sinusoid

Offensive research dude. Occasional CTF player (looking for a team!)

[Michael Weber @BouncyHat]

We think of WASM as a mechanism to run compiled code in your browser, but what if we shimmed in all the host APIs necessary to run full implants with ALL logic entirely in the WASM VM? This post walks through what that looks like.
https://t.co/xGVpPe2zyC

#wasm #malware #sliver

[Ferdous Saljooki @malwarezoo]

In macOS Tahoe 26.4 Apple added a new security feature to Terminal that warns users of potentially malicious pastes with a "Possible malware, Paste blocked" prompt. Here how it actually works 🧵

[sinusoid @the_bit_diddler]

@vxunderground With this, bullet-point two leans heavily into bullet-point one.

The (assumed) benefit here being a shipped runtime/FFI that differs with typical PIC/loader behavior.

Coming from the "red teaming" space, it tends to check more boxes for less respective effort.

[sinusoid @the_bit_diddler]

@vxunderground Changeling.

[sinusoid @the_bit_diddler]

@maple3142 @RBTree_ This point resonates with my internal thoughts at the moment.

The underpinnings of CTFs were (are?) the excitement of discovery. Throwing in things like a shorter timeline (one day vs. two, etc.), and it's not surprising the path of least resistance is taken.

[sinusoid @the_bit_diddler]

@0xP0ch1ta @es3n1n I'm curious to read the @PlaidCTF BBB submission.

[Karsten Hahn @struppigel]

New blog: Using LLMs the right way for malware analysis

💡Tips for building an autonomous AI analysis lab on a 12 yo laptop and getting stuff done faster without loss of accuracy.

https://t.co/hSd3xwBKGv

[sinusoid @the_bit_diddler]

@gf_256 @angelroom0 It's always a damned bummer.

Generally speaking, you all have better aggregated resources akin to https://t.co/QIzQfLpG1l I'd be very interested.

[sinusoid @the_bit_diddler]

DEMOSCENE > all.

[zabutom @zabutom]

Realtime code, handmade ascii animations and raw tracker music. The demo ’CMOS Cosmos’ by Razor 1911 in 2025 #demoscene #ascii #msdos

[zabutom @zabutom]

Realtime code, handmade ascii animations and raw tracker music. The demo ’CMOS Cosmos’ by Razor 1911 in 2025 #demoscene #ascii #msdos

[sinusoid @the_bit_diddler]

@b1ack0wl Been following for some time, about when he was writing a ROP-gadget finder for ARM.

Was just reading the blog on this and FORCEDENTRY, which still hails as the most insane logic implementation I can recall.

[Steffen Buck @buck_steffen]

@Defte_ Update:
Thanks to @RedTeamPT, I created a pull request for ntlmrelayx to reflect the new requirements:
https://t.co/g42CHDxQdB
Now Shadow Creds are working again 😀

[sinusoid @the_bit_diddler]

@bellafusari1 @DistrictCon I don't know how I saw this a year late, but turning a vape into a Glade PlugIn would've been hilarious.

[Jason Lang @curi0usJack]

Two new roles for @badsectorlabs ludus:

ludus_splunk: https://t.co/EX6tAxD9iA

ludus_splunk_universalforwarder: https://t.co/U4A0oHBV11

[flux @0xfluxsec]

I've tried something new! I have streamed some unfiltered coding, writing a module to detect malicious bytes in a shellcode injection scenario for an EDR that would use the System Call Integrity Layer project: https://t.co/BF2JHEtLPx

If this content is useful, or you like it, please let me know and give me some ideas what you would want to see! I want to grow in myself and help produce content that would be beneficial for our amazing cyber community!

#blueteam #cybersecurity #redteam #driver #rust #rustlang #infosec #rustdriver #soc #cyber #cti #informationsecurity #infosec

[itszn @itszn13]

When MicroQuickJS released, I spent 8.5 hours to summon an Exploit for it. Here is the Fault:

var arr = new Array(30)
var attack = {
valueOf: function() {
arr.length = 0
arr.length = 3
return 10
}
}
arr.splice(attack, 30)

I document the full Ritual Process below

[cts🌸 @gf_256]

i made a browser extension

[Outflank @OutflankNL]

Let's play peekaboo with PatchGuard! Read our blog post about hiding processes on modern Windows systems with HVCI enabled:
https://t.co/8q7cAo6pSo

[Andrew Oliveau @AndrewOliveau]

🔥Introducing a new Red Team tool - SessionHop: https://t.co/oU2R60ayPD

SessionHop utilizes the IHxHelpPaneServer COM object to hijack specified user sessions. This session hijacking technique is an alternative to remote process injection or dumping LSASS. Kudos to @tiraniddo for first discovering this years ago.

Blue Team tip: Look for unusual child processes spawning from HelpPane.exe

[_Ray @_RayRT]

Reusing part of the ESC1-unPAC BOF code to create a ShadowCreds + unPAC BOF

1. Write msDS-KeyCredentialLink attribute using obfuscated LDAP queries.
2. Authenticate to the KDC using PKINIT.
3. unPAC-the-hash.
4. Cleanup msDS-KeyCredentialLink.

https://t.co/4h4uWgcH4d