⤷ Title: Inside the Masjesu IoT Botnet’s 3-Year Stealth Reign
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 14 Apr 2026 07:05:05 +0000
════════════════════════
⌗ Tags: #Malware #C2 Infrastructure #D_Link #DDoS_for_hire #GPON #IoT security #Malware Analysis #Masjesu Botnet #Netgear #Trellix ARC #XOR encryption
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 14 Apr 2026 07:05:05 +0000
════════════════════════
⌗ Tags: #Malware #C2 Infrastructure #D_Link #DDoS_for_hire #GPON #IoT security #Malware Analysis #Masjesu Botnet #Netgear #Trellix ARC #XOR encryption
Daily CyberSecurity
Inside the Masjesu IoT Botnet’s 3-Year Stealth Reign
Trellix ARC reveals Masjesu, a stealthy, professional IoT botnet operational since 2023. Targeted DDoS-for-hire with a low-profile strategy. Patch now!
⤷ Title: 108 Coordinated Chrome Extensions Hijack Your Private Telegram Sessions
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 15 Apr 2026 01:00:22 +0000
════════════════════════
⌗ Tags: #Malware #browser security #C2 Infrastructure #Chrome extensions #cybersecurity #Google OAuth #infosec #malware #Session Hijacking #Socket Research #Telegram
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 15 Apr 2026 01:00:22 +0000
════════════════════════
⌗ Tags: #Malware #browser security #C2 Infrastructure #Chrome extensions #cybersecurity #Google OAuth #infosec #malware #Session Hijacking #Socket Research #Telegram
Daily CyberSecurity
108 Coordinated Chrome Extensions Hijack Your Private Telegram Sessions
Socket identifies 108 malicious Chrome extensions stealing Telegram sessions and Google IDs. 20,000 installs hit—audit your browser extensions immediately!
⤷ Title: Signed, Trusted, and Abused: Proxy Execution via WebView2
════════════════════════
𐀪 Author: BHIS
════════════════════════
ⴵ Time: Wed, 15 Apr 2026 14:00:00 +0000
════════════════════════
⌗ Tags: #C2 #How_To #Matthew Eidelberg #Red Team #DLL sideloading #initial access
════════════════════════
𐀪 Author: BHIS
════════════════════════
ⴵ Time: Wed, 15 Apr 2026 14:00:00 +0000
════════════════════════
⌗ Tags: #C2 #How_To #Matthew Eidelberg #Red Team #DLL sideloading #initial access
Black Hills Information Security
Signed, Trusted, and Abused: Proxy Execution via WebView2 - Black Hills Information Security, Inc.
An offensive security perspective on Microsoft Edge WebView2 Runtime, including architectural weaknesses, existing vulnerabilities, and exploitation methods.
⤷ Title: The Open Vault: How a Flaw in the Rhadamanthys Control Panel Saved 70,000 Victims
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 20 Apr 2026 08:10:08 +0000
════════════════════════
⌗ Tags: #Malware #API Vulnerability #C2 Server #Command and Control #cybersecurity #Infostealer #malware #Rhadamanthys #SANS CTI Summit 2026 #threat intelligence #Victim Notification
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 20 Apr 2026 08:10:08 +0000
════════════════════════
⌗ Tags: #Malware #API Vulnerability #C2 Server #Command and Control #cybersecurity #Infostealer #malware #Rhadamanthys #SANS CTI Summit 2026 #threat intelligence #Victim Notification
Penetration Testing Tools
The Open Vault: How a Flaw in the Rhadamanthys Control Panel Saved 70,000 Victims
A vulnerability within the control panel of the Rhadamanthys infostealer unexpectedly provided a rare opportunity to safeguard victims,
⤷ Title: The Administrator’s Shadow: How Hackers Turned a Popular GitHub Utility into an Invisible C2 Backdoor
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Wed, 06 May 2026 07:41:41 +0000
════════════════════════
⌗ Tags: #Malware #Behavioral Heuristics #C2 Server #Cybersecurity 2026 #Github #Huntress #Impacket #Komari #Living_off_the_land #NSSM #RDP #Remote Access Trojan #VPN Breach
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Wed, 06 May 2026 07:41:41 +0000
════════════════════════
⌗ Tags: #Malware #Behavioral Heuristics #C2 Server #Cybersecurity 2026 #Github #Huntress #Impacket #Komari #Living_off_the_land #NSSM #RDP #Remote Access Trojan #VPN Breach
Penetration Testing Tools
The Administrator’s Shadow: How Hackers Turned a Popular GitHub Utility into an Invisible C2 Backdoor
Adversaries no longer find it requisite to engineer sophisticated malware from its inception. Frequently, the appropriation of a
⤷ Title: The Claude AI Trap: Sophos Uncovers Undocumented Backdoor Hiding in Fake “Pro” Lure
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 11 May 2026 08:01:29 +0000
════════════════════════
⌗ Tags: #Malware #Anthropic #backdoor #C2 Infrastructure #Claude AI #cybersecurity #DonutLoader #G DATA Sideloading #Malvertising #malware #phishing #Sophos X_Ops #threat intelligence
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 11 May 2026 08:01:29 +0000
════════════════════════
⌗ Tags: #Malware #Anthropic #backdoor #C2 Infrastructure #Claude AI #cybersecurity #DonutLoader #G DATA Sideloading #Malvertising #malware #phishing #Sophos X_Ops #threat intelligence
Daily CyberSecurity
The Claude AI Trap: Sophos Uncovers Undocumented Backdoor Hiding in Fake "Pro" Lure
Sophos X-Ops uncovers a fake Claude AI site (claude-pro.com) distributing an undocumented backdoor via DonutLoader. Protect your team from AI-themed lures.
⤷ Title: Vidar Stealer Weaponizes AutoIt and Masqueraded Scripts
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 12 May 2026 06:02:50 +0000
════════════════════════
⌗ Tags: #Malware #AutoIt #C2 Communication #Credential Theft #cybersecurity #File Extension Masquerading #infosec #LevelBlue #living_off_the_land #Malware Analysis #Self_Deleting Malware #Vidar Stealer
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 12 May 2026 06:02:50 +0000
════════════════════════
⌗ Tags: #Malware #AutoIt #C2 Communication #Credential Theft #cybersecurity #File Extension Masquerading #infosec #LevelBlue #living_off_the_land #Malware Analysis #Self_Deleting Malware #Vidar Stealer
Daily CyberSecurity
Vidar Stealer Weaponizes AutoIt and Masqueraded Scripts
LevelBlue unmasks a stealthy Vidar Stealer campaign using AutoIt scripts and file renaming tricks to bypass EDR and harvest credentials. Is your system at risk?
⤷ Title: JDownloader Site Breach Installs Rootkits that Kill Your Antivirus
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 13 May 2026 06:09:45 +0000
════════════════════════
⌗ Tags: #Malware #antivirus bypass #C2 Dead_Drop #Code Integrity #Cyber Security #Gen Digital #infosec #JDownloader #Malware Analysis #Pyarmor #r77 Rootkit #supply chain attack #WDAC
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 13 May 2026 06:09:45 +0000
════════════════════════
⌗ Tags: #Malware #antivirus bypass #C2 Dead_Drop #Code Integrity #Cyber Security #Gen Digital #infosec #JDownloader #Malware Analysis #Pyarmor #r77 Rootkit #supply chain attack #WDAC
Daily CyberSecurity
JDownloader Site Breach Installs Rootkits that Kill Your Antivirus
Gen Digital exposes a JDownloader site breach (May 6-7, 2026). Attackers used WDAC policies to kill antivirus and r77 rootkits for total system invisibility.
⤷ Title: New “TencShell” Malware Weaponizes Open-Source Rshell via Third-Party Access
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 18 May 2026 12:28:23 +0000
════════════════════════
⌗ Tags: #Malware #C2 Framework #Cato CTRL #Cyber Security #Donut Shellcode #infosec #Malware Analysis #Rshell #supply chain attack #TencShell #third_party risk #threat intelligence
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 18 May 2026 12:28:23 +0000
════════════════════════
⌗ Tags: #Malware #C2 Framework #Cato CTRL #Cyber Security #Donut Shellcode #infosec #Malware Analysis #Rshell #supply chain attack #TencShell #third_party risk #threat intelligence
Daily CyberSecurity
New "TencShell" Malware Weaponizes Open-Source Rshell via Third-Party Access
Cato CTRL intercepts "TencShell," a new stealth malware derived from open-source Rshell. Attackers use third-party access to breach networks!
⤷ Title: Disrupted: How the “Trapdoor” Ad Fraud Ring Weaponized 455 Android Apps for 659 Million Daily Fake Bids
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 25 May 2026 08:01:56 +0000
════════════════════════
⌗ Tags: #Cybercriminals #Ad Fraud Pipeline #Android Malvertising #Anti_Analysis Evasion #C2 Domains #Cyber Security #HUMAN Satori #infosec #mobile security #Touch Event Simulation #Trapdoor Malware #WebView Exploit
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 25 May 2026 08:01:56 +0000
════════════════════════
⌗ Tags: #Cybercriminals #Ad Fraud Pipeline #Android Malvertising #Anti_Analysis Evasion #C2 Domains #Cyber Security #HUMAN Satori #infosec #mobile security #Touch Event Simulation #Trapdoor Malware #WebView Exploit
Daily CyberSecurity
Disrupted: How the "Trapdoor" Ad Fraud Ring Weaponized 455 Android Apps for 659 Million Daily Fake Bids
HUMAN's Satori team disrupted Trapdoor, an Android ad fraud ring using 455 apps and hidden WebViews to fake 659 million daily ad bids.