Daily Writeups
@Daily_Writeups
4.12K subscribers
4 photos
138K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
4.12K subscribers
Daily Writeups
⤷ Title: Hijacked Accounts and AI Code: The Deadly New Playbook of Iranian APT ‘Boggy Serpens’
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Fri, 20 Mar 2026 01:00:11 +0000
════════════════════════
⌗ Tags: #Cybercriminals #AI_Generated Code #Boggy Serpens #Cyberespionage #cybersecurity #Hijacked Accounts #Iranian APT #phishing #Rust malware #threat intelligence #Unit 42
Daily CyberSecurity
Hijacked Accounts and AI Code: The Deadly New Playbook of Iranian APT 'Boggy Serpens'
Unit 42 reveals Iranian APT Boggy Serpens is weaponizing hijacked accounts, AI-generated code, and Rust malware to infiltrate critical infrastructure.
16 views
Daily Writeups
⤷ Title: Double Agents in the Cloud: Unit 42 Unmasks Critical AI Vulnerabilities in Google Vertex AI
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 06 Apr 2026 08:16:07 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #AI security #data exfiltration #Double Agents #GCP Security #Google Cloud Platform #infosec #P4SA #Python Pickle #rce #Service Accounts #Unit 42 #Vertex AI
Daily CyberSecurity
Double Agents in the Cloud: Unit 42 Unmasks Critical AI Vulnerabilities in Google Vertex AI
Unit 42 reveals how GCP Vertex AI agents can become "double agents," exfiltrating data and accessing Google’s internal code. Learn why BYOSA is essential.
43 views
Daily Writeups
⤷ Title: State-Sponsored Actors Weaponize Critical PAN-OS Zero-Day for Root
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 07 May 2026 01:55:47 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #buffer overflow #captive portal #CL_STA_1132 #CVE_2026_0300 #cyber_espionage #Edge Security #infosec #Palo Alto Networks #PAN_OS #Root RCE #Unit 42 #zero_day
Daily CyberSecurity
State-Sponsored Actors Weaponize Critical PAN-OS Zero-Day for Root
Palo Alto Networks warns of active root RCE (CVE-2026-0300) in PAN-OS. State-sponsored cluster CL-STA-1132 is targeting edge assets. Patch and restrict now!
11 views
Daily Writeups
⤷ Title: The Zero-Detection Shadow: Unit 42 Exposes Advanced Gremlin Stealer Hijacking Live Browser WebSockets
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Wed, 20 May 2026 07:42:37 +0000
════════════════════════
⌗ Tags: #Malware #.NET Resource Obfuscation #Chromium Identity Theft #Code Virtualization Bytecode #Cookie Protection Bypass #Cryptojacking Clipboard Hijacker #Gremlin Stealer Malware #Unit 42 Palo Alto Networks #WebSocket Session Hijacking #XOR Encoded Payload #Zero Detection C2 Infrastructure
Information Security News
The Zero-Detection Shadow: Unit 42 Exposes Advanced Gremlin Stealer Hijacking Live Browser WebSockets - Information Security News
The exfiltration of administrative credentials and volatile session tokens increasingly manifests not as a rudimentary brute-force incursion, but as a meticulously obfuscated mechanism engineered to maintain absolute silence until the definitive moment of…
14 views
Daily Writeups
⤷ Title: Bypassing MFA: Gremlin Stealer Evolves into Advanced Memory-Resident Session Hijacker
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Thu, 21 May 2026 07:26:35 +0000
════════════════════════
⌗ Tags: #Malware #Chromium Browsers #Clipboard Hijacker #Control Flow Flattening #Cyber Security #Discord Token Stealer #Gremlin Stealer #infosec #Infostealer #MFA Bypass #Session Hijacking #Unit 42
Daily CyberSecurity
Bypassing MFA: Gremlin Stealer Evolves into Advanced Memory-Resident Session Hijacker
Unit 42 exposes the new Gremlin stealer. It uses memory-resident techniques to hijack active browser session tokens and completely bypass MFA.
17 views
Daily Writeups
⤷ Title: New Screening Serpens Cyberattacks Target Global Technology Professionals
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 27 May 2026 12:54:46 +0000
════════════════════════
⌗ Tags: #Cybercriminals #AppDomain Manager Hijacking #APT group #cyber_espionage #Malware Variants #Screening Serpens #threat intelligence #Unit 42
Daily CyberSecurity
New Screening Serpens Cyberattacks Target Global Technology Professionals
Learn about the latest Screening Serpens cyberattacks exposed by Unit 42. Discover their new RAT variants and advanced defensive evasion tactics.
6 views
Daily Writeups
⤷ Title: Malicious OpenClaw Skills on ClawHub Deliver Infostealers and Crypto Fraud
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Wed, 01 Jul 2026 07:01:10 +0000
════════════════════════
⌗ Tags: #Malware #agentic threats #AI supply chain #AMOS #ClawHavoc #ClawHub #Infostealer #malicious skills #OpenClaw #Palo Alto Networks #Unit 42
Daily CyberSecurity
Malicious OpenClaw Skills on ClawHub Deliver Infostealers and Crypto Fraud
At a glance Field Detail Actor Unattributed skill publishers; accounts banned by OpenClaw Activity Malicious AI agent skills: infostealer delivery, scanner evasion, agentic financial fraud Targets…
18 views
Daily Writeups
⤷ Title: Phantom Squatting Attacks Weaponize AI Hallucinated Domains, Unit 42 Warns
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Wed, 08 Jul 2026 08:13:32 +0000
════════════════════════
⌗ Tags: #Cybercriminals #AI security #LLM Hallucination #Phantom Squatting #phishing #Unit 42
Daily CyberSecurity
Phantom Squatting Attacks Weaponize AI Hallucinated Domains, Unit 42 Warns
At a glance Details Activity type Phantom squatting: registering AI hallucinated domains for phishing and malware Actors Multiple suspected threat actors, including the “Montana Empire&#8221…
7 views
Daily Writeups
⤷ Title: TuxBot v3 Evolution — an IoT Botnet Built With LLM Help
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Tue, 21 Jul 2026 08:11:55 +0000
════════════════════════
⌗ Tags: #Malware #Akiru #ddos #IoT botnet #Keksec #LLM malware #TuxBot #Unit 42
Daily CyberSecurity
TuxBot v3 Evolution — an IoT Botnet Built With LLM Help
At a glance Malware family TuxBot v3 Evolution (also tracked as Akiru) Threat actor Suspected link to the Keksec ecosystem; no confirmed named actor Target / victims IoT devices across 30+ device …
14 views
Daily Writeups
⤷ Title: Chinese Threat Actor Runs Autonomous AI Cyberattacks Using DeepSeek
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Wed, 05 Aug 2026 06:30:55 +0000
════════════════════════
⌗ Tags: #Cybercriminals #AI security #Autonomous AI Cyberattack #Chinese Threat Actor #DeepSeek #Hermes Agent #Palo Alto Networks #threat intelligence #Unit 42
Daily CyberSecurity
Chinese Threat Actor Runs Autonomous AI Cyberattacks Using DeepSeek
At a glance Field Detail Actor Chinese-speaking operator, aliases knaithe and KnYuan Activity AI-enabled autonomous hacking campaign Targets Internet-exposed infrastructure, Chinese systems, and a…
13 views
Daily Writeups
⤷ Title: 45% of Malware C2 Traffic Bypasses DNS by Connecting Directly to IP Addresses
════════════════════════
𐀪 Author: Nam Phong
════════════════════════
ⴵ Time: Fri, 07 Aug 2026 13:44:29 +0000
════════════════════════
⌗ Tags: #Malware #C2 Traffic #Direct_to_IP #Malware DNS Bypass #Mozi botnet #Phorpiex #SectopRAT #Unit 42 #ZT_IP Security
Information Security News
45% of Malware C2 Traffic Bypasses DNS by Connecting Directly to IP Addresses
Many defensive systems monitor domain name queries as their primary window into outbound malicious activity – but malware families are increasingly circumventing this approach by communicati…
11 views
Daily Writeups
⤷ Title: Google Password Manager Passkey Bypasses Uncovered
════════════════════════
𐀪 Author: Nam Phong
════════════════════════
ⴵ Time: Thu, 06 Aug 2026 12:08:43 +0000
════════════════════════
⌗ Tags: #Vulnerability #cybersecurity #Google Password Manager #Passkeys #Unit 42 #windows
Information Security News
Google Password Manager Passkey Bypasses Uncovered
The Transition to Passwordless Security Passwords are gradually giving way to passkeys as the primary means of digital authentication. Nevertheless, account security remains heavily dependent on h…
11 views
Daily Writeups
⤷ Title: ChainDrop npm Worm Hits 400+ Packages via Blockchain C2
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Thu, 13 Aug 2026 07:29:07 +0000
════════════════════════
⌗ Tags: #Malware #Blockchain C2 #ChainDrop #CI/CD security #npm Worm #supply chain attack #Unit 42
Daily CyberSecurity
ChainDrop npm Worm Hits 400+ Packages via Blockchain C2
At a glance Malware family ChainDrop (Shai-Hulud code lineage) Threat actor Unattributed; possible link to TeamPCP (not confirmed) Targets Developer workstations, CI pipelines, cloud environments …
29 views
Daily Writeups
⤷ Title: Attackers Use AI Tools to Hit Latin American Orgs
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Wed, 09 Sep 2026 00:04:26 +0000
════════════════════════
⌗ Tags: #Cybercriminals #AI_powered cyberattacks #Latin America #NextChat #SockTz #threat intelligence #Unit 42
Daily CyberSecurity
Attackers Use AI Tools to Hit Latin American Orgs
At a Glance Threat clusters CL-CRI-1131 and CL-CRI-1163 Activity type Network intrusion and data exfiltration, AI-assisted Targets Transportation, government, water utilities, financial sector Jur…
21 views
Daily Writeups
⤷ Title: Palo Alto Launches a Continuous AI Pentesting Service
════════════════════════
𐀪 Author: Nam Phong
════════════════════════
ⴵ Time: Thu, 24 Sep 2026 07:51:57 +0000
════════════════════════
⌗ Tags: #Technology #AI Agents #Claude Mythos #GPT_5.6_Cyber #Palo Alto Networks #Pentesting #Unit 42
Information Security News
Palo Alto Launches a Continuous AI Pentesting Service
Penetration testing is ceasing to be a rare checkup and turning into a tool of constant digital monitoring. Palo Alto Networks has unveiled Unit 42 Continuous Frontier AI Defense, a service that u…
24 views
Daily Writeups
⤷ Title: Iran-Linked Hackers Pose as Dubai Airports Recruiters in Blinder Tunnel Campaign Against Iraq
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Thu, 08 Oct 2026 07:11:01 +0000
════════════════════════
⌗ Tags: #Cybercriminals #AppDomainManager hijacking #Blinder Tunnel #CL_STA_1178 #fake job lure #Github C2 #Iran #ShelbyLoader #Unit 42
Daily CyberSecurity
Iran-Linked Hackers Pose as Dubai Airports Recruiters in Blinder Tunnel Campaign Against Iraq
At a Glance Actor CL-STA-1178, assessed as Iranian state-aligned (high confidence, per Unit 42) Activity Fake job lures, trojanized coding tests, GitHub-based espionage malware, credential phishin…
❤1
24 views
Daily Writeups
⤷ Title: CL-STA-0954 Deploys PEERSTITCH Malware on FortiGate Firewalls After FortiManager Breach
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Thu, 15 Oct 2026 02:11:28 +0000
════════════════════════
⌗ Tags: #Malware #CL_STA_0954 #CVE_2024_47575 #CVE_2025_61624 #FortiOS PEERSTITCH malware #PEERSTITCH malware #Unit 42
Daily CyberSecurity
CL-STA-0954 Deploys PEERSTITCH Malware on FortiGate Firewalls After FortiManager Breach
At a Glance Malware Family PEERSTITCH malware (64-bit Linux ARM64 in-memory process injector) Threat Actor Confirmed as cluster CL-STA-0954 (tracked by Mandiant as UNC5820); suspected nation-state…
19 views
Daily Writeups
⤷ Title: Qilin, Inc and Settra Ransomware Gangs Exploit PAN-OS Flaw CVE-2026-0257 for VPN Access
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Tue, 20 Oct 2026 08:18:27 +0000
════════════════════════
⌗ Tags: #Malware #CVE_2026_0257 #GlobalProtect authentication bypass #INC ransomware #PAN_OS #Qilin Ransomware #ReliaQuest #Settra ransomware #Unit 42 #VPN security
Daily CyberSecurity
Qilin, Inc and Settra Ransomware Gangs Exploit PAN-OS Flaw CVE-2026-0257 for VPN Access
At a glance Malware family Qilin, Inc, and Settra ransomware; Cobalt Strike and BloodHound in related activity Threat actors Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc), per Unit 42; Sett…
17 views
Daily Writeups
⤷ Title: CL-UNK-1211 Deploys SysGoRAT Malware and AI Scripts Against Government Linux Servers
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Wed, 21 Oct 2026 07:15:08 +0000
════════════════════════
⌗ Tags: #Malware #AI security #CL_UNK_1211 #CL_UNK_1211 SysGoRAT malware #Linux Malware #SysGoRAT malware #Unit 42
Daily CyberSecurity
CL-UNK-1211 Deploys SysGoRAT Malware and AI Scripts Against Government Linux Servers
At a Glance Malware Family SysGoRAT malware (cross-platform Go remote access trojan), PHP web shells, and AI-generated bash and PHP scripts Threat Actor Confirmed as cluster CL-UNK-1211; nation-st…
21 views
Daily Writeups
⤷ Title: PAN-OS Flaw Fuels Qilin and Inc Ransomware Attacks
════════════════════════
𐀪 Author: Nam Phong
════════════════════════
ⴵ Time: Thu, 22 Oct 2026 07:34:36 +0000
════════════════════════
⌗ Tags: #Malware #CVE_2026_0257 #GlobalProtect #Inc Ransomware #Palo Alto Networks #PAN_OS #Qilin #ransomware #Unit 42
Information Security News
PAN-OS Flaw Fuels Qilin and Inc Ransomware Attacks
A Firewall Bug Becomes a Ransomware Tool A flaw in Palo Alto Networks enterprise firewalls has become a full-fledged ransomware tool. It lets attackers enter protected networks without a password.…
11 views