kit

[CyberPulse @CyberPulse56]

‼️MALWARE / EXPLOIT ALERT — WhatsApp Android RCE

A threat actor xynapse claims to be selling an exploit allegedly targeting WhatsApp for Android through a specially crafted image/sticker message.

Claimed capabilities:
• Remote code execution in the WhatsApp process
• Triggered through a crafted media message
• No additional user interaction claimed
• Allegedly tested on Pixel 8/8 Pro and Samsung S24
• In-memory execution with no APK drop or persistence by default
• Claimed exploit chain involving media-parser memory corruption and controlled code execution
• Stage 0 payload, loader and C2 components reportedly included

💰 Claimed price: $10,000

⚠️ The exploit, affected versions, testing claims, and capabilities have not been independently verified. Users should keep WhatsApp and Android updated and avoid opening unexpected media messages.

#CyberSecurity #Malware #WhatsApp #Android #RCE #Exploit #ZeroDay #ThreatIntel #OSINT

[Anurag @Malwarehunterr]

More fake Income Tax Department portals are being used to distribute malware.

cheulmri[.]link
156.245.144[.]92
pureveda[.]fyi

#Malware #Phishing #CyberSecurity #ThreatIntel #InfoSec #India @IndianCERT @Cyberdost

[cr3ghost @cr3ghost]

If you work with Windows internals, reverse engineering or exploit development, bookmark this.

@j00ru 's blog is one of the best FREE archives of low-level Windows security research online.

It covers:

Windows kernel internals
Kernel exploitation
Reverse engineering
Memory corruption + infoleaks
Win32k internals
NT + Win32k syscall tables
CSRSS APIs + internals
Fuzzing + instrumentation
Windows mitigations
Conference talks
Technical papers + research
Exploit development

Some of this research goes back more than 15 years and is still incredibly useful for understanding how Windows works under the hood. The site also maintains dedicated Windows syscall tables and CSRSS reference material.

Absolute rabbit hole for anyone serious about Windows security.

https://t.co/ATqvtIFVGP

#WindowsInternals #ReverseEngineering #ExploitDevelopment

[Co11ateral @co11ateral]

Extracting PDF Metadata

PDF metadata can be valuable during a pentest. It can reveal employee names, the applications they use, document dates, and more. These names can then be used to create username lists and test whether those accounts exist, for example, with Kerbrute

On the other hand, you may also want to make sure you're not exposing anything private

https://t.co/pVMALBXmVd

[Mehmet Ergene @Cyb3rMonk]

𝗔𝗴𝗲𝗻𝘁𝗶𝗰 𝗧𝗵𝗿𝗲𝗮𝘁 𝗛𝘂𝗻𝘁𝗶𝗻𝗴 𝗘𝘅𝗽𝗲𝗿𝗶𝗺𝗲𝗻𝘁𝘀 - 𝟭
​
This is a result of a one-shot hunting experiment in a small environment with a single generic threat hunting agent. The agent doesn't have any specific SKILL.md or prompt. It has just a single short definition saying "you are a threat hunter".
​
I especially chose the scheduled task because it's a well-studied TTP, and there are lots of resources around it on the internet. Also, the malicious task had clear indicators. So, the expectation was a successful identification of the malicious scheduled task.
​
Let's see what's gonna happen when the clear indicators are gone.
​
#ThreatHunting #AgenticThreatHunting

[MAX @MAXdeg0]

THIS IS F**CKING DANGEROUS

7 AI cybersecurity tools every builder should know before shipping their next product.

→ PentestGPT — autonomous pentesting

→ BurpGPT — AI-powered Burp Suite analysis

→ Security Copilot — blue-team investigation

→ Snyk DeepCode AI — code scanning + autofix

→ HexStrike AI — 150+ security tools + AI agents

→ Garak — LLM vulnerability testing

→ Lakera Guard — prompt injection + jailbreak protection

The interesting part?

AI is now showing up across the entire security stack.

-Offensive security.
-Defensive security.
-Code security.
-LLM red teaming.
-Runtime protection.

Some are fully open source and self hostable, while others are commercial platforms.

If you’re building AI systems, cybersecurity is becoming impossible to ignore.

BOOKMARK this before someone take it down

LINKS BELOW

[cr3ghost @cr3ghost]

Detection engineers, malware analysts, reverse engineers, threat intel and red teamers, this one is worth a read.

Nextron breaks down RegPhantom, a Windows kernel backdoor using a signed driver, registry callbacks and reflective kernel loading.

Interesting bits:

CmRegisterCallback
Unsigned PE execution in kernel memory
No PsLoadedModuleList entry
CFG and API call obfuscation
Encoded hook pointers
Payload memory wiping

Good reversing material and a useful look at how signed driver trust can be abused for stealthy Ring 0 execution.

@nextronresearch
https://t.co/TJh5ao7nJA

#MalwareAnalysis #ReverseEngineering #ThreatIntel

[Hacking Articles @hackinarticles]

Active Directory Attack Architecture

https://t.co/HV2qvqd2Jj

#infosec #cybersecurity #cybersecuritytips #pentesting #cybersecurityawareness

[Dark Web Intelligence @DailyDarkWeb]

🤖🚨 GOOGLE: THREAT ACTORS ARE MOVING FROM AI PROMPTS TO AUTONOMOUS ATTACK WORKFLOWS

Google Threat Intelligence Group (GTIG) says adversaries are moving beyond simply asking LLMs for help and are beginning to operationalize agentic AI across cyberattacks.

One of the most striking cases:

GTIG observed a suspected financially motivated actor compromise cloud infrastructure and use an autonomous multi-agent framework to plan, build and execute a mass credential-harvesting campaign in LESS THAN SIX HOURS.

According to Google, the AI-enabled operation could:

* Automate vulnerability scanning
* Harvest credentials at scale
* Troubleshoot operational failures in real time
* Rotate IP addresses automatically
* Make tactical decisions with minimal human intervention

The campaign reportedly compromised thousands of third-party credentials.

Another exposed adversarial framework tracked by GTIG had accumulated more than 23,800 harvested secrets, including cloud and AI-service API keys.

🚨 AI IS ALSO BECOMING PART OF THE SOFTWARE SUPPLY-CHAIN ATTACK SURFACE

Google details activity by UNC6780 — also known as TeamPCP — targeting developers and AI tooling.

GTIG says the actor:

* Compromised developer accounts
* Trojanized MCP-related packages
* Targeted GitHub Actions OIDC tokens
* Published compromised packages with valid provenance attestations
* Hid malicious files inside .claude/, .cursor/ and .vscode/ directories
* Used prompt injection to manipulate AI coding assistants
* Embedded adversarial prompts in malware apparently intended to make LLM security scanners refuse or skip analysis

In one incident investigated by Mandiant, UNC6780 gained initial access before handing it to another actor that subsequently issued a ransom demand using LAPSUS branding.

Google also observed nation-state actors incorporating AI throughout their operations, including PRC-, Iranian-, Russian- and DPRK-linked activity.

⚠️ BUT THERE IS AN IMPORTANT LIMIT.

Google says it has NOT yet observed threat actors deploying fully autonomous zero-day discovery and exploitation pipelines against targets in the wild.

What it IS seeing is the progression toward that capability:

Prompting
→ AI-assisted tooling
→ Automated attack pipelines
→ Multi-agent operations
→ Increasingly autonomous decision-making

⚠️ Analyst Note:

This may be one of the more consequential changes occurring in offensive cyber operations.

AI isn't simply making individual hackers smarter.

It can reduce the amount of human attention required to operate an attack.

Reconnaissance, vulnerability analysis, exploitation, troubleshooting, credential harvesting and infrastructure management can increasingly be connected into machine-driven workflows.

That changes an important variable for defenders:

TIME.

Google says human-in-the-loop latency is being dramatically reduced, compressing the traditional window defenders have to detect and respond.

The emerging threat isn't simply “hackers using ChatGPT.”

It's cyber operations where humans increasingly supervise autonomous attack infrastructure rather than manually operating every step.

Source: Google Threat Intelligence Group — September 8, 2026
https://t.co/xUpJScLZXm

#DDW #AgenticAI #ThreatIntelligence #AISecurity #CyberSecurity

[Dark Web Intelligence @DailyDarkWeb]

🔎 48 CYBERSECURITY SEARCH & OSINT TOOLS WORTH BOOKMARKING

A strong investigation rarely depends on a single platform. The real advantage comes from knowing where to look and how to correlate what you find.

Here are 48 tools across six useful categories:

🌐 Internet Assets
* Shodan
* Censys
* ZoomEye
* FOFA
* Netlas
* Criminal IP
* GreyNoise
* LeakIX

🌍 Domains & DNS
* SecurityTrails
* DNSDumpster
* https://t.co/P40gIQj9wi
* DNSViz
* Robtex
* https://t.co/IbXIHOuCEY
* BuiltWith
* Wappalyzer

🔗 URLs & Web History
* https://t.co/bT79RVclQj
* VirusTotal
* Wayback Machine
* Common Crawl
* Google
* Bing
* Yandex
* TinEye

🛡️ Vulnerabilities
* NIST NVD
* https://t.co/2Z3hAgSNtV
* https://t.co/APmmHPaQOK
* OpenCVE
* Vulners
* VulDB
* Exploit-DB
* VulnCheck KEV

💻 Code & Artifacts
* GitHub Code Search
* GitLab Search
* https://t.co/6r3y7pj1U2
* Searchcode
* Sourcegraph
* LOLBAS
* GTFOBins
* Filesec

🕵️ Threat Intel & OSINT
* AlienVault OTX
* AbuseIPDB
* URLhaus
* MalwareBazaar
* ThreatFox
* SOCRadar Labs
* https://t.co/qB9qF32x09
* WiGLE

The important part isn't having 48 bookmarks. It's knowing how to pivot between them.

IP → domain → certificate → historical DNS → URL → malware → vulnerability → code → threat intelligence.

That correlation is where isolated indicators start becoming intelligence.

⚠️ Use responsibly, verify findings, and respect authorization boundaries.

Which tools would you add to the list?

#CyberSecurity #OSINT #ThreatIntelligence #DDW

[Hacking Articles @hackinarticles]

Impacket: Change Password Abuse

🔥 Telegram: https://t.co/upuP8k8ckB
✴ Twitter: https://t.co/Za7rYILz6E

Misconfigured AD permissions like ForceChangePassword allow attackers to reset a user’s password without knowing the original—leading to account takeover and privilege escalation.

⚡ Attack Highlights
🔐 Reset user password without old credentials
👤 Target privileged accounts
🚀 Privilege escalation & lateral movement
📡 Abuse SMB/RPC protocols

⚡ Tool
🛠️ impacket-changepasswd

💡 Attackers can abuse delegated rights to gain control over other accounts, making weak AD permission management a critical security risk.

📖 Article: https://t.co/Xwl7uzW8l9

#CyberSecurity #EthicalHacking #RedTeam #Pentesting #ActiveDirectory #Impacket #PrivilegeEscalation #InfoSec

[International Cyber Digest @IntCyberDigest]

‼️ Microsoft's patch for Windows Defender zero-day ShieldBreak (CVE-2026-69414) is still bypassable, a new PoC called ShieldCrash was published today by researcher Nightmare-Eclipse. It demonstrates arbitrary file read as SYSTEM on all supported Windows versions running the September 2026 patches.

The researcher describes it as a "skeleton PoC" and says a full SYSTEM exploit may follow.

[cr3ghost @cr3ghost]

Detection engineers, red teamers, malware analysts, reverse engineers and blue teams: if EDR bypass, EDR blinding, BYOVD, rootkits or Ring 0 tradecraft interests you, @Idov31 has published an absurd amount of FREE Windows security research.

Nidhogg: 25+ rootkit / EDR tampering capabilities, easily be integrated with your C2 framework.

NovaHypervisor: VT-x + EPT defense when the kernel itself may already be compromised or abused through BYOVD.

Jormungandr: Jormungandr is a kernel implementation of a COFF loader, allowing kernel developers to load and execute their COFFs in the kernel.

Cronos: PoC for a new sleep obfuscation technique (based on Ekko) leveraging waitable timers to RC4 encrypt the current process and change the permissions from RW to RX to evade memory scanners.

Venom: Venom is a library that meant to perform evasive communication using stolen browser socket

Sandman: Sandman is a backdoor that is meant to work on hardened networks during red team engagements.

MrKaplan: MrKaplan is a tool aimed to help red teamers to stay hidden by clearing evidence of execution.

And the blog goes much deeper: Windows drivers, WinDbg, IRPs/IOCTLs, ObRegisterCallbacks, process/thread/image callbacks, registry callbacks, IRP + SSDT hooking, APC injection, kernel-to-user injection, AMSI bypass, ETW/ETW-TI tampering, credential access, PPL, callback removal/tampering and the primitives EDRs depend on for visibility.

Then you get into PatchGuard, KVA Shadow, CR3/address-space internals, VBS, VTL0/VTL1, HVCI, VMX, VMCS, VM-exits, VMCALL, EPT, EPT hooks and the bigger question: how do you defend an endpoint when Ring 0 itself can no longer be trusted?

Red teamers: study EDR bypass/blinding, kernel post-ex, BYOVD, covert execution, sleep obfuscation and unconventional C2. Detection engineers + blue teams: study exactly what telemetry, callbacks and trust boundaries attackers can manipulate. Malware analysts + reverse engineers: see what modern kernel tradecraft actually looks like under the hood.

The FREE Lord Of The Ring0 series alone could keep you busy for a long time, and the individual project writeups turn the theory into actual implementations.

This is a rare GitHub full of PoCs with basically a public Windows offense-vs-defense research lab.

Blog:
https://t.co/7gpRfTt2OP

GitHub:
https://t.co/0HIDZmI7dN

Bookmark it. Clone the repos. Save the references while everything is public.

#DetectionEngineering #RedTeam #MalwareAnalysis #ReverseEngineering

[Dark Web Intelligence @DailyDarkWeb]

🚨 New Ransomware-as-a-Service Operation: Panzer Emerges With 19 Victim Claims in Its First Month

A newly launched ransomware operation called Panzer is showing unusually rapid growth and operational maturity.

First observed around August 5, 2026, Panzer has already accumulated approximately 19 victim claims across more than 10 countries, including several government-related organizations.

What makes Panzer worth watching isn't simply another ransomware leak site. The operation appears to have launched with a relatively mature Ransomware-as-a-Service (RaaS) infrastructure from day one.

Panzer reportedly supports:

* Windows
* Linux
* VMware ESXi
* FreeBSD

Its affiliate program reportedly includes:

* 80/20 affiliate/operator revenue split
* Screened affiliate enrollment
* Additional monitoring of new affiliates to identify researchers or law enforcement
* Integrated negotiation functionality
* BTC invoice generation
* Team and sub-account management
* Leak-site publishing controls
* Support-ticket infrastructure

🌍 Early victim activity is already geographically diverse.

Claims have involved organizations across Germany, Indonesia, Portugal, Serbia, Spain, Italy, South Korea, Thailand, Switzerland, Nigeria, Czechia and other countries.

Particularly notable are several government-related claims, including:

* Dinas Komunikasi dan Informatika — Indonesia
* Directorate-General for Education — Portugal
* Government of Vojvodina — Serbia
* Castilla-La Mancha — Spain

Panzer has also claimed Hochschule Heilbronn Bildungscampus in Germany.

⚠️ Important: These should currently be treated primarily as ransomware-group claims. Not every alleged compromise has been independently verified.

There is currently no confirmed predecessor or ransomware lineage for Panzer.

However, the sophistication of its affiliate backend, multi-platform encryptor support and rapid international victim acquisition raise an obvious question:

Is Panzer really a brand-new operation, or are experienced ransomware operators working behind a new identity?

The evidence isn't strong enough yet to attribute Panzer to another group.

📊 Why Panzer matters:

New ransomware brands appear constantly. Most never become strategically significant.

Panzer is different because of the speed of its development:

Launch → Mature RaaS infrastructure → Multi-platform encryptors → Affiliate recruitment → Government and enterprise claims → 19 victims in approximately one month

If the current trajectory continues, Panzer could quickly become a more consequential ransomware operation.

The indicators to watch next are affiliate growth, sustained weekly victim volume, verified high-value compromises, and—perhaps most importantly—evidence connecting Panzer's operators to a previous ransomware ecosystem.

Sources:
CyberXTron — Panzer Ransomware: Profile of an Emerging Double-Extortion Operator
https://t.co/2Ea6IaxeVn

Pulse — Panzer ransomware activity tracker
https://t.co/Z9gdFdJ0rN

#Ransomware #CyberSecurity #ThreatIntelligence #Cybercrime #DarkWeb #RaaS #ThreatActors #DailyDarkWeb

[Hacking Articles @hackinarticles]

🚨 Windows Privilege Escalation — Practical Cheat Sheet & Reference Guide 🪟🔥

Privilege Escalation is one of the most important skills for penetration testers, red teamers, and OSCP students.

We created a practical Windows Privilege Escalation GitHub repository covering 21 techniques and attack paths. 🚀

🔓 SeBackupPrivilege
🎭 SeImpersonatePrivilege
🐞 SeDebugPrivilege
🔑 SeTakeOwnershipPrivilege
👑 SeTcbPrivilege
⚙️ AlwaysInstallElevated
🌐 DnsAdmins → Domain Admin
🌙 HiveNightmare
🧩 Registry Run Keys
📂 Startup Folder
🔐 Stored Credentials
⚠️ Weak Registry Permissions
🛠️ Unquoted Service Paths
🖥️ Insecure GUI Applications
⚙️ Weak Service Permissions
⏰ Scheduled Tasks
💥 Kernel Exploits
🎭 SamAccountSpoofing
🖨️ SpoolFool
🔥 PrintNightmare
👤 Server Operator Group

📚 GitHub Repository:
https://t.co/sRqJbUbBWz

🔥 Join our cybersecurity community:

🔥 Telegram: https://t.co/upuP8k8ckB
✴ Twitter: https://t.co/Za7rYILz6E

⭐ Star the repository
🔖 Bookmark it for your labs
♻️ Share it with the cybersecurity community

More Windows Privilege Escalation techniques are coming soon. 🚀

#CyberSecurity #WindowsSecurity #PrivilegeEscalation #OSCP #RedTeam #Pentesting #EthicalHacking #ActiveDirectory #InfoSec

[The DFIR Report @TheDFIRReport]

🧪 DFIR Labs | ClickFix / RomComRAT, Private Case #35646

A fake-CAPTCHA (ClickFix) lure kicks off a nine-day espionage operation. Follow custom RomComRAT implants, stealthy lateral movement, credential harvesting, and a massive data-theft campaign that ends in domain compromise.

🔍 Investigate the real case, hands-on in DFIR Labs 👉 https://t.co/88iE1pnNKD

[cr3ghost @cr3ghost]

Windows kernel 0-day.
Ring 0 rootkit.
EDR visibility disruption.
Post-quantum crypto.
Lazarus.

This attack chain is ridiculous.

CVE-2026-68820 is an actively exploited use-after-free in Windows AFD.sys that Lazarus used to jump from a local foothold to SYSTEM and deploy FudModule v3.1 against defense and aerospace targets.

And it gets better:

• Windows kernel exploitation
• FudModule rootkit
• ML-KEM post-quantum key exchange
• DLL sideloading
• In-memory malware
• Microsoft Graph + OneDrive C2
• Hijacked infrastructure
• Security telemetry disruption

Exploit devs and reverse engineers: study the kernel path.

Malware analysts: study the implant chain.

Red teamers: study the tradecraft.

Blue teams + detection engineers: figure out what telemetry is still trustworthy after the attacker reaches Ring 0.

Threat intel: this is Lazarus operationalizing serious Windows kernel research in the wild.

Fresh technical deep dive:
https://t.co/PtDT7FHksI

#0day #WindowsKernel #MalwareAnalysis #ThreatIntel

[Steven Lim @0x534c]

🚨AiTM Phishing Campaign Propagating Across Healthcare and Academic Medical Institutions

If you are a cyber defender working in healthcare sector or MSP with healthcare sector clients, you better start scanning your EmailUrlInfo for sites[.]google[.]com/view/ as it is now propagating across healthcare pretty quick. Firstly it is a Sneaky2FA and a compromised account (Org A) sends an initial phish and a user (Org B) clicks the trusted-looking links, once Org B user session token is captured, it is then use to send phish to Org C and so forth.

https://t.co/zgTcJSr6n5

I have used my @anyrun_app Intelligence to create a query lookup for those sites[.]google[.]com/view/ tagged with threat name Sneaky2FA, you can use this IOCs to scan against your URL in EmailUrlInfo. If you are in healthcare sector, you would probably get some hits.🫡

Download https://t.co/ml8gIiK9QF_IOCS.txt under IOCS Folder:
https://t.co/GBrb6MmVzK

#threathunting #Sneaky2FA

[dbugs @ptdbugs]

CrystalPotato — implementation of GodPotato -> (https://t.co/vEInLANU0K) in the Crystal programming language

A tool for local privilege escalation from accounts with the "SeImpersonatePrivilege" privilege to "NT AUTHORITY\SYSTEM".

Features:
• Use of the indirect syscalls technique.
• Dynamic API resolution.
• Compile-time XOR string obfuscation.
• A standalone executable that does not require additional components or a runtime environment to operate.

The main advantage of this implementation is its set of OPSEC improvements designed to reduce the binary’s signature surface. The drawback is that the "CrystalPotato" page lists testing on Windows 10, 11, and Server 2025, whereas "GodPotato" claims support for Windows 8–11 and Server 2012–2022.

Tool: https://t.co/Q0Py5ipSXn -> (https://t.co/mKh3BNIgn8)

#dbugs_tools