kit @Keeeeittth

🚨 ClickFix Fake Microsoft verification site tricks users into copying a configurable payload and executing it in Windows Terminal. JS reveals an admin dashboard, visitor tracking, browser fingerprinting & payload management. IOCs: microsoftcloudverification[.]com agahamlwbxqqgnrcczph[.]supabase[.]co /assets/index-DmsF7J6g.js /api/rpc.php?action=payload /api/auth.php /api/public/track-visitor.php Actual clipboard payload is dynamically retrieved. #ClickFix #Phishing @MsftSecIntel @500mk500 @skocherhan

keyboard_arrow_left Previous keyboard_arrow_right Next

🚨 Hackers Registered New Teams-Based Domains and Used a Login Page to Steal Your Logins Details: cybersecuritynews.com/teams-domain-l… A newly registered domain copies Microsoft Teams’ login page and interface, raising concerns about a phishing attempt targeting workplace users. Security researcher Steven Lim reported that teams-cloud[.]live was just five days old when he flagged it on October 18, 2026. He urged organizations to block the address before employees encounter the fake site. A copied Teams screen could persuade employees to trust a sign-in request. However, the available report does not establish how many people visited the site, whether passwords were captured, or who operates the domain. #cybersecuritynews

🚨 BREAKING: AI-enabled ransomware hackers using Claude left their logs on an open server. SOCRadar found 8k+ AI messages from INC and The Gentlemen affiliates using Claude and Kimi, plus 46 INC encryptor builds. To fight refusals, they authorized it by calling it red-teaming.

keyboard_arrow_left Previous keyboard_arrow_right Next

PHP Remote Code Execution (CVE-2026-109618 & CVE-2026-109619) Information about two new remote code execution (RCE) vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS v3.1 10 / 10), has leaked ahead of their coordinated disclosure, and security firm Watchtowr Labs confirmed that the flaws are real. Both vulnerabilities are due to be disclosed on Thursday, October 22, alongside patches. Until those advisories land, no fix is available, which leaves the flaws as zero-days in PHP installations everywhere.There is currently a scheduled release of an advisement and possible patch on Wednesday, October 21 2026 at 14:00 UTC. Below is a video of a researcher, maybe the original researcher, showcasing the exploits. #CTI #BlueTeam #ThreatIntel #CVE-2026-109618 #CVE-2026-109619

🚨 Google Meet Phishing Two domains hosting fake Google Meet pages designed to steal Google credentials and facilitate 2FA phishing. Misconfiguration: An exposed /install page reveals database configuration and a prefilled DB password! IOCs: meet-google[.]cyou qooglo[.]com /meet /install /assets/js/demo.js /api/demo/sessions /api/demo/sessions/{token} /api/demo/sessions/{token}/resend #Phishing #Google @500mk500 @skocherhan @Namecheap

keyboard_arrow_left Previous keyboard_arrow_right Next

SCADA/ICS/OT Digital Forensics and Incident Response (DFIR) October 27-29 If you are tasked with protecting these industrial systems, you need to attend this class! hackersarise.thinkific.com/bundles/scada-… @three_cube @_aircorridor

SynthID Detector Identify AI generated media: Images (JPG, JPEG, PNG, BMP, WEBP, AVIF, HEIC, HEIF, TIFF, TIF, GIF) Video (MP4, MOV, WEBM) Audio (WAV, MP3, OGG, FLAC, AAC, M4A) synthid.com Tip by @BenDoBrown OSINT Field Notes

If you're into Windows internals, reverse engineering or exploit development, bookmark this. The @OpenSecTraining has an incredible collection of FREE low-level security courses covering: - x86-64 assembly - Windows kernel internals - Windows kernel exploitation - WinDbg from introductory to advanced - IDA + Ghidra + Binary Ninja - HyperDbg - UEFI internals - Intel firmware attack + defense - C/C++ vulnerability research - Symbolic analysis - C++ binary reversing - AFL++ fuzzing - TPM + trusted computing - Intel SPI analysis - OS internals - RISC-V - Emulator development with QEMU There is even a dedicated Windows kernel exploitation course covering race conditions + UAFs in KTM. Proper low-level material, not another surface-level security course. Start digging: p.ost2.fyi #WindowsInternals #ReverseEngineering #ExploitDevelopment

keyboard_arrow_left Previous keyboard_arrow_right Next

🚨 Threat Alert: A newly registered domain, 𝘁𝗲𝗮𝗺𝘀-𝗼𝗻𝗹𝗶𝗻𝗲[.]𝗰𝗼𝗺, created just 𝟰 𝗱𝗮𝘆𝘀 𝗮𝗴𝗼, is actively mimicking the full Microsoft Teams login and user interface. ​ At the time of analysis, 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗗𝗲𝗳𝗲𝗻𝗱𝗲𝗿 𝗿𝗲𝗽𝗼𝗿𝘁𝗲𝗱 𝘇𝗲𝗿𝗼 𝗱𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻𝘀, so don't rely solely on endpoint protection. Consider proactively adding this domain to your tenant's block list and web filtering policies immediately. ​ #threathunting #threatdetection 🫡

If you're into malware analysis, Windows internals or reverse engineering, bookmark this. @eversinc33 has built an excellent FREE archive of low-level security research covering: - Windows kernel internals - Driver reverse engineering - VMProtect unpacking - IDA + WinDbg - LLVM-based devirtualization - Symbolic execution - Rootkits + anti-rootkit research - Manual driver mapping + BYOVD - PspCidTable manipulation - Hidden kernel threads - .data pointer hijacking - Kernel keylogging - Windows access tokens + Potato exploits - Syscall trampolines - .NET obfuscation + deobfuscation - GPU malware + OpenCL - Node.js malware tracing - Anti-cheat driver reversing - Prompt malware + agentic AI security - YARA-like detection for malicious prompts Some particularly good rabbit holes include reversing and unpacking a VMProtect-protected anti-cheat kernel driver, building an LLVM devirtualizer, a 3-part anti-anti-rootkit series, GPU-based malware research and the newer NLIR work for hunting malicious prompts. A lot of it includes real code, IDA/WinDbg reversing and PoCs rather than just high-level theory. Start digging: eversinc33.com Huge credit to @eversinc33 for keeping all of this research publicly available. #WindowsInternals #ReverseEngineering #MalwareAnalysis

keyboard_arrow_left Previous keyboard_arrow_right Next

All 60 #CTF Qualifier A challenge walkthroughs are now live—free and ungated. Competed, got stuck, or preparing for Qualifier B in November? Explore the solutions and sharpen your investigative skills. maltego.com/blog/maltego-c…

More fake Income Tax Department portals are being used to distribute malware. cheulmri[.]link 156.245.144[.]92 pureveda[.]fyi #Malware #Phishing #CyberSecurity #ThreatIntel #InfoSec #India @IndianCERT @Cyberdost

keyboard_arrow_left Previous keyboard_arrow_right Next

Anurag @Malwarehunterr

4 weeks ago

Few more fake Income Tax Department portals are being used to distribute malware. hxxps://pldnf[.]top/ hxxps://ckrotbin[.]biz/ #Malware #Phishing #CyberSecurity #ThreatIntel #InfoSec #India @IndianCERT @Cyberdost @namesilo @Dynadot

keyboard_arrow_left Previous keyboard_arrow_right Next

4 2 7 3K 1

If you work with Windows internals, reverse engineering or exploit development, bookmark this. @j00ru 's blog is one of the best FREE archives of low-level Windows security research online. It covers: Windows kernel internals Kernel exploitation Reverse engineering Memory corruption + infoleaks Win32k internals NT + Win32k syscall tables CSRSS APIs + internals Fuzzing + instrumentation Windows mitigations Conference talks Technical papers + research Exploit development Some of this research goes back more than 15 years and is still incredibly useful for understanding how Windows works under the hood. The site also maintains dedicated Windows syscall tables and CSRSS reference material. Absolute rabbit hole for anyone serious about Windows security. j00ru.vexillium.org #WindowsInternals #ReverseEngineering #ExploitDevelopment

keyboard_arrow_left Previous keyboard_arrow_right Next

Extracting PDF Metadata PDF metadata can be valuable during a pentest. It can reveal employee names, the applications they use, document dates, and more. These names can then be used to create username lists and test whether those accounts exist, for example, with Kerbrute On the other hand, you may also want to make sure you're not exposing anything private hackers-arise.com/digital-forens…

𝗔𝗴𝗲𝗻𝘁𝗶𝗰 𝗧𝗵𝗿𝗲𝗮𝘁 𝗛𝘂𝗻𝘁𝗶𝗻𝗴 𝗘𝘅𝗽𝗲𝗿𝗶𝗺𝗲𝗻𝘁𝘀 - 𝟭 ​ This is a result of a one-shot hunting experiment in a small environment with a single generic threat hunting agent. The agent doesn't have any specific SKILL.md or prompt. It has just a single short definition saying "you are a threat hunter". ​ I especially chose the scheduled task because it's a well-studied TTP, and there are lots of resources around it on the internet. Also, the malicious task had clear indicators. So, the expectation was a successful identification of the malicious scheduled task. ​ Let's see what's gonna happen when the clear indicators are gone. ​ #ThreatHunting #AgenticThreatHunting

THIS IS F**CKING DANGEROUS 7 AI cybersecurity tools every builder should know before shipping their next product. → PentestGPT — autonomous pentesting → BurpGPT — AI-powered Burp Suite analysis → Security Copilot — blue-team investigation → Snyk DeepCode AI — code scanning + autofix → HexStrike AI — 150+ security tools + AI agents → Garak — LLM vulnerability testing → Lakera Guard — prompt injection + jailbreak protection The interesting part? AI is now showing up across the entire security stack. -Offensive security. -Defensive security. -Code security. -LLM red teaming. -Runtime protection. Some are fully open source and self hostable, while others are commercial platforms. If you’re building AI systems, cybersecurity is becoming impossible to ignore. BOOKMARK this before someone take it down LINKS BELOW

Detection engineers, malware analysts, reverse engineers, threat intel and red teamers, this one is worth a read. Nextron breaks down RegPhantom, a Windows kernel backdoor using a signed driver, registry callbacks and reflective kernel loading. Interesting bits: CmRegisterCallback Unsigned PE execution in kernel memory No PsLoadedModuleList entry CFG and API call obfuscation Encoded hook pointers Payload memory wiping Good reversing material and a useful look at how signed driver trust can be abused for stealthy Ring 0 execution. @nextronresearch nextron-systems.com/2026/03/20/reg… #MalwareAnalysis #ReverseEngineering #ThreatIntel

keyboard_arrow_left Previous keyboard_arrow_right Next

Active Directory Attack Architecture kypvas.github.io/ad_attack_arch… #infosec #cybersecurity #cybersecuritytips #pentesting #cybersecurityawareness

🤖🚨 GOOGLE: THREAT ACTORS ARE MOVING FROM AI PROMPTS TO AUTONOMOUS ATTACK WORKFLOWS Google Threat Intelligence Group (GTIG) says adversaries are moving beyond simply asking LLMs for help and are beginning to operationalize agentic AI across cyberattacks. One of the most striking cases: GTIG observed a suspected financially motivated actor compromise cloud infrastructure and use an autonomous multi-agent framework to plan, build and execute a mass credential-harvesting campaign in LESS THAN SIX HOURS. According to Google, the AI-enabled operation could: * Automate vulnerability scanning * Harvest credentials at scale * Troubleshoot operational failures in real time * Rotate IP addresses automatically * Make tactical decisions with minimal human intervention The campaign reportedly compromised thousands of third-party credentials. Another exposed adversarial framework tracked by GTIG had accumulated more than 23,800 harvested secrets, including cloud and AI-service API keys. 🚨 AI IS ALSO BECOMING PART OF THE SOFTWARE SUPPLY-CHAIN ATTACK SURFACE Google details activity by UNC6780 — also known as TeamPCP — targeting developers and AI tooling. GTIG says the actor: * Compromised developer accounts * Trojanized MCP-related packages * Targeted GitHub Actions OIDC tokens * Published compromised packages with valid provenance attestations * Hid malicious files inside .claude/, .cursor/ and .vscode/ directories * Used prompt injection to manipulate AI coding assistants * Embedded adversarial prompts in malware apparently intended to make LLM security scanners refuse or skip analysis In one incident investigated by Mandiant, UNC6780 gained initial access before handing it to another actor that subsequently issued a ransom demand using LAPSUS branding. Google also observed nation-state actors incorporating AI throughout their operations, including PRC-, Iranian-, Russian- and DPRK-linked activity. ⚠️ BUT THERE IS AN IMPORTANT LIMIT. Google says it has NOT yet observed threat actors deploying fully autonomous zero-day discovery and exploitation pipelines against targets in the wild. What it IS seeing is the progression toward that capability: Prompting → AI-assisted tooling → Automated attack pipelines → Multi-agent operations → Increasingly autonomous decision-making ⚠️ Analyst Note: This may be one of the more consequential changes occurring in offensive cyber operations. AI isn't simply making individual hackers smarter. It can reduce the amount of human attention required to operate an attack. Reconnaissance, vulnerability analysis, exploitation, troubleshooting, credential harvesting and infrastructure management can increasingly be connected into machine-driven workflows. That changes an important variable for defenders: TIME. Google says human-in-the-loop latency is being dramatically reduced, compressing the traditional window defenders have to detect and respond. The emerging threat isn't simply “hackers using ChatGPT.” It's cyber operations where humans increasingly supervise autonomous attack infrastructure rather than manually operating every step. Source: Google Threat Intelligence Group — September 8, 2026 cloud.google.com/blog/topics/th… #DDW #AgenticAI #ThreatIntelligence #AISecurity #CyberSecurity