SDK

Reverse Engineer & Malware Analyst. Now decoding AI-era threats. #malware #infosec #threatintel #AI

[SDK @sdkhere]

Sharing our latest research on SleeperWidget, a cross-browser extension campaign that used paid-ad installation paths to activate hidden behavior, including browsing-data collection, ad injection, and affiliate-link modification.
Read: https://t.co/8E4ABlziMl

[SDK @sdkhere]

🚪 New post: Hijacking AI Agents, Part 3 - The Four Surfaces.

A bad file in your repo is just one way in. The same trust bug also hits MCP servers, fetched web pages, and the supply chain.

One bug, four doors.

🔗 https://t.co/ld8JtbZXJV

#AISecurity #PromptInjection #MCP

[SDK @sdkhere]

• 64 victim sites (37 new)
• 147 rotations → ~127 hosts
• the current Go stealer

Read: https://t.co/RWYUGN7I9q

#ThreatIntel #ClickFix #EtherHiding #InfoStealer #DetectionEngineering

[SDK @sdkhere]

Identified 64 #compromised sites distributing a #ClickFix #infostealer - including a national government subdomain and healthcare and finance sites.

All from one operator who hid their C2 on a blockchain. Every rotation is a permanent on-chain tx in 4 months of their infra.

[SDK @sdkhere]

While building a scanner to detect #malicious #AI skills, it flagged this one.

It poses as a "Zero Trust compliance rule," but the block actually:
• Grabs every env var named key/secret/token
• Ships them to an external server
• Paste it in EVERY file to spread

[SDK @sdkhere]

@KirkDerpca Hey sure.

[SDK @sdkhere]

Identified a new #PolinRider npm supply-chain package - a decoy clone of the real "Funval" validation lib:
npm: [email protected]
Author: deepthought26
npm install → on-chain loader → TRON/Aptos pointer → BSC dead-drop tx → XOR-decrypt → eval → BeaverTail → RAT

[SDK @sdkhere]

Free and open, public now.
Write-up: https://t.co/oyMcmqlsl7
Repo: https://t.co/GVC0XTZ728
Try it on a real sample and tell me where it falls short. ⭐ helps.
#MalwareAnalysis #ReverseEngineering #ThreatHunting #AIAgents #AISkills #ThreatIntel

[SDK @sdkhere]

Ask an AI agent to look at a suspicious file and you get confident-sounding nonsense, a tool option that doesn't exist, or the step that mattered gets skipped.

So I built AnalystAIPack: 118 ready-to-use skills for malware analysis, reverse engineering & threat hunting. 🧵

[SDK @sdkhere]

The skills connect together: from an unknown file → unpack it → find what it hides → pull out its settings → hunt for it → write a detection. Each step feeds the next.

[SDK @sdkhere]

🆕 Dead Drops on the Blockchain

A DPRK npm package with no C2 in it. Strip it down and the payload lives in an immutable blockchain transaction (EtherHiding). Walked it all the way to the live C2.
https://t.co/CyiZHyfPAu

#malware #npm #threatintel #PolinRider #DPRK #supplychain

[SDK @sdkhere]

One more by the same publisher:
tailwind-color-shades 1.0.2
deepthought26 now has 2 confirmed malicious npm packages, both new-variant #PolinRider loaders

#c2 166.88.54[.]158, 23.27.202[.]27

[SDK @sdkhere]

Peeling the Sandworm: Reversing the nhmpy PyPI Supply-Chain Worm (Shai-Hulud / Hades Wave): https://t.co/nUJHv0nkb1

[vx-underground @vxunderground]

Someone showed me this on Telegram. It is very silly. It is clearly masquerading as "Free GPT and Claude". Anyone with half a brain knows this is malicious, but people will still fall for it.

People asked what it is. I have some free time. I poked it with a stick,

People discussing it said it is XMRig. That is not entirely accurate. This is not XMRig. This is flagged as XMRig from Triage and VirusTotal because it does indeed drop XMRig, but it is much more than that. This is a (maybe new) information stealer packaged with XMRig as a double whammy.

This malware is interesting because of a few things:

1. It is position independent, they care enough to be evasive and strip out a majority of dependencies. This is usually indicative of more serious malware.

2. They .zip it delivers from the "Free GPT and Claude" is intentionally bloated (payload inflation). It is 97MB, which may evade a majority of anti-malware product (initially) due to it's large size. It packages itself with FFMpeg and various other audio codecs.

3. It accesses Microsoft Outlook e-mails, accesses Chrome stuff using the COM IElevationService, looks for any SFTP credentials

It (currently) does not have any matching YARA rules from AV vendors. The closest approximation is LummaStealer. My knowledge base on the Information Stealer scene is out-of-date (it changes a lot). However, on first initial glance this appears like a new information stealer. Again, this should be taken with a grain of salt.

It's also worth noting the domain it exfiltrates to does not appear in any malware reports. The domain is unique, and the payload does not match any existing YARA rules (it's behavioral characteristics do, but not a specific malware family), so this is actually a pretty interesting sample.

A lookup though shows this is an emerging malware campaign. It first appeared around the end of May. This is (probably) a known Threat Actor who has switched it up a bit (or it's MaaS, whatever though).

The malware appears online masquerading as various products.
- ecore-sourceproject
- LogiDA
- GPT_Claude_Free
- CortexSystems.v3.4.2.Stable
- TikTokBot-v2.2
- CortexLauncher

Funny enough, this malware would have been much, much, much, MUCH more evasive if they didn't package it with XMRig. VirusTotal and Triage immediately flagged it because after it establishes persistence, and steals any credentials on the machine, it pulls XMRig to turn into a cryptocurrency miner.

If they did not pull the XMRig binary this stealer would be much more quiet. I have no idea why they decided to burn their OPSEC with XMRig.

C2: dfwioeiofwr-dot-info
Payload (and associated families from the C2)
027d576c6b5512d661081aaeeeb8e611f95a469ccf5ba35e0a390e8814334d05

5dcc599cf48227e65ea49d2708d08704fd1cb7e3b89736718d0d8e557857c49c

5e8b40b0b7512e1a1355374fb0cf34bfdf1260ebdb80a353c8f9da2490beeed3

6a0c332296b017220fc2b522da653fce36a8a3c5c79de0200d61c5fc31eb89ce

a2f8ebf65d54a4d9c8b720d01da77ad796683f1a5b8bd3d08738d7df4365f8a

9d4aaa9842c947756b7c128c432292732098fb71d247ef0bce60368563572da3

c4caca93e2291c018e701c217b7d232c534e4dd142042a59aa4d32754ef3022a

[Alex V. @Vishnyak0v]

One more #Bisonal #APT malware from recent attacks against Russia and South Korea.
XOR encrypted payload. RC4 encrypted strings and C2 communication remains the same.

221b9de416d42a979288cfa196912af4
15af764731c257caf1ee26d1cfc049a9
etude.servemp3[.]com
https://t.co/LzpkqAkOrL

[reecDeep @reecdeep]

#sload #malware #malspam #spam #italy 🇮🇹

vbs > ps > bitsadm

bitsadmin downloads from
hxxps://clubdeajedrezmatamoros.com/doprena/TQ29261131062.gif

@JAMESWT_MHT @malwrhunterteam @matte_lodi @luc4m @VK_Intel @merlos1977

#ThreatIntel #ThreatMonitoring #infosec #PowerShell #IOC

[AZORult Tracker @AZORult_Tracker]

#AZORult Tracker is now publicly available!

https://t.co/5gkkswYgVp

It's centralizing AZORult C2 panels and monitoring them for threat hunting and statistics purpose 🦅

Happy hunting!

[3r1c @p5yb34m]

x18 .exe #opendir with a variety of file sizes, just waiting to be ID'd. Lots of #agenttesla so far:

http://dk-rc[.]com/js/

Nice find, @zbetcheckin - @abuse_ch

[blackorbird @blackorbird]

quickly update！
New #Bluekeep Appeared!
Patch new wormable vulnerabilities in Remote Desktop Services (CVE-2019-1181/1182)
https://t.co/J3cPDUYmOF
update：
https://t.co/5eBcFEqZMB
https://t.co/hr33TUsapc