Aryeh Goretsky {@infosec.exchange}

Security researcher. Antivirus pioneer ● formerly w/ @ESET & @McAfee ● MS-MVP recipient ● mod: Lenovo, Neowin, ScotsNewsletter forums ● Intel Insider's Council

[Aryeh Goretsky {@infosec.exchange} @goretsky]

Looking for me elsewhere?
🐘https://t.co/HJ1fYkFpaA
🦋https://t.co/EesVPMyki8

[fab0 @FABO97662188]

#cybersecurity #macos #malware

Phexia macOS infostealer new C2 domains:

pobruog[.]wiki
samehoo229[.]fun
gran1xea[.]xyz
payload1717[.]pro
xzttyt[.]xyz
zmngfjl[.]fun
zttrych[.]icu
secdarvin2026[.]icu
oreshnik[.]top

Phexia uses the Polygon #blockchain to store C2 domain names.

[ThreatCluster.io @threatcluster]

Public exploit for GitLab CVE-2026-110264 dropped on 23 October, the same day Ruby shipped Regexp fixes in three releases. https://t.co/Mf9ZR6vx9o

[Virus Bulletin @virusbtn]

ESET researchers Anton Cherepanov & Peter Strýček uncover MythicRatatoskr – a previously unknown Go-based backdoor hiding its C&C server inside the Yggdrasil mesh network – which paved the way for a destructive attack against a Ukrainian grain firm. https://t.co/XnGLQj9Bd5

[Yogesh Londhe @suyog41]

CrashStealer

FollowUpUIAgent.dmg
f8842e867499e126d1638451affeed3f

[Szabolcs Schmidt @smica83]

Related 'NARCOTICS NETWORK AND POLICE FACILITATION.doc' seen from Pakistan @abuse_ch
e6eca876f1e4423eadde8298c879774118f094d0b714a9dd202883b50ddc02dc
https://t.co/HQb5CueaDc

[Anurag @Malwarehunterr]

🚨 SpyNote Android RAT

A fake Google Play Store page is distributing a suspicious APK identified as SpyNote.

IOCs:

Domain:
play-googlese[.]app

APK host:
psoz96apk[.]9yyl9[.]net
psoz96apk[.]9yyl9[.]net/psoz96apk/kobaiapp

Filename: kobai app.apk
312ccddffce813529d27c0962b140c031e6d7e8aa8eec3f4c6ada40d16d775d0

#SpyNote #AndroidMalware #ThreatIntel @500mk500 @skocherhan

[Team Cymru Research @teamcymru_S2]

INTEL DROP

Top 20 tools in Total Insights detection pipeline, ranked by the number of distinct IPs observed today per family.

C2 by IP count:
1,200+ CyberStrikeAI
500+ VShell
400+ PureRAT
300+ Cobalt Strike
300+ Sliver
200+ AdaptixC2
200+ XWorm
200+ Metasploit
200+ DarkSword
200+ OverlordRAT
200+ Hak5 Cloud C2
200+ Mirai
200+ RemcosRAT
100+ Mythic
90+ QuasarRAT
70+ PlugX
70+ Stealc
60+ Havoc
50+ SuperShell
50+ AsyncRAT

Offensive-security tools by IP count:
2,000+ Nessus
1,400+ ARL
1,400+ GoPhish
1,200+ ARTEX
1,200+ Interactsh
1,200+ Acunetix
600+ Burp Collaborator
400+ PentAGI
200+ Kali Linux
200+ Scope Sentry
200+ Java-Chains
80+ DeepAudit
60+ Hashtopolis
60+ reNgine
50+ Ligolo-ng
50+ Evilginx
40+ Xingrin
20+ Modlishka
10+ HTTP-revshell
10+ JspSpy

**This is not meant to convey a detection priorities ranking and is purely statistical observation (with unknowns). All organizations detection priorities are unique.

#TotalInsights #ThreatIntel #ThreatHunting #C2

https://t.co/nDqrsELahM

[Group-IB Threat Intelligence @GroupIB_TI]

First observed in April 2026, #SiriusQT is more than just another Windows RAT. Our investigation uncovered more than 280 publicly available SiriusQT client samples linked to different campaigns and identified 146 unique licenses, 110 of which were leaked. At least 30 users purchased valid licenses, while 30-day, 90-day, lifetime, and customized license periods point to an active commercial ecosystem around the #malware. #ThreatIntelligence

[ESET Research @ESETresearch]

#ESETresearch uncovered #MythicRatatoskr, an undocumented Go backdoor hiding its C&C server inside the #Yggdrasil mesh network. It was used against a Ukrainian 🇺🇦 grain logistics firm in an intrusion that ended in a destructive #Sandworm attack.
https://t.co/cdMywzNBtf 1/6

[Virus Bulletin @virusbtn]

SOCRadar found INC and The Gentlemen affiliates using LLMs in intrusions and extortion. Seven servers held 8,257 AI messages and 46 encryptors staged for six victims. https://t.co/yPUCSby1ue

[Anurag @Malwarehunterr]

Highly Suspicious ChatGPT-6 Website

URL: chatgpt-6[.]app

Potential OpenAI brand impersonation. Credential theft is not confirmed.

#phishing @500mk500 @skocherhan @TheKn0ck0ut @KirkDerpca #OpenAI

[Virus Bulletin @virusbtn]

Sekoia's Flowise honeypot caught an attacker stealing credentials and trying to use a decoy AI agent to analyse a Nightingale target in the iGaming sector. https://t.co/jBnBegMmHP

[Aryeh Goretsky {@infosec.exchange} @goretsky]

@sudo_Rem I wouldn't overly worry too much about it.
It is something that happens, like accidentally naming a computer virus after a person or a company.

[Anurag @Malwarehunterr]

🚨 Google Meet Phishing

Two domains hosting fake Google Meet pages designed to steal Google credentials and facilitate 2FA phishing.

Misconfiguration: An exposed /install page reveals database configuration and a prefilled DB password!

IOCs:

meet-google[.]cyou
qooglo[.]com
/meet
/install
/assets/js/demo.js
/api/demo/sessions
/api/demo/sessions/{token}
/api/demo/sessions/{token}/resend

#Phishing #Google @500mk500 @skocherhan @Namecheap

[Virus Bulletin @virusbtn]

ThreatFabric researchers identified Hirudo, a new Android banking RAT delivered via fake app updates. It replaces eight Indonesian banking apps with patched copies to bypass signature, accessibility, screen-capture and Play integrity checks. https://t.co/mx7lknyipT

[Panos Gkatziroulis 🦄 @ipurple]

A red team tool that packages a Windows PE payload into a .wsl file spoofing a real Linux distro installer https://t.co/WAf4T4HVsQ

[Anurag @Malwarehunterr]

🚨 Found websites impersonating Google Slides using identical Russian-language templates.

Clicking "Try It" redirects users to app[.]slidy[.]ai instead of Google Slides.

IOCs:

workspacegoogle[.]org[.]ru
workspacegoogle[.]pp[.]ru
workspacegoogle[.]net[.]ru

#Phishing #BrandImpersonation #ThreatIntel #Google @500mk500 @skocherhan @KirkDerpca

[Szabolcs Schmidt @smica83]

'screen9059163822525044318.jar' @abuse_ch
b9472cc080b4fef1cbc38bad1f1981380a7d71fc74138c7f4c41f18d8e6dacb1
https://t.co/Wao7tvYgos
Domain: 5kiwqdzvhip5yjx5u6ms2hsv3yozpslxocjhyf4cyimrg33fcb7devid(.)onion

[OpcodeIntel @OpcodeIntel]

Clearnet IPs of The Seven Deadly Sins Ransomware group.

185.100.85.146
37.72.140.179
193.24.123.177

@malwrhunterteam @skocherhan

#ThreatIntel #Malware #Ransomware

[Nextron Research ⚡️ @nextronresearch]

Our research team identified a second downloader variant linked to the WebSockets backdoor campaign recently analyzed by @dmpdump.

While the original downloader was written in native C++, this new variant uses C# (.NET 8).

Same seven payload files, same NVIDIA-themed disguise, but a very different implementation: no obfuscation, plaintext strings, and extensive retry logic designed to handle hours of unreliable connectivity.

An interesting detail: it ships as a 14 MB self-contained .NET single-file executable. Open it in IDA and you'll mainly see the native .NET runtime host rather than the actual downloader logic.

We've developed three new YARA detection rules covering both downloader variants and the WebSockets backdoor, and added them to our THOR scanners.

You can explore the rules' matches on VirusTotal through our Valhalla pages:

https://t.co/V0r21KOeA2
https://t.co/SwYLEa0ZhD
https://t.co/3U5LyM78rR

Full technical analysis, decompiled source and IOCs:
https://t.co/6DEEwCcAYS