CORTEXIn all seriousness seriousness, you should do this anyway whenever you accidentally malware your ...
ll your credentials, if you don't care then whatever, do your thing
Menaces, vulnérabilités, incidents et bonnes pratiques en sécurité informatique.
1116 articles
S’abonner (RSS)ll your credentials, if you don't care then whatever, do your thing
ing about a few days ago (RevStealer). Hahahahahaha, he says, "should I be worried?" Fuck yes you should be worried, dawg. Your credentials, your cookies and sessions, your banking information, all of that shit is gone-gone, like, they are 100%, without a doubt in my soul, going to use your credentials for stuff. You need to orbital nuke all of your credentials like, yesterday, and kill all of your sessions on all applications. Anyway, I'm just being silly and trying to be funny, ... but in all seriousness this is a SERIOUS problem and you need to take action immediately. I'm sorry this happened to you.
What does it do? It's an Information Stealer, but it's super fancy 2. Does it have a name? Yes, as of like, last Tuesday (I have no idea when it was named, I'm just talking shit). It's officially called RevStealer by my peers. There is limited information it at the moment. 3. How long have you been bonking it? I invested about 4 hours over the time span of a few days, I think. I wish I had more free time for bonkings, but I don't 4. Can you share it? Yes, I am sharing it now. I'm pushing it to prod now. It's under /Samples/Families/RevStealer. I encourage you to bonk it too. It's really cool and fun to explore. I haven't had enough time to explore it and appreciate it, but I enjoyed it. 5. Can you share hashes? Initial .zip: 251aa2b0831d88a6f796bb6ca01d0242c11476b2fc6a5baa3f9c64a9134cd61d Stage 1 (packer, stager): d23b9609b06ab23243543ee0d8ff0d4c1966530576fa37bb2ecde97309ebbc9e Stage 2 (in-memory payload): 724b400afcec2064a3477abd9a117103abfb51f7f7c8acd9c429fcdabd656ffc Decoy (maybe?): 851383fb22dcb1d16367839178271eef6504199b8ca60405e1698879696e49d4 6. Who is it attributed to? I have no idea. My colleagues have speculations, but nothing is solid yet. Pic unrelated (or maybe it is).
Elastic Security combines threat detection analytics, cloud native security, and endpoint protection capabilities in a single solution.
Manage, update, and secure all your devices like it's 2026
When your AirTags' batteries are low (or, let's face it, dead), you can replace them yourself—assuming you bought the proper batteries. But they're not the easiest to open up: You have to press down on the silver back of your AirTag and rotate it counterclockwise until the cover comes loose. If you're having trouble getting it to work, you're not alone. But there's a simple hack to make it a bit easier. I stumbled upon this via MacGeekGab on YouTube. The idea is, take a small amount of tape on t
ck, sifting through dummy and decoy data, I figured out how they evaded my VM, RecordedFuture Triage, AnyRun, and VirusTotal. They made a really fancy entropy thingie by collecting a bunch of data and doing fancy math. I respect it. https://gist.github.com/vxunderground/b8accc6e05d956889e0282e1926a6feb
The Chaos ransomware group uses new malware "msaRAT" that hijacks browsers. The malware doesn't communicate directly with C2 but connects through the browser. It enables arbitrary command execution while hiding the attacker's IP from victims via WebRTC over TURN.
The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution (RCE) has been demonstrated when ASLR is disabled; memory corruption or denial of service may occur in configurations where ASLR is enabled. View CVE Details Affected Products MZ Automation libIEC61850 Vendor:MZ Automation Product Version:MZ Automation libIEC61850: >=v1.0.0|<=v1.6.1 Product Status:known_affected Remediations Vendor fixMZ Automation recommends updating
Expand All + CVE-2026-34490 A cleartext storage weakness exists in the Fire Solutions Android application, which stores application data locally on the device without encryption. An attacker with physical access to the device and one able to compromise the device through a separate, unrelated flaw, could potentially read this data in plaintext. Exploitation does not require network access and is limited to the local device environment. View CVE Details Affected Products Johnson Controls XAAP
Cette newsletter du 24 juillet 2026 couvre les actualités majeures en cybersécurité et IA. Les principaux faits marquants incluent la condamnation d'un négociateur en incidents pour collaboration avec le gang BlackCat, dix incidents majeurs de fuites de données, et une démonstration de migration de serveur C&C réalisée par une IA en six minutes avec intervention humaine minimale.
e of it is the same .exe > .exe has itself inside of itself > only small difference > cant tell difference > confusion_intensifies.mp5 > has anti-vm code > cant get to work in emulation > written using delphi > delphi tform GUI thingy > weird af de-compilation > 16,000 functions present > most do basic stuff, like add or subtract > staticly links a bunch of random libraries > LOLWTF WHO WROTE THIS > bonk with really big stick > eventually find some good goop > new .exe randomly appears in-memory > ??? > grab from memory > c++ .exe, staticly linked > 500 functions > heavily obfuscated > has anti-code tampering in place > ??? > this in-memory .exe references 1st .exe goop > ask colleague about goop > "We discovered this Threat Actor likely created their own custom .exe encryptor and decryptor" I've been bonking this…
> small pieces scattered across .exe > dont understand some weird stuff seeing > completely evades all emulation attempts > successfully evaded every VM > evaded with no API calls > i dont know how or why > bonk with stick > written in delphi > compiled with weird ass compiler > decompilation weird lmfao wtf is this shit. this is fucking cool af wtf
Cisco Talos Incident Response (Talos IR) recently observed attacks by Chaos, a relatively new ransomware-as-a-service (RaaS) group conducting big-game hunting and double extortion attacks.
Date/Time: Wednesday, August 5 | 1:30 p.m. – 3:00 p.m. (Oceanside E, Level 2) If you're looking for something hands-on and interactive, don't miss our workshop with Talos’ Nick Biasini and Cisco’s Omar Santos. In two parts, they’ll demonstrate practical ways security teams can incorporate AI into SOC workflows to identify sophisticated adversary behavior. In Part 1, Omar will discuss the Foundry Security Spec. He’ll walk through how to deploy, build testing harnesses around its core agent roles,
Date/Time: Wednesday, August 5 | 10:15 a.m. – 11:00 a.m. (Mandalay Bay I) The Splunk workshop considers the fact that the next insider threat may not be a person; it may be an autonomous agent using valid credentials and delegated authority. Attendees will see real-world attack paths in which agents move sensitive data across tools, distribute brute-force attempts under a single delegation, and manipulate internal systems without triggering traditional SIEM or UEBA alerts.
Threat actors seek to abuse Microsoft Teams features and capabilities across the attack chain, underscoring the importance for defenders to proactively monitor, detect, and respond effectively. In this blog, we recommend countermeasures and optimal controls across identity, endpoints, data apps, and network layers to help strengthen protection for enterprise Teams users.