Ahmed NB

Security Research @Confidential. Youtube:
Founder of Ask-Academy:

[Ahmed NB @nu11charb]

Hello Friends, I am thrilled to announce a new training "Offensive Development and Tradecraft".

https://t.co/aMswvIRMo7

Pre Sales content being released now with a price of 429 USD valid till 15th April.

Details in the slides below:

1/5

[Ahmed NB @nu11charb]

Looks like redhat-cloud-services npm packages compromised. Till now 30 npm packages compromised pushing stealers.

https://t.co/I0v781JSEj

[Ahmed NB @nu11charb]

Expect every package maintained by antv maintainers to be compromised. Echarts for react is huge there.

[Ahmed NB @nu11charb]

Looks like the whole antv account on github hosting npm repos is compromised. In the last hour a lot of thier repos infected.

[Ahmed NB @nu11charb]

Trojanized Lightning Package - Supply Chain Attack

@vxunderground

[Ahmed NB @nu11charb]

also reported a bug on the github repo, but it was closed. Also reported on their discord.

[Ahmed NB @nu11charb]

Initial details only:
lightning==2.6.3 on PyPI is possibly compromised. It silently downloads a JS runtime and executes an 11MB obfuscated credential stealer on import lightning. Targets AWS/GCP/Azure creds, browser data, .env files, GitHub tokens. Reported to PyPI security.

[Ahmed NB @nu11charb]

@Gi7w0rm @domchell @SI_FalconTeam U have a hash for the sample

[Farza 🇵🇰🇺🇸 @FarzaTV]

Hey, I'm open-sourcing Clicky.

Go forth into the wild and build the future of education and the future of AI interfaces, my friends. I'm happy to have given a spark.

Enjoy!

https://t.co/x1gR0dib1p

[Farza 🇵🇰🇺🇸 @FarzaTV]

I built this thing called Clicky.

It's an AI teacher that lives as a buddy next to your cursor.

It can see your screen, talk to you, and even point at stuff, kinda like having a real teacher next to you.

I've been using it the past few days to learn Davinci Resolve, 10/10.

[Ahmed NB @nu11charb]

@FarzaTV Amazing idea. Well done. I would like to try it too please.

[Ahmed NB @nu11charb]

@Kostastsale @herrcore Brilliant, Congrats

[Ahmed NB @nu11charb]

@code loving the browser integration. add in prompt: validate it in live browser run 😍

[Ahmed NB @nu11charb]

@s4dbrd This is great work. Can u put in the sha256 in the article as well. Makes it easy to follow along.

[Ahmed NB @nu11charb]

@matterpreter Hey Matt, This is great work. Thanks for sharing, I have created a branch where I have added support for Ghidra and IDA:

https://t.co/88ReKevcvd

[Ahmed NB @nu11charb]

@_Evan_Boyle 🔥

[Pierce Boggan @pierceboggan]

Our growth team is hiring two software engineers!

Partner with our team to run experiments in @code :)

https://t.co/LZtMyfOwCe

https://t.co/RDNsuTBENK

[Jamie Levy🦉 @gleeda]

We're looking for a Principal Threat Intel Incident Commander here at @HuntressLabs ! Do you love to:

🔍 Conduct #DFIR analysis?
👀 Track threat actors?
🕸️ Work with others across different departments?
✍️ Write about your findings?
👩‍💼 Present your work?

👇

[Ahmed NB @nu11charb]

Full walkthrough + code here 👇

https://t.co/WjcOZ8NVYb

https://t.co/XgO55tw62B

The demo walks through:

Loading a vulnerable signed driver

Interacting with exposed IOCTLs from user mode

Abusing driver functionality to kill a privileged process

2/2

[Ahmed NB @nu11charb]

BYOVD (Bring Your Own Vulnerable Driver) attacks are still an effective way to abuse kernel trust on Windows.

I put together a hands-on walkthrough showing how a legitimately signed but vulnerable driver can be loaded and abused to perform privileged kernel actions — specifically, terminating a protected high-privilege process. 1/2

[Evan Boyle @_Evan_Boyle]

Today we're open sourcing a technical preview of the GitHub Copilot CLI SDK. Build agents with custom tools in Go, Python, TypeScript, and C#.

Built on the same agent loop that powers the Copilot CLI and GitHub Coding Agent. Supports BYOK, and any model.

Here is the Copilot CLI driving Excel: