Reborn

Crypto

[BlockOSINT @0xfigo]

🧵 New investigation: Beejern, an active Oklahoma LLC, appears linked to a suspected DPRK IT worker cluster first identified through GitHub activity

The case connects GitHub aliases, company records, Upwork activity, manipulated imagery, shared infrastructure, and external DPRK research corroboration

[Reborn @rebornff_]

@fengtality @blackbigswan

[Security Alliance @_SEAL_Org]

🚨 Multiple DPRK (UNC1069) Fake "Microsoft Teams" domains deployed on 2026-04-07 - Beware of impersonations and restarted conversations.

micrusoft[.]us
teams-meet[.]xyz
teams-meet[.]us[.]com

Check meeting destination URLs - apps like Telegram or Slack may disguise them.

[Nick @superducktoes]

since everyone is talking about those pesky DPRK IT workers, figured id join the fun

https://t.co/vjCckirQDW

[Reborn @rebornff_]

@tanuki42_ @sexinfochina @zachxbt @THORSwap @avax @SwapKitPowered @NEARProtocol @near_intents @AlexAuroraDev Not only that @tanuki42_ , but his other "venture" clearly links both of his profiles ;D

So "that tg account doesn't belong to me" doesn't sound like a smart excuse🤣

cc @zachxbt

[Tay 💖 @tayvano_]

🚨 WARNING (AGAIN)

DPRK threat actors are still rekting way too many of you via their fake Zoom / fake Teams meets.

They're taking over your Telegrams -> using them to rekt all your friends.

They've stolen over $300m via this method already.

Read this. Stop the cycle. 🙏

[bbsz @blackbigswan]

DPRK PSA: DO NOT interact with any of accounts claiming to be representative of @LightNodeVent. Communication and handles (@PulchraMens @TThompson @SirLeoThe1st) of company members are most likely COMPROMISED by DPRK Contagious Interview campaign through a ClickFix attack.

[Nick Bax.eth @bax1337]

🚨 Hackers are using Microsoft Teams to pwn people and steal their crypto.

The attack is deceptively simple and relies on social engineering as well as malware.

They've already stolen millions of dollars from both project founders and normal users.

How it works🧵

[Alex Hormozi @AlexHormozi]

If you want to be successful, you only need to do one thing: be proud of your work…

Genuinely. Alone. At night. On your own. When no one is watching. Know. In your bones. That you gave it your all.

When you do that, nothing can stop you.

[Reborn @rebornff_]

@BitoEx_Official @zachxbt finally^

[Reborn @rebornff_]

@zachxbt Funny that the "Jason" profile pic is the same stock image from this:
https://t.co/Q87JZum5k3

didn't even edit tho🤣

[Reborn @rebornff_]

@mert A weekend in a ryokan w/ onsen near fuji kawaguchiko

[Reborn @rebornff_]

@tanuki42_ If they care so much for the court order, can’t they implement a specific courtesy freeze time period for LE until that order is issued? I see 0 downside business wise.

[Reborn @rebornff_]

@TobyFrei4 @zachxbt @Andrey_10gwei 0x18...dC1C is an Asgard Vault =Thorchain infrastructure. You can double-check these types of addresses on Thorchain explorer itself.

[Easy @NotSoEasyMoney]

Post rug clarity

[Tay 💖 @tayvano_]

🚨 Heads up all—some dudes have a slick, new way of dropping some nasty malware.

Feels infostealer-y on the surface but...its not.🫠

It'll really, deeply rekt you.

Pls share this w/ your friends, devs, and multisig signers. Everyone needs to be careful + stay skeptical. 🙏

[ilemi @andrewhong5297]

Search -> expand and summarize -> ask deeper questions

Go from question to insight in less than 20 seconds, without ever leaving the chat.

Just shipped the update, more improvements on the way 🤫

[buffalu @buffalu__]

Be extremely diligent in the emails you open and make sure you have proper key management in place for funds (multi-sig, custodian, ledger, etc.)

Another company in the space was hacked for several million dollars one week ago. Very likely to be Lazarus, the NK hacking group, using the same attack that effected MGNR, Arthur_0x, and Nexus Mutual.

[ₕₐₘₚₜₒₙ @hamptonism]

"You’re crazy until you’re successful, then you are a genius."