Null Pwner

Turning random hashes into aha-moments. Coffee fueled. Views mine.

[Null Pwner @NullPwner]

🚨 Discovered a global campaign of ~2800 compromised sites delivering AMOS Stealer for MacOS

🔹 Vector: ClickFix & EtherHiding obfuscation via Binance
🔹 IOCs: technavix[.]cloud, salorttactical[.]top
🔹 Blog for analysis + domain list: https://t.co/7P4lzllZPl

VT: 9efddeb9e09eef067c3d2d307f38371ba0baf4c8fceaba01b9f007a50350a55c @L0Psec

BlockChain: 0x53fd54f55C93f9BCCA471cD0CcbaBC3Acbd3E4AA

@patrickwardle @RussianPanda9xx @malwrhunterteam @BleepinComputer @500mk500 @theJoshMeister @BushidoToken @DarkReading @ViriBack @DaveLikesMalwre @DarkWebInformer

#Stealer #MacOS #Clickfix

[Null Pwner @NullPwner]

@vxdb I use https://t.co/oREaUmCMnz!

[Null Pwner @NullPwner]

@DailyDarkWeb @securityaffairs Can tell its prob fake by the “99.97%” uptime 🤣

[Null Pwner @NullPwner]

@scottm24 Nice. What’s the main difference from https://t.co/veVhAkvmKb ?

[Null Pwner @NullPwner]

@thsottiaux 1) Add pro model for architecture/design decisions
2) Add remote control (leave codex running, use the phone to continue the work remotely)
3) Mobile app for the above would be nice
4) Keep up the good work :)

[Null Pwner @NullPwner]

4/ x-loading[.]com does not look X-owned. The issue is that X resolves whatever is in url= for the link card, giving attackers full control over what domain users see before clicking.

[Null Pwner @NullPwner]

1/ The token-supabase[.]com phishing going around today looks interesting. It was posted from a compromised account: Tyler Shukert's (dshukertjr). That's why it looked credible.

[sunil pai @threepointone]

hey @supabase @kiwicopple I think Tyler's account's been compromised

[Null Pwner @NullPwner]

3/ Same redirector, same trick, two more cases today. An impersonator account "Liquid[.]af" (TradeOnLiquid) pushing liquid-af[.]com, and a separate chain targeting ONINO sending users to oninofoundation[.]com. All three destination domains registered in the last 48h.

[Null Pwner @NullPwner]

@flpsnd @threepointone @supabase @kiwicopple Redirect infra used: x-loading[.]com/index[.]php?url=hxxps://www[.]supabase[.]com&redirect=hxxps://token-supabase[.]com. X appears to show the decoy url= host instead of the real redirect= target. Same pattern hit (on X) oninofoundation[.]com and liquid[.]af too. Ongoing campaign

[Null Pwner @NullPwner]

@Cyb3r_D4ddy @UK_Daniel_Card https://t.co/QfCPkvoExq

That same app can be used to provide Warp and zero trust services to team/enterprise users, that’s why it says that on the playstore (as it should).

[Null Pwner @NullPwner]

@solostalking Intelligence analysis - Robert Clark
Psychology of intelligence analysis - Richard’s Jeuer
Structured analytic techniques - Jeuer & Randolph
Intelligence driven incident response - Rebekah & Scott

Top tier reading 👍

[Null Pwner @NullPwner]

@solostalking @500mk500 @moonlock_lab Great camera fix 🤣

[Null Pwner @NullPwner]

🚨 Odyssey Stealer C2 Panel

🎯 http[:]//194.26.29[.]217 AS 206728

Rotating infostealer infra.

@malwrhunterteam @ViriBack @g0njxa @500mk500 @DaveLikesMalwre

[MalwareHunterTeam @malwrhunterteam]

Looks Aurotun stealer sample, "main.exe": 64366026bd9a8e783516a479c479d4087a24073f39f5ff8c1085e1aee2fd2572
From: https://luckyseaworld[.]com/main.exe
194.26.29[.]217

[Who said what? @g0njxa]

Lumma customers claim to have received this message on Telegram, apparently on Lumma customers group

[Null Pwner @NullPwner]

👀 Interesting coordinated release from multiple agencies (NCSC, NSA, BSI, etc) about Russian GRU Unit 26165.

Worth a read.

https://t.co/1KjFjK8VfO

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft has partnered with others across industry and international law enforcement and facilitated a disruption of Lumma infrastructure and the marketplaces in which the stealer malware was sold to other cybercriminals. https://t.co/KBvVTFm6QX

[Null Pwner @NullPwner]

@hanzohattori91 @onyphe @malwrhunterteam @ViriBack @g0njxa @RussianPanda9xx not yet

[Null Pwner @NullPwner]

🚨 Introducing Mave Stealer C2 Panel:

🎯 web.mavedashboard[.]lol
🎯31.57.156[.]135 (AS210538)
🧬ea8aebfaedd0d287ac10c39a5a3c4de6 @onyphe

Mave Stealer appears to have been launched on Apr 25.

[@]squ4ts🐀<🐈 :)

Any samples?
@malwrhunterteam @ViriBack @g0njxa @RussianPanda9xx
@500mk500 @DaveLikesMalwre @bruce_k3tta

[Null Pwner @NullPwner]

🚨 Odyssey Stealer C2 Panel

🎯 odyssey-st[.]com
🎯 83.222.190[.]214

@malwrhunterteam @ViriBack
@g0njxa @RussianPanda9xx
@500mk500 @DaveLikesMalwre

[Null Pwner @NullPwner]

🚨 New Odyssey Stealer C2 Panel

🎯 hxxp://5.199.166[.]102/login

This is the third C2 spin-up in a matter of days.

Favicon: 9108dde25ad958b27f6a97d644775dee

#Threathunting #Odyssey #Stealer #ThreatIntel

@malwrhunterteam @ViriBack @g0njxa @RussianPanda9xx @500mk500 @DaveLikesMalwre @censysio @L0Psec

[Null Pwner @NullPwner]

🚨 Clickfix - Binance Phishing delivering VIDAR

🎯 193.24.123[.]165
🎯 traderai[.]name

C2: t[.]me/m00f3r, steamcommunity[.]com/profiles/76561199851454339 (couple more IPs in the title).

VT: c3ac276122e6af6459eda55251a70ebf8bb091a620314f18ada33a6259fe10b1

@malwrhunterteam @ViriBack
@g0njxa @RussianPanda9xx
@500mk500 @DaveLikesMalwre #clickfix