Daily Writeups
@Daily_Writeups
3.55K subscribers
2 photos
130K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
3.55K subscribers
Daily Writeups
⤷ Title: SHADOW#REACTOR Malware Builds Remcos RAT via Text Files
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 15 Jan 2026 00:27:15 +0000
════════════════════════
⌗ Tags: #Malware #Cyber Security #Fileless Malware #living_off_the_land #Malware Analysis #MSBuild #powershell #Remcos RAT #Securonix #SHADOW#REACTOR #Text_Based Payload
Daily CyberSecurity
SHADOW#REACTOR Malware Builds Remcos RAT via Text Files
Securonix reveals SHADOW#REACTOR: A stealthy framework using "text-only" fragments to deploy Remcos RAT in memory via MSBuild. Avoids disk detection.
26 views
Daily Writeups
⤷ Title: Trusted Tool Turned Traitor: Signed ‘ahost.exe’ Weaponized to Sideload Malware
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 16 Jan 2026 00:12:59 +0000
════════════════════════
⌗ Tags: #Vulnerability #AgentTesla #ahost.exe #c_ares #DLL Sideloading #GitKraken #infosec #living_off_the_land #Malware Analysis #Remcos #supply chain attack #Trellix
Daily CyberSecurity
Trusted Tool Turned Traitor: Signed ‘ahost.exe’ Weaponized to Sideload Malware
A routine utility often bundled with developer tools has been weaponized by cybercriminals to bypass security scanners and deliver a payload of devastating malware. The Trellix Advanced Research C…
12 views
Daily Writeups
⤷ Title: The API Assassin: How “LOLAPI” Unmasks the Native Commands Turning Windows and Cloud Against You
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Thu, 05 Feb 2026 04:10:58 +0000
════════════════════════
⌗ Tags: #Open Source Tool #.NET reflection #API abuse #AWS #Azure #Cloud metadata #COM objects #cyber security news 2026 #GCP #Living_off_the_land #LOLAPI #Magic Claw #Windows API #WMI
Penetration Testing Tools
The API Assassin: How "LOLAPI" Unmasks the Native Commands Turning Windows and Cloud Against You
Magic Claw’s LOLAPI repository catalogs over 50 native Windows and Cloud APIs used by hackers to bypass WDAC and EDR. See the 2026 guide to stealthy API abuse.
20 views
Daily Writeups
⤷ Title: Email Under Siege: Storm-2603 Exploits SmarterMail to Deploy Warlock Ransomware
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 13 Feb 2026 00:28:27 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CVE_2026_23760 #CVE_2026_24423 #Email Security #living_off_the_land #Patch Alert #ReliaQuest #SmarterMail #Storm_2603 #Velociraptor #Warlock Ransomware
Daily CyberSecurity
Email Under Siege: Storm-2603 Exploits SmarterMail to Deploy Warlock Ransomware
Storm-2603 exploits SmarterMail vulnerability CVE-2026-23760 to deploy Warlock ransomware. Upgrade to Build 9511 immediately to prevent system compromise.
32 views
Daily Writeups
⤷ Title: Don’t Click That Shortcut: Phorpiex Botnet Hides in “Your Document” Emails
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 16 Feb 2026 00:56:25 +0000
════════════════════════
⌗ Tags: #Malware #botnet #Forcepoint #living_off_the_land #LNK File #malware #phishing #Phorpiex #powershell #Trik #Windows Security
Daily CyberSecurity
Don't Click That Shortcut: Phorpiex Botnet Hides in "Your Document" Emails
Phorpiex botnet returns in "Your Document" phishing campaign. Attackers use malicious .LNK files and hidden extensions to trick users.
24 views
Daily Writeups
⤷ Title: Hiding in Plain Sight: APT28’s “Operation MacroMaze” Hits European Govs
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 17 Feb 2026 00:32:54 +0000
════════════════════════
⌗ Tags: #Cyber Security #APT28 #cyber_espionage #Fancy Bear #Forest Blizzard #Lab52 #living_off_the_land #Macro Malware #Operation MacroMaze #Spanish Government #Webhook.site
Daily CyberSecurity
Hiding in Plain Sight: APT28's "Operation MacroMaze" Hits European Govs
APT28's "Operation MacroMaze" targets Europe using Spanish gov decoys. The campaign uses "low-tech" macros & Webhook.site to evade detection.
20 views
Daily Writeups
⤷ Title: Beyond Ukraine: Mercenary Akula Spearphishing Hits European Finance with Russian Remote Admin Tools
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 27 Feb 2026 03:40:30 +0000
════════════════════════
⌗ Tags: #Cybercriminals #BlueVoyant #cyber_espionage #European Finance #infosec #living_off_the_land #Mercenary Akula #Remote Manipulator System #RMS #Spearphishing #UAC_0050
Daily CyberSecurity
Beyond Ukraine: Mercenary Akula Spearphishing Hits European Finance with Russian Remote Admin Tools
BlueVoyant uncovers a shift in Mercenary Akula (UAC-0050) tactics, targeting European financial institutions via spoofed judicial lures and RMS malware.
21 views
Daily Writeups
⤷ Title: The “CrashFix” Evolution: KongTuke’s New Playbook for Enterprise Infiltration
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 13 Mar 2026 00:12:28 +0000
════════════════════════
⌗ Tags: #Malware #ClickFix #CrashFix #cybersecurity #infosec #KongTuke #living_off_the_land #LotL #ModeloRAT #threat intelligence #Trend Micro
Daily CyberSecurity
The "CrashFix" Evolution: KongTuke’s New Playbook for Enterprise Infiltration
Trend Micro exposes KongTuke's new "CrashFix" tactic, which tricks enterprise users via fake Chrome errors into deploying the fileless modeloRAT backdoor.
31 views
Daily Writeups
⤷ Title: The AI-Powered Arsenal: How ‘Forbidden Hyena’ Uses Generative AI to Spawn BlackReaperRAT
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 20 Mar 2026 07:15:31 +0000
════════════════════════
⌗ Tags: #Cybercriminals #AI Malware #BI.ZONE #BlackReaperRAT #cybersecurity #Forbidden Hyena #Generative AI #infosec #living_off_the_land #Milkyway Ransomware #threat intelligence
Daily CyberSecurity
The AI-Powered Arsenal: How 'Forbidden Hyena' Uses Generative AI to Spawn BlackReaperRAT
BI.ZONE uncovers Forbidden Hyena using AI-generated code to deploy the new BlackReaperRAT and Milkyway ransomware in highly evasive cyberattacks.
26 views
Daily Writeups
⤷ Title: The Trust Trap: How Cyber Marauders Are Turning WhatsApp Into a Windows Infection Engine
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Fri, 03 Apr 2026 07:52:08 +0000
════════════════════════
⌗ Tags: #Malware #cloud security #Cybersecurity 2026 #Living_off_the_land #malware #Microsoft Defender #phishing #Social Engineering #Visual Basic #WhatsApp #Windows Security
Penetration Testing Tools
The Trust Trap: How Cyber Marauders Are Turning WhatsApp Into a Windows Infection Engine
In the waning days of February 2026, cyber adversaries inaugurated a nascent campaign characterized by an unorthodox stratagem:
6 views