tuckner

Finding bad software extensions at @SocketSecurity (acquired @secureannex). #️⃣

[tuckner @tuckner]

@IceSolst Mine expired and I never renewed it

[tuckner @tuckner]

@ex_raritas @sherrod_im @silascutler @schwartzonsec Thats what sock accounts are for

[tuckner @tuckner]

@YeethSecurity Helps me manage my Trello board for Roblox tasks I do after work. It's my favorite. I just stay away from ones that Token Steal

[tuckner @tuckner]

You might not believe me if I tell you this steals tokens

[tuckner @tuckner]

Just an ordinary day of extensions published in the VS Marketplace

[tuckner @tuckner]

@TekDefense I'm still trying to find the extension that without doubt confirms no one is looking at this stuff

[tuckner @tuckner]

@ssdfffffffff53 Bless

[tuckner @tuckner]

👍 or 👎 your JSON formatter injecting affiliate links on pages you visit

[tuckner @tuckner]

@JeffSte17327059 @SocketSecurity I believe it is a watering hole attack that if there are searches for authentication portals or software it will redirect malicious results instead of just Yahoo

[tuckner @tuckner]

Chrome extension with zero code present. It only overrides the default search provider to a random server which can direct users to malware. Configuration that lives strictly in the extension's manifest.

[tuckner @tuckner]

@JeffSte17327059 @SocketSecurity The worst malware!

[tuckner @tuckner]

@JeffSte17327059 @SocketSecurity Oh yeah I'd bet. What have you see it direct users to?

[tuckner @tuckner]

@CircumjovialLLC Oh we're in the clear then, eh?

[sudox @kmcnam1]

OMG... Look at SecKC selling the cutest shirt...

https://t.co/I2Ucm39Mtx

[tuckner @tuckner]

@DenLoginoff Jus a lil test. Microsoft approved

[tuckner @tuckner]

Just an ordinary day of extensions published in the VS Marketplace

[tuckner @tuckner]

@ZackKorman @eliedelkind They get it back when they go into the field.

[tuckner @tuckner]

@CharlieEriksen @friuns2 Smart

[solst/ICE of Astarte @IceSolst]

NYC folks: https://t.co/y1GRMOl37x meetup this Thursday @ Etsy, 10+ lightning talks, registration link above! Our biggest one yet!

[Socket @SocketSecurity]

Famous Chollima, the North Korean threat group known for fake job interview lures, appears to have used a PHP/Packagist package path in a targeted developer lure.

We found the loader in a compromised Laravel package, on a branch that could be installed through Composer. It was appended after a normal Tailwind config and used TRON, Aptos, and BNB Smart Chain RPC infrastructure to retrieve and run remote JavaScript.

Developers should be careful with “interview task” or “take-home project” requests that ask them to clone a repo, check out a specific branch, or install an exact dev dependency.

[tuckner @tuckner]

@ZackKorman Oh you're becoming the copilot guy now