home.social

#malspam — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #malspam, aggregated by home.social.

fetched live
  1. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in August to include subject, #malware type, c2, hash, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  2. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in August to include subject, #malware type, c2, hash, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  3. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in August to include subject, #malware type, c2, hash, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  4. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in August to include subject, #malware type, c2, hash, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #retrohunt #malware #malspam
  5. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in August to include subject, #malware type, c2, hash, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  6. abuse.ch :verified: @[email protected] ·

    Over the past days, active #malspam campaigns targeting LatAm users 🇦🇷🇧🇷🇲🇽 have been delivering the Grandoreiro banking trojan 🏦💰

    📧 Email ➔ 📜 JS file ➔ 📑 Fake PDF download

    Final payload is hosted on MediaFire 🔥 free file hosting

    C2 network traffic is rather trivial to detect as #Grandoreiro is using Embarcadero Delphi compilation tools' HTTP user agent 🖥️⤵️

    User-Agent: Embarcadero URI Client/1.0

    🔎 Botnet C2 domain resolved via Google DNS-over-HTTPS (DoH): devilmaycry.servehumour .com 👀

    📡 Grandoreiro botnet C2s hosted at AWS:
    54.80.154.193
    54.91.129.132
    54.91.223.28

    🌐 Payloads URLs:
    urlhaus.abuse.ch/browse/tag/Gr

    📄 Malware samples:
    bazaar.abuse.ch/browse/signatu

    🦊 Relevant IOCs are available on ThreatFox:
    threatfox.abuse.ch/browse/malw

    #malspam #grandoreiro
  7. abuse.ch :verified: @[email protected] ·

    Over the past days, active #malspam campaigns targeting LatAm users 🇦🇷🇧🇷🇲🇽 have been delivering the Grandoreiro banking trojan 🏦💰

    📧 Email ➔ 📜 JS file ➔ 📑 Fake PDF download

    Final payload is hosted on MediaFire 🔥 free file hosting

    C2 network traffic is rather trivial to detect as #Grandoreiro is using Embarcadero Delphi compilation tools' HTTP user agent 🖥️⤵️

    User-Agent: Embarcadero URI Client/1.0

    🔎 Botnet C2 domain resolved via Google DNS-over-HTTPS (DoH): devilmaycry.servehumour .com 👀

    📡 Grandoreiro botnet C2s hosted at AWS:
    54.80.154.193
    54.91.129.132
    54.91.223.28

    🌐 Payloads URLs:
    urlhaus.abuse.ch/browse/tag/Gr

    📄 Malware samples:
    bazaar.abuse.ch/browse/signatu

    🦊 Relevant IOCs are available on ThreatFox:
    threatfox.abuse.ch/browse/malw

    #malspam #grandoreiro
  8. abuse.ch :verified: @[email protected] ·

    Over the past days, active #malspam campaigns targeting LatAm users 🇦🇷🇧🇷🇲🇽 have been delivering the Grandoreiro banking trojan 🏦💰

    📧 Email ➔ 📜 JS file ➔ 📑 Fake PDF download

    Final payload is hosted on MediaFire 🔥 free file hosting

    C2 network traffic is rather trivial to detect as #Grandoreiro is using Embarcadero Delphi compilation tools' HTTP user agent 🖥️⤵️

    User-Agent: Embarcadero URI Client/1.0

    🔎 Botnet C2 domain resolved via Google DNS-over-HTTPS (DoH): devilmaycry.servehumour .com 👀

    📡 Grandoreiro botnet C2s hosted at AWS:
    54.80.154.193
    54.91.129.132
    54.91.223.28

    🌐 Payloads URLs:
    urlhaus.abuse.ch/browse/tag/Gr

    📄 Malware samples:
    bazaar.abuse.ch/browse/signatu

    🦊 Relevant IOCs are available on ThreatFox:
    threatfox.abuse.ch/browse/malw

    #malspam #grandoreiro
  9. abuse.ch :verified: @[email protected] ·

    Over the past days, active #malspam campaigns targeting LatAm users 🇦🇷🇧🇷🇲🇽 have been delivering the Grandoreiro banking trojan 🏦💰

    📧 Email ➔ 📜 JS file ➔ 📑 Fake PDF download

    Final payload is hosted on MediaFire 🔥 free file hosting

    C2 network traffic is rather trivial to detect as #Grandoreiro is using Embarcadero Delphi compilation tools' HTTP user agent 🖥️⤵️

    User-Agent: Embarcadero URI Client/1.0

    🔎 Botnet C2 domain resolved via Google DNS-over-HTTPS (DoH): devilmaycry.servehumour .com 👀

    📡 Grandoreiro botnet C2s hosted at AWS:
    54.80.154.193
    54.91.129.132
    54.91.223.28

    🌐 Payloads URLs:
    urlhaus.abuse.ch/browse/tag/Gr

    📄 Malware samples:
    bazaar.abuse.ch/browse/signatu

    🦊 Relevant IOCs are available on ThreatFox:
    threatfox.abuse.ch/browse/malw

    #grandoreiro #malspam
  10. abuse.ch :verified: @[email protected] ·

    Over the past days, active #malspam campaigns targeting LatAm users 🇦🇷🇧🇷🇲🇽 have been delivering the Grandoreiro banking trojan 🏦💰

    📧 Email ➔ 📜 JS file ➔ 📑 Fake PDF download

    Final payload is hosted on MediaFire 🔥 free file hosting

    C2 network traffic is rather trivial to detect as #Grandoreiro is using Embarcadero Delphi compilation tools' HTTP user agent 🖥️⤵️

    User-Agent: Embarcadero URI Client/1.0

    🔎 Botnet C2 domain resolved via Google DNS-over-HTTPS (DoH): devilmaycry.servehumour .com 👀

    📡 Grandoreiro botnet C2s hosted at AWS:
    54.80.154.193
    54.91.129.132
    54.91.223.28

    🌐 Payloads URLs:
    urlhaus.abuse.ch/browse/tag/Gr

    📄 Malware samples:
    bazaar.abuse.ch/browse/signatu

    🦊 Relevant IOCs are available on ThreatFox:
    threatfox.abuse.ch/browse/malw

    #malspam #grandoreiro
  11. James_inthe_box @[email protected] ·

    PSA: If you're seeing links that literally start with _wildcard_ in #malspam, these are dropping #screenconnect (usual relay c2) via #zoom update lure.

    1f7ab5418d489fdd2fb392ada3accc77c13586f94f059ee8e5cc83c0974b614b

    #malspam #screenconnect #zoom
  12. James_inthe_box @[email protected] ·

    PSA: If you're seeing links that literally start with _wildcard_ in #malspam, these are dropping #screenconnect (usual relay c2) via #zoom update lure.

    1f7ab5418d489fdd2fb392ada3accc77c13586f94f059ee8e5cc83c0974b614b

    #malspam #screenconnect #zoom
  13. James_inthe_box @[email protected] ·

    PSA: If you're seeing links that literally start with _wildcard_ in #malspam, these are dropping #screenconnect (usual relay c2) via #zoom update lure.

    1f7ab5418d489fdd2fb392ada3accc77c13586f94f059ee8e5cc83c0974b614b

    #malspam #screenconnect #zoom
  14. James_inthe_box @[email protected] ·

    PSA: If you're seeing links that literally start with _wildcard_ in #malspam, these are dropping #screenconnect (usual relay c2) via #zoom update lure.

    1f7ab5418d489fdd2fb392ada3accc77c13586f94f059ee8e5cc83c0974b614b

    #zoom #screenconnect #malspam
  15. James_inthe_box @[email protected] ·

    PSA: If you're seeing links that literally start with _wildcard_ in #malspam, these are dropping #screenconnect (usual relay c2) via #zoom update lure.

    1f7ab5418d489fdd2fb392ada3accc77c13586f94f059ee8e5cc83c0974b614b

    #malspam #screenconnect #zoom
  16. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in July to include #malware type, subjects, c2's, hashes, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  17. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in July to include #malware type, subjects, c2's, hashes, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  18. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in July to include #malware type, subjects, c2's, hashes, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  19. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in July to include #malware type, subjects, c2's, hashes, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #retrohunt #malware #malspam
  20. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in June to include #malware type, c2, hash, subject, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  21. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in June to include #malware type, c2, hash, subject, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  22. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in June to include #malware type, c2, hash, subject, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  23. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in June to include #malware type, c2, hash, subject, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #retrohunt #malware #malspam
  24. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in June to include #malware type, c2, hash, subject, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  25. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in May to include #malware, subjects, hashes, c2's, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  26. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in May to include #malware, subjects, hashes, c2's, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  27. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in May to include #malware, subjects, hashes, c2's, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  28. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in May to include #malware, subjects, hashes, c2's, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #retrohunt #malware #malspam
  29. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in May to include #malware, subjects, hashes, c2's, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  30. James_inthe_box @[email protected] ·

    An on time (yay) csv formatted list of #malspam campaigns that crossed my path in April to include #malware type, c2, hash, subject, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  31. James_inthe_box @[email protected] ·

    An on time (yay) csv formatted list of #malspam campaigns that crossed my path in April to include #malware type, c2, hash, subject, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  32. James_inthe_box @[email protected] ·

    An on time (yay) csv formatted list of #malspam campaigns that crossed my path in April to include #malware type, c2, hash, subject, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  33. James_inthe_box @[email protected] ·

    An on time (yay) csv formatted list of #malspam campaigns that crossed my path in April to include #malware type, c2, hash, subject, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #retrohunt #malware #malspam
  34. James_inthe_box @[email protected] ·

    An on time (yay) csv formatted list of #malspam campaigns that crossed my path in April to include #malware type, c2, hash, subject, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  35. James_inthe_box @[email protected] ·

    When your #malspam threat actor forgets to properly configure their #remcos ....ya "Juniorer" indeed 🤣

    app.any.run/tasks/1ff77354-94c

    #malspam #remcos
  36. James_inthe_box @[email protected] ·

    When your #malspam threat actor forgets to properly configure their #remcos ....ya "Juniorer" indeed 🤣

    app.any.run/tasks/1ff77354-94c

    #malspam #remcos
  37. James_inthe_box @[email protected] ·

    When your #malspam threat actor forgets to properly configure their #remcos ....ya "Juniorer" indeed 🤣

    app.any.run/tasks/1ff77354-94c

    #malspam #remcos
  38. James_inthe_box @[email protected] ·

    When your #malspam threat actor forgets to properly configure their #remcos ....ya "Juniorer" indeed 🤣

    app.any.run/tasks/1ff77354-94c

    #remcos #malspam
  39. James_inthe_box @[email protected] ·

    When your #malspam threat actor forgets to properly configure their #remcos ....ya "Juniorer" indeed 🤣

    app.any.run/tasks/1ff77354-94c

    #malspam #remcos
  40. Infoblox Threat Intel @[email protected] ·

    Trust this “Amazon” phishing email in Japan—and you’re Prime sashimi 🎣 🍣

    Looking into our malspam data, we identified an active campaign impersonating Amazon and targeting Japanese citizens. The emails use subjects such as 「至急 Amazonプライム会員情報の確認」 (“Urgent: Confirm Amazon Prime member information”).

    The URLs within the emails ultimately lead to an Amazon phishing page, but only after routing victims through a TDS. Interestingly, instead of keeping the TDS step invisible, the actors chose to show it off—repackaging it as a reassuring security check.

    Upon clicking the link within the email, victims are first redirected to an RDGA TDS domain, where fingerprinting occurs. If the user does not match the targeting criteria (e.g., connecting from outside Japan), access is blocked. If they do match, potential victims are redirected to a second RDGA domain.
    This second and last domain is not a TDS domain, but funny enough, these actors decided they would emulate it anyway!

    At that step victims are already at the landing page but instead of immediately displaying a standard Amazon phishing page, the website displays a CAPTCHA and fake console interface simulating environment fingerprinting checks to “make sure your environment and connection is safe” before "proceeding to the landing page". Ironically, part of their message is true: fingerprinting did happen one domain earlier. It just wasn’t for the user’s benefit—it was to make sure the environment was safe… for the scammers. A few seconds later, without added user interaction needed, a fake Amazon login page is displayed.

    Domains samples:
    qqc10c[.]cyou
    51wang11c[.]cyou

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #phishing #amazon #malspam #email #fingerprinting #japan

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec
  41. Infoblox Threat Intel @[email protected] ·

    Trust this “Amazon” phishing email in Japan—and you’re Prime sashimi 🎣 🍣

    Looking into our malspam data, we identified an active campaign impersonating Amazon and targeting Japanese citizens. The emails use subjects such as 「至急 Amazonプライム会員情報の確認」 (“Urgent: Confirm Amazon Prime member information”).

    The URLs within the emails ultimately lead to an Amazon phishing page, but only after routing victims through a TDS. Interestingly, instead of keeping the TDS step invisible, the actors chose to show it off—repackaging it as a reassuring security check.

    Upon clicking the link within the email, victims are first redirected to an RDGA TDS domain, where fingerprinting occurs. If the user does not match the targeting criteria (e.g., connecting from outside Japan), access is blocked. If they do match, potential victims are redirected to a second RDGA domain.
    This second and last domain is not a TDS domain, but funny enough, these actors decided they would emulate it anyway!

    At that step victims are already at the landing page but instead of immediately displaying a standard Amazon phishing page, the website displays a CAPTCHA and fake console interface simulating environment fingerprinting checks to “make sure your environment and connection is safe” before "proceeding to the landing page". Ironically, part of their message is true: fingerprinting did happen one domain earlier. It just wasn’t for the user’s benefit—it was to make sure the environment was safe… for the scammers. A few seconds later, without added user interaction needed, a fake Amazon login page is displayed.

    Domains samples:
    qqc10c[.]cyou
    51wang11c[.]cyou

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #phishing #amazon #malspam #email #fingerprinting #japan

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec
  42. Infoblox Threat Intel @[email protected] ·

    Trust this “Amazon” phishing email in Japan—and you’re Prime sashimi 🎣 🍣

    Looking into our malspam data, we identified an active campaign impersonating Amazon and targeting Japanese citizens. The emails use subjects such as 「至急 Amazonプライム会員情報の確認」 (“Urgent: Confirm Amazon Prime member information”).

    The URLs within the emails ultimately lead to an Amazon phishing page, but only after routing victims through a TDS. Interestingly, instead of keeping the TDS step invisible, the actors chose to show it off—repackaging it as a reassuring security check.

    Upon clicking the link within the email, victims are first redirected to an RDGA TDS domain, where fingerprinting occurs. If the user does not match the targeting criteria (e.g., connecting from outside Japan), access is blocked. If they do match, potential victims are redirected to a second RDGA domain.
    This second and last domain is not a TDS domain, but funny enough, these actors decided they would emulate it anyway!

    At that step victims are already at the landing page but instead of immediately displaying a standard Amazon phishing page, the website displays a CAPTCHA and fake console interface simulating environment fingerprinting checks to “make sure your environment and connection is safe” before "proceeding to the landing page". Ironically, part of their message is true: fingerprinting did happen one domain earlier. It just wasn’t for the user’s benefit—it was to make sure the environment was safe… for the scammers. A few seconds later, without added user interaction needed, a fake Amazon login page is displayed.

    Domains samples:
    qqc10c[.]cyou
    51wang11c[.]cyou

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #phishing #amazon #malspam #email #fingerprinting #japan

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec
  43. Infoblox Threat Intel @[email protected] ·

    Trust this “Amazon” phishing email in Japan—and you’re Prime sashimi 🎣 🍣

    Looking into our malspam data, we identified an active campaign impersonating Amazon and targeting Japanese citizens. The emails use subjects such as 「至急 Amazonプライム会員情報の確認」 (“Urgent: Confirm Amazon Prime member information”).

    The URLs within the emails ultimately lead to an Amazon phishing page, but only after routing victims through a TDS. Interestingly, instead of keeping the TDS step invisible, the actors chose to show it off—repackaging it as a reassuring security check.

    Upon clicking the link within the email, victims are first redirected to an RDGA TDS domain, where fingerprinting occurs. If the user does not match the targeting criteria (e.g., connecting from outside Japan), access is blocked. If they do match, potential victims are redirected to a second RDGA domain.
    This second and last domain is not a TDS domain, but funny enough, these actors decided they would emulate it anyway!

    At that step victims are already at the landing page but instead of immediately displaying a standard Amazon phishing page, the website displays a CAPTCHA and fake console interface simulating environment fingerprinting checks to “make sure your environment and connection is safe” before "proceeding to the landing page". Ironically, part of their message is true: fingerprinting did happen one domain earlier. It just wasn’t for the user’s benefit—it was to make sure the environment was safe… for the scammers. A few seconds later, without added user interaction needed, a fake Amazon login page is displayed.

    Domains samples:
    qqc10c[.]cyou
    51wang11c[.]cyou

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #phishing #amazon #malspam #email #fingerprinting #japan

    #japan #fingerprinting #email #malspam #amazon #phishing
  44. Infoblox Threat Intel @[email protected] ·

    Trust this “Amazon” phishing email in Japan—and you’re Prime sashimi 🎣 🍣

    Looking into our malspam data, we identified an active campaign impersonating Amazon and targeting Japanese citizens. The emails use subjects such as 「至急 Amazonプライム会員情報の確認」 (“Urgent: Confirm Amazon Prime member information”).

    The URLs within the emails ultimately lead to an Amazon phishing page, but only after routing victims through a TDS. Interestingly, instead of keeping the TDS step invisible, the actors chose to show it off—repackaging it as a reassuring security check.

    Upon clicking the link within the email, victims are first redirected to an RDGA TDS domain, where fingerprinting occurs. If the user does not match the targeting criteria (e.g., connecting from outside Japan), access is blocked. If they do match, potential victims are redirected to a second RDGA domain.
    This second and last domain is not a TDS domain, but funny enough, these actors decided they would emulate it anyway!

    At that step victims are already at the landing page but instead of immediately displaying a standard Amazon phishing page, the website displays a CAPTCHA and fake console interface simulating environment fingerprinting checks to “make sure your environment and connection is safe” before "proceeding to the landing page". Ironically, part of their message is true: fingerprinting did happen one domain earlier. It just wasn’t for the user’s benefit—it was to make sure the environment was safe… for the scammers. A few seconds later, without added user interaction needed, a fake Amazon login page is displayed.

    Domains samples:
    qqc10c[.]cyou
    51wang11c[.]cyou

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #phishing #amazon #malspam #email #fingerprinting #japan

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec
  45. James_inthe_box @[email protected] ·

    A very late (due to work travel) csv formatted list of #malspam campaigns that crossed my path in March to include #malware type, subject, hash, c2, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  46. James_inthe_box @[email protected] ·

    A very late (due to work travel) csv formatted list of #malspam campaigns that crossed my path in March to include #malware type, subject, hash, c2, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  47. James_inthe_box @[email protected] ·

    A very late (due to work travel) csv formatted list of #malspam campaigns that crossed my path in March to include #malware type, subject, hash, c2, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  48. James_inthe_box @[email protected] ·

    A very late (due to work travel) csv formatted list of #malspam campaigns that crossed my path in March to include #malware type, subject, hash, c2, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #retrohunt #malware #malspam
  49. James_inthe_box @[email protected] ·

    A very late (due to work travel) csv formatted list of #malspam campaigns that crossed my path in March to include #malware type, subject, hash, c2, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  50. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in February to include subjects, #malware type, hashes, c2's, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  51. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in February to include subjects, #malware type, hashes, c2's, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  52. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in February to include subjects, #malware type, hashes, c2's, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  53. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in February to include subjects, #malware type, hashes, c2's, and email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #retrohunt #malware #malspam
  54. TechNadu @[email protected] ·

    New 2026 telemetry from Bitdefender indicates 41% of Valentine’s-themed email traffic contained scam elements.

    Threat vectors observed:
    • Brand impersonation campaigns
    • AI-generated dating personas
    • Advance-fee survey funnels
    • Delivery notification phishing
    • Pharma spam distribution
    • Healthcare provider impersonation (e.g., Techniker Krankenkasse)
    Geographic targeting concentrated in the U.S. (55%) and key European markets.

    Question for defenders:
    Are current email filtering models sufficiently adaptive to seasonal emotional triggers amplified by generative AI?
    Engage below.

    Follow @technadu for threat intelligence reporting.

    #ThreatIntel #Phishing #EmailSecurity #AIThreats #SOC #BlueTeam #FraudDetection #BrandAbuse #SecurityResearch #CyberDefense #Malspam #DigitalRisk

    #threatintel #phishing #emailsecurity #aithreats #soc #blueteam
  55. TechNadu @[email protected] ·

    New 2026 telemetry from Bitdefender indicates 41% of Valentine’s-themed email traffic contained scam elements.

    Threat vectors observed:
    • Brand impersonation campaigns
    • AI-generated dating personas
    • Advance-fee survey funnels
    • Delivery notification phishing
    • Pharma spam distribution
    • Healthcare provider impersonation (e.g., Techniker Krankenkasse)
    Geographic targeting concentrated in the U.S. (55%) and key European markets.

    Question for defenders:
    Are current email filtering models sufficiently adaptive to seasonal emotional triggers amplified by generative AI?
    Engage below.

    Follow @technadu for threat intelligence reporting.

    #ThreatIntel #Phishing #EmailSecurity #AIThreats #SOC #BlueTeam #FraudDetection #BrandAbuse #SecurityResearch #CyberDefense #Malspam #DigitalRisk

    #threatintel #phishing #emailsecurity #aithreats #soc #blueteam
  56. TechNadu @[email protected] ·

    New 2026 telemetry from Bitdefender indicates 41% of Valentine’s-themed email traffic contained scam elements.

    Threat vectors observed:
    • Brand impersonation campaigns
    • AI-generated dating personas
    • Advance-fee survey funnels
    • Delivery notification phishing
    • Pharma spam distribution
    • Healthcare provider impersonation (e.g., Techniker Krankenkasse)
    Geographic targeting concentrated in the U.S. (55%) and key European markets.

    Question for defenders:
    Are current email filtering models sufficiently adaptive to seasonal emotional triggers amplified by generative AI?
    Engage below.

    Follow @technadu for threat intelligence reporting.

    #ThreatIntel #Phishing #EmailSecurity #AIThreats #SOC #BlueTeam #FraudDetection #BrandAbuse #SecurityResearch #CyberDefense #Malspam #DigitalRisk

    #digitalrisk #malspam #cyberdefense #securityresearch #brandabuse #frauddetection
  57. TechNadu @[email protected] ·

    New 2026 telemetry from Bitdefender indicates 41% of Valentine’s-themed email traffic contained scam elements.

    Threat vectors observed:
    • Brand impersonation campaigns
    • AI-generated dating personas
    • Advance-fee survey funnels
    • Delivery notification phishing
    • Pharma spam distribution
    • Healthcare provider impersonation (e.g., Techniker Krankenkasse)
    Geographic targeting concentrated in the U.S. (55%) and key European markets.

    Question for defenders:
    Are current email filtering models sufficiently adaptive to seasonal emotional triggers amplified by generative AI?
    Engage below.

    Follow @technadu for threat intelligence reporting.

    #ThreatIntel #Phishing #EmailSecurity #AIThreats #SOC #BlueTeam #FraudDetection #BrandAbuse #SecurityResearch #CyberDefense #Malspam #DigitalRisk

    #threatintel #phishing #emailsecurity #aithreats #soc #blueteam
  58. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in January to include #malware, c2, hash, subject, and some email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  59. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in January to include #malware, c2, hash, subject, and some email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt
  60. James_inthe_box @[email protected] ·

    A csv formatted list of #malspam campaigns that crossed my path in January to include #malware, c2, hash, subject, and some email exfil addresses:

    gist.github.com/silence-is-bes

    #retrohunt

    #malspam #malware #retrohunt