nsquar3

Malware Researcher, Reverser and coder.

[nsquar3 @nsquar3]

@Dixit_404 @ElementalX2 @smica83 @AndreGironda @skocherhan @Cyberdost @IncomeTaxIndia @IndianCERT Nice write up. I saw similar campaign but deliver different payload.

https://t.co/pOVRojb9yI

[nsquar3 @nsquar3]

China-Nexus APT Targets India with Fake Tax Assessment Campaign Using DLL Hijacking

Attack chain:
📧 Phishing Email → 📄 PDF → 🌐 Fake Tax Portal → 📦 ZIP → 💽 VHDX → ⚙️ DLL Hijacking → 🧠 ValleyRat

🔗 https://t.co/pOVRojb9yI

[nsquar3 @nsquar3]

What are the chances? 😅

While analyzing a Discord stealer today, I found a screenshot of the threat actor's desktop... scanning https://t.co/qIh5AhwKqE.
As a Drexel alum, I definitely wasn't expecting to see my old university during malware hunting.

[nsquar3 @nsquar3]

A new phishing campaign is abusing the Starlink brand to harvest user credentials.

starlink-nepal.vercel[.]app

@elonmusk

[nsquar3 @nsquar3]

https:// friendlygamelink[.]com/

[nsquar3 @nsquar3]

phish using Canada Revenue Agency (CRA) theme.

A legitimate, signed RMM application.

Full remote access for the attacker.

[nsquar3 @nsquar3]

Is This URL Malicious?

https:// login.microsoftonline[.]com/common/oauth2/v2.0/authorize?state=%7bRECIPIENT_BASE64_EMAIL%7d&scope=openid&prompt=none&client_id=952a8d0d-0053-4672-953e-d20a6abc4a3a

[nsquar3 @nsquar3]

How much is a victim worth? $1.

Cybercriminal advertising 100 ScreenConnect victims for $100.

We're seeing IRS and Social Security-themed phishing campaigns deliver remote access tools daily. Thousands have already fallen victim.

#CyberSecurity #ThreatIntelligence #CyberCrime

[nsquar3 @nsquar3]

Microsoft is moving toward a passwordless future.

We've spent years focusing on stolen passwords, and cookies.

Game over for phishers?

Not quite. Attackers are already shifting toward authentication artifacts created after login, including Cloud Kerberos authentication data.

[nsquar3 @nsquar3]

Kali365 Panel

sfn.letsrockscgx02[.]net/login
g78w4chwjn.completecallsolution[.]com

[nsquar3 @nsquar3]

Beware Of Promotion-ChatGPT[.]com

The site impersonating ChatGPT to deploy a malware through ClickFix.

URL:
promotion-chatgpt[.]com
promotion-claudes[.].com
claudescript[.]top
hxxps://www.youtube[.]com/watch?v=ubHZ-R4qVbk

[nsquar3 @nsquar3]

Using ChatGPT to write a malware decryptor in 5 seconds

[nsquar3 @nsquar3]

Over 400 users across Indian universities were impacted by a phishing campaign focused on session hijacking, not just credentials.

Impacted:
@Vijaybhoomi_Uni – 34
@JAGSOMblr – 31
@IFIM – 17
@PresidencyUni – 26

Modern phishing enables persistent access without passwords

[nsquar3 @nsquar3]

Shadow Syndicate C2 Command Center

transcendent-yeot-3b164d.netlify[.]app

[nsquar3 @nsquar3]

URLs:
sslinkdoc[.]top
privlink1[.]top
constructionaltg[.]com
salinkme[.]top
hxxps://github[.]com/lemay679 hxxps://github[.].com/RobertAsh-arc hxxps://github[.]com/Oladaddy1

[nsquar3 @nsquar3]

🚨 New Phishing Chain: SSA -> ps1 -> GitHub → RAT

We’re tracking multiple active campaign abusing a “Social Security” theme to deliver malware developed in Golang.

Analysis (https://t.co/hWQiOm05VK):
hxxps://app.any[.]run/tasks/5e9cc1e8-6094-436b-871e-80154bf28f1b

[nsquar3 @nsquar3]

Yesterday, we observed cybercriminals targeting religious organizations in a phishing campaign. If you are on the web, you will be a target.

[nsquar3 @nsquar3]

We’re seeing campaigns use GraphQL to capture credentials and validate them in real time—no traditional form posts, no obvious endpoints. Fronted by Cloudflare to blend in.

Not Evilginx—same result.

https://t.co/iMP5a5lRIN

#phishing #cybersecurity #threatintel

[nsquar3 @nsquar3]

⚠️ Phishing Alert: Fake @NavyFederal pages are targeting seniors, show a fake check to build trust and steal sensitive data.

Verify before you act.

#Phishing #CyberSecurity #ScamAlert

[nsquar3 @nsquar3]

🚨 Beware of a New Instagram Impersonation Scam

Scammers copy photos from public profiles, create look-alike accounts (often adding “_”), and message friends or family asking for money—using the correct local currency to appear real.