@NullPwner

Turning random hashes into aha-moments. Coffee fueled. Views mine.

badbyte.io
Joined February 2010
  • Tweets89
  • Following853
  • Followers246
🚨 Discovered a global campaign of ~2800 compromised sites delivering AMOS Stealer for MacOS 🔹 Vector: ClickFix & EtherHiding obfuscation via Binance 🔹 IOCs: technavix[.]cloud, salorttactical[.]top 🔹 Blog for analysis + domain list: badbyte.io/infostealer-macos… VT: 9efddeb9e09eef067c3d2d307f38371ba0baf4c8fceaba01b9f007a50350a55c @L0Psec BlockChain: 0x53fd54f55C93f9BCCA471cD0CcbaBC3Acbd3E4AA @patrickwardle @RussianPanda9xx @malwrhunterteam @BleepinComputer @500mk500 @theJoshMeister @BushidoToken @DarkReading @ViriBack @DaveLikesMalwre @DarkWebInformer #Stealer #MacOS #Clickfix
4
17
2
57
12,702
1/ The token-supabase[.]com phishing going around today looks interesting. It was posted from a compromised account: Tyler Shukert's (dshukertjr). That's why it looked credible.
sunil pai
@threepointoneMar 19
hey @supabase @kiwicopple I think Tyler's account's been compromised
1
1
188
more replies
3/ Same redirector, same trick, two more cases today. An impersonator account "Liquid[.]af" (TradeOnLiquid) pushing liquid-af[.]com, and a separate chain targeting ONINO sending users to oninofoundation[.]com. All three destination domains registered in the last 48h.
1
48
4/ x-loading[.]com does not look X-owned. The issue is that X resolves whatever is in url= for the link card, giving attackers full control over what domain users see before clicking.
44
🚨 Odyssey Stealer C2 Panel 🎯 http[:]//194.26.29[.]217 AS 206728 Rotating infostealer infra. @malwrhunterteam @ViriBack @g0njxa @500mk500 @DaveLikesMalwre
MalwareHunterTeam
@malwrhunterteam1 May 2025
Looks Aurotun stealer sample, "main.exe": 64366026bd9a8e783516a479c479d4087a24073f39f5ff8c1085e1aee2fd2572 From: https://luckyseaworld[.]com/main.exe 194.26.29[.]217
1
13
718
Lumma customers claim to have received this message on Telegram, apparently on Lumma customers group
Who said what?
@g0njxa21 May 2025
Seems like some #Lumma Stealer panels have started to display a banner of seizure /tsoi-zhiv.com /anna-akhmatova.com
7
32
6
213
71,920
👀 Interesting coordinated release from multiple agencies (NCSC, NSA, BSI, etc) about Russian GRU Unit 26165. Worth a read. nsa.gov/Press-Room/Press-Rel…

NSA and Others Publish Advisory Warning of Russian State-sponsored Cyb

FORT MEADE, Md. - The National Security Agency (NSA) is joining several United States and foreign entities to release the Cybersecurity Advisory (CSA), “Russian GRU Targeting Western Logistics

nsa.gov
2
5
321
Microsoft has partnered with others across industry and international law enforcement and facilitated a disruption of Lumma infrastructure and the marketplaces in which the stealer malware was sold to other cybercriminals. msft.it/6011Sd2zc

Disrupting Lumma Stealer: Microsoft leads global action against favored cybercrime tool

Microsoft and partners disrupted Lumma Stealer, malware used to steal data and enable cybercrime. Legal action was filed on May 13 by Microsoft DCU

blogs.microsoft.com
6
13
4,577
🚨 Introducing Mave Stealer C2 Panel: 🎯 web.mavedashboard[.]lol 🎯31.57.156[.]135 (AS210538) 🧬ea8aebfaedd0d287ac10c39a5a3c4de6 @onyphe Mave Stealer appears to have been launched on Apr 25. [@]squ4ts🐀<🐈 :) Any samples? @malwrhunterteam @ViriBack @g0njxa @RussianPanda9xx @500mk500 @DaveLikesMalwre @bruce_k3tta
1
6
1
31
1,920
🚨 Odyssey Stealer C2 Panel 🎯 odyssey-st[.]com 🎯 83.222.190[.]214 @malwrhunterteam @ViriBack @g0njxa @RussianPanda9xx @500mk500 @DaveLikesMalwre
Null Pwner
@NullPwner30 Apr 2025
🚨 New Odyssey Stealer C2 Panel 🎯 hxxp://5.199.166[.]102/login This is the third C2 spin-up in a matter of days. Favicon: 9108dde25ad958b27f6a97d644775dee #Threathunting #Odyssey #Stealer #ThreatIntel @malwrhunterteam @ViriBack @g0njxa @RussianPanda9xx @500mk500 @DaveLikesMalwre @censysio @L0Psec
1
4
17
1,441
🚨 Clickfix - Binance Phishing delivering VIDAR 🎯 193.24.123[.]165 🎯 traderai[.]name C2: t[.]me/m00f3r, steamcommunity[.]com/profiles/76561199851454339 (couple more IPs in the title). VT: c3ac276122e6af6459eda55251a70ebf8bb091a620314f18ada33a6259fe10b1 @malwrhunterteam @ViriBack @g0njxa @RussianPanda9xx @500mk500 @DaveLikesMalwre #clickfix
5
1
20
1,182
NEW BLOG: Investigating ClickFix Incidents ClickFix/Fake Captcha has emerged as a popular technique to deliver malware to users. This blog discusses the first stages of a ClickFix investigation to determine the impact on your organisation. kqlquery.com/posts/investiga…

Investigating ClickFix Incidents

With ClickFix being one of the popular delivery methods for malware, infostealers and state-sponsored hackers it is time to share a blog on investigating these incidents using Defender For Endpoint....

kqlquery.com
3
19
77
3,135
👽Disruption Update: 1: technavix[.]cloud, salorttactical[.]top are no longer resolving 2: TA has stopped delivering ClickFix (for now) for both Windows and Mac 3: Binance transactions are still happening in the background for almost all compromised sites so there is a chance of infrastructure rotation 4: 🎯nc1.overallwobbly[.]ru is still operational (Windows payload delviery) All the BSC contracts for EtherHiding observed: 0x9179dda8B285040Bf381AABb8a1f4a1b8c37Ed53 0xa6165aa33ac710ad5dcd4f4d6379466825476fde 0x8FBA1667BEF5EdA433928b220886A830488549BD 0x53fd54f55C93f9BCCA471cD0CcbaBC3Acbd3E4AA Thanks @NCSC
1
1
338
All the BSC contracts for EtherHiding: 0x9179dda8B285040Bf381AABb8a1f4a1b8c37Ed53 0xa6165aa33ac710ad5dcd4f4d6379466825476fde 0x8FBA1667BEF5EdA433928b220886A830488549BD 0x53fd54f55C93f9BCCA471cD0CcbaBC3Acbd3E4AA
284
🚨 Same Threat Actor is now delivering Windows Payload through the ~2800 compromised sites using ClickFix It dinamycally changes depending on platform (user-agent) Mac/Win 1: https://e.overallwobbly[.]ru/au1 (Dropper1: era-stau1.a) → PowerShell → Stage 1 Script (AutoIT) 2: https://e.overallwobbly[.]ru/era-std → PowerShell → Stage 2 Code 3: https://nc1.overallwobbly[.]ru/googlerestricted.ide → Final Payload (heavily obfuscated) Probably using LOLBin. Hash era-stau: d2465b8f9b36fa3139bcdcacab54591490753cc7f8843f8dddb0831094ef53ac Hash of dropped Zloader: 4e72ca1baee2c7c0f50a42614d101159a9c653a8d6f7498f7bf9d7026c24c187 Thoughts? @malwrhunterteam @RussianPanda9xx @500mk500 @ViriBack @Big_Bad_W0lf_ @DaveLikesMalwre @g0njxa @JohnHultquist #ThreatIntel #ClickFix
Null Pwner
@NullPwner5 May 2025
🚨 Discovered a global campaign of ~2800 compromised sites delivering AMOS Stealer for MacOS 🔹 Vector: ClickFix & EtherHiding obfuscation via Binance 🔹 IOCs: technavix[.]cloud, salorttactical[.]top 🔹 Blog for analysis + domain list: badbyte.io/infostealer-macos… VT: 9efddeb9e09eef067c3d2d307f38371ba0baf4c8fceaba01b9f007a50350a55c @L0Psec BlockChain: 0x53fd54f55C93f9BCCA471cD0CcbaBC3Acbd3E4AA @patrickwardle @RussianPanda9xx @malwrhunterteam @BleepinComputer @500mk500 @theJoshMeister @BushidoToken @DarkReading @ViriBack @DaveLikesMalwre @DarkWebInformer #Stealer #MacOS #Clickfix
8
2
15
2,909
🚨 ClickFix Delivering XWorm 🎯 hxxps://lbkequityexchange[.]com/i.cmd 🎯 hxxps://lbkequityexchange[.]com/EQTRN.exe 🎯 Prob C2: winservicesconsole[.]duckdns.]org - 45.154.98[.]252 ASN 210558 💻 Fake CAPTCHA → Runs PS script → Downloads i.cmd → Deploys XWorm while mimicking a crypto transfer 🧬 Hash i.cmd: fda2f3d8e7905cfcbc8deb708275638e4da02a7185314d70ff6b0851481b1033 🧬 Hash EQTRN.exe (xWorm): 80aebd0486bcc05a3759210d58dfec22 @malwrhunterteam @ViriBack @g0njxa @500mk500 @DaveLikesMalwre #threatintel #clickfix #threathunting
5
399
🚨 ClickFix - Sennheiser CF Phishing 🎯 hxxps://www.sennheiser[.]ad/ @malwrhunterteam @ViriBack @g0njxa @RussianPanda9xx @500mk500 @DaveLikesMalwre #threatintel #clickfix #threathunting #PhishingScam
1
1
10
632
Load more