Daily Writeups
@Daily_Writeups
4.07K subscribers
4 photos
138K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
4.07K subscribers
Daily Writeups
⤷ Title: BRONZE SANDCASTLE Uses Sandboxie DLL Sideloading to Deploy Modified Meterpreter Backdoor
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Fri, 23 Oct 2026 06:22:49 +0000
════════════════════════
⌗ Tags: #Malware #backdoor #BRONZE SANDCASTLE #China APT #cyber_espionage #DLL Sideloading #meterpreter #Sandboxie DLL sideloading #Sophos
Daily CyberSecurity
BRONZE SANDCASTLE Uses Sandboxie DLL Sideloading to Deploy Modified Meterpreter Backdoor
At a glance Malware family Custom Meterpreter-style backdoor (versions 1.1.5 and 1.1.7) Threat actor BRONZE SANDCASTLE; suspected China-based Targets Organizations in the Philippines, Taiwan, Afgh…
18 views
Daily Writeups
⤷ Title: LiteLLM Supply Chain Attack Compromises PyPI and Docker
════════════════════════
𐀪 Author: Nam Phong
════════════════════════
ⴵ Time: Fri, 23 Oct 2026 08:58:36 +0000
════════════════════════
⌗ Tags: #Malware #cybersecurity #Infostealer #LiteLLM #PyPI #supply chain attack
Information Security News
LiteLLM Supply Chain Attack Compromises PyPI and Docker
Merely launching Python after installing LiteLLM triggered immediate credential theft. On October 21, threat actors injected a malicious data stealer into version 1.107.0. The compromise affected …
11 views
Daily Writeups
⤷ Title: INC Ransomware Affiliates Expose Seven Servers Holding Phantom AI Framework and 46 Encryptors
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Fri, 23 Oct 2026 08:01:29 +0000
════════════════════════
⌗ Tags: #Malware #CVE_2026_35616 #INC Ransomware affiliates #INC Ransomware affiliates AI #Phantom Framework #SOCRadar #The Gentlemen Ransomware
Daily CyberSecurity
INC Ransomware Affiliates Expose Seven Servers Holding Phantom AI Framework and 46 Encryptors
At a Glance Malware Family INC Ransomware (Rust-based encryptors), The Gentlemen extortion kit, Phantom framework, Ghost C2, and RevSocks Threat Actor Confirmed affiliates of INC Ransomware (MITRE…
15 views
Daily Writeups
⤷ Title: China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
════════════════════════
𐀪 Author: Ionut Arghire
════════════════════════
ⴵ Time: Fri, 23 Oct 2026 10:31:16 +0000
════════════════════════
⌗ Tags: #Artificial Intelligence #Malware & Threats #AI #China #China APT #ConnectWise #Microsoft
SecurityWeek
China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
The state-sponsored hackers targeted hundreds of organizations and gained privileged access to some environments.
32 views
Daily Writeups
⤷ Title: Speaker-Activated Backdoor Hijacks Speech AI Agents
════════════════════════
𐀪 Author: Nam Phong
════════════════════════
ⴵ Time: Fri, 23 Oct 2026 09:59:40 +0000
════════════════════════
⌗ Tags: #Malware #AI Agents #AI security #Backdoor #machine learning #Speaker_Activated Backdoor #Speech Recognition #Voice Cloning #Whisper
Information Security News
Speaker-Activated Backdoor Hijacks Speech AI Agents
A Backdoor That Listens for One Voice Researchers have taught speech recognition systems to recognize a specific person by voice. At that moment, the system secretly changes the person’s wor…
17 views
Daily Writeups
⤷ Title: Two Worms, One Blind Spot | RelayShield
════════════════════════
𐀪 Author: Relayshieldadmin
════════════════════════
ⴵ Time: Fri, 23 Oct 2026 00:00:23 GMT
════════════════════════
⌗ Tags: #supply_chain_security #infosec #malware #threat_intelligence #cybersecurity
Medium
Two Worms, One Blind Spot | RelayShield
Twice this year, npm has been hit by worms that spread from maintainer machine to maintainer machine. The two campaigns used opposite…
24 views
Daily Writeups
⤷ Title: In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
════════════════════════
𐀪 Author: SecurityWeek News
════════════════════════
ⴵ Time: Fri, 23 Oct 2026 14:23:37 +0000
════════════════════════
⌗ Tags: #Malware & Threats #In Other News
SecurityWeek
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
Noteworthy stories that might have slipped under the radar: Russia’s APT28 hit NATO defense firms, PingCAP source code stolen, ShinyHunters negotiator probe.
34 views
Daily Writeups
⤷ Title: Overlord RAT Uses Fake Legal Notices to Infect Windows PCs in New Campaign
════════════════════════
𐀪 Author: Deeba Ahmed
════════════════════════
ⴵ Time: Fri, 23 Oct 2026 17:31:31 +0000
════════════════════════
⌗ Tags: #Security #Malware #Brazil #Cyber Attack #Cybersecurity #Overlord RAT #Portugal #RAT #security #WatchGuard #Windows
Hackread
Overlord RAT Uses Fake Legal Notices to Infect Windows PCs in New Campaign
WatchGuard details Overlord RAT attacks using fake Brazilian legal notices, plus Lampion malware and a separate remote access campaign targeting users in Portugal.
14 views
Daily Writeups
⤷ Title: Skynet LLMjacking Agent Hijacks Exposed AI Models to Hack Servers and Mine Crypto
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Sat, 24 Oct 2026 01:14:31 +0000
════════════════════════
⌗ Tags: #Malware #AI Agents #AI security #Cryptojacking #exposed AI models #jailbreak #LLMjacking #MCP #Symantec
Daily CyberSecurity
Skynet LLMjacking Agent Hijacks Exposed AI Models to Hack Servers and Mine Crypto
Symantec researchers have captured the full playbook of an autonomous LLMjacking agent that hijacks exposed AI models to run its own attacks. Once connected, the agent can scan the internet, break…
21 views
Daily Writeups
⤷ Title: Day-O — Investigation Challenge
════════════════════════
𐀪 Author: Jose Praveen
════════════════════════
ⴵ Time: Sat, 24 Oct 2026 03:06:24 GMT
════════════════════════
⌗ Tags: #tryhackme #memory_forensics #cybersecurity #tryhackme_writeup #malware_analysis
Medium
Day-O — Investigation Challenge
A process left traces in memory. Analyze the evidence and uncover what the malware was set to do.
39 views
Daily Writeups
⤷ Title: Why That Harmless Photo Could Hack You in 2026: The Rise of Image Steganography (And 5 Ways to Spot…
════════════════════════
𐀪 Author: SecureByte
════════════════════════
ⴵ Time: Sat, 24 Oct 2026 06:16:45 GMT
════════════════════════
⌗ Tags: #cybersecurity #malware #technology #privacy #infosec
Medium
Why That Harmless Photo Could Hack You in 2026: The Rise of Image Steganography (And 5 Ways to Spot It)
You receive an innocent email from a business colleague with a standard landscape JPEG attached. Or perhaps you download a trending digital…
14 views
Daily Writeups
⤷ Title: Deconstructing Harvest Ransomware: A Static Analysis Walkthrough
════════════════════════
𐀪 Author: Vishwas Adhikari
════════════════════════
ⴵ Time: Sun, 25 Oct 2026 06:56:17 GMT
════════════════════════
⌗ Tags: #ransomware #malware_analysis #cybersecurity #infosec #info_sec_writeups
Medium
Deconstructing Harvest Ransomware: A Static Analysis Walkthrough
Ransomware targeting Linux environments continues to evolve. Unlike the bulky, multi-staged payloads often seen in Windows environments…
13 views
Daily Writeups
⤷ Title: The Waiting Room — Digital Forensics
════════════════════════
𐀪 Author: Jose Praveen
════════════════════════
ⴵ Time: Sun, 25 Oct 2026 07:26:01 GMT
════════════════════════
⌗ Tags: #digital_forensics #tryhackme_walkthrough #cybersecurity #malware_analysis #tryhackme
Medium
The Waiting Room — Digital Forensics
A supplier email hides an odd attachment. Follow the evidence and find what left the workstation.
18 views
Daily Writeups
⤷ Title: Amazon ClickFix Campaign Abuses Windows Finger Command to Drop Lumma Stealer and NetSupport
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Mon, 26 Oct 2026 06:03:23 +0000
════════════════════════
⌗ Tags: #Malware #Amazon ClickFix campaign #ClickFix #Doina #finger command #Huntress #LOLBIN #Lumma Stealer #Malvertising #NetSupport RAT
Daily CyberSecurity
Amazon ClickFix Campaign Abuses Windows Finger Command to Drop Lumma Stealer and NetSupport
At a glance Malware family Doina loader, a Node.js malware module, suspected Lumma Stealer, and a pirated NetSupport RMM client Threat actor Unknown; no attribution Targets Windows and macOS users…
15 views
Daily Writeups
⤷ Title: Popcorn Time Updater Flaw Threatened a Huge Botnet
════════════════════════
𐀪 Author: Nam Phong
════════════════════════
ⴵ Time: Mon, 26 Oct 2026 08:11:59 +0000
════════════════════════
⌗ Tags: #Malware #Abandoned Software #BOTNET #CVE_2026_30612 #Eye Security #Popcorn Time #remote code execution #Shadowserver #Time4Popcorn
Information Security News
Popcorn Time Updater Flaw Threatened a Huge Botnet
A Forgotten Backdoor on Millions of PCs An abandoned build of Popcorn Time kept a dangerous mechanism on millions of computers for years. Through it, anyone could quietly run code with top system …
20 views
Daily Writeups
⤷ Title: Dead Endpoint — Linux Disk Forensics, Command Injection, and Ransomware Key Recovery | TryHackMe
════════════════════════
𐀪 Author: Tarif Bin Belal
════════════════════════
ⴵ Time: Mon, 26 Oct 2026 08:25:39 GMT
════════════════════════
⌗ Tags: #cybersecurity #malware_analysis #tryhackme #incident_response
Medium
Dead Endpoint — Linux Disk Forensics, Command Injection, and Ransomware Key Recovery | TryHackMe
Introduction
34 views
Daily Writeups
⤷ Title: uCreator Android Spyware Hooks Telegram and WeChat Inside Virtual Containers
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Mon, 26 Oct 2026 07:08:56 +0000
════════════════════════
⌗ Tags: #Malware #Android Malware #LSPatch #mobile security #uCreator Android spyware #VirtualApp #YingGai uCreator Android spyware
Daily CyberSecurity
uCreator Android Spyware Hooks Telegram and WeChat Inside Virtual Containers
At a Glance Malware Family uCreator Android spyware (branded by the vendor as YingGai and packaged under com.ucreator.*) Threat Actor Confirmed artifacts tied to three Changsha, Hunan companies (H…
10 views
Daily Writeups
⤷ Title: 953 Online Stores Infected in Long-Lasting Malware Campaign
════════════════════════
𐀪 Author: Ionut Arghire
════════════════════════
ⴵ Time: Mon, 26 Oct 2026 12:46:44 +0000
════════════════════════
⌗ Tags: #Malware & Threats #magento #malware
SecurityWeek
953 Online Stores Infected in Long-Lasting Malware Campaign
Small loader code injected into the stores served a payload to visitors or did nothing to avoid detection.
26 views
Daily Writeups
⤷ Title: StealC Malware Returns as Stadia RAT After Operation Endgame Takedown
════════════════════════
𐀪 Author: Deeba Ahmed
════════════════════════
ⴵ Time: Mon, 26 Oct 2026 11:18:00 +0000
════════════════════════
⌗ Tags: #Security #Malware #Cyber Crime #Cybersecurity #FileFix #Operation Endgame #Phishing #RAT #security #Stadia #Stealc #Windows
Hackread
StealC Malware Returns as Stadia RAT After Operation Endgame Takedown
StealC's seller has returned with Stadia RAT, combining credential theft, hidden desktop control, and remote command execution using code reused from StealC v3.5.
10 views
Daily Writeups
⤷ Title: The Waiting Room — TryHackMe | DFIR Investigation Writeup
════════════════════════
𐀪 Author: Tarif Bin Belal
════════════════════════
ⴵ Time: Mon, 26 Oct 2026 20:00:47 GMT
════════════════════════
⌗ Tags: #tryhackme #cybersecurity #incident_response #digital_forensics #malware_analysis
Medium
The Waiting Room — TryHackMe | DFIR Investigation Writeup
Room: The Waiting Room Category: Digital Forensics & Incident Response (DFIR) Difficulty: Medium Platform: TryHackMe
21 views