Marcus Holloway

[SpecterOps @SpecterOps]

Your browser is a C2 agent waiting to happen.

@KingOfTheNOPs shows how to silently sideload a Chromium extension, no prompts or GUI, and turn Chrome/Edge into a persistent implant with SOCKS, cookie theft, and OS access.

Read more 👇 https://t.co/kh0W1ObkeQ

[Smukx.E @5mukx]

Introduction to Windows shellcode development series

Part 1:- https://t.co/EMdEvLUaud

Part 2:- https://t.co/UwLvzr9NUl

Part 3:- https://t.co/Oyj2AkRSZA

#redteam #exploit #shellcode

[Marcus Holloway @malwaremarcus]

Someone explain to me what the obsession is with having employees work in the office?

[Ramin Nasibov @RaminNasibov]

How do people survive 40 years of this?

[Squiblydoo @SquiblydooBlog]

The latest LoremIpsumLoader is JS instead of an MSI file.

They still use the same dead drop technique. They decode text from
https[:]//www[.]letsdiskuss[.]com/user/stevenseagal4596

C2: https[:]//loginrestforest[.]com/api/init/bf428ad4-cb18-44b1-87f7-7047da02c592
https[:]//grapesinlife[.]com/api/cl/b6bac461-9d5d-49b8-958a-5bf9ce07f667

https://t.co/laN51EN2GP

https://t.co/E5wvFchQuA

[I Am Devloper @iamdevloper]

startups will create a "war room" and it's just 3 guys looking at some AWS logs

[Daily CyberSecurity @Daily_CyberSec]

A sophisticated ValleyRAT malware campaign uses fake Microsoft Teams installers and DLL sideloading to evade Windows Defender detection.

#ValleyRAT #SilverFoxAPT #MalwareCampaign #Infosec #CyberNews
https://t.co/MMMABax6qY

[Marcus Holloway @malwaremarcus]

@SquiblydooBlog https://t.co/Jh0Hv2sZWU

This appears to be related

[The DFIR Report @TheDFIRReport]

The DFIR Report recently observed MEOWBACKCONN again in the wild:

➡️ Initial Access: Malicious Microsoft Teams MSI Installer
➡️ Execution: Encrypted PowerShell backdoor
➡️ Discovery: PowerShell Cmdlets, WMI, and whoami
➡️ Credential Access: SAM Registry Dump
➡️ Exfil: Curl to temp[.]sh
➡️ Lateral Movement: SOCKS proxy dropped to enable RDP
🐱 MEOWBACKCONN dropped on domain controllers

The last time we observed this malware was from a GOOTLOADER case in Nov 2025.

[Marcus Holloway @malwaremarcus]

@SquiblydooBlog Thank you! By chance do you know the ultimate goal of the malware? Ex: was it just doing recon on the infected system?

[⚚Sage @belikesagee]

Life between accepted new offer letter & joining date

[Squiblydoo @SquiblydooBlog]

AhnLabs reports seeing evidence of the campaign going back as far as October 2025.

Thanks to folk who upload such files to MalwareBazaar, VT, and help report the certificates.

Thanks @AhnLab_SecuInfo for publishing the analysis:
https://t.co/rUKnUByjt2
2/2

[Marcus Holloway @malwaremarcus]

@hatfieldsports That Chantilly team was damn good. Crazy how the mighty have fallen.

[Marcus Holloway @malwaremarcus]

@luke92881 I see! I’ll be on the lookout for it if you do! Seeing a lot more of it these days

[Marcus Holloway @malwaremarcus]

@luke92881 do you plan on doing any write ups for pdfskills or zipthis?

[Marcus Holloway @malwaremarcus]

@SquiblydooBlog Thank you.

[Marcus Holloway @malwaremarcus]

@StixPhish @SquiblydooBlog @struppigel @InvokeReversing Thank you!

[Marcus Holloway @malwaremarcus]

@StixPhish @SquiblydooBlog @struppigel @InvokeReversing Do you have any more info regarding “openmymanual”? recently came across it and trying to determine what its end goal is. Anything helps!🙏

[AlexFx @itzalexfx]

70 cybersecurity projects from beginners to experts