Luke Leal

Threat Intel.

[Luke Leal @rootprivilege]

#strox runs an impressive #phishing op, #PHaaS, which removes barriers of entry into phishing.

#strox will rent you everything but the domain. e.g bulletproof host, phishing page, & market to sell the phished logins, etc

#cybersecurity #infosec #malware

https://t.co/CCVCAQSv7v

[Luke Leal @rootprivilege]

@riper81 @mirphak @unmaskparasites Yeah it is...I get crawlers searching for the same file names, too.

[Luke Leal @rootprivilege]

@JCyberSec_ @DCPCU_tweets fake louis bag just chilling on the table next to the joint crutch and emptied cigarette 😂

nice work!

[Luke Leal @rootprivilege]

@nullcookies "All the rumors, the human sacrifices, the Hell portal, the demons... it's all true"

let us know where to go to enjoy the synths 🙂

[Luke Leal @rootprivilege]

@1ZRR4H What's the redacted domain name from $inter_domain that is being used to pull the SEO spam from?

The sample I have looks like an older one and its domain isn't active anymore.

[Luke Leal @rootprivilege]

@nullcookies @BanningLyon Great story!

Sadly National Medical Enterprises failed upwards and is now known as Tenet Healthcare (THC)

https://t.co/7qxdX5eCTb

[Luke Leal @rootprivilege]

@ViriBack I got a laugh out of this #malware vendor's reaction to a past tweet from you about finding a #Gomorrah #stealer C2 panel

[Luke Leal @rootprivilege]

@tdreed00 @ANeilan @HGSupport @nullcookies @dyngnosis @dave_daves @JCyberSec_ @sysgoblin @n0p1shing @Spam404 @KB_Intel @SteveD3 It's still online =\ but at least Google hit it with the red page so that helps

[Luke Leal @rootprivilege]

#Arkei #Stealer malware C2 panel using a login page that mimics the #WordPress login page but is actually connected to the C2 panel's database.

Used to evade detection so the panel can stay active on compromised websites for longer.

#malware #cybersecurity #C2

[Luke Leal @rootprivilege]

@ULTRAFRAUD @idclickthat @ActorExpose @bumbl3r @ANeilan @AlvieriD @illegalFawn who has the best ascii art? el zero or xbalti?

[Luke Leal @rootprivilege]

@j2k3k Isn't that how you get CS:GO from this Sierra published masterpiece?

[Luke Leal @rootprivilege]

@JCyberSec_ I don't think they should be criminally prosecuted unless there is gross negligence and/or the telecom intentionally allowed the abuse.

[Luke Leal @rootprivilege]

#strox phishing pages also have the capability to steal #2FA OTP from victims (along with their email account, personal documents, etc - fullz)

[Luke Leal @rootprivilege]

#strox runs an impressive #phishing op, #PHaaS, which removes barriers of entry into phishing.

#strox will rent you everything but the domain. e.g bulletproof host, phishing page, & market to sell the phished logins, etc

#cybersecurity #infosec #malware

https://t.co/CCVCAQSv7v

[Luke Leal @rootprivilege]

@CryptoprenuerUK @JCyberSec_ This actor has made the barrier of entry even lower...they provide everything but the domain. They even have a market to sell the phished logins. Also they never directly provide the kits and they use a subscription model ($3/day, 10 day min). I'll drop a post on it later today.

[Luke Leal @rootprivilege]

#phishing operator #strox added a feature so their phishers can go to sleep and not have to be sit around waiting 24/7 for the phished #2FA #OTP codes due to the short time limit on using them 😂😂

#infosec #cybersecurity #malware

[Luke Leal @rootprivilege]

@JCyberSec_ Yeah they can still get fullz and also access to the email account associated with banking login (assuming victim submits this data).

[Luke Leal @rootprivilege]

@JayTHL @TwitterSupport @Cryptolaemus1 Twitter appeals are ridiculously one sided and a serious problem on this platform. It's extremely frustrating. Hope you win this one.

[Luke Leal @rootprivilege]

@glotcode Hi - is there any way to report malicious activity on some of the pastes you host?

[Luke Leal @rootprivilege]

@nullcookies My understanding is that those videos aren't eligible for Adsense payouts so not sure where the money goes to... 🤔

[Luke Leal @rootprivilege]

@joshlemon Thanks! I have more posts on skimmers that go more in depth on how they operate on ecommerce websites (both #javascript and #php based skimmers)

https://t.co/1Fjht9jgNA