Daily Writeups
@Daily_Writeups
3.53K subscribers
2 photos
129K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
3.53K subscribers
Daily Writeups
⤷ Title: The Proxifier Trap: The “Fileless” Marathon Stealing Your Crypto
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 14 Apr 2026 04:15:18 +0000
════════════════════════
⌗ Tags: #Malware #ClipBanker #Cryptocurrency Theft #Fileless Malware #GitHub Malware #infosec #kaspersky #powershell #Proxifier #SEO Poisoning #Trojan
Daily CyberSecurity
The Proxifier Trap: The "Fileless" Marathon Stealing Your Crypto
Kaspersky reveals a fileless Trojan campaign targeting Proxifier searches. Learn how this "ClipBanker" hijacks crypto wallets via search engine poisoning.
18 views
Daily Writeups
⤷ Title: New Stealth Attack Chain Weaponizes Legitimate Remote Access Software
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 14 Apr 2026 09:21:28 +0000
════════════════════════
⌗ Tags: #Malware #.NET Reflection #Adobe Acrobat #cybersecurity #Fileless Malware #In_Memory Execution #infosec #ScreenConnect #UAC bypass #VBScript Loader #Zscaler ThreatLabz
Daily CyberSecurity
New Stealth Attack Chain Weaponizes Legitimate Remote Access Software
Zscaler reveals a 2026 attack chain using fake Adobe Reader lures to install ScreenConnect via in-memory execution and UAC bypass. Protect your network now!
13 views
Daily Writeups
⤷ Title: The Friend Request from Pyongyang: How APT37 Hijacks Facebook to Deploy RokRAT
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 15 Apr 2026 07:40:02 +0000
════════════════════════
⌗ Tags: #Cybercriminals #APT37 #Code Cave Injection #Facebook Phishing #Fileless Malware #Genians Security Center #North Korean APT #PE Patching #RokRAT #social engineering #Wondershare PDFelement #Zoho WorkDrive
Daily CyberSecurity
The Friend Request from Pyongyang: How APT37 Hijacks Facebook to Deploy RokRAT
APT37 pivots to Facebook social engineering, using Wondershare PDFelement "code caves" to deploy RokRAT. Learn how they bypass EDR with memory-only payloads.
15 views
Daily Writeups
⤷ Title: RondoDox Botnet Hijacks Everything from IoT to Fortnite
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 21 Apr 2026 02:01:00 +0000
════════════════════════
⌗ Tags: #Malware #anti_debugging #Bitsight #botnet #dos attack #Fileless Malware #infosec #IoT security #Malware Analysis #Monero mining #Nanomites #RondoDox #XMRig
Daily CyberSecurity
RondoDox Botnet Hijacks Everything from IoT to Fortnite
BitSight unmasks RondoDox: a modular botnet using "nanomites" to dodge debuggers while hijacking 18 architectures for Monero mining and gaming DoS attacks.
16 views
Daily Writeups
⤷ Title: PureRAT Unmasked: The Stealthy, Multi-Stage “Dynamic Loader” Targeting Windows
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 23 Apr 2026 02:00:16 +0000
════════════════════════
⌗ Tags: #Malware #cybersecurity #Fileless Malware #infosec #Malware Analysis #Process Hollowing #PureRAT #rat #Remote Access Trojan #steganography #Trellix #UAC bypass
Daily CyberSecurity
PureRAT Unmasked: The Stealthy, Multi-Stage "Dynamic Loader" Targeting Windows
Trellix uncovers PureRAT, a modular Trojan hiding malware in PNG images. Learn how it uses steganography and fileless delivery to bypass Windows security.
18 views
Daily Writeups
⤷ Title: Inside the Stealthy Evolution of Vidar Infostealer
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 28 Apr 2026 07:06:31 +0000
════════════════════════
⌗ Tags: #Malware #ClickFix #Crypto theft #cybersecurity #Fileless Malware #infosec #Infostealer #living_off_the_land #malware #social engineering #Telegram C2 #Vidar
Daily CyberSecurity
Inside the Stealthy Evolution of Vidar Infostealer
Vidar infostealer evolves into a fileless 2026 threat. From fake CAPTCHAs to "Claude Code" leaks, see how it steals crypto and passwords via Telegram C2.
16 views
Daily Writeups
⤷ Title: New Quasar Linux (QLNX) RAT Hijacks Cloud Keys and NPM Tokens
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 06 May 2026 08:11:06 +0000
════════════════════════
⌗ Tags: #Malware #AWS Credentials #DevOps Security #eBPF Rootkit #Fileless Malware #infosec #Linux RAT #npm Security #PyPI #QLNX #Quasar Linux #supply chain attack #Trend Micro
Daily CyberSecurity
New Quasar Linux (QLNX) RAT Hijacks Cloud Keys and NPM Tokens
Trend Micro uncovers QLNX, a fileless Linux RAT targeting AWS, NPM, and Kubernetes keys. Learn how its eBPF rootkit hides from even the deepest system scans.
14 views
Daily Writeups
⤷ Title: The InstallFix Trap: Fake Claude AI Google Ads Drop Fileless RedLine Malware on Developers
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 08 May 2026 06:11:33 +0000
════════════════════════
⌗ Tags: #Malware #AMSI Bypass #Anthropic #Claude AI #ClickFix #cybersecurity #Fileless Malware #Google Ads Phishing #infosec #InstallFix #Redline stealer #Threat Intel
Daily CyberSecurity
The InstallFix Trap: Fake Claude AI Google Ads Drop Fileless RedLine Malware on Developers
Beware of InstallFix: Fake Claude AI Google Ads trick users into running fileless scripts that deploy RedLine Stealer to steal passwords and crypto.
31 views
Daily Writeups
⤷ Title: Fileless Python Malware Uses Humanitarian Lures to Deploy Full-Spectrum Surveillance
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 11 May 2026 06:11:11 +0000
════════════════════════
⌗ Tags: #Malware #CRIL #Cyberespionage #Cyble #Fileless Malware #GitHub abuse #infosec #phishing #Pyarmor #Python Malware #social engineering #threat intelligence
Daily CyberSecurity
Fileless Python Malware Uses Humanitarian Lures to Deploy Full-Spectrum Surveillance
CRIL exposes a cyberespionage campaign using fake humanitarian aid forms to deploy fileless Python malware via GitHub for full-spectrum surveillance.
27 views
Daily Writeups
⤷ Title: CountLoader Malware Weaponizes EtherHiding to Deploy Stealth Crypto Clippers
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 18 May 2026 09:15:54 +0000
════════════════════════
⌗ Tags: #Malware #AMSI Bypass #CountLoader #Crypto theft #Cryptocurrency Clipper #Cyber Security #EtherHiding #Fileless Malware #infosec #McAfee Labs #threat intelligence
Daily CyberSecurity
CountLoader Malware Weaponizes EtherHiding to Deploy Stealth Crypto Clippers
McAfee Labs exposes a massive CountLoader campaign using EtherHiding and AMSI bypass to drop stealthy cryptocurrency clippers. Secure your assets!
20 views
Daily Writeups
⤷ Title: Under the PyInstaller Mask: Point Wild Exposes XWorm V7.4 Stealth Loader and AMSI Bypass
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Wed, 20 May 2026 07:49:06 +0000
════════════════════════
⌗ Tags: #Malware #.NET Reflection Plugins #AES Encrypted C2 Configuration #AMSI Bypass In_Memory Execution #Fileless Remote Administrative Trojan #Hidden System File Attributes #Point Wild Threat Intelligence #PyInstaller Loader Forensic #Runtime Windows API Resolving #Win.Kernel_Svc_AJ8iOw.exe #XWorm V7.4 Malware
Information Security News
Under the PyInstaller Mask: Point Wild Exposes XWorm V7.4 Stealth Loader and AMSI Bypass - Information Security News
Threat intelligence architects at Point Wild have dissectively mapped a contemporary XWorm V7.4 infection pipeline, demonstrating how a seemingly innocuous, Python-based installation package systematically mutates into a formidable remote administrative implant.…
23 views
Daily Writeups
⤷ Title: China-Linked Hackers Deploy “TencShell” Backdoor via Faux Web Font Files
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Wed, 20 May 2026 07:45:33 +0000
════════════════════════
⌗ Tags: #Malware #Cato CTRL Threat Research #Donut Shellcode In_Memory Execution #Fileless Position_Independent Code #Rshell Framework Customization #State_Sponsored Cyber Espionage #Tencent API Impersonation #TencShell Backdoor Malware #Third_Party Identity Compromise #Web Font Masquerading #Windows Registry Persistence
Information Security News
China-Linked Hackers Deploy "TencShell" Backdoor via Faux Web Font Files - Information Security News
In April 2026, threat intelligence specialists at Cato CTRL neutralized a sophisticated network intrusion attempt targeting a major multinational manufacturing enterprise. The adversaries sought to establish a persistent foothold within the corporate perimeter…
19 views
Daily Writeups
⤷ Title: Microsoft’s Retired IE Tool MSHTA Now Being Used in Fileless Malware Attacks
════════════════════════
𐀪 Author: Deeba Ahmed
════════════════════════
ⴵ Time: Thu, 21 May 2026 10:18:11 +0000
════════════════════════
⌗ Tags: #Security #Malware #Microsoft #Cyber Attack #Cybersecurity #Fileless #LOLBIN #MSHTA #Vulnerability
Hackread
Microsoft’s Retired IE Tool MSHTA Now Being Used in Fileless Malware Attacks
Despite Internet Explorer’s retirement, hackers are abusing the legacy MSHTA utility in stealthy fileless malware attacks targeting Windows users.
41 views
Daily Writeups
⤷ Title: In-Memory Financial Theft: Inside Banana RAT’s Operator-Driven Attacks on Brazilian Banks
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 25 May 2026 06:47:33 +0000
════════════════════════
⌗ Tags: #Malware #Banana RAT #Banking Trojan #Cyber Security #Fileless Execution #In_Memory Exploit #infosec #Malware_as_a_Service #Pix_QR Interception #Powershell obfuscation #SHADOW_WATER_063 #TrendAI Counter Threat Unit
Daily CyberSecurity
In-Memory Financial Theft: Inside Banana RAT’s Operator-Driven Attacks on Brazilian Banks
TrendAI exposes Banana RAT, a fileless banking trojan by SHADOW-WATER-063 that uses in-memory execution and fake UI overlays to hijack Pix-QR transfers.
26 views
Daily Writeups
⤷ Title: Global Malicious AI Installer Campaign Targets Developer Workstations
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 27 May 2026 06:37:53 +0000
════════════════════════
⌗ Tags: #Cybercriminals #Claude Code #developer security #EclecticIQ #Fileless Malware #Gemini CLI #Infostealer Campaign #SEO Poisoning
16 views
Daily Writeups
⤷ Title: Advanced Lazarus Memory-Only Toolset Deeply Analyzed by Fox-IT
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 29 May 2026 06:33:06 +0000
════════════════════════
⌗ Tags: #Malware #DPAPILoader #Fileless Malware #Fox_IT #Lazarus Group #Memory_Only Malware #RemotePE #RemotePELoader #threat intelligence
Daily CyberSecurity
Advanced Lazarus Memory-Only Toolset Deeply Analyzed by Fox-IT
Fox-IT uncovers a sophisticated Lazarus memory-only toolset used to compromise financial firms via an evasive three-stage malware pipeline.
17 views