Malware Hunter

infosec enthusiast

[Malware Hunter @mreee786]

They should be detected quite easily this time because of the almost similar TTPs.

[Wiz @wiz_io]

🚨 Research alert: Another npm supply chain attack is targeting developers.this time through popular packages in the keyv and cacheable ecosystems.

Check affected versions, IOCs, and mitigation steps 👇
https://t.co/nKRT04ACS0

[Florian Roth ⚡️ @cyb3rops]

Google just patched a serious ⚠️ vulnerability (CVE-2025-4664) that allows attackers to steal sensitive tokens (like OAuth or session IDs) when you simply visit a malicious site.

No clicking. No downloading. Just loading the page is enough.

What makes this so dangerous?

The bug lives in Chrome’s resource loading mechanism. It fails to apply origin policies correctly to Link headers, so attackers can trick your browser into sending full URLs – including those juicy query strings with your login tokens – to their server.

Imagine someone in HR or Finance clicking a phishing link. Suddenly their session tokens to SaaS tools (like payroll systems, admin panels, or customer databases) get exfiltrated without any interaction.

This isn’t remote code execution – but in today’s cloud-first, token-based authentication world, it might be worse.

So, yeah. I don’t post often about browser vulns. But this one is a no-go.

Update your Chrome. Right now.

[Harshleen @0xharshleen]

Threat Intelligence Cheat Sheet

[Andrew Case @attrc]

Our talk from @defcon is now available! In the presented research, we document every EDR bypass technique used in the wild along with how to detect it using new memory forensics techniques and @volatility plugins. Feedback appreciated!

https://t.co/fWD57fzchj

#DFIR

[xiu @osint_barbie]

Let's play a game! I'll share yet another #macOS stealer with a low detection rate on VT, and you try to find anything that’s not a stealer! Honestly, I'd settle even for a good old-fashioned adware at this point xD https://t.co/scqy8hli7F

[Elastic Security Labs @elasticseclabs]

Yesterday the CUPS vulnerabilities were disclosed — today, we’re showcasing our analysis of the POC and how Elastic Security can protect against it. Check it out: https://t.co/h8mkxOWCPt

#ElasticSecurityLabs #vulnerability #cybersecurity

[Karol Mazurek @karmaz95]

I finished the promised article about System Integrity Protection #SIP, which introduces the #Apple idea of #rootless on #macOS. The article is for anyone interested in: #Programming #Re #Cybersecurity

https://t.co/9Qe2CIG6cQ

Enjoy reading!

[Elastic Security Labs @elasticseclabs]

The new publication from @DefSecSentinel explores the DPRK’s use of Python and social engineering for initial access. Check out the detailed breakdown here: https://t.co/PJyOr0vTMA

#ElasticSecurityLabs #DPRK #Python

[0xor0ne @0xor0ne]

Very useful collection of anti debugging techniques by @_CPResearch_

https://t.co/TmQtUXHRt4

#malware #infosec

[hithere @asdasd13asbz]

#Lazarus #APT

The Lazarus group appears to be currently reaching out to targets via LinkedIn and spreading malware

https://t.co/OKtcMcZf2z

IOC :
https://t.co/YOrxCdZttj

[Florian Roth ⚡️ @cyb3rops]

We decided to share our #YARA rules to scan for indicators of the exploitation of CVE-2024-3400 in #PaloAlto's PAN-OS with the community and included some of the generic rules (detect similar attacks)

Three Steps

1. Generate a Tech Support file and extract it
https://t.co/ITPOvDtw7U

2. Download and extract THOR Lite
https://t.co/EVPjanmunk

3. Scan the extracted folder (tech support files)

thor64-lite.exe -a FileScan -p ..\2024XXXX_XXXX_techsupport.tgz_unpacked --intense --cross-platform --max-file-size 500MB

YARA Rules (already included in THOR Lite's signature package)
https://t.co/qMgto8kP9k

[RandomAccessMusings @RndmAccssMsngs]

Evidence of exploitation and post-exploitation activity for #CVE20243400 can be found in log files on the FW in these locations:
/var/log/pan/gpsvc.log
/var/log/pan/md_out.log
/var/log/pan/device_telemetry_send.log
/var/log/syslog-system.log
/var/log/pan/mp-monitor.log

[Milos Constantin ♏(@Tinolle hachyderm.io ) @Tinolle]

Quick and dirty PoC for checking whether a vulnerable version of xz-utils is installed (CVE-2024-3094) https://t.co/Ih0FXHjvFt

[Bert-Jan 🛡️ @BertJanCyber]

Pushed a new #KQL to search for vulnerable XZ devices (CVE-2024-3094). Since it seems related to SSH server compromise I also created a KQL query to list all inbound SSH connections to vulnerable XZ devices, you may want to review those.
https://t.co/89OPVeFhIN

[Malwar3Ninja | Threatview.io @Malwar3Ninja]

Check if impacted by CVE-2024-3094 ❓

❌ xz -V

✔️ strings /usr/local/bin/xz | grep "(XZ Utils)"

✔️strings `which xz` | grep "(XZ Utils"

✔️for xz_p in $(type -a xz | awk '{print $NF}' | uniq); do strings "$xz_p" | grep "xz (XZ Utils)" || echo "No match found for $xz_p"; done

[Kostas @Kostastsale]

🚀Major Update: EDR Telemetry Project🚀

I updated the EDR Telemetry Project to make the table accessible for color vision deficiencies, map all sub-categories to Mitre ATT&CK and more. (Read below👇)

Many thanks to all who contributed to this major update! Here are some changes:

✨ New EDR Additions:

✅ Cortex EDR!
✅Symantec SES Complete!

🛠️ Enhancements and Fixes:

• Color Accessibility Enhancements
• Mitre ATT&CK Mapping (Thanks to @jamieantisocial and sorry it took so long 😬)
+ Elastic Telemetry Corrections
+ HarfangLab Telemetry Corrections

🎯New Additions Coming Up:
🔜 Sophos EDR
+Linux Telemetry Table (Started planning)

A huge shoutout to everyone who contributed! Your support and feedback are what drive this project forward. 🙌

🔗 GitHub Page: https://t.co/8DmXzffYVC
🔗 Telemetry Table: https://t.co/6nvs6ymqof

[Josh Stroschein | The Cyber Yeti @jstrosch]

Been slowly adding small programs that help me when teaching malware analysis - most programs in c/c++

👓 https://t.co/DXvS6Oqpha

Example, a program that implements the PEB-walking technique to resolve imports.

https://t.co/BMK1FADo8F

👇

[Aziz Farghly ⚡ @FarghlyMal]

I just published a detailed analysis about Stealc info stealer, a deep dive article about C/C++ stealer, the report involves

- in detailed code analysis
- config extractor
- yara rule
- IOCs
https://t.co/Daieg4YF1M

[Ali Hadi | B!n@ry @binaryz0ne]

Uploaded all my Offensive Security & Reverse Engineering (OSRE) course labs (docx) to my repo found below. Most of them have very detailed instructions and should be great to get you started in Software Exploitation. 1/n
#Offsec #SoftwareExploitation #RE

https://t.co/D5oBtDNOnS

[Dr Milan Milanović @milan_milanovic]

𝗖𝗹𝗼𝘂𝗱 𝗠𝗼𝗻𝗶𝘁𝗼𝗿𝗶𝗻𝗴 𝗖𝗵𝗲𝗮𝘁 𝗦𝗵𝗲𝗲𝘁

Check out the Cloud Monitoring Cheat Sheet for all significant Cloud providers (AWS, GCP, Azure, and OCI).

When we talk about monitoring, we cover the following aspects:

🔹 𝗗𝗮𝘁𝗮 𝗖𝗼𝗹𝗹𝗲𝗰𝘁𝗶𝗼𝗻: Gathering information from various sources to monitor the performance and health of cloud resources.

🔹𝗗𝗮𝘁𝗮 𝗦𝘁𝗼𝗿𝗮𝗴𝗲: Storing the collected monitoring data in a repository or database for future reference and analysis.

🔹 𝗗𝗮𝘁𝗮 𝗔𝗻𝗮𝗹𝘆𝘀𝗶𝘀: Examining the stored monitoring data to identify patterns, anomalies, or insights about the cloud environment.

🔹 𝗔𝗹𝗲𝗿𝘁𝗶𝗻𝗴: Receiving notifications when specific conditions or thresholds are met or exceeded.

🔹 𝗩𝗶𝘀𝘂𝗮𝗹𝗶𝘇𝗮𝘁𝗶𝗼𝗻: Representing monitoring data graphically, such as through charts or dashboards, to make it easier to understand.

🔹 𝗥𝗲𝗽𝗼𝗿𝘁𝗶𝗻𝗴 𝗮𝗻𝗱 𝗖𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲: Generating summaries or detailed monitoring data reports to ensure adherence to policies or regulations.

🔹 𝗔𝘂𝘁𝗼𝗺𝗮𝘁𝗶𝗼𝗻: Using software to automatically perform tasks or actions based on monitoring data without manual intervention.

🔹 𝗜𝗻𝘁𝗲𝗴𝗿𝗮𝘁𝗶𝗼𝗻: Combining monitoring tools or data with other systems or applications to enhance functionality.

🔹 𝗙𝗲𝗲𝗱𝗯𝗮𝗰𝗸 𝗟𝗼𝗼𝗽𝘀: Processes where the results or outcomes from monitoring are used to make improvements or adjustments to the cloud environment.

_______
If you want to expand your knowledge and personal growth, please follow me, @milan_milanovic, and hit the 🔔 on my profile to get a notification for all my new posts.

#technology #softwareengineering #programming #techworldwithmilan #cloudcomputing