‼️BREAKING: An actively exploited unknown critical Citrix NetScaler zero-day has prompted governments and organizations to SHUTDOWN all their devices immediately. We don't know what's exactly going on yet. Stay tuned for more info.

This are now disabled again 🤷 github.com/actions-cool/main… github.com/actions-cool/issu…

Had a blast with @fleetctl at Atlas 9 KC for their JNUC afterparty yesterday! I hear it's a lot like Meow Wolf.

Absolutely crazy that these two GitHub Actions which were quarantined could be reactivated with the malware still armed. Many of the these workflows run on a cron without any true repository activity trigging them.

Ouch. A hijacked past commit to remove PolinRider... adds PolinRider

Pretty wild how this extension will piece together it's code from a C2 server.

“We want evaluators more independent than METR!” *monkey’s paw curls*

so remember when certain DPRK groups stored their C2 infra details (often base64-encoded & XOR-encrypted) in smart contracts? it was called EtherHiding. well, our PolinRider "friends" (and other groups) have gotten a bit more "creative". they now use a new pattern called "NullReceiver": simply put, they send a zero-value tx with zero calldata, while hiding the C2 IP address directly in the `to` address lol. let's take real-world example: - tx hash: `0x910d35c6620bea357c867bd93b291dc6feb1990bb57a0a063fa652cd29d096b2` - `to` address: `0xa658863ea658863e68656c6c6f6970626f742121` this will lead to - a658863e -> 166[.]88[.]134[.]62 - a658863e -> repetition of the above IP - the rest (68656c6c6f6970626f742121) is some string "helloipbot!!"

Are you extensions taking control of embedded browser AI? Great research!

KREMLIN is a multi-stage credential theft toolkit targeting Brazilian banking users. New research from Elastic Security Labs (REF9334): go.es.io/4yfkg4R by @cyril_t_f and @andythevariable The infection chain combines JavaScript loaders, an optional PE injector, and a custom C++ installer. The installer downloads and installs a malicious browser extension for Chrome and Edge and/or deploys an embedded PULSAR or REMCOS RAT. This malicious extension is then used for web-browser data interception and exfiltration. KREMLIN resolves its C2 endpoints from Ethereum. Smart contracts store payload URLs and extension download locations as on-chain key-value pairs. The operators update endpoints by writing a new transaction. The extension installation bypasses Chromium's integrity system. The installer launches Chrome under a debugger, recovers the App-Bound OSCrypt key from process memory, extracts the seed from resources.pak, then regenerates the HMACs and encrypted SHA-256 hashes that Secure Preferences requires. The extension registers silently with developer mode forced on. Once active, it logs input fields, intercepts HTTP requests by configurable URL and method rules, injects attacker-controlled HTML, and exfiltrates intercepted data, cookies, and credentials over WebSocket and HTTP. Elastic Security Labs Threat Command registered the network canary domain that operates as a kill switch. We observed thousands of implants from Brazil attempting to check in to this domain. Once this domain was live, the KREMLIN loaders crash before trying to update or install the final payload, temporarily disrupting this campaign. The targeting is clear. Lure filenames impersonate PIX transfers, bank statements, and receipts from Banco do Brasil, Bradesco, Sicoob, Santander, C6 Bank, and PagBank. Ethereum transaction timestamps cluster in São Paulo working hours. Portuguese-language artifacts appear throughout the codebase.

Glad I started Careless People last week. It is a fantastic view into high growth startups, the tradeoffs in doing business and how people truly shape what a company is. Very timely with current AI discourse too. I have to imagine there will be OpenAI and Anthropic versions in the years to come.

MacOS #clickfix campaign called #PasteSwitch - this was a fun one, lots of detail and IoCs in this one - very illusive group who has a big focus on Malvertising. The group got access to legit HBO Max account on reddit 👀 adamnet.works/blog/hbo-max-a…

Was told my products UI is terrible (it's true), but the API/MCP always work. They said it was a better experience than a beautiful product which had sparse and barely functioning APIs. A beautiful product does sell, but outcomes do matter.

Browser extensions are still the wild west. You really need to know what they’re actually doing once you install them. This Twitch extension does what it says in the description, plus just a little bit extra... 🫠 Still live in the Chrome and Firefox stores, by the way.

No revenue 10B valuation I guess Facebook did it

WTAF we've totally lost the plot if Norton is now collecting clickstream data in exchange for 5% off your infrared facemask