Steve ⚛️

🚘 Motorhead
💻 Red Team Operator w/ a focus in infrastructure and development

Tweets are my own and not of my employer

[Bad Sector Labs @badsectorlabs]

Babe, wake up. Someone finally dropped a sick macOS/Linux implant.

https://t.co/rMmAxoI2gr

[Steve ⚛️ @krydus03]

@alexocheema https://t.co/T0lM2jouCq

I could use some!

[hacker.house @hackerfantastic]

🚨PSA #defcon34 - this user attempted a ClickOne malware delivery exploit and social engineering attack on me, relatively sophisticated. Be very cautious as blackhat's are actively targeting attendees with information stealers and wallet drainers.

[cr3ghost @cr3ghost]

Three zero-days in Windows 11 and Microsoft Entra ID. Over 20 novel attack techniques against passkeys. Toolkit open sourced. Microsoft declined to fix one of them.

Passkeys were supposed to be unphishable. @MGrafnetter from @SpecterOps just presented Pass-the-Passkey at Black Hat.

Global Admin impersonation from a standard user account. No user interaction. Bypasses phishing-resistant MFA Conditional Access policies. Zero alerts from Defender for Identity or Entra Identity Protection on M365 E5.

Windows Hello passkeys are still vulnerable after the patches because they always send signature counter 0.

Microsoft scored it 6.5 Medium and paid $1,000. The researcher scored it 8.6 High. Their advisory described it as 'could potentially read small portions of heap memory.'

This is the same team behind BloodHound, Certified Pre-Owned (AD CS), Rubeus, Certify, Seatbelt, SharpDPAPI, SharpUp, Ghostwriter, Nemesis, SharpSCCM, and CuddlePhish. They consistently ship research that changes how the industry thinks about Active Directory and identity security.

If you do red teaming, pentesting, identity security, Entra ID, FIDO2, WebAuthn, Windows Hello, phishing-resistant MFA, or detection engineering, this is the most important identity research to drop this year.

Pass-the-Hash for the passwordless era.

https://t.co/zZgx8JP89F

#Infosec #RedTeam #DetectionEngineering

[Zenity @zenitysec]

Yesterday at #BlackHat US 2026, our CTO, Michael Bargury (@mbrg0) and AI Security Research Team Lead, Stav Cohen (@StAJect0r), shared their latest research: A New Vulnerability Class for 0-Click Takeover, which has been named PleaseFix.

Read more about this groundbreaking research from Zenity Labs:

Claude in Chrome: From alert(1) to Full Account Takeover: https://t.co/CjfEke32VI

Claude in Chrome: Breaking down the injection: https://t.co/lM6uxFETwZ

Account Takeover via Claude in Chrome: A Technical Deep Dive: https://t.co/F2p8JIdihn

Grand Theft Atlas: https://t.co/km4MkTuqiS

#AISecurity #ZenityLabs #ZenityResearch

[Steve ⚛️ @krydus03]

@cryps1s DM’ed

[BriPwn @BriPwn]

Your EDR just coerced itself. 🫠
Drop a crafted LNK → MsSense.exe makes a CreateFile call → machine account hands over its Net-NTLMv2 hash over WebDAV → relay to LDAP → Shadow Credentials or RBCD.

No user interaction. No exotic exploit. Just vibes and a shortcut file.

If you're running Microsoft Defender for Endpoint, this one is literally about you. 👀
Full attack + detection breakdown 👇 https://t.co/wUsR1cHuZP

#purpleteam #MDE #NTLMcoercion #detectionengineering

[Dave Kennedy @HackingDave]

Introducing a new tool called "SideChannel". A secure alternative to OpenClaw. Utilizes signal for communication and has Claude integration.

I built SideChannel, an open-source Signal bot that connects Claude AI to your entire development workflow. End-to-end encrypted. From your pocket.

The real power is autonomous development. Send one message like "Build a REST API with auth, pagination, and tests" and SideChannel will:

- Generate a full PRD with stories and atomic tasks.
- Dispatch up to 10 parallel workers (each running Claude).
- Independently verify every task with a separate Claude context.
- Run quality gates to catch regressions
- Auto-fix failures.
- Send you progress updates via Signal as work completes.

Every piece of code is reviewed by a separate AI context using a fail-closed security model. If it detects security issues, backdoors, or logic errors — the code gets rejected automatically. No rubber stamps.

It also has memory that actually works. Conversations are stored with vector embeddings for semantic search. Claude remembers your project conventions, past decisions, and what's been tried before. It gets smarter about your codebase over time.

Other things I'm proud of:

- Plugin framework for extending with custom commands.
- Multi-project support with per-user scoping.
- Rate limiting, path validation, phone allowlist.
- Git checkpoints before every task, atomic commits after.
- Stale task recovery, circular dependency detection.
- Works on Linux and macOS, one-command install.

It also integrates into OpenAI or Grok (optional) for more Generative AI response for simple things like "Whats the weather in New York City right now?".

https://t.co/R3hNfoJ0Y5

[toli @tolibear_]

https://t.co/gprOAK0k9n

[Branko @brankopetric00]

https://t.co/BmzVV4LpqQ

[blackorbird @blackorbird]

Massive APT35 (Charming Kitten)
internal leak exposes a highly mature, quota-driven cyber-espionage machine focused on long-term mailbox persistence & HUMINT collection.
Core technical tradecraft is Exchange-centric & credential-obsessed:
Initial Access & Exploitation
• Heavy reliance on ProxyShell chains (CVE-2021-34473/34523/31207), Autodiscover proxying, EWS enumeration, and PowerShell automation to drop https://t.co/GRPGKLiB4J webshells (predictable paths: aspnet_client/, owa/auth/, often named m0s.aspx, m0s.php).
• Ivanti Connect Secure CVE weaponization playbooks that turn appliance vulns into reliable RCE for pivoting to internal mail estates.
• Broad recon → curated target queues: mass scanning for exposed OWA/EWS, .env grabs, RDP mstshash probes, WordPress enumeration — all feeding annotated ProxyShell target lists per country.
Credential Harvesting & Reuse
• LSASS dumps via Mimikatz-style tools (real example: plaintext creds + NTLM hashes from mfa.kktc in 2022).
• OAuth token replay, delegated token abuse, and AiTM-style MFA bypass in HERV phishing kits.
• GAL exports immediately weaponized: harvested address books → personalized HERV lures → new credentials → repeat cycle.
Persistence & Lateral Movement
• Credential-driven over fragile shells: token persistence + credential reuse for months-long access even after patches.
• WMI + WMIC remote execution, SMB admin$ mounts (net use \IP\C$), scheduled tasks, and in-memory PowerShell loaders.
• Custom in-house RAT family (RAT-2Ac2 / “PowerShort”) dropped to C:\ProgramData\Microsoft\diagnostic\ as vmware-tools.exe or JavaUpdateServices.exe — full-featured with keylogger, browser stealer, file collection, encrypted C2.
Operator Tooling & C2
• Lightweight Python REPL clients (https://t.co/sSf5t81xrC, https://t.co/1Mh3YDa1I4, https://t.co/GwgqwR7vMV) that control webshells by stuffing commands into Accept-Language headers + static Accept-Captcha handshake token (high-confidence network signature).
• Exfil via 7z to Mega/Dropbox/ProtonDrive, compromised Exchange SMTP relays, DNS tunneling, or direct HTTP beacons to C2 (e.g., 103.57.251.153).
Phishing (HERV framework)
• Mature, KPI-tracked phishing unit: HTML credential harvesters, localized templates, success metrics (lures sent, creds captured, mailbox dwell time).
• Closed-loop integration: GALs from Exchange hacks directly seed the next phishing wave.
Infrastructure & OPSEC
• Staging from Iranian DSL (Pishgaman, Zitel AS50810) + clean international VPS relays (Singapore RIPE 128.199.237.132, etc.) to separate operator origin from victim traffic.
• Internal comms: Output Messenger, 3CX, Issabelle for task hand-off.
Detection gold from the leak:
• Hunt for m0s.* webshells + long/obfuscated Accept-Language headers
• ProgramData\Microsoft\diagnostic\vmware-tools.exe / JavaUpdateServices.exe execution
• Static Accept-Captcha token in traffic
• Anomalous GAL exports + sudden HERV-style phishing spikes
This isn’t opportunistic hacking — it’s industrialized, repeatable intelligence collection run like a factory with daily KPIs, supervisor sign-offs, and specialized cells (exploit dev → credential team → HERV phishing → RTM monitoring).
Defenders: patch Exchange/Ivanti aggressively, enforce phishing-resistant MFA (FIDO2), monitor EWS/GAL activity, and hunt the repeatable signatures above. The bureaucratic rhythm makes them efficient but predictable.
Full DomainTools report: https://t.co/x5vUHE4TaO
#APT35 #CharmingKitten #IRGC #CyberEspionage #ThreatIntel

[Chris Thompson @retBandit]

Seeing a lot of bad takes on Anthropic's incident report. A lot of people are missing the point; offensive cyber capabilities in current models are a side-effect of being trained on coding datasets. As frontier model labs and private groups start to shift to tuning current models and training purpose-built cyber models on refined offensive datasets, the effectiveness of open and closed models will increase significantly, enabling stealth & evasion focused offensive cyber operations and advanced ransomware attacks.

This is why I started @OffensiveAIcon, as the community can help guide how these advancements happen and help defense try and keep pace. Here's a chart I made over a year and half ago that still holds up, purple added today:

[Demis Hassabis @demishassabis]

Excited to share early results about CodeMender, our new AI agent that automatically fixes critical software vulnerabilities. AI could be a huge boost for developer productivity and security. Amazing work from the team - congrats!

[Soumyani1 @reveng007]

I have created a Github repo targeting AWS Attack Simulation and Detection. Followed these AWS challenges https://t.co/H4Oh4XouSo (Thanks to @bohops for letting me know about this website for getting introductory hands on for log analysis 👏 )

Scenarios:
1. "AWS Delete DNS query logs" Detection
2. "AWS EC2 Windows Instance Password Data Retrieval" Detection
3. "EC2 Credential Exfiltration – EC2 Account Credentials Used by Another AWS Account" Detection
4. "Retrieving a High Number of AWS Secrets Manager Secrets" Detection
5. "Retrieve And Decrypt SSM Parameters" Detection
6. "AWS Deletes a trail" Detection
7. "Disabling Management Event Logging via Event Selector" Detection
8. "CloudTrail Logs Impairment Through S3 Lifecycle Rule" Detection
9. "Stop CloudTrail Trail" Detection
10. "AWS Remove VPC Flow Logs" Detection
11. "Download EC2 Instance User Data" Detection
12. "Enumerate SES Information Activities" Detection

Repo: https://t.co/ud1t9SrJCu

Btw, I am open to constructive criticism and would really be glad to fine tune each query, if necessary.

Also thanks to @SoumyadeepBas12, @gl4ssesbo1 and @permisosecurity for there contribution to AWS Threat Detections.

#AWS #ThreatHunting #SigmaHQ #Sigma #DetectionEngineering #ThreatDetection #BlueTeam #Infosec

[Steve ⚛️ @krydus03]

Enjoying the views before @OffensiveAIcon

[Steve ⚛️ @krydus03]

@_hyp3ri0n I'm pretty good at breaking stuff!

[K̵i̵r̵k̵ ̵T̵r̵y̵c̵h̵e̵l̵ @Teach2Breach]

This looks really good @praetorianlabs , thanks for sharing
https://t.co/w070YkK8CC

[S3cur3Th1sSh1t @ShitSecure]

After today’s talk at #TROOPERS25 I’m releasing BitlockMove, a PoC to execute code on remote systems in the context of a loggedon user session 🔥

https://t.co/zXbngHQZDD

No need to steal credentials, no impersonation, no injection needed 👌

[shubs @infosec_au]

IP whitelisting is fundamentally broken. At @assetnote, we've successfully bypassed network controls by routing traffic through a specific location (cloud provider, geo-location). Today, we're releasing Newtowner, to help test for this issue: https://t.co/X3dkMz9gwK