home.social

#proxy — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #proxy, aggregated by home.social.

  1. Complete Guide to Setting Up an #Apache Reverse #Proxy for an #Ecommerce Website

    This article provides a complete guide to setting up an Apache reverse proxy for an ecommerce website. We will provide a start-to-finish guide for installing all required software, configuring your reverse proxy and installing the SSL certificate ...
    Continued 👉 blog.radwebhosting.com/complet #proxyserver #rockylinux #shoppingcart #oraclelinux #letsencrypt #debian #loadbalancing #reverseproxy #almalinux #loadbalancer

  2. Complete Guide to Setting Up an #Apache Reverse #Proxy for an #Ecommerce Website

    This article provides a complete guide to setting up an Apache reverse proxy for an ecommerce website. We will provide a start-to-finish guide for installing all required software, configuring your reverse proxy and installing the SSL certificate ...
    Continued 👉 blog.radwebhosting.com/complet #proxyserver #rockylinux #shoppingcart #oraclelinux #letsencrypt #debian #loadbalancing #reverseproxy #almalinux #loadbalancer

  3. Complete Guide to Setting Up an #Apache Reverse #Proxy for an #Ecommerce Website

    This article provides a complete guide to setting up an Apache reverse proxy for an ecommerce website. We will provide a start-to-finish guide for installing all required software, configuring your reverse proxy and installing the SSL certificate ...
    Continued 👉 blog.radwebhosting.com/complet #proxyserver #rockylinux #shoppingcart #oraclelinux #letsencrypt #debian #loadbalancing #reverseproxy #almalinux #loadbalancer

  4. ClickFix Evolves with PySoxy Proxying

    A sophisticated ClickFix campaign was observed in April 2026 deploying PySoxy, a decade-old open-source Python SOCKS5 proxy tool, to establish encrypted proxy access on compromised hosts. The attack chain begins with social engineering that tricks users into executing obfuscated PowerShell commands, which then establishes scheduled task persistence and deploys an in-memory PowerShell-based command-and-control agent. Following domain reconnaissance activities, attackers deploy PySoxy to create a redundant encrypted access channel. The persistence mechanism continues attempting re-execution even after initial connections are blocked, demonstrating how single ClickFix executions can evolve into modular post-exploitation chains. This development represents a significant evolution from simple one-time execution to durable access with multiple redundant pathways, requiring comprehensive remediation beyond blocking initial callbacks.

    Pulse ID: 6a04a9a171b2ad5ef57d9993
    Pulse Link: otx.alienvault.com/pulse/6a04a
    Pulse Author: AlienVault
    Created: 2026-05-13 16:41:05

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #InfoSec #OTX #OpenThreatExchange #PowerShell #Proxy #Python #RAT #RCE #SocialEngineering #bot #socks5 #AlienVault

  5. ClickFix Evolves with PySoxy Proxying

    A sophisticated ClickFix campaign was observed in April 2026 deploying PySoxy, a decade-old open-source Python SOCKS5 proxy tool, to establish encrypted proxy access on compromised hosts. The attack chain begins with social engineering that tricks users into executing obfuscated PowerShell commands, which then establishes scheduled task persistence and deploys an in-memory PowerShell-based command-and-control agent. Following domain reconnaissance activities, attackers deploy PySoxy to create a redundant encrypted access channel. The persistence mechanism continues attempting re-execution even after initial connections are blocked, demonstrating how single ClickFix executions can evolve into modular post-exploitation chains. This development represents a significant evolution from simple one-time execution to durable access with multiple redundant pathways, requiring comprehensive remediation beyond blocking initial callbacks.

    Pulse ID: 6a04a9a171b2ad5ef57d9993
    Pulse Link: otx.alienvault.com/pulse/6a04a
    Pulse Author: AlienVault
    Created: 2026-05-13 16:41:05

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #InfoSec #OTX #OpenThreatExchange #PowerShell #Proxy #Python #RAT #RCE #SocialEngineering #bot #socks5 #AlienVault

  6. ClickFix Evolves with PySoxy Proxying

    A sophisticated ClickFix campaign was observed in April 2026 deploying PySoxy, a decade-old open-source Python SOCKS5 proxy tool, to establish encrypted proxy access on compromised hosts. The attack chain begins with social engineering that tricks users into executing obfuscated PowerShell commands, which then establishes scheduled task persistence and deploys an in-memory PowerShell-based command-and-control agent. Following domain reconnaissance activities, attackers deploy PySoxy to create a redundant encrypted access channel. The persistence mechanism continues attempting re-execution even after initial connections are blocked, demonstrating how single ClickFix executions can evolve into modular post-exploitation chains. This development represents a significant evolution from simple one-time execution to durable access with multiple redundant pathways, requiring comprehensive remediation beyond blocking initial callbacks.

    Pulse ID: 6a04a9a171b2ad5ef57d9993
    Pulse Link: otx.alienvault.com/pulse/6a04a
    Pulse Author: AlienVault
    Created: 2026-05-13 16:41:05

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #InfoSec #OTX #OpenThreatExchange #PowerShell #Proxy #Python #RAT #RCE #SocialEngineering #bot #socks5 #AlienVault

  7. ClickFix Evolves with PySoxy Proxying

    A sophisticated ClickFix campaign was observed in April 2026 deploying PySoxy, a decade-old open-source Python SOCKS5 proxy tool, to establish encrypted proxy access on compromised hosts. The attack chain begins with social engineering that tricks users into executing obfuscated PowerShell commands, which then establishes scheduled task persistence and deploys an in-memory PowerShell-based command-and-control agent. Following domain reconnaissance activities, attackers deploy PySoxy to create a redundant encrypted access channel. The persistence mechanism continues attempting re-execution even after initial connections are blocked, demonstrating how single ClickFix executions can evolve into modular post-exploitation chains. This development represents a significant evolution from simple one-time execution to durable access with multiple redundant pathways, requiring comprehensive remediation beyond blocking initial callbacks.

    Pulse ID: 6a04a9a171b2ad5ef57d9993
    Pulse Link: otx.alienvault.com/pulse/6a04a
    Pulse Author: AlienVault
    Created: 2026-05-13 16:41:05

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #InfoSec #OTX #OpenThreatExchange #PowerShell #Proxy #Python #RAT #RCE #SocialEngineering #bot #socks5 #AlienVault

  8. ClickFix Evolves with PySoxy Proxying

    A sophisticated ClickFix campaign was observed in April 2026 deploying PySoxy, a decade-old open-source Python SOCKS5 proxy tool, to establish encrypted proxy access on compromised hosts. The attack chain begins with social engineering that tricks users into executing obfuscated PowerShell commands, which then establishes scheduled task persistence and deploys an in-memory PowerShell-based command-and-control agent. Following domain reconnaissance activities, attackers deploy PySoxy to create a redundant encrypted access channel. The persistence mechanism continues attempting re-execution even after initial connections are blocked, demonstrating how single ClickFix executions can evolve into modular post-exploitation chains. This development represents a significant evolution from simple one-time execution to durable access with multiple redundant pathways, requiring comprehensive remediation beyond blocking initial callbacks.

    Pulse ID: 6a04a9a171b2ad5ef57d9993
    Pulse Link: otx.alienvault.com/pulse/6a04a
    Pulse Author: AlienVault
    Created: 2026-05-13 16:41:05

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #InfoSec #OTX #OpenThreatExchange #PowerShell #Proxy #Python #RAT #RCE #SocialEngineering #bot #socks5 #AlienVault

  9. ClickFix Evolves with PySoxy Proxying | ReliaQuest Threat Research

    Pulse ID: 6a048cbf63327b322259d6ec
    Pulse Link: otx.alienvault.com/pulse/6a048
    Pulse Author: CyberHunter_NL
    Created: 2026-05-13 14:37:51

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #InfoSec #OTX #OpenThreatExchange #Proxy #bot #CyberHunter_NL

  10. ClickFix Evolves with PySoxy Proxying | ReliaQuest Threat Research

    Pulse ID: 6a048cbf63327b322259d6ec
    Pulse Link: otx.alienvault.com/pulse/6a048
    Pulse Author: CyberHunter_NL
    Created: 2026-05-13 14:37:51

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #InfoSec #OTX #OpenThreatExchange #Proxy #bot #CyberHunter_NL

  11. ClickFix Evolves with PySoxy Proxying | ReliaQuest Threat Research

    Pulse ID: 6a048cbf63327b322259d6ec
    Pulse Link: otx.alienvault.com/pulse/6a048
    Pulse Author: CyberHunter_NL
    Created: 2026-05-13 14:37:51

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #InfoSec #OTX #OpenThreatExchange #Proxy #bot #CyberHunter_NL

  12. ClickFix Evolves with PySoxy Proxying | ReliaQuest Threat Research

    Pulse ID: 6a048cbf63327b322259d6ec
    Pulse Link: otx.alienvault.com/pulse/6a048
    Pulse Author: CyberHunter_NL
    Created: 2026-05-13 14:37:51

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #InfoSec #OTX #OpenThreatExchange #Proxy #bot #CyberHunter_NL

  13. ClickFix Evolves with PySoxy Proxying | ReliaQuest Threat Research

    Pulse ID: 6a048cbf63327b322259d6ec
    Pulse Link: otx.alienvault.com/pulse/6a048
    Pulse Author: CyberHunter_NL
    Created: 2026-05-13 14:37:51

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #InfoSec #OTX #OpenThreatExchange #Proxy #bot #CyberHunter_NL

  14. Install and Configure #SOCKS #Proxy Server on Rocky Linux VPS

    This article provides a guide for how to install and configure SOCKS proxy server on Rocky Linux VPS.

    In this tutorial, we'll go through the process of installing and configuring a SOCKS proxy server on a Rocky Linux VPS. We will also discuss enabling SSH tunnelling from a PC using the SOCKS proxy server. This will allow you to route your ...
    Continued 👉 blog.radwebhosting.com/install #installguide #vpsguide #rockylinux #proxyserver

  15. Install and Configure #SOCKS #Proxy Server on Rocky Linux VPS

    This article provides a guide for how to install and configure SOCKS proxy server on Rocky Linux VPS.

    In this tutorial, we'll go through the process of installing and configuring a SOCKS proxy server on a Rocky Linux VPS. We will also discuss enabling SSH tunnelling from a PC using the SOCKS proxy server. This will allow you to route your ...
    Continued 👉 blog.radwebhosting.com/install #installguide #vpsguide #rockylinux #proxyserver

  16. Install and Configure #SOCKS #Proxy Server on Rocky Linux VPS

    This article provides a guide for how to install and configure SOCKS proxy server on Rocky Linux VPS.

    In this tutorial, we'll go through the process of installing and configuring a SOCKS proxy server on a Rocky Linux VPS. We will also discuss enabling SSH tunnelling from a PC using the SOCKS proxy server. This will allow you to route your ...
    Continued 👉 blog.radwebhosting.com/install #installguide #vpsguide #rockylinux #proxyserver

  17. Install and Configure #SOCKS #Proxy Server on Rocky Linux VPS

    This article provides a guide for how to install and configure SOCKS proxy server on Rocky Linux VPS.

    In this tutorial, we'll go through the process of installing and configuring a SOCKS proxy server on a Rocky Linux VPS. We will also discuss enabling SSH tunnelling from a PC using the SOCKS proxy server. This will allow you to route your ...
    Continued 👉 blog.radwebhosting.com/install #installguide #vpsguide #rockylinux #proxyserver

  18. Vibe Hacking: Two AI-Augmented Campaigns Target Government and Financial Sectors in Latin America

    Two distinct threat campaigns, SHADOW-AETHER-040 and SHADOW-AETHER-064, have been identified targeting government entities and financial organizations across Latin America using agentic artificial intelligence to conduct cyber intrusions. SHADOW-AETHER-040, a Spanish-speaking group, compromised six government entities in Mexico between December 2025 and January 2026, while SHADOW-AETHER-064, operating in Portuguese, targeted Brazilian financial institutions starting in April 2026. Both campaigns established SOCKS5 tunnels via ProxyChains and SSH, enabling AI agents to execute commands directly within victim networks. The AI agents dynamically generated hacking tools and scripts on-demand, reducing detection by signature-based security solutions. Despite tactical similarities including shared toolsets like Chisel, Neo-reGeorg, CrackMapExec, and Impacket, the campaigns appear to be separate entities distinguished primarily by language. These operations represent emerging cases of AI agents executing complete...

    Pulse ID: 6a02ea171e7005022d5c8a6f
    Pulse Link: otx.alienvault.com/pulse/6a02e
    Pulse Author: AlienVault
    Created: 2026-05-12 08:51:35

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Brazil #CyberSecurity #Government #InfoSec #LatinAmerica #Mexico #OTX #OpenThreatExchange #Proxy #RAT #SSH #bot #socks5 #AlienVault

  19. Vibe Hacking: Two AI-Augmented Campaigns Target Government and Financial Sectors in Latin America

    Two distinct threat campaigns, SHADOW-AETHER-040 and SHADOW-AETHER-064, have been identified targeting government entities and financial organizations across Latin America using agentic artificial intelligence to conduct cyber intrusions. SHADOW-AETHER-040, a Spanish-speaking group, compromised six government entities in Mexico between December 2025 and January 2026, while SHADOW-AETHER-064, operating in Portuguese, targeted Brazilian financial institutions starting in April 2026. Both campaigns established SOCKS5 tunnels via ProxyChains and SSH, enabling AI agents to execute commands directly within victim networks. The AI agents dynamically generated hacking tools and scripts on-demand, reducing detection by signature-based security solutions. Despite tactical similarities including shared toolsets like Chisel, Neo-reGeorg, CrackMapExec, and Impacket, the campaigns appear to be separate entities distinguished primarily by language. These operations represent emerging cases of AI agents executing complete...

    Pulse ID: 6a02ea171e7005022d5c8a6f
    Pulse Link: otx.alienvault.com/pulse/6a02e
    Pulse Author: AlienVault
    Created: 2026-05-12 08:51:35

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Brazil #CyberSecurity #Government #InfoSec #LatinAmerica #Mexico #OTX #OpenThreatExchange #Proxy #RAT #SSH #bot #socks5 #AlienVault

  20. Vibe Hacking: Two AI-Augmented Campaigns Target Government and Financial Sectors in Latin America

    Two distinct threat campaigns, SHADOW-AETHER-040 and SHADOW-AETHER-064, have been identified targeting government entities and financial organizations across Latin America using agentic artificial intelligence to conduct cyber intrusions. SHADOW-AETHER-040, a Spanish-speaking group, compromised six government entities in Mexico between December 2025 and January 2026, while SHADOW-AETHER-064, operating in Portuguese, targeted Brazilian financial institutions starting in April 2026. Both campaigns established SOCKS5 tunnels via ProxyChains and SSH, enabling AI agents to execute commands directly within victim networks. The AI agents dynamically generated hacking tools and scripts on-demand, reducing detection by signature-based security solutions. Despite tactical similarities including shared toolsets like Chisel, Neo-reGeorg, CrackMapExec, and Impacket, the campaigns appear to be separate entities distinguished primarily by language. These operations represent emerging cases of AI agents executing complete...

    Pulse ID: 6a02ea171e7005022d5c8a6f
    Pulse Link: otx.alienvault.com/pulse/6a02e
    Pulse Author: AlienVault
    Created: 2026-05-12 08:51:35

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Brazil #CyberSecurity #Government #InfoSec #LatinAmerica #Mexico #OTX #OpenThreatExchange #Proxy #RAT #SSH #bot #socks5 #AlienVault

  21. Vibe Hacking: Two AI-Augmented Campaigns Target Government and Financial Sectors in Latin America

    Two distinct threat campaigns, SHADOW-AETHER-040 and SHADOW-AETHER-064, have been identified targeting government entities and financial organizations across Latin America using agentic artificial intelligence to conduct cyber intrusions. SHADOW-AETHER-040, a Spanish-speaking group, compromised six government entities in Mexico between December 2025 and January 2026, while SHADOW-AETHER-064, operating in Portuguese, targeted Brazilian financial institutions starting in April 2026. Both campaigns established SOCKS5 tunnels via ProxyChains and SSH, enabling AI agents to execute commands directly within victim networks. The AI agents dynamically generated hacking tools and scripts on-demand, reducing detection by signature-based security solutions. Despite tactical similarities including shared toolsets like Chisel, Neo-reGeorg, CrackMapExec, and Impacket, the campaigns appear to be separate entities distinguished primarily by language. These operations represent emerging cases of AI agents executing complete...

    Pulse ID: 6a02ea171e7005022d5c8a6f
    Pulse Link: otx.alienvault.com/pulse/6a02e
    Pulse Author: AlienVault
    Created: 2026-05-12 08:51:35

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Brazil #CyberSecurity #Government #InfoSec #LatinAmerica #Mexico #OTX #OpenThreatExchange #Proxy #RAT #SSH #bot #socks5 #AlienVault

  22. Vibe Hacking: Two AI-Augmented Campaigns Target Government and Financial Sectors in Latin America

    Two distinct threat campaigns, SHADOW-AETHER-040 and SHADOW-AETHER-064, have been identified targeting government entities and financial organizations across Latin America using agentic artificial intelligence to conduct cyber intrusions. SHADOW-AETHER-040, a Spanish-speaking group, compromised six government entities in Mexico between December 2025 and January 2026, while SHADOW-AETHER-064, operating in Portuguese, targeted Brazilian financial institutions starting in April 2026. Both campaigns established SOCKS5 tunnels via ProxyChains and SSH, enabling AI agents to execute commands directly within victim networks. The AI agents dynamically generated hacking tools and scripts on-demand, reducing detection by signature-based security solutions. Despite tactical similarities including shared toolsets like Chisel, Neo-reGeorg, CrackMapExec, and Impacket, the campaigns appear to be separate entities distinguished primarily by language. These operations represent emerging cases of AI agents executing complete...

    Pulse ID: 6a02ea171e7005022d5c8a6f
    Pulse Link: otx.alienvault.com/pulse/6a02e
    Pulse Author: AlienVault
    Created: 2026-05-12 08:51:35

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Brazil #CyberSecurity #Government #InfoSec #LatinAmerica #Mexico #OTX #OpenThreatExchange #Proxy #RAT #SSH #bot #socks5 #AlienVault

  23. Complete Guide to Setting Up an #Apache Reverse #Proxy for an #Ecommerce Website

    This article provides a complete guide to setting up an Apache reverse proxy for an ecommerce website. We will provide a start-to-finish guide for installing all required software, configuring your reverse proxy and installing the SSL certificate ...
    Continued 👉 blog.radwebhosting.com/complet #debian #letsencrypt #almalinux #reverseproxy #loadbalancer #proxyserver #shoppingcart #rockylinux #oraclelinux #loadbalancing

  24. Complete Guide to Setting Up an #Apache Reverse #Proxy for an #Ecommerce Website

    This article provides a complete guide to setting up an Apache reverse proxy for an ecommerce website. We will provide a start-to-finish guide for installing all required software, configuring your reverse proxy and installing the SSL certificate ...
    Continued 👉 blog.radwebhosting.com/complet #debian #letsencrypt #almalinux #reverseproxy #loadbalancer #proxyserver #shoppingcart #rockylinux #oraclelinux #loadbalancing

  25. Complete Guide to Setting Up an #Apache Reverse #Proxy for an #Ecommerce Website

    This article provides a complete guide to setting up an Apache reverse proxy for an ecommerce website. We will provide a start-to-finish guide for installing all required software, configuring your reverse proxy and installing the SSL certificate ...
    Continued 👉 blog.radwebhosting.com/complet #debian #letsencrypt #almalinux #reverseproxy #loadbalancer #proxyserver #shoppingcart #rockylinux #oraclelinux #loadbalancing

  26. Complete Guide to Setting Up an #Apache Reverse #Proxy for an #Ecommerce Website

    This article provides a complete guide to setting up an Apache reverse proxy for an ecommerce website. We will provide a start-to-finish guide for installing all required software, configuring your reverse proxy and installing the SSL certificate ...
    Continued 👉 blog.radwebhosting.com/complet #debian #letsencrypt #almalinux #reverseproxy #loadbalancer #proxyserver #shoppingcart #rockylinux #oraclelinux #loadbalancing

  27. New TrickMo Variant: Device Take Over malware targeting Banking, Fintech, Wallet & Auth apps

    A new variant of the TrickMo Android banking trojan was identified between January and February 2026, representing a substantial platform redesign rather than new capabilities. The malware has migrated its command-and-control infrastructure entirely onto The Open Network (TON) using .adnl endpoints, moving away from conventional internet infrastructure. Active campaigns have targeted banking and wallet users in France, Italy, and Austria. Once accessibility permissions are granted, operators gain real-time device control including credential phishing, keylogging, screen recording, SMS interception, and bidirectional remote control. New features include network reconnaissance capabilities and SSH tunnelling that transform infected devices into programmable network pivots and SOCKS5 proxy exit nodes, enabling operators to bypass IP-based fraud detection systems while accessing victim networks.

    Pulse ID: 6a019c5f0a3344d92c4302a3
    Pulse Link: otx.alienvault.com/pulse/6a019
    Pulse Author: AlienVault
    Created: 2026-05-11 09:07:43

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Android #Bank #BankingTrojan #CyberSecurity #Endpoint #France #InfoSec #Italy #Malware #OTX #OpenThreatExchange #Phishing #Proxy #RAT #RCE #SMS #SSH #Trojan #bot #socks5 #AlienVault

  28. New TrickMo Variant: Device Take Over malware targeting Banking, Fintech, Wallet & Auth apps

    A new variant of the TrickMo Android banking trojan was identified between January and February 2026, representing a substantial platform redesign rather than new capabilities. The malware has migrated its command-and-control infrastructure entirely onto The Open Network (TON) using .adnl endpoints, moving away from conventional internet infrastructure. Active campaigns have targeted banking and wallet users in France, Italy, and Austria. Once accessibility permissions are granted, operators gain real-time device control including credential phishing, keylogging, screen recording, SMS interception, and bidirectional remote control. New features include network reconnaissance capabilities and SSH tunnelling that transform infected devices into programmable network pivots and SOCKS5 proxy exit nodes, enabling operators to bypass IP-based fraud detection systems while accessing victim networks.

    Pulse ID: 6a019c5f0a3344d92c4302a3
    Pulse Link: otx.alienvault.com/pulse/6a019
    Pulse Author: AlienVault
    Created: 2026-05-11 09:07:43

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Android #Bank #BankingTrojan #CyberSecurity #Endpoint #France #InfoSec #Italy #Malware #OTX #OpenThreatExchange #Phishing #Proxy #RAT #RCE #SMS #SSH #Trojan #bot #socks5 #AlienVault

  29. New TrickMo Variant: Device Take Over malware targeting Banking, Fintech, Wallet & Auth apps

    A new variant of the TrickMo Android banking trojan was identified between January and February 2026, representing a substantial platform redesign rather than new capabilities. The malware has migrated its command-and-control infrastructure entirely onto The Open Network (TON) using .adnl endpoints, moving away from conventional internet infrastructure. Active campaigns have targeted banking and wallet users in France, Italy, and Austria. Once accessibility permissions are granted, operators gain real-time device control including credential phishing, keylogging, screen recording, SMS interception, and bidirectional remote control. New features include network reconnaissance capabilities and SSH tunnelling that transform infected devices into programmable network pivots and SOCKS5 proxy exit nodes, enabling operators to bypass IP-based fraud detection systems while accessing victim networks.

    Pulse ID: 6a019c5f0a3344d92c4302a3
    Pulse Link: otx.alienvault.com/pulse/6a019
    Pulse Author: AlienVault
    Created: 2026-05-11 09:07:43

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Android #Bank #BankingTrojan #CyberSecurity #Endpoint #France #InfoSec #Italy #Malware #OTX #OpenThreatExchange #Phishing #Proxy #RAT #RCE #SMS #SSH #Trojan #bot #socks5 #AlienVault

  30. New TrickMo Variant: Device Take Over malware targeting Banking, Fintech, Wallet & Auth apps

    A new variant of the TrickMo Android banking trojan was identified between January and February 2026, representing a substantial platform redesign rather than new capabilities. The malware has migrated its command-and-control infrastructure entirely onto The Open Network (TON) using .adnl endpoints, moving away from conventional internet infrastructure. Active campaigns have targeted banking and wallet users in France, Italy, and Austria. Once accessibility permissions are granted, operators gain real-time device control including credential phishing, keylogging, screen recording, SMS interception, and bidirectional remote control. New features include network reconnaissance capabilities and SSH tunnelling that transform infected devices into programmable network pivots and SOCKS5 proxy exit nodes, enabling operators to bypass IP-based fraud detection systems while accessing victim networks.

    Pulse ID: 6a019c5f0a3344d92c4302a3
    Pulse Link: otx.alienvault.com/pulse/6a019
    Pulse Author: AlienVault
    Created: 2026-05-11 09:07:43

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Android #Bank #BankingTrojan #CyberSecurity #Endpoint #France #InfoSec #Italy #Malware #OTX #OpenThreatExchange #Phishing #Proxy #RAT #RCE #SMS #SSH #Trojan #bot #socks5 #AlienVault

  31. New TrickMo Variant: Device Take Over malware targeting Banking, Fintech, Wallet & Auth apps

    A new variant of the TrickMo Android banking trojan was identified between January and February 2026, representing a substantial platform redesign rather than new capabilities. The malware has migrated its command-and-control infrastructure entirely onto The Open Network (TON) using .adnl endpoints, moving away from conventional internet infrastructure. Active campaigns have targeted banking and wallet users in France, Italy, and Austria. Once accessibility permissions are granted, operators gain real-time device control including credential phishing, keylogging, screen recording, SMS interception, and bidirectional remote control. New features include network reconnaissance capabilities and SSH tunnelling that transform infected devices into programmable network pivots and SOCKS5 proxy exit nodes, enabling operators to bypass IP-based fraud detection systems while accessing victim networks.

    Pulse ID: 6a019c5f0a3344d92c4302a3
    Pulse Link: otx.alienvault.com/pulse/6a019
    Pulse Author: AlienVault
    Created: 2026-05-11 09:07:43

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #Android #Bank #BankingTrojan #CyberSecurity #Endpoint #France #InfoSec #Italy #Malware #OTX #OpenThreatExchange #Phishing #Proxy #RAT #RCE #SMS #SSH #Trojan #bot #socks5 #AlienVault

  32. AI-Assisted Lure Factory Targets Developers & Gamers

    A large-scale malware campaign tracked as TroyDen's Lure Factory has been identified distributing LuaJIT-based infostealers through over 300 delivery packages hosted on GitHub. The operation uses AI-generated lure names incorporating obscure biological taxonomy and medical terminology to target developers, gamers, Roblox players, and crypto users. The malware employs a two-component design with a renamed LuaJIT runtime and encrypted Lua payload that evades sandbox detection through anti-analysis checks and extreme sleep delays. Upon execution, it disables proxy detection, captures desktop screenshots, performs geolocation, and exfiltrates data to C2 servers in Frankfurt. The infrastructure demonstrates scalability with multiple IP addresses serving identical encrypted commands, while maintaining simultaneous campaigns across gaming cheats, developer tools, phone trackers, and VPN crackers.

    Pulse ID: 69fdc9a2b94badfe5abacbcb
    Pulse Link: otx.alienvault.com/pulse/69fdc
    Pulse Author: AlienVault
    Created: 2026-05-08 11:31:46

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #GitHub #InfoSec #InfoStealer #LUA #Malware #OTX #OpenThreatExchange #Proxy #RAT #VPN #bot #developers #AlienVault

  33. AI-Assisted Lure Factory Targets Developers & Gamers

    A large-scale malware campaign tracked as TroyDen's Lure Factory has been identified distributing LuaJIT-based infostealers through over 300 delivery packages hosted on GitHub. The operation uses AI-generated lure names incorporating obscure biological taxonomy and medical terminology to target developers, gamers, Roblox players, and crypto users. The malware employs a two-component design with a renamed LuaJIT runtime and encrypted Lua payload that evades sandbox detection through anti-analysis checks and extreme sleep delays. Upon execution, it disables proxy detection, captures desktop screenshots, performs geolocation, and exfiltrates data to C2 servers in Frankfurt. The infrastructure demonstrates scalability with multiple IP addresses serving identical encrypted commands, while maintaining simultaneous campaigns across gaming cheats, developer tools, phone trackers, and VPN crackers.

    Pulse ID: 69fdc9a2b94badfe5abacbcb
    Pulse Link: otx.alienvault.com/pulse/69fdc
    Pulse Author: AlienVault
    Created: 2026-05-08 11:31:46

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #GitHub #InfoSec #InfoStealer #LUA #Malware #OTX #OpenThreatExchange #Proxy #RAT #VPN #bot #developers #AlienVault

  34. AI-Assisted Lure Factory Targets Developers & Gamers

    A large-scale malware campaign tracked as TroyDen's Lure Factory has been identified distributing LuaJIT-based infostealers through over 300 delivery packages hosted on GitHub. The operation uses AI-generated lure names incorporating obscure biological taxonomy and medical terminology to target developers, gamers, Roblox players, and crypto users. The malware employs a two-component design with a renamed LuaJIT runtime and encrypted Lua payload that evades sandbox detection through anti-analysis checks and extreme sleep delays. Upon execution, it disables proxy detection, captures desktop screenshots, performs geolocation, and exfiltrates data to C2 servers in Frankfurt. The infrastructure demonstrates scalability with multiple IP addresses serving identical encrypted commands, while maintaining simultaneous campaigns across gaming cheats, developer tools, phone trackers, and VPN crackers.

    Pulse ID: 69fdc9a2b94badfe5abacbcb
    Pulse Link: otx.alienvault.com/pulse/69fdc
    Pulse Author: AlienVault
    Created: 2026-05-08 11:31:46

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #GitHub #InfoSec #InfoStealer #LUA #Malware #OTX #OpenThreatExchange #Proxy #RAT #VPN #bot #developers #AlienVault

  35. AI-Assisted Lure Factory Targets Developers & Gamers

    A large-scale malware campaign tracked as TroyDen's Lure Factory has been identified distributing LuaJIT-based infostealers through over 300 delivery packages hosted on GitHub. The operation uses AI-generated lure names incorporating obscure biological taxonomy and medical terminology to target developers, gamers, Roblox players, and crypto users. The malware employs a two-component design with a renamed LuaJIT runtime and encrypted Lua payload that evades sandbox detection through anti-analysis checks and extreme sleep delays. Upon execution, it disables proxy detection, captures desktop screenshots, performs geolocation, and exfiltrates data to C2 servers in Frankfurt. The infrastructure demonstrates scalability with multiple IP addresses serving identical encrypted commands, while maintaining simultaneous campaigns across gaming cheats, developer tools, phone trackers, and VPN crackers.

    Pulse ID: 69fdc9a2b94badfe5abacbcb
    Pulse Link: otx.alienvault.com/pulse/69fdc
    Pulse Author: AlienVault
    Created: 2026-05-08 11:31:46

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #GitHub #InfoSec #InfoStealer #LUA #Malware #OTX #OpenThreatExchange #Proxy #RAT #VPN #bot #developers #AlienVault

  36. AI-Assisted Lure Factory Targets Developers & Gamers

    A large-scale malware campaign tracked as TroyDen's Lure Factory has been identified distributing LuaJIT-based infostealers through over 300 delivery packages hosted on GitHub. The operation uses AI-generated lure names incorporating obscure biological taxonomy and medical terminology to target developers, gamers, Roblox players, and crypto users. The malware employs a two-component design with a renamed LuaJIT runtime and encrypted Lua payload that evades sandbox detection through anti-analysis checks and extreme sleep delays. Upon execution, it disables proxy detection, captures desktop screenshots, performs geolocation, and exfiltrates data to C2 servers in Frankfurt. The infrastructure demonstrates scalability with multiple IP addresses serving identical encrypted commands, while maintaining simultaneous campaigns across gaming cheats, developer tools, phone trackers, and VPN crackers.

    Pulse ID: 69fdc9a2b94badfe5abacbcb
    Pulse Link: otx.alienvault.com/pulse/69fdc
    Pulse Author: AlienVault
    Created: 2026-05-08 11:31:46

    Be advised, this data is unverified and should be considered preliminary. Always do further verification.

    #CyberSecurity #GitHub #InfoSec #InfoStealer #LUA #Malware #OTX #OpenThreatExchange #Proxy #RAT #VPN #bot #developers #AlienVault

  37. 🎉 Happy to announce the official release of Anzu Proxy v1.0.0!

    After a very long development journey, Anzu Proxy is finally here: an all-in-one proxy server combining SOCKS5, HTTP/HTTPS (with HTTP/2 + optional caching), and Telegram MTProto with Fake-TLS for DPI resistance.

    Available on Snap Store for amd64, arm64, and arm7.

    Install:
    sudo snap install anzu-proxy

    Source Code:
    codeberg.org/alimiracle/anzu-p

    #OpenSource
    #Linux
    #Proxy
    #golang

  38. 🎉 Happy to announce the official release of Anzu Proxy v1.0.0!

    After a very long development journey, Anzu Proxy is finally here: an all-in-one proxy server combining SOCKS5, HTTP/HTTPS (with HTTP/2 + optional caching), and Telegram MTProto with Fake-TLS for DPI resistance.

    Available on Snap Store for amd64, arm64, and arm7.

    Install:
    sudo snap install anzu-proxy

    Source Code:
    codeberg.org/alimiracle/anzu-p

    #OpenSource
    #Linux
    #Proxy
    #golang

  39. 🎉 Happy to announce the official release of Anzu Proxy v1.0.0!

    After a very long development journey, Anzu Proxy is finally here: an all-in-one proxy server combining SOCKS5, HTTP/HTTPS (with HTTP/2 + optional caching), and Telegram MTProto with Fake-TLS for DPI resistance.

    Available on Snap Store for amd64, arm64, and arm7.

    Install:
    sudo snap install anzu-proxy

    Source Code:
    codeberg.org/alimiracle/anzu-p

    #OpenSource
    #Linux
    #Proxy
    #golang