos40

[The Hacker News @TheHackersNews]

‼️ OnePlus confirmed a stock phone could be rooted by an installed app. Then it warned the researcher not to publish.

The app needs no special permissions. OnePlus confirmed the two flaws in May, but no fix was available when the researcher disclosed them. No real-world exploitation is known.

How the root chain works → https://t.co/0WRNLlTvyd

[elhacker.NET @elhackernet]

🛡️ wifit3: auditor Wi‑Fi multiplataforma para Linux, Windows y macOS, funcionando directamente con adaptadores USB compatibles

📡 Escanea redes y permite auditar WPA/WPA2, PMKID, WPS y WEP desde una TUI en Python
https://t.co/LqUhhNQruj

[ESET Research @ESETresearch]

The switch to SparroWocky happened shortly after FamousSparrow started targeting Latin America almost exclusively, going mainly after governmental entities. This is most probably part of 🇨🇳 China’s reaction to the increased 🇺🇸 US interest in the region. 2/6

[Joe Security @joe4security]

🚨 Great research from @Unit42_Intel on ZionSiphon - an OT-focused threat targeting industrial environments.

We took a deeper look at the sample with Joe Reverser 🔬⚙️

🔗 Unit 42:
https://t.co/NTNArdpUNn

🔗 Joe Reverser analysis:
https://t.co/QJKC5BMms6

Interesting capabilities include SCADA/OT discovery, configuration manipulation, PLC/Modbus activity, USB propagation and anti-forensic behavior. 🏭🛡️

[ESET Research @ESETresearch]

Drawing on ESET’s investigations of 10+ 🇷🇺 Sandworm-linked incidents in 2025, we’ll unpack the group’s latest TTPs and a rarely documented collaboration between Sandworm and UAC-0099 during a destructive attack against a 🇺🇦 Ukrainian grain logistics company. 2/4

[Gen Threat Labs @GenThreatLabs]

We stumbled upon this pretty little dropper on Mac abusing #Polygon smart contracts as a dead-drop C&C resolver. Upon decoding the server address, it pipes the second stage payload directly to osascript.

Contract: 0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0

Selector: 0x2686ecea

SHA-256: 7fc061fa6a4ae18c140bfb22c0f9d9080aa6bb4a302e6b32e38ecaca2d8ab196

Blockchain: Polygon

#macOS #AppleScript #malware

[The Hacker News @TheHackersNews]

🚨 From compromised VPN credentials to MQTT and Matrix C2, three threat groups are targeting Russian enterprises.

NightEagle uses GhostContainer, Toy Ghouls now fields a custom backdoor, and Kaspersky links Hacking Cat to Gorilla RAT and destructive malware.

Read: https://t.co/9SxDUgC4Pj