Pham Tai Tue

Hit and Miss, Seek and Hide. You and I, remember that: “Not all treasure’s silver and gold, mate.”
I’m a man of my word, and my words are my own!

[Pham Tai Tue @tuedenn]

My presentation at Security Bootcamp 2024. This is the 11th edition of this conference, with the theme Humanity, over 2 days, Sep 28-29, in Phu Quoc.

My presentation focus on What, Why, and How to hunt, so I named it "Let the Hunt Begin!"

Check it out: https://t.co/QOG8P2OlZa

[Pham Tai Tue @tuedenn]

@Kostastsale @XintraOrg Your @ThruntingLabs as well

[Pham Tai Tue @tuedenn]

@Kostastsale And @XintraOrg

[Adam Chester 🏴‍☠️ @_xpn_]

New blog post is up looking at how LLMs are making local EDR rulesets, YARA rules, and behavioral detections trivial to extract. This post focuses on how simple the harness can be. Buckle up h4xx0rs, the next few months are gonna get interesting! https://t.co/QvzXsPA01F

[Florian Roth ⚡️ @cyb3rops]

I think AI coding hype follows roughly four stages:

1. Amazement

You try it and can’t believe how much code it generates from a few prompts.

2. Expansion

You start more and more projects because shipping suddenly feels cheap and fast.

This is also the phase where people start convincing everyone around them:

- coworkers
- management
- friends in other companies

because nobody wants to “fall behind” in 6–12 months.

That creates a massive snowball/FOMO effect.

3. The grind phase

You realize the generated code has architectural issues, sloppy mistakes, weird abstractions, duplicated logic, broken edge cases, etc.

So you start:

- re-prompting
- switching models
- increasing reasoning effort
- reviewing fixes
- generating fixes for previous fixes

And suddenly you spend your days reviewing AI-generated pull requests instead of building software.

4. Realization

You realize AI coding increases output much faster than it increases certainty.

The code still needs:

- review
- testing
- ownership
- architectural understanding
- long-term maintenance

Usually by expensive senior engineers.

And the interesting thing is:
this whole cycle can take many months or even more than a year because people become socially and professionally invested in the narrative themselves.

Once teams, managers, and entire companies have been convinced that this is the future, it becomes psychologically and politically very hard to later say:

“Actually, the ROI is much lower than we expected.”

[Grzegorz Tworek @0gtweet]

I’ve always claimed that ETW is very fast. I’ve been writing and teaching about it for years (for example, my talk “The Good, the Bad and the ETW” at x33fcon 2020 https://t.co/mRjLi3Jr2D), but I never actually measured its speed - until today. I needed an exact figure, so I wrote a small C app that logs 1 million events and measures the elapsed time. Here’s the code along with the complete test procedure. Enjoy! 🚀
https://t.co/Ow75wzaIHz

[Pham Tai Tue @tuedenn]

@Kostastsale UAC is a Swiss knife about collect Unix artifact. Especially the stability for OSs like AIX and Solaris – which few people have the environment to test in. I remember asking @tclahr a long time ago that he worked in an environment that allowed him to test. So, yes, it's great.

[Pavel Yosifovich @zodiacon]

.LNK files are implemented as COM objects. You need IShellLink + IPersistFile to create, read, or modify them programmatically. New video + write-up, code included, security angle too. https://t.co/rXhnOQSyxd

[Wiz @wiz_io]

🚨 BREAKING: Wiz Research discovered Remote Code Execution on https://t.co/SvN2lGsnbO with a single git push

The flaw in @github allowed unauthorized access to millions of repositories belonging to other users and organizations 🤯

[Pham Tai Tue @tuedenn]

@l4wio Chúc mừng anh 🥳🔥🙏

[Pham Tai Tue @tuedenn]

@solostalking There are some STIX objects to follow: Threat actor, intrusion sets and campaign

[Socket @SocketSecurity]

🚨 New findings in our @Checkmarx compromise investigation:

- VS Code / Open VSX extensions delivered a second-stage payload as mcpAddon.js

- It was silently downloaded from a hardcoded GitHub URL pinned to a specific commit in Checkmarx’s own repo

- It was executed via Bun

- The malware harvested GitHub, AWS, Azure, GCP, npm, SSH, env vars, and MCP-related credentials

- Stolen GitHub tokens were used to create public repos for staging exfiltrated data

- The malware injected malicious GitHub Actions workflows to capture repository secrets

- Stolen npm credentials were used to identify writable packages for downstream propagation

- TeamPCP appears to be taking credit publicly

[Check Point Research @_CPResearch_]

Rare glimpse behind the 2nd most dangerous RaaS for 2026, publicly claiming 225+ victims. CP<r> shares behind-the-scenes details that reveal the real number is potentially over 1,570 victims.
https://t.co/EYlEvZXWHi

[Florian Roth ⚡️ @cyb3rops]

There is now a write-up on https://t.co/bAhWWd4OTf, apparently based on Hudson Rock data, that adds more detail to the #Vercel breach

Many will focus on the Lumma stealer infection and the Roblox download. Okay. That matters too.

But for me, the bigger failure came after that …

Infections happen - always. The real question is what one infected machine can reach afterwards.

If one compromised path was enough to expose access to Google Workspace, Supabase, Datadog, Authkit and Vercel-related admin resources, then the problem was not just the infostealer. The problem was too much access, weak separation, missing limits and security monitoring that failed to highlight highly suspicious activity on that account

The mantra should be: “assume compromise”

https://t.co/8494DeQ1gj

[Karsten Hahn @struppigel]

New Video: Build your own LLM dynamic analysis lab 🦔🎥

➡️ AI debugs and unpacks with x64dbg
➡️ AI can access powershell terminal

https://t.co/0qoRQmyIQi

[Florian Roth ⚡️ @cyb3rops]

Anthropic’s CEO has every incentive to push the idea that AI will replace every second job.

That story makes his company look bigger, more important and more profitable to investors who are pouring billions into this space and expecting huge returns

I’d be careful with claims like that, especially when they come from people selling systems trained on flawed human knowledge ..systems that are sometimes dead certain while being dead wrong

[Pham Tai Tue @tuedenn]

@_ZeroPointSec @fortraofficial @_CobaltStrike @OutflankNL @_CoreImpact Wow, congrats sir @_RastaMouse

[DefSecSentinel @DefSecSentinel]

🧵 The axios @npmjs compromise dropped a @macOS backdoor that closely mirrors North Korea's (@DPRK) recent WAVESHAPER backdoor. Let's take a quick look the full intrusion:

[Elastic Security Labs @elasticseclabs]

ElasticSecurityLabs detects the Axios npm supply chain attack across Linux, Windows & macOS.

Our behavioral detections caught it without relying on static indicators.

Full malware analysis dropping soon: https://t.co/RLFNCpS6AG

[Florian Roth ⚡️ @cyb3rops]

You can reduce a lot of package supply chain risk with one boring rule:

- Do not install fresh releases immediately. use a minimum release age
- delay new package versions by a few days or a week
- let the ecosystem inspect the package before your pipeline pulls it

In many recent cases, that delay alone would have been enough. Let everyone else, scanners, sandboxes, analysts, regexes, AI, and poor souls on incident response, look at the package first 😏

PS: pnpm has a pretty useful setting for this: minimumReleaseAge

[Pham Tai Tue @tuedenn]

@RexorVc0 looks very promising