home.social
Sign in Create account

#backdoor — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #backdoor, aggregated by home.social.

  1. OTX Bot @[email protected] ·

    Disclosing new PebbleDash-based tools

    Kaspersky researchers conducted an in-depth analysis of Kimsuky APT activity, revealing tactical shifts and new malware variants based on the PebbleDash platform. The group introduced HelloDoor, a Rust-based backdoor, httpMalice leveraging HTTP and Dropbox communications, and updated MemLoad and httpTroy variants. Kimsuky maintains persistence through legitimate tools including VSCode Tunneling with GitHub authentication and DWAgent remote management software. Initial access occurs via spear-phishing with malicious attachments disguised as documents. The group primarily targets South Korean entities across government and defense sectors, with additional PebbleDash attacks observed in Brazil and Germany. Infrastructure relies on free South Korean hosting services and tunneling services like Cloudflare Quick Tunnels and Ngrok. Both PebbleDash and AppleSeed malware clusters demonstrate ongoing development with shared distribution methods, stolen certificates, and overlapping targets, indicating single-actor c...

    Pulse ID: 6a05af0979e3cc1214a50d4e
    Pulse Link: otx.alienvault.com/pulse/6a05a
    Pulse Author: AlienVault
    Created: 2026-05-14 11:16:25

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #AppleSeed #BackDoor #Brazil #Cloud #CyberSecurity #Dropbox #Germany #GitHub #Government #HTTP #InfoSec #Kaspersky #Kimsuky #Korea #Malware #OTX #OpenThreatExchange #Phishing #RAT #Rust #SouthKorea #SpearPhishing #UK #bot #AlienVault

    #appleseed #backdoor #brazil #cloud #cybersecurity #dropbox
  2. OTX Bot @[email protected] ·

    Disclosing new PebbleDash-based tools

    Kaspersky researchers conducted an in-depth analysis of Kimsuky APT activity, revealing tactical shifts and new malware variants based on the PebbleDash platform. The group introduced HelloDoor, a Rust-based backdoor, httpMalice leveraging HTTP and Dropbox communications, and updated MemLoad and httpTroy variants. Kimsuky maintains persistence through legitimate tools including VSCode Tunneling with GitHub authentication and DWAgent remote management software. Initial access occurs via spear-phishing with malicious attachments disguised as documents. The group primarily targets South Korean entities across government and defense sectors, with additional PebbleDash attacks observed in Brazil and Germany. Infrastructure relies on free South Korean hosting services and tunneling services like Cloudflare Quick Tunnels and Ngrok. Both PebbleDash and AppleSeed malware clusters demonstrate ongoing development with shared distribution methods, stolen certificates, and overlapping targets, indicating single-actor c...

    Pulse ID: 6a05af0979e3cc1214a50d4e
    Pulse Link: otx.alienvault.com/pulse/6a05a
    Pulse Author: AlienVault
    Created: 2026-05-14 11:16:25

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #AppleSeed #BackDoor #Brazil #Cloud #CyberSecurity #Dropbox #Germany #GitHub #Government #HTTP #InfoSec #Kaspersky #Kimsuky #Korea #Malware #OTX #OpenThreatExchange #Phishing #RAT #Rust #SouthKorea #SpearPhishing #UK #bot #AlienVault

    #appleseed #backdoor #brazil #cloud #cybersecurity #dropbox
  3. OTX Bot @[email protected] ·

    Disclosing new PebbleDash-based tools

    Kaspersky researchers conducted an in-depth analysis of Kimsuky APT activity, revealing tactical shifts and new malware variants based on the PebbleDash platform. The group introduced HelloDoor, a Rust-based backdoor, httpMalice leveraging HTTP and Dropbox communications, and updated MemLoad and httpTroy variants. Kimsuky maintains persistence through legitimate tools including VSCode Tunneling with GitHub authentication and DWAgent remote management software. Initial access occurs via spear-phishing with malicious attachments disguised as documents. The group primarily targets South Korean entities across government and defense sectors, with additional PebbleDash attacks observed in Brazil and Germany. Infrastructure relies on free South Korean hosting services and tunneling services like Cloudflare Quick Tunnels and Ngrok. Both PebbleDash and AppleSeed malware clusters demonstrate ongoing development with shared distribution methods, stolen certificates, and overlapping targets, indicating single-actor c...

    Pulse ID: 6a05af0979e3cc1214a50d4e
    Pulse Link: otx.alienvault.com/pulse/6a05a
    Pulse Author: AlienVault
    Created: 2026-05-14 11:16:25

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #AppleSeed #BackDoor #Brazil #Cloud #CyberSecurity #Dropbox #Germany #GitHub #Government #HTTP #InfoSec #Kaspersky #Kimsuky #Korea #Malware #OTX #OpenThreatExchange #Phishing #RAT #Rust #SouthKorea #SpearPhishing #UK #bot #AlienVault

    #appleseed #backdoor #brazil #cloud #cybersecurity #dropbox
  4. OTX Bot @[email protected] ·

    Disclosing new PebbleDash-based tools

    Kaspersky researchers conducted an in-depth analysis of Kimsuky APT activity, revealing tactical shifts and new malware variants based on the PebbleDash platform. The group introduced HelloDoor, a Rust-based backdoor, httpMalice leveraging HTTP and Dropbox communications, and updated MemLoad and httpTroy variants. Kimsuky maintains persistence through legitimate tools including VSCode Tunneling with GitHub authentication and DWAgent remote management software. Initial access occurs via spear-phishing with malicious attachments disguised as documents. The group primarily targets South Korean entities across government and defense sectors, with additional PebbleDash attacks observed in Brazil and Germany. Infrastructure relies on free South Korean hosting services and tunneling services like Cloudflare Quick Tunnels and Ngrok. Both PebbleDash and AppleSeed malware clusters demonstrate ongoing development with shared distribution methods, stolen certificates, and overlapping targets, indicating single-actor c...

    Pulse ID: 6a05af0979e3cc1214a50d4e
    Pulse Link: otx.alienvault.com/pulse/6a05a
    Pulse Author: AlienVault
    Created: 2026-05-14 11:16:25

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #AppleSeed #BackDoor #Brazil #Cloud #CyberSecurity #Dropbox #Germany #GitHub #Government #HTTP #InfoSec #Kaspersky #Kimsuky #Korea #Malware #OTX #OpenThreatExchange #Phishing #RAT #Rust #SouthKorea #SpearPhishing #UK #bot #AlienVault

    #alienvault #bot #uk #spearphishing #southkorea #rust
  5. OTX Bot @[email protected] ·

    Disclosing new PebbleDash-based tools

    Kaspersky researchers conducted an in-depth analysis of Kimsuky APT activity, revealing tactical shifts and new malware variants based on the PebbleDash platform. The group introduced HelloDoor, a Rust-based backdoor, httpMalice leveraging HTTP and Dropbox communications, and updated MemLoad and httpTroy variants. Kimsuky maintains persistence through legitimate tools including VSCode Tunneling with GitHub authentication and DWAgent remote management software. Initial access occurs via spear-phishing with malicious attachments disguised as documents. The group primarily targets South Korean entities across government and defense sectors, with additional PebbleDash attacks observed in Brazil and Germany. Infrastructure relies on free South Korean hosting services and tunneling services like Cloudflare Quick Tunnels and Ngrok. Both PebbleDash and AppleSeed malware clusters demonstrate ongoing development with shared distribution methods, stolen certificates, and overlapping targets, indicating single-actor c...

    Pulse ID: 6a05af0979e3cc1214a50d4e
    Pulse Link: otx.alienvault.com/pulse/6a05a
    Pulse Author: AlienVault
    Created: 2026-05-14 11:16:25

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #AppleSeed #BackDoor #Brazil #Cloud #CyberSecurity #Dropbox #Germany #GitHub #Government #HTTP #InfoSec #Kaspersky #Kimsuky #Korea #Malware #OTX #OpenThreatExchange #Phishing #RAT #Rust #SouthKorea #SpearPhishing #UK #bot #AlienVault

    #appleseed #backdoor #brazil #cloud #cybersecurity #dropbox
  6. (in)sicurezza digitale @[email protected] ·

    FamousSparrow nel Caucaso: tre ondate di spionaggio cinese colpiscono il gas azero che alimenta l’Europa

    Il gruppo APT cinese FamousSparrow ha condotto un'operazione di cyberspionaggio in tre fasi successive contro una società petrolifera e del gas dell'Azerbaigian, sfruttando ripetutamente la stessa vulnerabilità di Microsoft Exchange. Un caso che illumina la strategia di Pechino per il controllo delle infrastrutture energetiche europee.

    insicurezzadigitale.com/famous

    #apt #azerbaijan #backdoor #cina #cyberwar #energia
  7. (in)sicurezza digitale @[email protected] ·

    FamousSparrow nel Caucaso: tre ondate di spionaggio cinese colpiscono il gas azero che alimenta l’Europa

    Il gruppo APT cinese FamousSparrow ha condotto un'operazione di cyberspionaggio in tre fasi successive contro una società petrolifera e del gas dell'Azerbaigian, sfruttando ripetutamente la stessa vulnerabilità di Microsoft Exchange. Un caso che illumina la strategia di Pechino per il controllo delle infrastrutture energetiche europee.

    insicurezzadigitale.com/famous

    #apt #azerbaijan #backdoor #cina #cyberwar #energia
  8. (in)sicurezza digitale @[email protected] ·

    FamousSparrow nel Caucaso: tre ondate di spionaggio cinese colpiscono il gas azero che alimenta l’Europa

    Il gruppo APT cinese FamousSparrow ha condotto un'operazione di cyberspionaggio in tre fasi successive contro una società petrolifera e del gas dell'Azerbaigian, sfruttando ripetutamente la stessa vulnerabilità di Microsoft Exchange. Un caso che illumina la strategia di Pechino per il controllo delle infrastrutture energetiche europee.

    insicurezzadigitale.com/famous

    #apt #azerbaijan #backdoor #cina #cyberwar #energia
  9. (in)sicurezza digitale @[email protected] ·

    FamousSparrow nel Caucaso: tre ondate di spionaggio cinese colpiscono il gas azero che alimenta l’Europa

    Il gruppo APT cinese FamousSparrow ha condotto un'operazione di cyberspionaggio in tre fasi successive contro una società petrolifera e del gas dell'Azerbaigian, sfruttando ripetutamente la stessa vulnerabilità di Microsoft Exchange. Un caso che illumina la strategia di Pechino per il controllo delle infrastrutture energetiche europee.

    insicurezzadigitale.com/famous

    #supplychain #infosec #famoussparrow #energia #cyberwar #cina
  10. (in)sicurezza digitale @[email protected] ·

    FamousSparrow nel Caucaso: tre ondate di spionaggio cinese colpiscono il gas azero che alimenta l’Europa

    Il gruppo APT cinese FamousSparrow ha condotto un'operazione di cyberspionaggio in tre fasi successive contro una società petrolifera e del gas dell'Azerbaigian, sfruttando ripetutamente la stessa vulnerabilità di Microsoft Exchange. Un caso che illumina la strategia di Pechino per il controllo delle infrastrutture energetiche europee.

    insicurezzadigitale.com/famous

    #apt #azerbaijan #backdoor #cina #cyberwar #energia
  11. OTX Bot @[email protected] ·

    Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign

    A sophisticated campaign linked to APT37 delivers Python-based backdoors through spear-phishing emails containing malicious LNK files disguised as legitimate documents. Attackers use themes including airline e-tickets, North Korea research invitations, and impersonation of defense and police officials to induce execution. The LNK files employ environment variable-based obfuscation techniques to download additional BAT files, which establish a Python runtime environment and execute compiled Python bytecode disguised with .cat extensions. The malware functions as a remote command execution backdoor, communicating with C2 servers to receive commands and exfiltrate results. Persistence is maintained through scheduled tasks executing at one-minute intervals. The campaign shows strong tactical similarities to previous APT37 operations, including infrastructure patterns, script obfuscation methods, and the abuse of legitimate tools.

    Pulse ID: 6a04a9a090a64de310cb0568
    Pulse Link: otx.alienvault.com/pulse/6a04a
    Pulse Author: AlienVault
    Created: 2026-05-13 16:41:04

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #APT37 #BackDoor #CyberSecurity #Email #InfoSec #Korea #LNK #Malware #NorthKorea #OTX #OpenThreatExchange #Phishing #Python #RAT #RemoteCommandExecution #SpearPhishing #bot #AlienVault

    #apt37 #backdoor #cybersecurity #email #infosec #korea
  12. OTX Bot @[email protected] ·

    Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign

    A sophisticated campaign linked to APT37 delivers Python-based backdoors through spear-phishing emails containing malicious LNK files disguised as legitimate documents. Attackers use themes including airline e-tickets, North Korea research invitations, and impersonation of defense and police officials to induce execution. The LNK files employ environment variable-based obfuscation techniques to download additional BAT files, which establish a Python runtime environment and execute compiled Python bytecode disguised with .cat extensions. The malware functions as a remote command execution backdoor, communicating with C2 servers to receive commands and exfiltrate results. Persistence is maintained through scheduled tasks executing at one-minute intervals. The campaign shows strong tactical similarities to previous APT37 operations, including infrastructure patterns, script obfuscation methods, and the abuse of legitimate tools.

    Pulse ID: 6a04a9a090a64de310cb0568
    Pulse Link: otx.alienvault.com/pulse/6a04a
    Pulse Author: AlienVault
    Created: 2026-05-13 16:41:04

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #APT37 #BackDoor #CyberSecurity #Email #InfoSec #Korea #LNK #Malware #NorthKorea #OTX #OpenThreatExchange #Phishing #Python #RAT #RemoteCommandExecution #SpearPhishing #bot #AlienVault

    #apt37 #backdoor #cybersecurity #email #infosec #korea
  13. OTX Bot @[email protected] ·

    Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign

    A sophisticated campaign linked to APT37 delivers Python-based backdoors through spear-phishing emails containing malicious LNK files disguised as legitimate documents. Attackers use themes including airline e-tickets, North Korea research invitations, and impersonation of defense and police officials to induce execution. The LNK files employ environment variable-based obfuscation techniques to download additional BAT files, which establish a Python runtime environment and execute compiled Python bytecode disguised with .cat extensions. The malware functions as a remote command execution backdoor, communicating with C2 servers to receive commands and exfiltrate results. Persistence is maintained through scheduled tasks executing at one-minute intervals. The campaign shows strong tactical similarities to previous APT37 operations, including infrastructure patterns, script obfuscation methods, and the abuse of legitimate tools.

    Pulse ID: 6a04a9a090a64de310cb0568
    Pulse Link: otx.alienvault.com/pulse/6a04a
    Pulse Author: AlienVault
    Created: 2026-05-13 16:41:04

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #APT37 #BackDoor #CyberSecurity #Email #InfoSec #Korea #LNK #Malware #NorthKorea #OTX #OpenThreatExchange #Phishing #Python #RAT #RemoteCommandExecution #SpearPhishing #bot #AlienVault

    #apt37 #backdoor #cybersecurity #email #infosec #korea
  14. OTX Bot @[email protected] ·

    Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign

    A sophisticated campaign linked to APT37 delivers Python-based backdoors through spear-phishing emails containing malicious LNK files disguised as legitimate documents. Attackers use themes including airline e-tickets, North Korea research invitations, and impersonation of defense and police officials to induce execution. The LNK files employ environment variable-based obfuscation techniques to download additional BAT files, which establish a Python runtime environment and execute compiled Python bytecode disguised with .cat extensions. The malware functions as a remote command execution backdoor, communicating with C2 servers to receive commands and exfiltrate results. Persistence is maintained through scheduled tasks executing at one-minute intervals. The campaign shows strong tactical similarities to previous APT37 operations, including infrastructure patterns, script obfuscation methods, and the abuse of legitimate tools.

    Pulse ID: 6a04a9a090a64de310cb0568
    Pulse Link: otx.alienvault.com/pulse/6a04a
    Pulse Author: AlienVault
    Created: 2026-05-13 16:41:04

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #APT37 #BackDoor #CyberSecurity #Email #InfoSec #Korea #LNK #Malware #NorthKorea #OTX #OpenThreatExchange #Phishing #Python #RAT #RemoteCommandExecution #SpearPhishing #bot #AlienVault

    #alienvault #bot #spearphishing #remotecommandexecution #rat #python
  15. OTX Bot @[email protected] ·

    Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign

    A sophisticated campaign linked to APT37 delivers Python-based backdoors through spear-phishing emails containing malicious LNK files disguised as legitimate documents. Attackers use themes including airline e-tickets, North Korea research invitations, and impersonation of defense and police officials to induce execution. The LNK files employ environment variable-based obfuscation techniques to download additional BAT files, which establish a Python runtime environment and execute compiled Python bytecode disguised with .cat extensions. The malware functions as a remote command execution backdoor, communicating with C2 servers to receive commands and exfiltrate results. Persistence is maintained through scheduled tasks executing at one-minute intervals. The campaign shows strong tactical similarities to previous APT37 operations, including infrastructure patterns, script obfuscation methods, and the abuse of legitimate tools.

    Pulse ID: 6a04a9a090a64de310cb0568
    Pulse Link: otx.alienvault.com/pulse/6a04a
    Pulse Author: AlienVault
    Created: 2026-05-13 16:41:04

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #APT37 #BackDoor #CyberSecurity #Email #InfoSec #Korea #LNK #Malware #NorthKorea #OTX #OpenThreatExchange #Phishing #Python #RAT #RemoteCommandExecution #SpearPhishing #bot #AlienVault

    #apt37 #backdoor #cybersecurity #email #infosec #korea
  16. 🅺🅸🅼 🆂🅲🅷🆄🅻🆉:~$ ▓ @[email protected] ·

    The other day I was asked to help clean a wordpress installation that had unwanted visitors. It was a fun journey looking through the backdoor code and a wrote a small piece about it here:
    schulz.dk/2026/05/14/the-wordp
    WP is great for many things but so wide-spread that bad actors will try to find holes in it.
    #wordpress #infosec #security #malware @blog #blogpost #php #code #backdoor #walkthrough

    #wordpress #infosec #security #malware #blogpost #php
  17. 🅺🅸🅼 🆂🅲🅷🆄🅻🆉:~$ ▓ @[email protected] ·

    The other day I was asked to help clean a wordpress installation that had unwanted visitors. It was a fun journey looking through the backdoor code and a wrote a small piece about it here:
    schulz.dk/2026/05/14/the-wordp
    WP is great for many things but so wide-spread that bad actors will try to find holes in it.
    #wordpress #infosec #security #malware @blog #blogpost #php #code #backdoor #walkthrough

    #wordpress #infosec #security #malware #blogpost #php
  18. 🅺🅸🅼 🆂🅲🅷🆄🅻🆉:~$ ▓ @[email protected] ·

    The other day I was asked to help clean a wordpress installation that had unwanted visitors. It was a fun journey looking through the backdoor code and a wrote a small piece about it here:
    schulz.dk/2026/05/14/the-wordp
    WP is great for many things but so wide-spread that bad actors will try to find holes in it.
    #wordpress #infosec #security #malware @blog #blogpost #php #code #backdoor #walkthrough

    #wordpress #infosec #security #malware #blogpost #php
  19. 🅺🅸🅼 🆂🅲🅷🆄🅻🆉:~$ ▓ @[email protected] ·

    The other day I was asked to help clean a wordpress installation that had unwanted visitors. It was a fun journey looking through the backdoor code and a wrote a small piece about it here:
    schulz.dk/2026/05/14/the-wordp
    WP is great for many things but so wide-spread that bad actors will try to find holes in it.
    #wordpress #infosec #security #malware @blog #blogpost #php #code #backdoor #walkthrough

    #walkthrough #backdoor #code #php #blogpost #malware
  20. 🅺🅸🅼 🆂🅲🅷🆄🅻🆉:~$ ▓ @[email protected] ·

    The other day I was asked to help clean a wordpress installation that had unwanted visitors. It was a fun journey looking through the backdoor code and a wrote a small piece about it here:
    schulz.dk/2026/05/14/the-wordp
    WP is great for many things but so wide-spread that bad actors will try to find holes in it.
    #wordpress #infosec #security #malware @blog #blogpost #php #code #backdoor #walkthrough

    #wordpress #infosec #security #malware #blogpost #php
  21. Rudolf M. @[email protected] ·

    #Microsoft baut #Backdoor in den #Windows #Bitlocker ein?

    (also mutmaßlich)

    Windows 11, Windows Server 2022, 2025 sind betroffen.

    Laut einen Sicherheitsforscher kann man relativ einfach mit einem #USB Stick die Verschlüsselung umgehen... WTF Windows.

    Hoods Informatik hat dazu ein Kurzvideo hochgeladen:
    youtube.com/shorts/h09NoxuYW4w

    Können wir jetzt bitte endlich alle zu ner gescheiten #Linux Distro wechseln?
    Oder für die, die zu viel Geld haben wenigstens zu Mac? (Auch wenn ich Mac nicht leiden kann.)

    #IT #itsecurtity #sicherheitslücken

    #it #itsecurtity #microsoft #backdoor #windows #bitlocker
  22. Rudolf M. @[email protected] ·

    # #Microsoft baut #Backdoor in den #Windows #Bitlocker ein?
    (also mutmaßlich)

    Windows 11, Windows Server 2022, 2025 sind betroffen.

    Laut einen Sicherheitsforscher kann man relativ einfach mit einem #USB Stick die Verschlüsselung umgehen... WTF Windows.

    Hoods Informatik hat dazu ein Kurzvideo hochgeladen:
    youtube.com/shorts/h09NoxuYW4w

    **Können wir jetzt bitte endlich alle zu ner gescheiten #Linux Distro wechseln?**
    Oder für die, die zu viel Geld haben wenigstens zu Mac? (Auch wenn ich Mac nicht leiden kann.)

    #microsoft #backdoor #windows #bitlocker #usb #linux
  23. Rudolf M. @[email protected] ·

    # #Microsoft baut #Backdoor in den #Windows #Bitlocker ein?
    (also mutmaßlich)

    Windows 11, Windows Server 2022, 2025 sind betroffen.

    Laut einen Sicherheitsforscher kann man relativ einfach mit einem #USB Stick die Verschlüsselung umgehen... WTF Windows.

    Hoods Informatik hat dazu ein Kurzvideo hochgeladen:
    youtube.com/shorts/h09NoxuYW4w

    **Können wir jetzt bitte endlich alle zu ner gescheiten #Linux Distro wechseln?**
    Oder für die, die zu viel Geld haben wenigstens zu Mac? (Auch wenn ich Mac nicht leiden kann.)

    #microsoft #backdoor #windows #bitlocker #usb #linux
  24. N-gated Hacker News @[email protected] ·

    🎉 BREAKING: GitHub accidentally leaks its own token in Actions logs! 🎉 It's like they finally decided to play hide and seek, but forgot the 'hide' part. 🤦‍♂️ GitHub devs now busy inventing new ways to accidentally leave the #backdoor open. 🚪🔓
    github.com/composer/composer/s #GitHubLeaks #GitHubActions #SecurityBreach #DevOps #Failures #HackerNews #ngated

    #backdoor #githubleaks #githubactions #securitybreach #devops #failures
  25. N-gated Hacker News @[email protected] ·

    🎉 BREAKING: GitHub accidentally leaks its own token in Actions logs! 🎉 It's like they finally decided to play hide and seek, but forgot the 'hide' part. 🤦‍♂️ GitHub devs now busy inventing new ways to accidentally leave the #backdoor open. 🚪🔓
    github.com/composer/composer/s #GitHubLeaks #GitHubActions #SecurityBreach #DevOps #Failures #HackerNews #ngated

    #backdoor #githubleaks #githubactions #securitybreach #devops #failures
  26. N-gated Hacker News @[email protected] ·

    🎉 BREAKING: GitHub accidentally leaks its own token in Actions logs! 🎉 It's like they finally decided to play hide and seek, but forgot the 'hide' part. 🤦‍♂️ GitHub devs now busy inventing new ways to accidentally leave the #backdoor open. 🚪🔓
    github.com/composer/composer/s #GitHubLeaks #GitHubActions #SecurityBreach #DevOps #Failures #HackerNews #ngated

    #backdoor #githubleaks #githubactions #securitybreach #devops #failures
  27. N-gated Hacker News @[email protected] ·

    🎉 BREAKING: GitHub accidentally leaks its own token in Actions logs! 🎉 It's like they finally decided to play hide and seek, but forgot the 'hide' part. 🤦‍♂️ GitHub devs now busy inventing new ways to accidentally leave the #backdoor open. 🚪🔓
    github.com/composer/composer/s #GitHubLeaks #GitHubActions #SecurityBreach #DevOps #Failures #HackerNews #ngated

    #ngated #hackernews #failures #devops #securitybreach #githubactions
  28. N-gated Hacker News @[email protected] ·

    🎉 BREAKING: GitHub accidentally leaks its own token in Actions logs! 🎉 It's like they finally decided to play hide and seek, but forgot the 'hide' part. 🤦‍♂️ GitHub devs now busy inventing new ways to accidentally leave the #backdoor open. 🚪🔓
    github.com/composer/composer/s #GitHubLeaks #GitHubActions #SecurityBreach #DevOps #Failures #HackerNews #ngated

    #backdoor #githubleaks #githubactions #securitybreach #devops #failures
  29. OTX Bot @[email protected] ·

    Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign

    Pulse ID: 6a048d03417ba877dc0a4e1d
    Pulse Link: otx.alienvault.com/pulse/6a048
    Pulse Author: CyberHunter_NL
    Created: 2026-05-13 14:38:59

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #BackDoor #CyberSecurity #InfoSec #OTX #OpenThreatExchange #Python #bot #CyberHunter_NL

    #backdoor #cybersecurity #infosec #otx #openthreatexchange #python
  30. OTX Bot @[email protected] ·

    Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign

    Pulse ID: 6a048d03417ba877dc0a4e1d
    Pulse Link: otx.alienvault.com/pulse/6a048
    Pulse Author: CyberHunter_NL
    Created: 2026-05-13 14:38:59

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #BackDoor #CyberSecurity #InfoSec #OTX #OpenThreatExchange #Python #bot #CyberHunter_NL

    #backdoor #cybersecurity #infosec #otx #openthreatexchange #python
  31. OTX Bot @[email protected] ·

    Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign

    Pulse ID: 6a048d03417ba877dc0a4e1d
    Pulse Link: otx.alienvault.com/pulse/6a048
    Pulse Author: CyberHunter_NL
    Created: 2026-05-13 14:38:59

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #BackDoor #CyberSecurity #InfoSec #OTX #OpenThreatExchange #Python #bot #CyberHunter_NL

    #backdoor #cybersecurity #infosec #otx #openthreatexchange #python
  32. OTX Bot @[email protected] ·

    Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign

    Pulse ID: 6a048d03417ba877dc0a4e1d
    Pulse Link: otx.alienvault.com/pulse/6a048
    Pulse Author: CyberHunter_NL
    Created: 2026-05-13 14:38:59

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #BackDoor #CyberSecurity #InfoSec #OTX #OpenThreatExchange #Python #bot #CyberHunter_NL

    #cyberhunter_nl #bot #python #openthreatexchange #otx #infosec
  33. OTX Bot @[email protected] ·

    Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign

    Pulse ID: 6a048d03417ba877dc0a4e1d
    Pulse Link: otx.alienvault.com/pulse/6a048
    Pulse Author: CyberHunter_NL
    Created: 2026-05-13 14:38:59

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #BackDoor #CyberSecurity #InfoSec #OTX #OpenThreatExchange #Python #bot #CyberHunter_NL

    #backdoor #cybersecurity #infosec #otx #openthreatexchange #python
  34. Christoph Schmees @[email protected] ·

    USA #Neuland

    Und ich dachte immer, Neuland wäre bei uns! Die Posse um das Verbot "ausländischer" Netzwerktechnik in den USA geht weiter. Zum Bann gegen ausländische Router etc. gehörte auch, dass Geräte im Bestand schon 2027 keine Updates mehr vom jeweiligen Hersteller bekommen dürften. Die Befürchtung dahinter ist, dass Hersteller mit jedem Update eine neue Hintertür ausliefern könnten. Wie kommen die USA nur auf diesen Gedanken? ;-) Das Risiko besteht, natürlich. Aber Updates sind normalerweise notwendig zur Behebung von Sicherheitslücken. Beim zweiten Nachdenken erschien der FCC das Risiko durch bekannte Sicherheitslücken, die mangels Updates offen bleiben, dann doch

    pc-fluesterer.info/wordpress/2

    #Hintergrund #cybercrime #hersteller #hintertr #router #UnplugTrump #usa #backdoor #spionage

    #neuland #hintergrund #cybercrime #hersteller #hintertr #router
  35. Christoph Schmees @[email protected] ·

    USA #Neuland

    Und ich dachte immer, Neuland wäre bei uns! Die Posse um das Verbot "ausländischer" Netzwerktechnik in den USA geht weiter. Zum Bann gegen ausländische Router etc. gehörte auch, dass Geräte im Bestand schon 2027 keine Updates mehr vom jeweiligen Hersteller bekommen dürften. Die Befürchtung dahinter ist, dass Hersteller mit jedem Update eine neue Hintertür ausliefern könnten. Wie kommen die USA nur auf diesen Gedanken? ;-) Das Risiko besteht, natürlich. Aber Updates sind normalerweise notwendig zur Behebung von Sicherheitslücken. Beim zweiten Nachdenken erschien der FCC das Risiko durch bekannte Sicherheitslücken, die mangels Updates offen bleiben, dann doch

    pc-fluesterer.info/wordpress/2

    #Hintergrund #cybercrime #hersteller #hintertr #router #UnplugTrump #usa #backdoor #spionage

    #backdoor #spionage #neuland #hintergrund #cybercrime #hersteller
  36. Christoph Schmees @[email protected] ·

    USA #Neuland

    Und ich dachte immer, Neuland wäre bei uns! Die Posse um das Verbot "ausländischer" Netzwerktechnik in den USA geht weiter. Zum Bann gegen ausländische Router etc. gehörte auch, dass Geräte im Bestand schon 2027 keine Updates mehr vom jeweiligen Hersteller bekommen dürften. Die Befürchtung dahinter ist, dass Hersteller mit jedem Update eine neue Hintertür ausliefern könnten. Wie kommen die USA nur auf diesen Gedanken? ;-) Das Risiko besteht, natürlich. Aber Updates sind normalerweise notwendig zur Behebung von Sicherheitslücken. Beim zweiten Nachdenken erschien der FCC das Risiko durch bekannte Sicherheitslücken, die mangels Updates offen bleiben, dann doch

    pc-fluesterer.info/wordpress/2

    #Hintergrund #cybercrime #hersteller #hintertr #router #UnplugTrump #usa #backdoor #spionage

    #spionage #backdoor #usa #unplugtrump #router #hintertr
  37. Christoph Schmees @[email protected] ·

    USA #Neuland

    Und ich dachte immer, Neuland wäre bei uns! Die Posse um das Verbot "ausländischer" Netzwerktechnik in den USA geht weiter. Zum Bann gegen ausländische Router etc. gehörte auch, dass Geräte im Bestand schon 2027 keine Updates mehr vom jeweiligen Hersteller bekommen dürften. Die Befürchtung dahinter ist, dass Hersteller mit jedem Update eine neue Hintertür ausliefern könnten. Wie kommen die USA nur auf diesen Gedanken? ;-) Das Risiko besteht, natürlich. Aber Updates sind normalerweise notwendig zur Behebung von Sicherheitslücken. Beim zweiten Nachdenken erschien der FCC das Risiko durch bekannte Sicherheitslücken, die mangels Updates offen bleiben, dann doch

    pc-fluesterer.info/wordpress/2

    #Hintergrund #cybercrime #hersteller #hintertr #router #UnplugTrump #usa #backdoor #spionage

    #neuland #hintergrund #cybercrime #hersteller #hintertr #router
  38. your auntifa liza 🇵🇷 🦛 🦦 @[email protected] ·

    RE: indieweb.social/@permafriday/1

    THIS IS A LABOR ISSUE

    now that Google doesn't have to pretend #android is not the #backdoor #surveillance system Snowden warned us about, it has a problem:

    app developers.

    the app store was always a honeypot for free #labor. without #apps there is no android. so Google has to rein in app devs, if they don't want their #spyware broken.

    but if you give up your encryption keys, the app isn't yours. this isn’t about #privacy.

    Google wants app devs to be employees without labor rights.

    #android #backdoor #surveillance #labor #apps #spyware
  39. OTX Bot @[email protected] ·

    Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign

    Pulse ID: 6a02da5139868596248b6e77
    Pulse Link: otx.alienvault.com/pulse/6a02d
    Pulse Author: Tr1sa111
    Created: 2026-05-12 07:44:17

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #BackDoor #CyberSecurity #InfoSec #OTX #OpenThreatExchange #Python #bot #Tr1sa111

    #backdoor #cybersecurity #infosec #otx #openthreatexchange #python
  40. OTX Bot @[email protected] ·

    Mysterious hacker organization operating secretly for 6 years is exploiting critical cPanel vulnerability to deploy backdoor trojans

    Pulse ID: 6a02ae06bc4da27b818aa732
    Pulse Link: otx.alienvault.com/pulse/6a02a
    Pulse Author: Tr1sa111
    Created: 2026-05-12 04:35:18

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #BackDoor #CyberSecurity #InfoSec #OTX #OpenThreatExchange #RAT #Trojan #Vulnerability #bot #Tr1sa111

    #backdoor #cybersecurity #infosec #otx #openthreatexchange #rat
  41. (in)sicurezza digitale @[email protected] ·

    DAEMON Tools compromesso: supply chain attack dal sito ufficiale con backdoor QUIC RAT e 100+ paesi colpiti

    Dal 8 aprile 2026 il sito ufficiale di DAEMON Tools distribuisce installer trojanizzati con firma digitale valida. Kaspersky svela l'operazione: migliaia di infezioni in 100+ paesi, backdoor QUIC RAT con 7 protocolli C2, targeting chirurgico su governi e industria. Attore probabilmente sinofono.

    insicurezzadigitale.com/daemon

    #backdoor #cina #infosec #malware #supplychain
  42. OTX Bot @[email protected] ·

    Malicious PyPI Package Embeds Multi-Layer Encrypted Backdoor to Steal Users’ Cryptocurrency Information — HelixGuard

    Pulse ID: 6a01c0fff6a09f21f8fe5e4f
    Pulse Link: otx.alienvault.com/pulse/6a01c
    Pulse Author: CyberHunter_NL
    Created: 2026-05-11 11:43:59

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #BackDoor #CyberSecurity #InfoSec #OTX #OpenThreatExchange #PyPI #bot #cryptocurrency #CyberHunter_NL

    #backdoor #cybersecurity #infosec #otx #openthreatexchange #pypi
  43. OTX Bot @[email protected] ·

    Mysterious hacker organization operating secretly for 6 years is exploiting critical cPanel vulnerability to deploy backdoor trojans

    A previously unknown threat group designated Mr_Rot13 has been exploiting CVE-2026-41940, a critical authentication bypass vulnerability in cPanel & WHM, to compromise Linux servers globally. Active since at least 2020, the group deploys a Go-based payload installer that plants SSH keys, PHP webshells, malicious JavaScript for credential harvesting, and a cross-platform remote access tool called Filemanager. Stolen data is exfiltrated to attacker-controlled Telegram channels and command servers. The group has maintained operational security for six years with extremely low detection rates. Attack infrastructure includes domains registered as early as 2020, with over 2,000 attacking IP addresses observed worldwide. The campaign primarily targets cPanel installations and WordPress systems, with confirmed compromise of Southeast Asian government and military entities resulting in 4.37GB of sensitive data theft.

    Pulse ID: 6a01847e13b4074a8d4b6381
    Pulse Link: otx.alienvault.com/pulse/6a018
    Pulse Author: AlienVault
    Created: 2026-05-11 07:25:50

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Asia #BackDoor #CredentialHarvesting #CyberSecurity #DataTheft #Government #InfoSec #Java #JavaScript #Linux #Military #OTX #OpenThreatExchange #PHP #RAT #RDP #SSH #Telegram #Trojan #Troll #Vulnerability #Word #Wordpress #bot #AlienVault

    #asia #backdoor #credentialharvesting #cybersecurity #datatheft #government
  44. OTX Bot @[email protected] ·

    Mysterious hacker organization operating secretly for 6 years is exploiting critical cPanel vulnerability to deploy backdoor trojans

    A previously unknown threat group designated Mr_Rot13 has been exploiting CVE-2026-41940, a critical authentication bypass vulnerability in cPanel & WHM, to compromise Linux servers globally. Active since at least 2020, the group deploys a Go-based payload installer that plants SSH keys, PHP webshells, malicious JavaScript for credential harvesting, and a cross-platform remote access tool called Filemanager. Stolen data is exfiltrated to attacker-controlled Telegram channels and command servers. The group has maintained operational security for six years with extremely low detection rates. Attack infrastructure includes domains registered as early as 2020, with over 2,000 attacking IP addresses observed worldwide. The campaign primarily targets cPanel installations and WordPress systems, with confirmed compromise of Southeast Asian government and military entities resulting in 4.37GB of sensitive data theft.

    Pulse ID: 6a01847e13b4074a8d4b6381
    Pulse Link: otx.alienvault.com/pulse/6a018
    Pulse Author: AlienVault
    Created: 2026-05-11 07:25:50

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Asia #BackDoor #CredentialHarvesting #CyberSecurity #DataTheft #Government #InfoSec #Java #JavaScript #Linux #Military #OTX #OpenThreatExchange #PHP #RAT #RDP #SSH #Telegram #Trojan #Troll #Vulnerability #Word #Wordpress #bot #AlienVault

    #asia #backdoor #credentialharvesting #cybersecurity #datatheft #government
  45. OTX Bot @[email protected] ·

    Mysterious hacker organization operating secretly for 6 years is exploiting critical cPanel vulnerability to deploy backdoor trojans

    A previously unknown threat group designated Mr_Rot13 has been exploiting CVE-2026-41940, a critical authentication bypass vulnerability in cPanel & WHM, to compromise Linux servers globally. Active since at least 2020, the group deploys a Go-based payload installer that plants SSH keys, PHP webshells, malicious JavaScript for credential harvesting, and a cross-platform remote access tool called Filemanager. Stolen data is exfiltrated to attacker-controlled Telegram channels and command servers. The group has maintained operational security for six years with extremely low detection rates. Attack infrastructure includes domains registered as early as 2020, with over 2,000 attacking IP addresses observed worldwide. The campaign primarily targets cPanel installations and WordPress systems, with confirmed compromise of Southeast Asian government and military entities resulting in 4.37GB of sensitive data theft.

    Pulse ID: 6a01847e13b4074a8d4b6381
    Pulse Link: otx.alienvault.com/pulse/6a018
    Pulse Author: AlienVault
    Created: 2026-05-11 07:25:50

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Asia #BackDoor #CredentialHarvesting #CyberSecurity #DataTheft #Government #InfoSec #Java #JavaScript #Linux #Military #OTX #OpenThreatExchange #PHP #RAT #RDP #SSH #Telegram #Trojan #Troll #Vulnerability #Word #Wordpress #bot #AlienVault

    #asia #backdoor #credentialharvesting #cybersecurity #datatheft #government
  46. OTX Bot @[email protected] ·

    Mysterious hacker organization operating secretly for 6 years is exploiting critical cPanel vulnerability to deploy backdoor trojans

    A previously unknown threat group designated Mr_Rot13 has been exploiting CVE-2026-41940, a critical authentication bypass vulnerability in cPanel & WHM, to compromise Linux servers globally. Active since at least 2020, the group deploys a Go-based payload installer that plants SSH keys, PHP webshells, malicious JavaScript for credential harvesting, and a cross-platform remote access tool called Filemanager. Stolen data is exfiltrated to attacker-controlled Telegram channels and command servers. The group has maintained operational security for six years with extremely low detection rates. Attack infrastructure includes domains registered as early as 2020, with over 2,000 attacking IP addresses observed worldwide. The campaign primarily targets cPanel installations and WordPress systems, with confirmed compromise of Southeast Asian government and military entities resulting in 4.37GB of sensitive data theft.

    Pulse ID: 6a01847e13b4074a8d4b6381
    Pulse Link: otx.alienvault.com/pulse/6a018
    Pulse Author: AlienVault
    Created: 2026-05-11 07:25:50

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Asia #BackDoor #CredentialHarvesting #CyberSecurity #DataTheft #Government #InfoSec #Java #JavaScript #Linux #Military #OTX #OpenThreatExchange #PHP #RAT #RDP #SSH #Telegram #Trojan #Troll #Vulnerability #Word #Wordpress #bot #AlienVault

    #alienvault #bot #wordpress #word #vulnerability #troll
  47. OTX Bot @[email protected] ·

    Mysterious hacker organization operating secretly for 6 years is exploiting critical cPanel vulnerability to deploy backdoor trojans

    A previously unknown threat group designated Mr_Rot13 has been exploiting CVE-2026-41940, a critical authentication bypass vulnerability in cPanel & WHM, to compromise Linux servers globally. Active since at least 2020, the group deploys a Go-based payload installer that plants SSH keys, PHP webshells, malicious JavaScript for credential harvesting, and a cross-platform remote access tool called Filemanager. Stolen data is exfiltrated to attacker-controlled Telegram channels and command servers. The group has maintained operational security for six years with extremely low detection rates. Attack infrastructure includes domains registered as early as 2020, with over 2,000 attacking IP addresses observed worldwide. The campaign primarily targets cPanel installations and WordPress systems, with confirmed compromise of Southeast Asian government and military entities resulting in 4.37GB of sensitive data theft.

    Pulse ID: 6a01847e13b4074a8d4b6381
    Pulse Link: otx.alienvault.com/pulse/6a018
    Pulse Author: AlienVault
    Created: 2026-05-11 07:25:50

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Asia #BackDoor #CredentialHarvesting #CyberSecurity #DataTheft #Government #InfoSec #Java #JavaScript #Linux #Military #OTX #OpenThreatExchange #PHP #RAT #RDP #SSH #Telegram #Trojan #Troll #Vulnerability #Word #Wordpress #bot #AlienVault

    #asia #backdoor #credentialharvesting #cybersecurity #datatheft #government
  48. OTX Bot @[email protected] ·

    Donuts and Beagles: Fake Claude site spreads backdoor

    Pulse ID: 6a01601a5577d48cf5f71e57
    Pulse Link: otx.alienvault.com/pulse/6a016
    Pulse Author: Tr1sa111
    Created: 2026-05-11 04:50:34

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #BackDoor #CyberSecurity #InfoSec #OTX #OpenThreatExchange #bot #Tr1sa111

    #backdoor #cybersecurity #infosec #otx #openthreatexchange #bot
  49. (in)sicurezza digitale @[email protected] ·

    Silver Fox lancia ABCDoor: spear phishing con loader Rust personalizzato contro India e Russia, nuova backdoor Python in campo

    Il gruppo APT cinese Silver Fox ha condotto campagne di spear phishing a tema fiscale contro organizzazioni in India e Russia, distribuendo il backdoor ValleyRAT affiancato da un nuovo payload Python inedito denominato ABCDoor. Kaspersky ha documentato il malware e le tecniche di evasione del loader RustSL, incluso il geofencing per paese e la persistenza tramite Phantom Persistence.

    insicurezzadigitale.com/silver

    #apt #backdoor #cina #infosec #malware #phishing
  50. jbz @[email protected] ·

    🔥 CISA: US agency breached through Cisco vulnerability, FIRESTARTER backdoor allowed access through March

    therecord.media/cisa-us-agency

    #cisco #firestarter #backdoor #CVE202520333 #CVE202520362

    #cisco #firestarter #backdoor #cve202520333 #cve202520362