Jim Saveker

Security Person @ Perpetual | Catching badness, calming nerves | Opinions mine, detections shared

[Samir @SBousseaden]

EDRUnChoker😀registers a permanent WMI subscription with a 5-second timer runs embedded VBScript (fileless) that deletes malicious MSFT_NetQosPolicySettingData policies targeting known security products or aggressive app-path throttles.
https://t.co/A1hcrpav2X

[Jim Saveker @Saveker]

Interlock operators are running Volatility... the defender's memory-forensics tool against their own victims. {windows.hashdump} on a dump file → creds extracted, zero LSASS access. RunAsPPL / Credential Guard don't fire. Interesting finding from the DFIR Report.

[Jim Saveker @Saveker]

@cyb3rops I have been playing with it today and it’s both capable and fast. 70+ tps on my MacBook Pro

[Jim Saveker @Saveker]

Claude + Obsidian = 10x usefulness unlocked. Vault goes from static notes to thinking partner overnight. 🤯

[Jim Saveker @Saveker]

I am reasonably reserved with respect to the AI hype train but tmux + Claude agent swarm? Absolute BEAST mode. Got my lead Claude bossing a squad of AI teammates, shared tasks, direct chit-chat via mailboxes, no race condition nightmares. Wow just wow.

[Jim Saveker @Saveker]

This chap is hilarious https://t.co/shl5ezOpG6

[John Hammond @_JohnHammond]

A VS Code extension for a "Clawdbot Agent" was fake; it was actually malware that installed ScreenConnect on a target computer to be used as a remote access trojan!

YouTube video walking through the extension source code & Rust-based loader by DLL hijacking: https://t.co/rUmxuvd2dJ

Hat tip to Aikido Security and Charlie Eriksen for catching this thing in the wild -- one of the domains looks to also be hosting a panel for Evelyn Stealer malware, so we reference some other research from Trend Micro and Koi Security as well to note the similarities in the Lightshot EXE and DLL naming & abuse of VS Code extensions for fake AI coding assistants.

While I was recording, the extension was changed and updated to a new version in real-time -- so we take a look at both and actually fire off the sample to see it work.

... it didn't work. (???)

Looking more closely at the syntax of the extension, even recreating how it is invoked, the logic seemed wrong. Was the whole thing vibecoded? Maybe I missed something, so I need your eyes! (Or your Clawdbot Moltbot Robot Botbot bot "eyes"😜)

https://t.co/7SGypThbZL

[Jim Saveker @Saveker]

Attackers are now using Microsoft's own App-V scripts as a LOLBin to proxy PowerShell and slip past your defenses. The payload? Amatera infostealer, served via fake CAPTCHA.

Microsoft really said "here, have a trusted binary" and threat actors said "don't mind if I do." https://t.co/JZ5HMRBUqY

[Jim Saveker @Saveker]

https://t.co/F2xzuAyME4

[Jim Saveker @Saveker]

Prohibited at NYC inauguration: Flipper Zero and Raspberry Pi.
Permitted: Notebook computers running Kali Linux, cellphones with full pentesting toolchains and SDR apps.
Classic security theater: banning specific hobbyist devices while allowing far more capable general-purpose hardware.
https://t.co/z8y44uMhkB

[Jim Saveker @Saveker]

@British_Airways Thank you. Eventually they let us through. The gate agent explained that the cutoff is 4 years old for priority boarding but made an exception for them being 5 years old. It’s very stressful traveling with kids and all their gear.

[Jim Saveker @Saveker]

@British_Airways you are denying me and my two young children priory boarding from London to Austin. This was something we had from Austin to Heathrow. Please have a consistent policy and now it’s really hard boarding with kids. It’s hard enough to travel with kids.

[Jim Saveker @Saveker]

Pushin’ Vibes, not code! https://t.co/hha5sYn8Cl

[Jim Saveker @Saveker]

With #DGXSpark, my time goes into fine tuning LORAs and NVFP4 quantization instead of debugging the stack. That’s real progress...nicely done #NVIDIA, Bravo!

[Jim Saveker @Saveker]

Graph API: “Trust me bro, here’s global admin.”
Actor tokens: “Say less.”
CVE-2025-55241: the bug that made every tenant a group project. 😬 https://t.co/47THBNNiwz

[Jim Saveker @Saveker]

Threat actors aren’t just recycling old tricks they’re bending them. Fake CAPTCHA, fake Cloudflare Turnstile, disguised MSI’s, Steganography and FileFix-style paths. https://t.co/D7HR05N3kt

[Jim Saveker @Saveker]

TAG-150 speedrunning malware dev: CastleLoader > CastleBot > CastleRAT in months. Multi-tier C2, Python + C implants, abuse of legitimate services. https://t.co/xY9JEPLgiE

[Jim Saveker @Saveker]

If you’re not abusing both DNS and ICMP in your RAT, are you even modern malware? https://t.co/glSNUcx7Zl

[Jim Saveker @Saveker]

@techspence App/binary allow-listing, when paired with strong auth (machine trust cert + WebAuthn key), quietly prevents a lot of bad days. Hugely underrated control imho.

[Jim Saveker @Saveker]

UNC6395 abused compromised OAuth tokens from the Salesloft Drift integration to exfiltrate data from Salesforce, including AWS keys/Snowflake creds. So what: SaaS integrations expand your attack surface as much as your own code, but with far less visibility or control. https://t.co/QqLIJVwfpB