Cyber Arnaque

Malware Analysis

The plain-crypto-js package serves as a payload delivery vehicle. The core component, SILKBELL, setup.js (SHA256: e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09), dynamically checks the target system's operating system upon execution to deliver platform-specific payloads. The script uses a custom XOR and Base64-based string obfuscation routine to conceal the command-and-control (C2 or C&C) URL and host OS execution commands. To evade static analysis, it dynamically loads fs, os

What I found: The top downloaded skill was a malware delivery vehicle

While browsing ClawHub (I won’t link it for obvious reasons), I noticed the top downloaded skill at the time was a “Twitter” skill. It looked normal: description, intended use, an overview, the kind of thing you’d expect to install without a second thought. But the very first thing it did was introduce a “required dependency” named “openclaw-core,” along with platform-specific install steps. Those steps included convenient links (“here”, “this link”) that appeared to be normal documentation poin

AI-powered scammers are flooding Americans with tough-to-spot phishing attacks

Phishing has been around for decades, but AI is helping attackers run more believable scams at higher volumes. People used to spot phishing attempts by their typos and shoddy graphic design, but with AI, it takes only minutes for a scammer to create a highly polished phishing email or website. As we mentioned, the best way to spot a phishing site in the age of AI is to check the URL, but only 25% of Americans in our survey said they hover over URLs before clicking them. Take-home lesson #1 Don’t

> be me > havent taken malware inventory in a long time > lol how much malware do i actually have...

> be me > havent taken malware inventory in a long time > lol how much malware do i actually have? > usually estimate 32,000,000-ish > look inside Argus Collection (archived): 24,830 ATM Malware (archived): 285 Bazaar (actively collected): 733,985 Families (retired): 122,888 InTheWild (actively collected): 8,195,377 Malware Analysis (actively collected): 53,746 Malware Ingestion (retired): 7,511,822 OpenSourceMalware (archived): 40 Twitter IOC Collection (archived): 40,324 VirusShare (actively collected): 23,775,600 VirusSign (actively collected): 1,786,542 Total malwares: 42,225,439 Total archives (7z files): 128,786 Total size: 12.9TB (7z ultra compressed) Time performed collecting malware: 2,618 days

t.me20 juil.

Hello, People Living Inside My Computer (PLIMC), If you're someone who enjoys malware, I have go...

t.me20 juil.

Have you ever accidentally lost 50,000 malwares? I downloaded 50,000 malwares and I don't know w...

Have you ever accidentally lost 50,000 malwares? I downloaded 50,000 malwares and I don't know where it went. No, I'm serious, I actually have no idea where the malware went. I'm confused and scared. Have you seen my malware?

t.me19 juil.

Administrative update: 1. I am going to begin the process of thanking people for malware submiss...

Administrative update: 1. I am going to begin the process of thanking people for malware submissions and/or papers and/or recommendations. They will be placed somewhere on the website. You can exaggerate yourself on LinkedIn and say you're a collaborator. 2. I have a large volume of malware papers and malwares in queue. It is 175,000 malwares, 20 or so papers. As is tradition, malware analysis will be coupled with the papers too. That is expanded every month as new material comes in. 3. I have no plans to resurrect the virus exchange for the time being, unless someone (preferably a large company) is willing to bank roll the entire thing. I can provide the malware goopies, but computers are expensive. 4. Per request from OG vx-underground nerds, in more serious posts discussing technical topics, I will drop the silly cats and instead revive the classic edgy vx-underground dark. I will introduce a balance between seriousness, and edgy Hot Topic Goth, and generate kitty cat stuff. Thank you everyone for the love and support. I see your messages and e-mails. I am enjoying the summer with my son and family, so I am simply less inside at the moment. I will (hopefully) do more malwares soon.

t.me19 juil.

Literally every 3 or 4 months Satya Nadella serves us up a big slop pot of abusable features. He'...

Literally every 3 or 4 months Satya Nadella serves us up a big slop pot of abusable features. He's a malware factory

t.me19 juil.

The SCAM leaderboard

ModelOut of the Box± Avg Critical FailuresSkill± Avg Critical FailuresImprovementGemini 3 Flash75.6%2.199.3% 0.7+23.7Claude Opus 4.692.4%0.598.3% 0.2+5.9Claude Sonnet 449.4%1.798.1% 0.7+48.7Claude Haiku 4.565.5%5.497.8% 1.2+32.3GPT-5.281.0%1.496.6% 1.2+15.5GPT-4.137.9%2.496.2% 0.7+58.3Gemini 2.5 Flash34.9%3.494.8% 1.4+59.9GPT-4.1 Mini35.8%0.394.7% 2.9+58.8 The baseline rankings follow the pattern you'd expect: larger, more capable models score higher. But the skill rankings tell a different stor

What I found: The top downloaded skill was a malware delivery vehicle

While browsing ClawHub (I won’t link it for obvious reasons), I noticed the top downloaded skill at the time was a “Twitter” skill. It looked normal: description, intended use, an overview, the kind of thing you’d expect to install without a second thought. But the very first thing it did was introduce a “required dependency” named “openclaw-core,” along with platform-specific install steps. Those steps included convenient links (“here”, “this link”) that appeared to be normal documentation poin

AI-powered scammers are flooding Americans with tough-to-spot phishing attacks

Phishing has been around for decades, but AI is helping attackers run more believable scams at higher volumes. People used to spot phishing attempts by their typos and shoddy graphic design, but with AI, it takes only minutes for a scammer to create a highly polished phishing email or website. As we mentioned, the best way to spot a phishing site in the age of AI is to check the URL, but only 25% of Americans in our survey said they hover over URLs before clicking them. Take-home lesson #1 Don’t

Chat, big shenanigans are afoot. Zyaire Dontaevious Zamarion Wilkins, one of the individuals behi...

Chat, big shenanigans are afoot. Zyaire Dontaevious Zamarion Wilkins, one of the individuals behind the "BlockBlasters" steam malware campaign, also social engineered people online by pretending to be a woman. Wilkins, and a currently unlisted number of people, worked to spearphish people who owned cryptocurrency. They published a fake game on Steam named "BlockBlasters" which received international attention for crypto draining a terminally ill cancer patient. It turns out Wilkins also impersonated a person named sibeleth That girl who was flirting with you, asking about how much money you hold in crypto, was actually a 21 year old African American man

t.me19 juil.

Malware Analysis

The plain-crypto-js package serves as a payload delivery vehicle. The core component, SILKBELL, setup.js (SHA256: e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09), dynamically checks the target system's operating system upon execution to deliver platform-specific payloads. The script uses a custom XOR and Base64-based string obfuscation routine to conceal the command-and-control (C2 or C&C) URL and host OS execution commands. To evade static analysis, it dynamically loads fs, os

Une interface simple en trois parties

Sur l’application, que nous avons testée, l’interface est simple et organisée en trois rubriques « Problème », « Outils » et « Me sécuriser » ainsi qu’une page d’accueil. La première rubrique est dédiée aux situations problématiques que l’on peut rencontrer en ligne (cyberharcèlement, vol de données ou de comptes, piratage, tentatives d’arnaque, chantage sexuel ou encore suppression de contenus problématiques). L’utilisateur répond à quelques questions simples, puis accède à des informations uti

Une cyberattaque revendiquant 16 millions de données

Le 13 décembre, un groupe de cybercriminels revendiquant l'identité « Indra » a annoncé sur BreachForums avoir infiltré le système CHEOPS du ministère de l'Intérieur et extrait 16 millions de données sensibles incluant antécédents judiciaires et données d'identification. Les attaquants ont fixé un ultimatum de 48 heures pour être contactés par l'État, menaçant de revendre ou publier les données en cas de non-réponse. À ce jour, aucune preuve concrète n'a été fournie, le ministère reste dubitatif quant à l'authenticité de l'attaque tout en la prenant au sérieux.

tldr you sending me malware is good, sometimes really interesting things happen. Thank you for se...

tldr you sending me malware is good, sometimes really interesting things happen. Thank you for sending me malware. Also, I really want to note I didn't do any investigative work or whatever, I just reverse engineered it, explained how it works, noted some IPs or crypto wallets, nothing else. I'm just the malware guy. I'm nothing else. There were a lot of people who came together after BlockBlasters appeared that did really cool stuff and helped a lot of people. Lots of people shared information publicly which identified people. I'm just bonking stuff with sticks and looking at cats

t.me18 juil.

Malware Analysis

The plain-crypto-js package serves as a payload delivery vehicle. The core component, SILKBELL, setup.js (SHA256: e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09), dynamically checks the target system's operating system upon execution to deliver platform-specific payloads. The script uses a custom XOR and Base64-based string obfuscation routine to conceal the command-and-control (C2 or C&C) URL and host OS execution commands. To evade static analysis, it dynamically loads fs, os

The SCAM leaderboard

ModelOut of the Box± Avg Critical FailuresSkill± Avg Critical FailuresImprovementGemini 3 Flash75.6%2.199.3% 0.7+23.7Claude Opus 4.692.4%0.598.3% 0.2+5.9Claude Sonnet 449.4%1.798.1% 0.7+48.7Claude Haiku 4.565.5%5.497.8% 1.2+32.3GPT-5.281.0%1.496.6% 1.2+15.5GPT-4.137.9%2.496.2% 0.7+58.3Gemini 2.5 Flash34.9%3.494.8% 1.4+59.9GPT-4.1 Mini35.8%0.394.7% 2.9+58.8 The baseline rankings follow the pattern you'd expect: larger, more capable models score higher. But the skill rankings tell a different stor

What I found: The top downloaded skill was a malware delivery vehicle

While browsing ClawHub (I won’t link it for obvious reasons), I noticed the top downloaded skill at the time was a “Twitter” skill. It looked normal: description, intended use, an overview, the kind of thing you’d expect to install without a second thought. But the very first thing it did was introduce a “required dependency” named “openclaw-core,” along with platform-specific install steps. Those steps included convenient links (“here”, “this link”) that appeared to be normal documentation poin

AI-powered scammers are flooding Americans with tough-to-spot phishing attacks

Phishing has been around for decades, but AI is helping attackers run more believable scams at higher volumes. People used to spot phishing attempts by their typos and shoddy graphic design, but with AI, it takes only minutes for a scammer to create a highly polished phishing email or website. As we mentioned, the best way to spot a phishing site in the age of AI is to check the URL, but only 25% of Americans in our survey said they hover over URLs before clicking them. Take-home lesson #1 Don’t

Maybe a year ago, I don't remember, a game appeared on Steam called BlockBlasters. BlockBlasters ...

Maybe a year ago, I don't remember, a game appeared on Steam called BlockBlasters. BlockBlasters was actually malware, and it gained recognition primarily because it was used to crypto drain a terminally ill cancer patient. I was the first person (to the best of my knowledge) to reverse engineer BlockBlasters after people began notifying me about the game on Steam potentially being malware. It ended up being a huge deal, primarily because BlockBlasters was used for targeted crypto draining campaigns. Anyway, the FBI has begun arresting the people. The first person arrested was 21 year old Zyaire Dontaevious Zamarion Wilkins, based out of Florida. I assume more arrests are coming. This person specifically made $220,000 from the malware campaign, with $32,000 coming from a terminally ill (now deceased) cancer patient.

t.me18 juil.

Une cyberattaque revendiquant 16 millions de données

Le 13 décembre, un groupe de cybercriminels revendiquant l'identité « Indra » a annoncé sur BreachForums avoir infiltré le système CHEOPS du ministère de l'Intérieur et extrait 16 millions de données sensibles incluant antécédents judiciaires, personnes recherchées et données financières. Les attaquants ont fixé un ultimatum de 48 heures pour être contactés par l'État, menaçant de revendre ou publier les données en cas de non-réponse. Le ministère demeure prudent faute de preuves concrètes publiées à ce jour.

Malware

Malware

t.me17 juil.

How Elastic discovered this malware campaign

Elastic Security Labs exposes an attempt by the DPRK to infect blockchain engineers with novel macOS malware.