ToastSec @ToastSec

information security, machos and toast. toastsec.com/?I_AM_COOL Joined September 2023

Tweets

63
Followers

30
Following

165
Likes

118

ToastSec @ToastSec

4 months ago

@majatrebacz Thanks for the research Maja. I’m sure security teams around the world appreciate this assistant

0 0 1 1K 0

View Details

Bias in CTI attribution is harder to shake than you think. The DPRK/cybercrime boundary has always been blurry, but today I got a personal reminder of just how biased I still am. Here's what happened: 1⃣ First look: I encountered a compiled AppleScript malware (Zoom Audio SDK Update.scpt, MD5: 743f60f02d352201e2df36805f1ec00d). I suspected a link to `APT38` due to their known use of similar social engineering lures, including ClickFix techniques. 2⃣ Deeper dive: I checked the 2nd and 3rd stage payloads. I told myself they'd just changed their tradecraft. Still convinced it was DPRK. 3⃣ Final payload: The last-stage AppleScript was focused on stealing a wide range of sensitive data from the victim. Something felt off. I ran it through my IOC search bot. Result: `SHub Infostealer`, known crimeware, nothing to do with DPRK. DataDog published a solid write-up on it: 🔗 securitylabs.datadoghq.com/articles/tech-… If I had stopped at stage 1 or 2, I would have published a completely wrong attribution. Attribution requires full context. Our prior knowledge is a lens that helps us work faster, but it's also a blindfold. The more deeply you specialize in one actor, the more you'll see that actor everywhere. Stay humble. Follow the evidence to the end.

3 34 141 15K 49

View Details

Curtis @cybershtuff

5 months ago

Infrastructure pivots have identified a high-confidence link to DPRK-nexus activity (#TA444). The #Axios C2 shares a unique ETag with 23.254.167[.]216 also hosted on Hostwinds AS54290. This specific IP is a documented artifact of the "JustJoin" campaigns from @Huntio.

3 16 46 6K 36

View Details

ToastSec @ToastSec

7 months ago

@0x4D31 @perplexity_ai Congrats dude; you're going to absolutely smash it! Wishing you the best!

1 0 1 55 0

View Details

Adel Ka @0x4D31

12 months ago

the commit that introduced the ci/cd vuln—used as the initial access vector in the s1ngularity attack—was co-authored by claude! first real incident from insecure ai-written code? gpt-5 and even 4o flagged it instantly, but somehow it slipped past their ai code review 🤔

Adnan Khan @adnanthekhan

a year ago

What a PR github.com/nrwl/nx/pull/3… by @NxDevTools This one was written by AI and introduces a critical PR title injection that could allow anyone to steal their NPM token with a little privesc. How is stuff like this still shipping?

6 8 81 43K 44

2 5 23 4K 6

View Details

ToastSec @ToastSec

a year ago

@_rdowd Also received and thought the same thing 🤔

1 0 1 105 0

View Details

Marcelo Rivero @MarceloRivero

2 years ago

#Odyssey new macOS malware #Stealer 🍎 - Just another #AMOS fork. 🤔 - C2: poseidon[.]cool - Saves stolen data in `/tmp/pizda/` - More structured Apple Notes exfiltration - Uses AppleScript (`osascript`) instead of pure shell.

5 20 102 8K 38

View Details

ToastSec @ToastSec

2 years ago

@osint_barbie @bing FYI I’ve also observed distribution via Facebook Advertisements (mostly targeting LLM apps). I found you can Meta exposes all their ads which is great for finding more distributions facebook.com/ads/library/

0 0 1 64 0

View Details

ToastSec @ToastSec

2 years ago

@suyog41 @banthisguy9349 The greatest compliment you can receive.

0 0 3 171 0

View Details

Fox_threatintel @banthisguy9349

2 years ago

Well I gues we where spot on! x.com/banthisguy9349… Amos Stealer botnet actors registrated a domain exactly like @suyog41 twitter handle!

Yogesh Londhe @suyog41

2 years ago

Amos Stealer AMOS registered domain with my name C2 [New] yogeshlond[.]cfd 🤣 hdking[.]cfd bfgnet[.]cfd explosem[.]cfd update 2a9e9815739f5144d7442229cfb9bfcf Launcher c90930423cae1497d13dd3e764ee35ed 8a41a304faa8bbbd061fe95daf4dd071 2a18a668c24e74be52fd61052b4c6a86

3 7 50 8K 18

2 4 18 3K 2

View Details

ToastSec @ToastSec

2 years ago

@StrikeReadyLabs Feels LLM-assisted

0 0 0 211 0

View Details

ToastSec @ToastSec

2 years ago

@osint_barbie The enemy of my enemy is my friend...?!

0 0 1 24 0

View Details

xiu @osint_barbie

2 years ago

seems like they've realized that targeting other cybercriminals with stealers could be more profitable than going after ordinary users lol

Bruce Ketta @bruce_k3tta

2 years ago

New #macOS #stealer with 0 VT hits Written in C++, it gathers info about the system, collects keychain data, browser data & crypto wallets (Chrome & Brave) Cool things: 1. Uses uploadcare.com to exfiltrate data 2. Please put your psw to access XSS forum (??!!?)

4 21 55 21K 25

2 2 12 912 0

View Details

ToastSec @ToastSec

2 years ago

@g0njxa @vxunderground Do you guys have a plan/playbook in-case you get raided?

0 0 0 31 0

View Details

ToastSec @ToastSec

2 years ago

@g0njxa @vxunderground Have you ever thought about quitting while ahead? How much money would be required for you to cease operations?

0 0 0 31 0

View Details

ToastSec @ToastSec

2 years ago

@TLP_R3D It's great that these are being found so early in their attack; nice one dude.

0 0 1 210 0

View Details

ToastSec @ToastSec

2 years ago

@500mk500 Have you observed these hosting anything? I'm not seeing anything interesting yet.

1 0 0 31 0

View Details

ToastSec @ToastSec

2 years ago

@L0Psec @Steph3nSims That's also a pretty sweet end trick with the Base64 ;)

0 0 2 15 0

View Details

ToastSec @ToastSec

2 years ago

@L0Psec @Steph3nSims This has given me an irrational hatred of SwiftUI and Elevate.

1 0 1 74 0

View Details

ToastSec @ToastSec

2 years ago

@UK_Daniel_Card I looked at these briefly and noted some hosting providers that looked like small internet gateways, so it may be worth checking those. It is a little annoying when people provide Mullvad VPN IoCs without disclaiming them as such