David Cohen

Security Researcher / Reversing & Malware Analysis

[David Cohen @xDCrev]

My latest technical article on behalf of @CyberArk: How malware hides their game! #HeavensGate #PushRet #ProcessHollowing #SEHRedef #Pony #Malware https://t.co/9eIKdgUFHN

[JFrog Security @JFrogSecurity]

🚨 SECURITY ALERT: A widespread supply chain attack dubbed "easy-day-js" has been identified, targeting the mastra npm packages.

Attackers have compromised and published malicious versions of these packages. 144 packages are currently confirmed to be affected.

Please check your dependencies immediately. We will share the full list of affected packages in this thread and further analysis in:

https://t.co/yeiFnaagQe (will be live in a few hours)

[JFrog Security @JFrogSecurity]

⚠️Hackers are using AI safety guardrails against you!

The latest wave of Shai-Hulud malware uses clever prompt injection to intentionally trigger safety refusals. By doing this, it forces AI scanners to "look away" and stop reading before they ever analyze the actual malicious payload hidden below.

Learn exactly how this evasion technique works and how to keep your pipelines protected in our latest blog post:
https://t.co/PlNueEWNEa

[JFrog Security @JFrogSecurity]

TeamPCP is back.
The xinference PyPI package (680K downloads, 9.3K stars) was hijacked. Import it and your cloud credentials, SSH keys, and .env secrets are instantly harvested and exfiltrated.
Versions 2.6.0–2.6.2 are malicious. If you installed them, assume compromise and rotate everything now.
Full technical breakdown 👇

[David Cohen @xDCrev]

@steipete 2026 the year that we complain about perfect text without typos 😂

[David Cohen @xDCrev]

@tomcrawshaw01 GEMINI

[David Cohen @xDCrev]

@glnarayanan @warpdotdev sad it happens.. I hope they will at least re-adjust the build to 2500 requests instead of 1500...

[David Cohen @xDCrev]

@etheria_restart It has some nice things but it is getting boring..

[David Cohen @xDCrev]

@JusticeRage Is there something équivalent for ghidra?

[vx-underground @vxunderground]

No.

Someone took a bunch of existing leaks, threw it all together, and slapped a NEW stick on it.

[David Cohen @xDCrev]

Can we call that social engineering? 😂

[vx-underground @vxunderground]

Hahahahhahahaha

Unironically a good idea. It's so unbelievably stupid and it works. Depending on explorer layout, the .exe might not be visible.

Filename.mp4 + ??? spaces + .exe

Hahahahahaha UNC6032 is wild as hell

[David Cohen @xDCrev]

@cyb3rops I have a big issue advising the young people.. what should they learn? Logical reasoning? How to prompt? Really not clear what direction to give

[slonser @slonser_]

Today I used a technique that’s probably not widely known in the community.
In what cases could code like this lead to a vulnerability? ->

[Prajwal Tomar @PrajwalTomar_]

Cursor is literally the best AI coding tool.

But most AI projects break because of 3 core issues:

- AI hallucinations
- Loop of errors
- Context awareness

Here’s the system I use to fix all 3.

It’s called the Context Boundary Method ↓

[jro @junr0n]

Writeup on how the PoC was designed, some observations, comparisons with other decompiler MCPs and thoughts:

https://t.co/Zx6muUIwBM

[Nicolas Krassas @Dinosn]

CF-Hero: discover the real IP addresses of web applications protected by Cloudflare https://t.co/eZksknMcsL

[Duncan Ogilvie 🍍 @mrexodia]

https://t.co/5j3pPRnyyo

[MalwareHunterTeam @malwrhunterteam]

"InLine" signed "AddInProcess64.exe" sample: f1eaef2e1269594edcf61f2e77d6ca25fc3947cff8508b3474427521e67d6a5a
If remember right, this the first time I see a malware sample that was signed with a cert having "Microsoft ID Verified CS EOC CA 01" as issuer. And only valid 3 days?
🤔

[David Cohen @xDCrev]

@cyb3rops I am surprised you don't have a AI agent working for you during your holidays!!! 😂
Very good resource!

[GAZAWOOD - the PALLYWOOD saga @GAZAWOOD1]

If the situation in Gaza is so terrible, why do they keep taking stories from other countries?

[David Cohen @xDCrev]

@IdoNaor1 עד שהם מגי��ים כמה טוב הרכבת היא חח