#troll — Public Fediverse posts

#TROLL #GODS www.perplexity.ai/search/new?q... #HERMAPHRODITUS chatgpt.com?prompt=Analy... Semantic BACKLINKS: The Bridge between Humans and AI. AÉPIOT ( #aePiot ): INDEPENDENT SEMANTIC WEB 4.0 INFRASTRUCTURE (EST. 2009): allgraph.ro

Perplexity

#TROLL #GODS www.perplexity.ai/search/new?q... #HERMAPHRODITUS chatgpt.com?prompt=Analy... Semantic BACKLINKS: The Bridge between Humans and AI. AÉPIOT ( #aePiot ): INDEPENDENT SEMANTIC WEB 4.0 INFRASTRUCTURE (EST. 2009): allgraph.ro

Perplexity

Le seul truc qui m'a fait regretté d'avoir choisi un Commodore Amiga... c'est que ce ne soit pas un Atari.. si non c'était quand même vachement plus cool et puissant !
Mais Atari c'est quand même classe !
Heureusement, j'avais eu une console Atari 2600 ! Si non je n'aurai pas choisi un Amiga... j'aurai regretté de ne pas en avoir eu un...
Je ne sais pas si c'est bien clair...
#retrocomputing #troll

Le seul truc qui m'a fait regretté d'avoir choisi un Commodore Amiga... c'est que ce ne soit pas un Atari.. si non c'était quand même vachement plus cool et puissant !
Mais Atari c'est quand même classe !
Heureusement, j'avais eu une console Atari 2600 ! Si non je n'aurai pas choisi un Amiga... j'aurai regretté de ne pas en avoir eu un...
Je ne sais pas si c'est bien clair...
#retrocomputing #troll

Le seul truc qui m'a fait regretté d'avoir choisi un Commodore Amiga... c'est que ce ne soit pas un Atari.. si non c'était quand même vachement plus cool et puissant !
Mais Atari c'est quand même classe !
Heureusement, j'avais eu une console Atari 2600 ! Si non je n'aurai pas choisi un Amiga... j'aurai regretté de ne pas en avoir eu un...
Je ne sais pas si c'est bien clair...
#retrocomputing #troll

Le seul truc qui m'a fait regretté d'avoir choisi un Commodore Amiga... c'est que ce ne soit pas un Atari.. si non c'était quand même vachement plus cool et puissant !
Mais Atari c'est quand même classe !
Heureusement, j'avais eu une console Atari 2600 ! Si non je n'aurai pas choisi un Amiga... j'aurai regretté de ne pas en avoir eu un...
Je ne sais pas si c'est bien clair...
#retrocomputing #troll

Le seul truc qui m'a fait regretté d'avoir choisi un Commodore Amiga... c'est que ce ne soit pas un Atari.. si non c'était quand même vachement plus cool et puissant !
Mais Atari c'est quand même classe !
Heureusement, j'avais eu une console Atari 2600 ! Si non je n'aurai pas choisi un Amiga... j'aurai regretté de ne pas en avoir eu un...
Je ne sais pas si c'est bien clair...
#retrocomputing #troll

Thank you @[email protected] and @[email protected]! I #unfollowed. I don't #block unless they #troll me actively. Who knows how many of their users might be legitimate like me that just didn't pay enough attention. LOL Have a great day! 🩷🩵😺 - The account in question is: @ michaelsrants bsky social.

RE: https://bsky.app/profile/did:plc:zszvspbzkzpl2p26wbrbznl3/post/3mlkoujbtz22t

#Tennessee removes its #black #US House district in #Memphis

#MAGA goons celebrate

"It's rigged why vote"

On the contrary people not #voting got us here as much as MAGA

Getting out of this means many things. But voting is a small effort compared to the other efforts so voices against voting are inauthentic or #troll #psyop

#Hungary had as bad or worse manipulations against #democracy, and look what Hungarians delivered

Are you angry? Do you want to fix this?

#Vote

https://www.reuters.com/legal/government/tennessee-republicans-pass-new-map-erasing-majority-black-us-house-district-2026-05-07/

#Tennessee removes its #black #US House district in #Memphis

#MAGA goons celebrate

"It's rigged why vote"

On the contrary people not #voting got us here as much as MAGA

Getting out of this means many things. But voting is a small effort compared to the other efforts so voices against voting are inauthentic or #troll #psyop

#Hungary had as bad or worse manipulations against #democracy, and look what Hungarians delivered

Are you angry? Do you want to fix this?

#Vote

https://www.reuters.com/legal/government/tennessee-republicans-pass-new-map-erasing-majority-black-us-house-district-2026-05-07/

#Tennessee removes its #black #US House district in #Memphis

#MAGA goons celebrate

"It's rigged why vote"

On the contrary people not #voting got us here as much as MAGA

Getting out of this means many things. But voting is a small effort compared to the other efforts so voices against voting are inauthentic or #troll #psyop

#Hungary had as bad or worse manipulations against #democracy, and look what Hungarians delivered

Are you angry? Do you want to fix this?

#Vote

https://www.reuters.com/legal/government/tennessee-republicans-pass-new-map-erasing-majority-black-us-house-district-2026-05-07/

#Tennessee removes its #black #US House district in #Memphis

#MAGA goons celebrate

"It's rigged why vote"

On the contrary people not #voting got us here as much as MAGA

Getting out of this means many things. But voting is a small effort compared to the other efforts so voices against voting are inauthentic or #troll #psyop

#Hungary had as bad or worse manipulations against #democracy, and look what Hungarians delivered

Are you angry? Do you want to fix this?

#Vote

https://www.reuters.com/legal/government/tennessee-republicans-pass-new-map-erasing-majority-black-us-house-district-2026-05-07/

Mysterious hacker organization operating secretly for 6 years is exploiting critical cPanel vulnerability to deploy backdoor trojans

A previously unknown threat group designated Mr_Rot13 has been exploiting CVE-2026-41940, a critical authentication bypass vulnerability in cPanel & WHM, to compromise Linux servers globally. Active since at least 2020, the group deploys a Go-based payload installer that plants SSH keys, PHP webshells, malicious JavaScript for credential harvesting, and a cross-platform remote access tool called Filemanager. Stolen data is exfiltrated to attacker-controlled Telegram channels and command servers. The group has maintained operational security for six years with extremely low detection rates. Attack infrastructure includes domains registered as early as 2020, with over 2,000 attacking IP addresses observed worldwide. The campaign primarily targets cPanel installations and WordPress systems, with confirmed compromise of Southeast Asian government and military entities resulting in 4.37GB of sensitive data theft.

Pulse ID: 6a01847e13b4074a8d4b6381
Pulse Link: https://otx.alienvault.com/pulse/6a01847e13b4074a8d4b6381
Pulse Author: AlienVault
Created: 2026-05-11 07:25:50

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Asia #BackDoor #CredentialHarvesting #CyberSecurity #DataTheft #Government #InfoSec #Java #JavaScript #Linux #Military #OTX #OpenThreatExchange #PHP #RAT #RDP #SSH #Telegram #Trojan #Troll #Vulnerability #Word #Wordpress #bot #AlienVault

Mysterious hacker organization operating secretly for 6 years is exploiting critical cPanel vulnerability to deploy backdoor trojans

A previously unknown threat group designated Mr_Rot13 has been exploiting CVE-2026-41940, a critical authentication bypass vulnerability in cPanel & WHM, to compromise Linux servers globally. Active since at least 2020, the group deploys a Go-based payload installer that plants SSH keys, PHP webshells, malicious JavaScript for credential harvesting, and a cross-platform remote access tool called Filemanager. Stolen data is exfiltrated to attacker-controlled Telegram channels and command servers. The group has maintained operational security for six years with extremely low detection rates. Attack infrastructure includes domains registered as early as 2020, with over 2,000 attacking IP addresses observed worldwide. The campaign primarily targets cPanel installations and WordPress systems, with confirmed compromise of Southeast Asian government and military entities resulting in 4.37GB of sensitive data theft.

Pulse ID: 6a01847e13b4074a8d4b6381
Pulse Link: https://otx.alienvault.com/pulse/6a01847e13b4074a8d4b6381
Pulse Author: AlienVault
Created: 2026-05-11 07:25:50

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Asia #BackDoor #CredentialHarvesting #CyberSecurity #DataTheft #Government #InfoSec #Java #JavaScript #Linux #Military #OTX #OpenThreatExchange #PHP #RAT #RDP #SSH #Telegram #Trojan #Troll #Vulnerability #Word #Wordpress #bot #AlienVault

Mysterious hacker organization operating secretly for 6 years is exploiting critical cPanel vulnerability to deploy backdoor trojans

A previously unknown threat group designated Mr_Rot13 has been exploiting CVE-2026-41940, a critical authentication bypass vulnerability in cPanel & WHM, to compromise Linux servers globally. Active since at least 2020, the group deploys a Go-based payload installer that plants SSH keys, PHP webshells, malicious JavaScript for credential harvesting, and a cross-platform remote access tool called Filemanager. Stolen data is exfiltrated to attacker-controlled Telegram channels and command servers. The group has maintained operational security for six years with extremely low detection rates. Attack infrastructure includes domains registered as early as 2020, with over 2,000 attacking IP addresses observed worldwide. The campaign primarily targets cPanel installations and WordPress systems, with confirmed compromise of Southeast Asian government and military entities resulting in 4.37GB of sensitive data theft.

Pulse ID: 6a01847e13b4074a8d4b6381
Pulse Link: https://otx.alienvault.com/pulse/6a01847e13b4074a8d4b6381
Pulse Author: AlienVault
Created: 2026-05-11 07:25:50

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Asia #BackDoor #CredentialHarvesting #CyberSecurity #DataTheft #Government #InfoSec #Java #JavaScript #Linux #Military #OTX #OpenThreatExchange #PHP #RAT #RDP #SSH #Telegram #Trojan #Troll #Vulnerability #Word #Wordpress #bot #AlienVault

Mysterious hacker organization operating secretly for 6 years is exploiting critical cPanel vulnerability to deploy backdoor trojans

A previously unknown threat group designated Mr_Rot13 has been exploiting CVE-2026-41940, a critical authentication bypass vulnerability in cPanel & WHM, to compromise Linux servers globally. Active since at least 2020, the group deploys a Go-based payload installer that plants SSH keys, PHP webshells, malicious JavaScript for credential harvesting, and a cross-platform remote access tool called Filemanager. Stolen data is exfiltrated to attacker-controlled Telegram channels and command servers. The group has maintained operational security for six years with extremely low detection rates. Attack infrastructure includes domains registered as early as 2020, with over 2,000 attacking IP addresses observed worldwide. The campaign primarily targets cPanel installations and WordPress systems, with confirmed compromise of Southeast Asian government and military entities resulting in 4.37GB of sensitive data theft.

Pulse ID: 6a01847e13b4074a8d4b6381
Pulse Link: https://otx.alienvault.com/pulse/6a01847e13b4074a8d4b6381
Pulse Author: AlienVault
Created: 2026-05-11 07:25:50

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Asia #BackDoor #CredentialHarvesting #CyberSecurity #DataTheft #Government #InfoSec #Java #JavaScript #Linux #Military #OTX #OpenThreatExchange #PHP #RAT #RDP #SSH #Telegram #Trojan #Troll #Vulnerability #Word #Wordpress #bot #AlienVault

Mysterious hacker organization operating secretly for 6 years is exploiting critical cPanel vulnerability to deploy backdoor trojans

A previously unknown threat group designated Mr_Rot13 has been exploiting CVE-2026-41940, a critical authentication bypass vulnerability in cPanel & WHM, to compromise Linux servers globally. Active since at least 2020, the group deploys a Go-based payload installer that plants SSH keys, PHP webshells, malicious JavaScript for credential harvesting, and a cross-platform remote access tool called Filemanager. Stolen data is exfiltrated to attacker-controlled Telegram channels and command servers. The group has maintained operational security for six years with extremely low detection rates. Attack infrastructure includes domains registered as early as 2020, with over 2,000 attacking IP addresses observed worldwide. The campaign primarily targets cPanel installations and WordPress systems, with confirmed compromise of Southeast Asian government and military entities resulting in 4.37GB of sensitive data theft.

Pulse ID: 6a01847e13b4074a8d4b6381
Pulse Link: https://otx.alienvault.com/pulse/6a01847e13b4074a8d4b6381
Pulse Author: AlienVault
Created: 2026-05-11 07:25:50

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Asia #BackDoor #CredentialHarvesting #CyberSecurity #DataTheft #Government #InfoSec #Java #JavaScript #Linux #Military #OTX #OpenThreatExchange #PHP #RAT #RDP #SSH #Telegram #Trojan #Troll #Vulnerability #Word #Wordpress #bot #AlienVault

Abuse of Cloud-Native Infrastructure in Modern Phishing Campaigns

An investigation has revealed a structural evolution in phishing operations where threat actors conduct entire campaigns through legitimate, enterprise-trusted cloud infrastructure rather than attacker-controlled systems. Adversaries weaponize platforms employees use daily, including cloud storage, productivity suites, and OAuth authentication endpoints. Attacks originate from legitimate Google or Microsoft systems, passing all authentication checks while linking to whitelisted cloud services. Multi-factor authentication is bypassed without touching passwords, and victim organizations show no anomalous SIEM events at compromise time. Campaigns employ five stages: delivery via provider-owned infrastructure, payload hosting on legitimate cloud storage, execution within browser memory using native APIs, credential theft through legitimate authentication flows, and persistent presence through licensed services. Detection requires behavioral analysis rather than traditional indicators, as attackers operate enti...

Pulse ID: 69fe0ae9bf660196169e557b
Pulse Link: https://otx.alienvault.com/pulse/69fe0ae9bf660196169e557b
Pulse Author: AlienVault
Created: 2026-05-08 16:10:17

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #Cloud #CyberSecurity #Endpoint #Google #InfoSec #Microsoft #OTX #OpenThreatExchange #Password #Passwords #Phishing #RAT #Rust #Troll #Word #bot #AlienVault

Abuse of Cloud-Native Infrastructure in Modern Phishing Campaigns

An investigation has revealed a structural evolution in phishing operations where threat actors conduct entire campaigns through legitimate, enterprise-trusted cloud infrastructure rather than attacker-controlled systems. Adversaries weaponize platforms employees use daily, including cloud storage, productivity suites, and OAuth authentication endpoints. Attacks originate from legitimate Google or Microsoft systems, passing all authentication checks while linking to whitelisted cloud services. Multi-factor authentication is bypassed without touching passwords, and victim organizations show no anomalous SIEM events at compromise time. Campaigns employ five stages: delivery via provider-owned infrastructure, payload hosting on legitimate cloud storage, execution within browser memory using native APIs, credential theft through legitimate authentication flows, and persistent presence through licensed services. Detection requires behavioral analysis rather than traditional indicators, as attackers operate enti...

Pulse ID: 69fe0ae9bf660196169e557b
Pulse Link: https://otx.alienvault.com/pulse/69fe0ae9bf660196169e557b
Pulse Author: AlienVault
Created: 2026-05-08 16:10:17

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #Cloud #CyberSecurity #Endpoint #Google #InfoSec #Microsoft #OTX #OpenThreatExchange #Password #Passwords #Phishing #RAT #Rust #Troll #Word #bot #AlienVault

Abuse of Cloud-Native Infrastructure in Modern Phishing Campaigns

An investigation has revealed a structural evolution in phishing operations where threat actors conduct entire campaigns through legitimate, enterprise-trusted cloud infrastructure rather than attacker-controlled systems. Adversaries weaponize platforms employees use daily, including cloud storage, productivity suites, and OAuth authentication endpoints. Attacks originate from legitimate Google or Microsoft systems, passing all authentication checks while linking to whitelisted cloud services. Multi-factor authentication is bypassed without touching passwords, and victim organizations show no anomalous SIEM events at compromise time. Campaigns employ five stages: delivery via provider-owned infrastructure, payload hosting on legitimate cloud storage, execution within browser memory using native APIs, credential theft through legitimate authentication flows, and persistent presence through licensed services. Detection requires behavioral analysis rather than traditional indicators, as attackers operate enti...

Pulse ID: 69fe0ae9bf660196169e557b
Pulse Link: https://otx.alienvault.com/pulse/69fe0ae9bf660196169e557b
Pulse Author: AlienVault
Created: 2026-05-08 16:10:17

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #Cloud #CyberSecurity #Endpoint #Google #InfoSec #Microsoft #OTX #OpenThreatExchange #Password #Passwords #Phishing #RAT #Rust #Troll #Word #bot #AlienVault

Abuse of Cloud-Native Infrastructure in Modern Phishing Campaigns

An investigation has revealed a structural evolution in phishing operations where threat actors conduct entire campaigns through legitimate, enterprise-trusted cloud infrastructure rather than attacker-controlled systems. Adversaries weaponize platforms employees use daily, including cloud storage, productivity suites, and OAuth authentication endpoints. Attacks originate from legitimate Google or Microsoft systems, passing all authentication checks while linking to whitelisted cloud services. Multi-factor authentication is bypassed without touching passwords, and victim organizations show no anomalous SIEM events at compromise time. Campaigns employ five stages: delivery via provider-owned infrastructure, payload hosting on legitimate cloud storage, execution within browser memory using native APIs, credential theft through legitimate authentication flows, and persistent presence through licensed services. Detection requires behavioral analysis rather than traditional indicators, as attackers operate enti...

Pulse ID: 69fe0ae9bf660196169e557b
Pulse Link: https://otx.alienvault.com/pulse/69fe0ae9bf660196169e557b
Pulse Author: AlienVault
Created: 2026-05-08 16:10:17

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #Cloud #CyberSecurity #Endpoint #Google #InfoSec #Microsoft #OTX #OpenThreatExchange #Password #Passwords #Phishing #RAT #Rust #Troll #Word #bot #AlienVault

Abuse of Cloud-Native Infrastructure in Modern Phishing Campaigns

An investigation has revealed a structural evolution in phishing operations where threat actors conduct entire campaigns through legitimate, enterprise-trusted cloud infrastructure rather than attacker-controlled systems. Adversaries weaponize platforms employees use daily, including cloud storage, productivity suites, and OAuth authentication endpoints. Attacks originate from legitimate Google or Microsoft systems, passing all authentication checks while linking to whitelisted cloud services. Multi-factor authentication is bypassed without touching passwords, and victim organizations show no anomalous SIEM events at compromise time. Campaigns employ five stages: delivery via provider-owned infrastructure, payload hosting on legitimate cloud storage, execution within browser memory using native APIs, credential theft through legitimate authentication flows, and persistent presence through licensed services. Detection requires behavioral analysis rather than traditional indicators, as attackers operate enti...

Pulse ID: 69fe0ae9bf660196169e557b
Pulse Link: https://otx.alienvault.com/pulse/69fe0ae9bf660196169e557b
Pulse Author: AlienVault
Created: 2026-05-08 16:10:17

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Browser #Cloud #CyberSecurity #Endpoint #Google #InfoSec #Microsoft #OTX #OpenThreatExchange #Password #Passwords #Phishing #RAT #Rust #Troll #Word #bot #AlienVault

OPERATION SILENTCANVAS: JPEG BASED MULTISTAGE POWERSHELL INTRUSION

A sophisticated multi-stage intrusion campaign was identified leveraging a weaponized PowerShell payload disguised as a JPEG image file (sysupdate.jpeg) to deploy a trojanized ConnectWise ScreenConnect instance for covert remote access. The attack likely originates through social engineering techniques including phishing emails or malicious attachments. Upon execution, the malware establishes a staging environment, retrieves additional payloads from attacker-controlled infrastructure, and dynamically compiles a custom launcher using Microsoft's legitimate .NET compiler (csc.exe) to evade detection. The intrusion abuses ComputerDefaults.exe and a malicious ms-settings registry hijack to perform a fileless UAC bypass and obtain elevated privileges. Once elevated, the malware deploys a persistent service masquerading as OneDriveServers and launches a modified ScreenConnect framework capable of credential interception, remote command execution, surveillance operations, SYSTEM-level execution, encrypted command...

Pulse ID: 6a008382641183db3b20fef5
Pulse Link: https://otx.alienvault.com/pulse/6a008382641183db3b20fef5
Pulse Author: AlienVault
Created: 2026-05-10 13:09:22

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#ConnectWise #CyberSecurity #EDR #Email #InfoSec #Malware #Microsoft #NET #OTX #OpenThreatExchange #Phishing #PowerShell #RAT #RCE #RemoteCommandExecution #ScreenConnect #SocialEngineering #Trojan #Troll #bot #AlienVault

OPERATION SILENTCANVAS: JPEG BASED MULTISTAGE POWERSHELL INTRUSION

A sophisticated multi-stage intrusion campaign was identified leveraging a weaponized PowerShell payload disguised as a JPEG image file (sysupdate.jpeg) to deploy a trojanized ConnectWise ScreenConnect instance for covert remote access. The attack likely originates through social engineering techniques including phishing emails or malicious attachments. Upon execution, the malware establishes a staging environment, retrieves additional payloads from attacker-controlled infrastructure, and dynamically compiles a custom launcher using Microsoft's legitimate .NET compiler (csc.exe) to evade detection. The intrusion abuses ComputerDefaults.exe and a malicious ms-settings registry hijack to perform a fileless UAC bypass and obtain elevated privileges. Once elevated, the malware deploys a persistent service masquerading as OneDriveServers and launches a modified ScreenConnect framework capable of credential interception, remote command execution, surveillance operations, SYSTEM-level execution, encrypted command...

Pulse ID: 6a008382641183db3b20fef5
Pulse Link: https://otx.alienvault.com/pulse/6a008382641183db3b20fef5
Pulse Author: AlienVault
Created: 2026-05-10 13:09:22

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#ConnectWise #CyberSecurity #EDR #Email #InfoSec #Malware #Microsoft #NET #OTX #OpenThreatExchange #Phishing #PowerShell #RAT #RCE #RemoteCommandExecution #ScreenConnect #SocialEngineering #Trojan #Troll #bot #AlienVault

OPERATION SILENTCANVAS: JPEG BASED MULTISTAGE POWERSHELL INTRUSION

A sophisticated multi-stage intrusion campaign was identified leveraging a weaponized PowerShell payload disguised as a JPEG image file (sysupdate.jpeg) to deploy a trojanized ConnectWise ScreenConnect instance for covert remote access. The attack likely originates through social engineering techniques including phishing emails or malicious attachments. Upon execution, the malware establishes a staging environment, retrieves additional payloads from attacker-controlled infrastructure, and dynamically compiles a custom launcher using Microsoft's legitimate .NET compiler (csc.exe) to evade detection. The intrusion abuses ComputerDefaults.exe and a malicious ms-settings registry hijack to perform a fileless UAC bypass and obtain elevated privileges. Once elevated, the malware deploys a persistent service masquerading as OneDriveServers and launches a modified ScreenConnect framework capable of credential interception, remote command execution, surveillance operations, SYSTEM-level execution, encrypted command...

Pulse ID: 6a008382641183db3b20fef5
Pulse Link: https://otx.alienvault.com/pulse/6a008382641183db3b20fef5
Pulse Author: AlienVault
Created: 2026-05-10 13:09:22

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#ConnectWise #CyberSecurity #EDR #Email #InfoSec #Malware #Microsoft #NET #OTX #OpenThreatExchange #Phishing #PowerShell #RAT #RCE #RemoteCommandExecution #ScreenConnect #SocialEngineering #Trojan #Troll #bot #AlienVault

OPERATION SILENTCANVAS: JPEG BASED MULTISTAGE POWERSHELL INTRUSION

A sophisticated multi-stage intrusion campaign was identified leveraging a weaponized PowerShell payload disguised as a JPEG image file (sysupdate.jpeg) to deploy a trojanized ConnectWise ScreenConnect instance for covert remote access. The attack likely originates through social engineering techniques including phishing emails or malicious attachments. Upon execution, the malware establishes a staging environment, retrieves additional payloads from attacker-controlled infrastructure, and dynamically compiles a custom launcher using Microsoft's legitimate .NET compiler (csc.exe) to evade detection. The intrusion abuses ComputerDefaults.exe and a malicious ms-settings registry hijack to perform a fileless UAC bypass and obtain elevated privileges. Once elevated, the malware deploys a persistent service masquerading as OneDriveServers and launches a modified ScreenConnect framework capable of credential interception, remote command execution, surveillance operations, SYSTEM-level execution, encrypted command...

Pulse ID: 6a008382641183db3b20fef5
Pulse Link: https://otx.alienvault.com/pulse/6a008382641183db3b20fef5
Pulse Author: AlienVault
Created: 2026-05-10 13:09:22

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#ConnectWise #CyberSecurity #EDR #Email #InfoSec #Malware #Microsoft #NET #OTX #OpenThreatExchange #Phishing #PowerShell #RAT #RCE #RemoteCommandExecution #ScreenConnect #SocialEngineering #Trojan #Troll #bot #AlienVault

OPERATION SILENTCANVAS: JPEG BASED MULTISTAGE POWERSHELL INTRUSION

A sophisticated multi-stage intrusion campaign was identified leveraging a weaponized PowerShell payload disguised as a JPEG image file (sysupdate.jpeg) to deploy a trojanized ConnectWise ScreenConnect instance for covert remote access. The attack likely originates through social engineering techniques including phishing emails or malicious attachments. Upon execution, the malware establishes a staging environment, retrieves additional payloads from attacker-controlled infrastructure, and dynamically compiles a custom launcher using Microsoft's legitimate .NET compiler (csc.exe) to evade detection. The intrusion abuses ComputerDefaults.exe and a malicious ms-settings registry hijack to perform a fileless UAC bypass and obtain elevated privileges. Once elevated, the malware deploys a persistent service masquerading as OneDriveServers and launches a modified ScreenConnect framework capable of credential interception, remote command execution, surveillance operations, SYSTEM-level execution, encrypted command...

Pulse ID: 6a008382641183db3b20fef5
Pulse Link: https://otx.alienvault.com/pulse/6a008382641183db3b20fef5
Pulse Author: AlienVault
Created: 2026-05-10 13:09:22

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#ConnectWise #CyberSecurity #EDR #Email #InfoSec #Malware #Microsoft #NET #OTX #OpenThreatExchange #Phishing #PowerShell #RAT #RCE #RemoteCommandExecution #ScreenConnect #SocialEngineering #Trojan #Troll #bot #AlienVault

#TROLL #SATELLITE www.perplexity.ai/search/new?q... www.paypal.com/donate?busin...

Perplexity

#TROLL #SATELLITE www.perplexity.ai/search/new?q... www.paypal.com/donate?busin...

Perplexity

#SilentSunday #nature #photography #troll #ent #treant #tree #NoAI

#SilentSunday #nature #photography #troll #ent #treant #tree #NoAI

#SilentSunday #nature #photography #troll #ent #treant #tree #NoAI

#SilentSunday #nature #photography #troll #ent #treant #tree #NoAI

#SilentSunday #nature #photography #troll #ent #treant #tree #NoAI

Opvallend dat ik vandaag al meerdere accounts ben tegengekomen, en daarna heb gerapporteerd, geblokkeerd of genegeerd, die vandaag heel veel berichten hebben geplaatst ter meerdere glorie van Rusland, Putin etc. en die tekeer gaan tegen Ukraine en de NATO.
Heeft Vladimir een nieuwe trollenfabriek geopend of zo ?

Afbeelding is stukje van site waar veelvuldig naar verwezen wordt of geciteerd wordt.
(Ik gun ze het bezoek niet, dus heb de url weggeknipt)

#russia #putin #ukraine #nato #troll

Opvallend dat ik vandaag al meerdere accounts ben tegengekomen, en daarna heb gerapporteerd, geblokkeerd of genegeerd, die vandaag heel veel berichten hebben geplaatst ter meerdere glorie van Rusland, Putin etc. en die tekeer gaan tegen Ukraine en de NATO.
Heeft Vladimir een nieuwe trollenfabriek geopend of zo ?

Afbeelding is stukje van site waar veelvuldig naar verwezen wordt of geciteerd wordt.
(Ik gun ze het bezoek niet, dus heb de url weggeknipt)

#russia #putin #ukraine #nato #troll

Opvallend dat ik vandaag al meerdere accounts ben tegengekomen, en daarna heb gerapporteerd, geblokkeerd of genegeerd, die vandaag heel veel berichten hebben geplaatst ter meerdere glorie van Rusland, Putin etc. en die tekeer gaan tegen Ukraine en de NATO.
Heeft Vladimir een nieuwe trollenfabriek geopend of zo ?

Afbeelding is stukje van site waar veelvuldig naar verwezen wordt of geciteerd wordt.
(Ik gun ze het bezoek niet, dus heb de url weggeknipt)

#russia #putin #ukraine #nato #troll

Opvallend dat ik vandaag al meerdere accounts ben tegengekomen, en daarna heb gerapporteerd, geblokkeerd of genegeerd, die vandaag heel veel berichten hebben geplaatst ter meerdere glorie van Rusland, Putin etc. en die tekeer gaan tegen Ukraine en de NATO.
Heeft Vladimir een nieuwe trollenfabriek geopend of zo ?

Afbeelding is stukje van site waar veelvuldig naar verwezen wordt of geciteerd wordt.
(Ik gun ze het bezoek niet, dus heb de url weggeknipt)

#russia #putin #ukraine #nato #troll

Opvallend dat ik vandaag al meerdere accounts ben tegengekomen, en daarna heb gerapporteerd, geblokkeerd of genegeerd, die vandaag heel veel berichten hebben geplaatst ter meerdere glorie van Rusland, Putin etc. en die tekeer gaan tegen Ukraine en de NATO.
Heeft Vladimir een nieuwe trollenfabriek geopend of zo ?

Afbeelding is stukje van site waar veelvuldig naar verwezen wordt of geciteerd wordt.
(Ik gun ze het bezoek niet, dus heb de url weggeknipt)

#russia #putin #ukraine #nato #troll

Russische(?) trol.
Actief sinds gisteren.
Gerapporteerd en geblokkeerd.
Geef ze alstublieft niet de mogelijkheid om hun rotzooi hier te spuien.

Russian(?) troll.
Active since yesterday.
Reported and blocked
Please don't give them the opportunity to spew their trash here.

#troll #russia #ukraine #usa

Russische(?) trol.
Actief sinds gisteren.
Gerapporteerd en geblokkeerd.
Geef ze alstublieft niet de mogelijkheid om hun rotzooi hier te spuien.

Russian(?) troll.
Active since yesterday.
Reported and blocked
Please don't give them the opportunity to spew their trash here.

#troll #russia #ukraine #usa

Russische(?) trol.
Actief sinds gisteren.
Gerapporteerd en geblokkeerd.
Geef ze alstublieft niet de mogelijkheid om hun rotzooi hier te spuien.

Russian(?) troll.
Active since yesterday.
Reported and blocked
Please don't give them the opportunity to spew their trash here.

#troll #russia #ukraine #usa

Russische(?) trol.
Actief sinds gisteren.
Gerapporteerd en geblokkeerd.
Geef ze alstublieft niet de mogelijkheid om hun rotzooi hier te spuien.

Russian(?) troll.
Active since yesterday.
Reported and blocked
Please don't give them the opportunity to spew their trash here.

#troll #russia #ukraine #usa

Russische(?) trol.
Actief sinds gisteren.
Gerapporteerd en geblokkeerd.
Geef ze alstublieft niet de mogelijkheid om hun rotzooi hier te spuien.

Russian(?) troll.
Active since yesterday.
Reported and blocked
Please don't give them the opportunity to spew their trash here.

#troll #russia #ukraine #usa

#Barfußpark #Beelitz #woodart #troll

#Barfußpark #Beelitz #woodart #troll

#Barfußpark #Beelitz #woodart #troll

#Barfußpark #Beelitz #woodart #troll

#Barfußpark #Beelitz #woodart #troll

PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale

PCPJack is a sophisticated credential theft framework that propagates across exposed cloud infrastructure while systematically removing artifacts linked to TeamPCP, a threat actor behind notable 2026 supply chain compromises. The toolset harvests credentials from cloud platforms, containers, developer tools, productivity applications, and financial services, exfiltrating data through attacker-controlled infrastructure. It targets exposed Docker, Kubernetes, Redis, MongoDB, RayML services and vulnerable web applications, enabling external propagation and lateral movement. Unlike typical cloud malware, PCPJack deploys no cryptominers, focusing instead on credential theft for monetization through fraud, spam campaigns, extortion, or access resale. The framework uses modular Python scripts orchestrated by a central component, employs Common Crawl data for target selection, and utilizes Telegram for command and control communications.

Pulse ID: 69fd0520d3687243cca2f973
Pulse Link: https://otx.alienvault.com/pulse/69fd0520d3687243cca2f973
Pulse Author: AlienVault
Created: 2026-05-07 21:33:20

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Cloud #CryptoMiner #CyberSecurity #Docker #Extortion #InfoSec #Malware #OTX #OpenThreatExchange #Python #RAT #Redis #Spam #SupplyChain #Telegram #Troll #Worm #bot #AlienVault