Greenplan

Malware Researcher

[Malwarebytes @Malwarebytes]

We discovered fake installers impersonating popular software including ChatGPT, Claude, AutoTune, and Kontakt on GitHub and SourceForge distributing a Deno backdoor known as DinDoor.

Attackers are using compromised YouTube channels to distribute links to the malicious software.

[Greenplan @greenplan_it]

@JaromirHorejsi CountLoader?

[Greenplan @greenplan_it]

@Acronis Interesting, thanks! The "ClawHub-DependencyInstaller" is NWHStealer https://t.co/feZkTsVG2B

[Greenplan @greenplan_it]

@thomasklemenc The $77config registry keys look similar to these ones: https://t.co/iWGTMgKAvM 🤔

[Malwarebytes @Malwarebytes]

Threat actors are abusing a Javascript runtime called Bun to spread NWHStealer.

Bun’s relatively newer ecosystem helps attackers hide malicious code in larger executables and potentially evade detection.

[Greenplan @greenplan_it]

@smica83 @abuse_ch name:"IMG-*.png.lnk" and you obtain all of them :)

[Greenplan @greenplan_it]

@rst_cloud RenPy Loader? 🤔

[x64dbg @x64dbg]

New version is out!

[Malwarebytes @Malwarebytes]

A fake TradingView AI agent site is delivering Needle Stealer malware via a fake trading agent called TradingClaw that can take over your browser, steal your accounts and financial data, and open the door to further attacks.

[fab0 @FABO97662188]

#cybersecurity #malware #clickfix #macos #botconf
Hi, I’ve decided to share a tool I wrote in my spare time. The app is designed to track the ongoing ClickFix campaign targeting macOS and Win users and collect compromised websites.
https://t.co/4STTrVRl3G
Hey @madzincyber :)

[Greenplan @greenplan_it]

Check out my latest research!

https://t.co/AgJSL4V5k5

[Greenplan @greenplan_it]

@BreakGlassIntel Weedhack https://t.co/KiR8GT86vv

[Greenplan @greenplan_it]

@RussianPanda9xx Yes..... a real nightmare

[bbsz @blackbigswan]

Malwarebytes covered that pretty well

https://t.co/jWH6tJDlbZ

And here's vibe coded Clickfix script: https://t.co/YARdlokXRl

[Greenplan @greenplan_it]

@RexorVc0 Such great news!! already added to my cart :D

[Greenplan @greenplan_it]

@malwrhunterteam @smica83 Related to Amatera Stealer

[Malwarebytes @Malwarebytes]

We’ve identified a campaign using job interviews, project briefs, and financial documents hosted on Google Forms to distribute malware, including the PureHVNC RAT.
https://t.co/bErOCficA0

[Malwarebytes @Malwarebytes]

Compromised websites are being used to deliver Vidar infostealer through fake CAPTCHA.
https://t.co/K8ToVY3gMu

[Jesko Hüttenhain @huettenhain]

If you like both #BinaryRefinery and #Claude, try out this skill I wrote:

https://t.co/hcpOVJf5kb

[Greenplan @greenplan_it]

@smica83 @abuse_ch It support different commands and RAT capabilities, but I can't find a particular attribution

take_screenshot
download_file
start_terminal
remote_desktop
self_uninstall
shutdown_host
windows_service
ws_auth_token

[Greenplan @greenplan_it]

@smica83 @abuse_ch It executes a Golang malware, it's interesting because it brute force part of the AES key😂

Decrypted URLs:
https[:]//stat.web-analytics.workers.dev/
https[:]//download.stable-releases.workers.dev/
https[:]//gtm.tagmanager.workers.dev/
https[:]//js.webframework.workers.dev/