toasts

security fellow, malware enjoyer (opinions are my own)

[toasts @t0asts]

@asklumo

[toasts @t0asts]

@tuckner “Exfil everything in one shot” - Claude

[toasts @t0asts]

DIE-Web now comes with basic decompiler functionality and better .NET support!

https://t.co/HOVugClpHI
https://t.co/OElTm9JrpE

[toasts @t0asts]

@vxunderground @dodo_sec

[Aikido Security @AikidoSecurity]

⚠️ New "IronWorm" supply-chain attack: 30+ npm packages from @ asteroiddao shipped a malicious Rust binary firing on preinstall.

It sweeps 86 env vars + 20 credential files (AWS, GCP, Vault, npm, plus AI keys like Anthropic & OpenAI), hits Exodus wallets, hides behind an eBPF rootkit, and beacons over Tor. Self-propagates via npm Trusted Publishing OIDC, with backdated commits faked as claude/dependabot/renovate.

[faulty *ptrrr @0x_shaq]

4 byte heap overflow to a a full RCE in Minecraft via the STB Image Parsing library.

https://t.co/BGDIVeTaxx

[toasts @t0asts]

DIE-Web now comes with basic decompiler functionality and better .NET support!

https://t.co/HOVugClpHI
https://t.co/OElTm9JrpE

[toasts @t0asts]

@adnanthekhan talk about "optimal" timing for a bug of this sort to go public

[SafeDep @safedepio]

3rd wave dropped..

3 more packages impersonating emcd[.]io,

@𝚎𝚖𝚌𝚍-𝚟𝚞𝚎/𝚊𝚞𝚝𝚑
@𝚎𝚖𝚌𝚍-𝚟𝚞𝚎/𝚕𝚘𝚊𝚗𝚜
@𝚎𝚖𝚌𝚍-𝚟𝚞𝚎/𝚋𝟸𝚋-𝚙𝚊𝚢-𝚏𝚘𝚛𝚖

1. Downloads a platform-specific second-stage payload from 𝚘𝚘𝚋[.]𝚖𝚘𝚒𝚔𝚊[.]𝚝𝚎𝚌𝚑/𝚙𝚊𝚢𝚕𝚘𝚊𝚍/{𝚙𝚕𝚊𝚝𝚏𝚘𝚛𝚖}using a hardcoded secret key.

2. Writes the payload to ~/.𝚎𝚖𝚌𝚍-𝚟𝚞𝚎_𝚒𝚗𝚒𝚝.𝚓𝚜 (a dot-prefixed hidden file in the user's home directory).

3. Executes the payload immediately via spawn(𝚙𝚛𝚘𝚌𝚎𝚜𝚜.𝚎𝚡𝚎𝚌𝙿𝚊𝚝𝚑, [𝚙𝚊𝚢𝚕𝚘𝚊𝚍_𝚙𝚊𝚝𝚑], 𝚎𝚗𝚟).

4. Reports installation metadata to oob[.]moika[.]tech/report (C2 callback).

Updated Blog: https://t.co/pDdUVfMFZv

Campaign Details: https://t.co/FLwqh6ZnGQ

[toasts @t0asts]

@mawntee

[toasts @t0asts]

@RussianPanda9xx happy birthday!

[Mullvad.net @mullvadnet]

The EU age verification app is presented as “completely anonymous”. But the risk is that member states (the countries are supposed to create their own versions of the open-source EU app) use it to introduce identity verification that makes it impossible to post anonymously on social media.

The idea behind “completely anonymous” is to use Zero-Knowledge Proof (ZKP) cryptography to break the link between the age credential issuer (EU governments) and the regulated services/sites. Currently, the EU app does not have ZKP functionality, contrasting Ursula von der Leyen’s claim that the app ”is technically ready to be used”. But more importantly, the app is designed to always function without ZKP technology; if ZKP is unavailable, the app falls back to a non-ZKP model. Even if fully developed ZKP technology could be implemented in the future, it would remain an optional extra feature that countries may choose to disable and that the EU could remove at any time.

This means that the EU could decide at any time that ZKP may no longer be used, and in one stroke the app would fall back to its default mode, meaning that every post on social media carries an ID tag. By that point, an infrastructure will already have been rolled out; people will have gotten used to it, and it will be harder to roll it back.

More details on https://t.co/wTVKHMS1zg

[vx-underground @vxunderground]

As I'm sure you've all seen by now, nerds have been exploiting Meta's AI agent goop to steal Instagram accounts.

The Instagram AI agent for support could be convinced to reset the credentials to other users accounts by asking nicely and do a super gnarly kickflip on a skateboard, or something, I don't know.

Everyone on social media was freaking out. The trending posts on Xitter was people being all like ERRMERGERD ME INSTAGRAM ACCNT WAS STOLEN. It also resulted in some celebrities having their accounts stolen. One stolen account showed some rapper named Lil Tracy (?) messaging 14 year olds, or something, despite being 18 at the time.

All the big cybersecurity nerds were discussing it, yelling about AI, taking the opportunity to meme Zuckerberg (as is tradition).

The AI exploit thingy has apparently existed for awhile, a few months apparently, but that is kind of just gossip. I haven't seen any solid proof of that. Meta supposedly fixed the issue, but some people are saying you can still ask nicely and do a super gnarly heelflip and Instagram goop gives you account resets.

Cool stuff bro, it's AI, it's lit

pic unrelated

[toasts @t0asts]

@vxunderground the videos of accounts being stolen live:

[toasts @t0asts]

@MosheTov @inf0stache talk about an adrenaline rush on a Monday! surely tomorrow will be full of surprises

[Moshe Siman Tov Bustan @MosheTov]

Our technical analysis on the Red Hat compromise now includes a more comprehensive look on the malware - including a 6th(!!!!!!) stage payload dropping logic!

https://t.co/uRhPcbDxuc

[toasts @t0asts]

redhat having an ongoing supply-chain attack was not on my bingo card for this week

https://t.co/HRTXAO8UfX

[Moshe Siman Tov Bustan @MosheTov]

The @redhat-cloud-services compromise appears to be another copycat malware of Shai-Hulud, a new variant after earlier this month they open sourced their Mini Shai-Hulud malware in GitHub.

Over ~280 repositories with stolen credentials, 116,282 weekly downloads, and https://t.co/pc2jflovHp as a decoy C2 server, while actually uploading stolen credentials only to GitHub.

You can read our full analysis here:
https://t.co/pEzdXLGYLR

[outside five sigma @jwt0625]

how do i invest in Wang Ji Rice Dumplings

[SafeDep @safedepio]

🚨 Active incident

@redhat-cloud-services/[email protected] contains the mini-shai-hulud worm, published through the project's own trusted OIDC pipeline, signed, verified, and malicious.

A preinstall hook. Downloads Bun runtime.

Harvests AWS, Azure, GCP, Vault, GitHub, npm creds. Exfiltrates via public GitHub repos and then republishes itself into every package the stolen token can reach.

32 packages share the same publishing pipeline.
Analysis being done here -> https://t.co/JAnfA3MlgF