l0kki @lokithemarvel

Imagine receiving a normal WhatsApp message from someone… and later discovering that the message secretly contained their exact location, even though they never shared it. That’s exactly what happened during a recent forensic extraction I performed on my iPhone 12 Pro Max. During the analysis, I found a I decided to pick a message I received from @RedHatPentester, on 3rd September 2025 at 7:11 AM. Nothing unusual at first glance just a regular text. But deep inside the message metadata, the phone had silently logged: @RedHatPentester exact location at the moment he sent that message. He didn’t share it intentionally. I didn’t request it. Yet the device recorded it automatically. This was extracted directly from my own phone, meaning: If your location is turned ON while chatting on WhatsApp, your exact location can be extracted from someone else’s device if theirs undergoes forensic imaging. Most people have absolutely no idea this happens. But this was only the beginning. Also, every single file created on the device, ie: photos, videos, screenshots, recordings had the exact location of where I was when that file was created. The phone automatically logged precise GPS coordinates for each media file. This means investigators can determine where you were at the exact moment you took a picture, recorded a video, captured a screenshot, or created any media on the device. This level of metadata helps reconstruct movements, timelines, and behaviors with incredible accuracy. The extraction revealed far more than hidden location data and remember, this phone was NOT jailbroken. Here’s what else was recovered: 1. Full Synchronized Accounts & Passwords The extraction pulled: •URLs •Usernames •Passwords •Stored login metadata Basically, every synchronized password ever used on the device all recovered without jailbreak. 2. Complete Application Logs & Histories Every installed application had: ✔ Detailed logs ✔ Usage history ✔ Internal data ✔ Metadata Even apps considered “secure” or “encrypted” still left behind recoverable traces. 3. Full WhatsApp Data, Including Group Histories WhatsApp revealed more than most users realize: •Full history of every group ever joined •Date each group was created •Who created it •Date I was added •Group metadata even after you exit the group This is critical in investigations because a suspect cannot deny belonging to a group when the device itself retains: 📌 Creation date 📌 Creator identity 📌 Join date 📌 Participation timeline Even if they left the group years ago. 4. Message-Level Location Metadata The iPhone logged exact sender locations at the moment messages were typed and sent just like what happened with @RedHatPentester message. Most people never see this. Investigators do. Why This Matters Every phone tells a story. Every app keeps footprints. Every message carries more than text. This extraction proves that even without a jailbreak, investigators can discover: ✔ Locations ✔ Passwords ✔ Group associations ✔ Message histories ✔ Detailed app activity ✔ Metadata most users never realize exists Digital devices rarely forget even when the user does.

keyboard_arrow_left Previous keyboard_arrow_right Next

🚨 OSINT EXPOSÉ: Scattered LAPSUS$ Hunters Cartel – Admins Unmasked, Timelines Cracked, & Hidden Networks Mapped 🚨 November 25, 2025 – The Scattered LAPSUS$ Hunters (SLSH) supergroup – a toxic fusion of ShinyHunters, Scattered Spider, & LAPSUS$ remnants – isn't just alive; it's metastasizing. We've infiltrated their latest Telegram respawn ("part 7," 349 members, 76 online spikes today via proxy t.me/comefacecedisw…). Description? A venomous "fuck allison nixon" – raw grudge against TAG's top researcher exposing their Salesforce vishing ops. This isn't playtime: SLSH has orchestrated 16+ channel nukes/rebirths since Aug 8, 2025, per Mandiant/Flare intel. They've weaponized insiders for CrowdStrike/Gainsight breaches ($30K bribes for SSO cookies), LVMH/Gucci leaks (160M+ records), Qantas extortion, & teased kernel-level ESXi RaaS "SHINYSP1D3R" to eclipse LockBit. Admin #1: Rey ⭐ (Pink "R" avatar, hyper-active ops coordinator). Last seen: Today. Role: Gatekeeper for leaks/recruitment – posts PoCs for SAP NetWeaver exploits & insiders calls (e.g., Aug 31 "scattered LAPSUS$ hunters 4.0" targeting enterprise moles). CRITICAL EXPOSURE: Cross-referencing Telegram artifacts w/ Iranian MCI leaks (2025 dumps via HaveIBeenPwned), we've traced Rey's SIM to *+98 919 362 ** (Tehran prefix, active since Oct 2025). Linked persona: "Maryam Rashidi" – potential Iranian cutout in SLSH's "Trinity of Chaos" (Scattered Spider initial access + ShinyHunters exfil). Group logs show Rey name-dropping FalconFeeds in psyop rants, plotting hits on OSINT firms. Flip history: 25/11/25 → Rey; 01/10/25 → jolt30n ("Jolt" – nod to Discord vishing tools). This Iran-SS nexus? Fuels their global reach – from Porsche firmware hacks to recirculated Epstein files on black markets. Rey's not just admin; they're the nerve center. Exposed & vulnerable. Admin #2: *famous celebrity Sex (Anime catgirl avatar, UID "7327440053" – the "Sevy" chameleon). Last seen: Recently. This one's a serial evader, cycling "famous celebrity" troll bios to spoof celeb vishing (e.g., impersonating execs for MFA fatigue). Posted today's media bait – but that's misdirection for their real game: Insider grooming & RaaS hype. DETAILED TIMELINE – Sevy's Profile Evolution (18-Month Evasion Map): •⁠ ⁠13 May 2024: KAngel_uwu (ID 5701053895) – Kawaii origins, pre-SLSH merger. •⁠ ⁠ 15 Jul 2025: sevyuwu – "famous, celebrity" bio kicks off; ties to early Com leaks. •⁠ ⁠29 Aug 2025: lyssa – "famous celebrity 🐈" (cat emoji motif for "pussy" edgelord flex, post-Aug 8 channel launch). •⁠ ⁠17 Sep 2025: loooolidcccloooolidccCEO – "🐈famous💗celebrity🐱meowmy👙" (Lingerie troll + "lol I dccc" CEO mockery; aligns w/ Sep "retirement" psyop on BreachForums). •⁠ ⁠18 Sep 2025: sevykitten – "maybe it wasnt meant to be" (Emo pivot amid LAPSUS$ arrest echoes). •⁠ ⁠27 Oct 2025: ISEEITILIKEITIWANTITIG0TITxDUwU – "INACTIVE" (Ariana meme leetspeak; Oct Qantas/Discord chaos). •⁠ ⁠13 Nov 2025: barbie – "Deleted Account" (Post-CrowdStrike $25K bribe flop). •⁠ ⁠25 Nov 2025*: kAngel_uwu – "famous celebrity" (Full circle; admin flex in your channel). Pattern? Renames cluster around LE heat (e.g., FBI BreachForums seizures Oct 9). Sevy's the psychological warfare arm – bios mock victims/researchers while baiting recruits. No direct phone leak yet, but UID ties to Com's youth cluster (teens/20s). Admin #3: Rose (Redhead cartoon avatar, full message access). Automated greeter bot – pings new joins by username for vetting (e.g., "Welcome @newbie – prove your insider creds or GTFO"). Custom script: Scrapes profiles, flags non-English speakers, auto-bans lurkers. Rose isn't human; it's SLSH's opsec enforcer – logs every entry for doxxing fodder (e.g., feeding vishing lists). GIFT NETWORK EXPOSED – Sevy's Underground Web*: UID 7327440053's "Подарочные связи" (Telegram Premium gifts/Stars laundering – Oct 2024 feature abused for affiliate payouts). 10+ linked IDs (e.g., 8042142303, 6524181273, 7082816478) – potential co-admins/recruits in RaaS beta ("SHINYSP1D3R" boosts via gifts). These trace to Com's crypto scams (Yukari-style), funding $370K+ extortions (AT&T echoes). Cross-scrapes show gifts spiking Nov 15-23 (post-Gainsight), likely insider bribes masked as "collectibles." This isn't gifting; it's money laundering for chaos – $0.01/Star flips to untraceable crypto. SLSH's cruelty? They taunt fallen LAPSUS$ "soldiers" in prison, leak victim PII for sport, & psyop researchers (us included). But exposure cuts both ways. The Hydra's Weak Spot: SLSH's "retirement" teases (Sep 2025 BreachForums post) were smoke – they're escalating w/ FBI NICS/Google LERS access proofs & new victims (LinkedIn, DocuSign, Verizon).

FalconFeeds.io @FalconFeedsio

9 months ago

🚨 OSINT EXPOSÉ: FalconFeeds Cracks Open Scattered Spider's Hidden Iranian Nerve Center! 🚨 Deep in our undercover ops: Admin "Rey" (ilovethensa) pulling strings on "LAPSSUS$ Hunters Part 7" (t.me/comefacediswood)—the beating heart of their LAPSUS$ resurrection, as detailed

keyboard_arrow_left Previous keyboard_arrow_right Next

2 18 54 42K 32

🚀 FalconFeeds CTF Challenge is LIVE — now in partnership with @Sycek_osint , the AI-powered OSINT platform! Ready to put your skills to the ultimate test? With a $15,000 prize pool and exclusive rewards, this is your chance to prove you’ve got what it takes. Here’s how to join the action: 1️⃣ Follow FalconFeeds on LinkedIn & Twitter 2️⃣ Sign up for your FalconFeeds account 3️⃣ Complete KYC verification if you’re among the winners (company details + profile) With just 2 weeks to prove yourself (Sept 25th – Oct 8th) The Clock is Ticking. 🏆 Prizes include: a PS5, Amazon gift cards, and 50 free 1-year Researcher Plans. Think you have what it takes? Don’t just watch—play. 🔗 Register today and claim your spot in the FalconFeeds CTF! community.sycek.io #FalconFeedsCTF #CTFChallenge #SkillTest #CybersecurityCompetition #WinBig #TechChallenge #JoinTheAction #PrizePool #GameOn #LevelUpYourSkills

China’s cyber strategy is no longer just about stealing secrets—it’s about planting flags inside the world’s most vital systems. From power grids and financial networks to transportation and communications, groups like Volt Typhoon, APT41, and APT40 are exploiting edge vulnerabilities and blending in with legitimate activity to stay hidden. Our latest analysis unpacks the 150% surge in China-linked operations, the geopolitical stakes behind this escalation, and how organizations can harden their defences before these footholds turn into flashpoints. 🔍 Read the full story here: falconfeeds.io/blogs/china-cy… #CyberSecurity #ChinaCyberStrategy #Geopolitics #CriticalInfrastructure #APTThreats #VoltTyphoon #CyberDefense #InformationSecurity #EdgeVulnerabilities #CyberThreatAnalysis

When cyberwar meets propaganda, borders disappear. From Russia’s AI-cloned newsrooms, to China’s stealthy espionage, to Iran’s hack-and-leak playbooks, and Israel’s precision cyber strikes—state-sponsored operations in 2024–2025 have redefined the battlefield. Our new report “Emerging State-Sponsored Cyber Operations & Disinformation Campaigns” maps the actors, tools, and geopolitical motives driving these shadow wars. You’ve seen the headlines. What you haven’t seen is the playbook. 📄 Read the full report to see how nation-states are waging hybrid warfare in plain sight, and what it means for global security. falconfeeds.io/reports/emergi… #CyberWar #Propaganda #StateSponsoredOperations #HybridWarfare #GeopoliticalSecurity #DisinformationCampaigns #AIinMedia #CyberEspionage #GlobalSecurity #EmergingThreats

keyboard_arrow_left Previous keyboard_arrow_right Next

🚨 New Group claiming to linked to “Scattered Spider” emerges on Telegram Blending Scattered Spider, LAPSUS$ & ShinyHunters chaos — leaks hit Gucci, Chanel, Neiman Marcus, Coca-Cola Europacific & govs of 🇺🇸🇬🇧🇧🇷🇮🇳. Data ranges from vendor lists to breach samples, mixed w/ threats & trolling. We would be soon publishing a detailed blog analysing the real time chats.

keyboard_arrow_left Previous keyboard_arrow_right Next

Group drops unvetted list of alleged 0day/1day exploits — spanning browsers, iOS/Android full chains, baseband RCEs, Fortinet/SonicWall/Juniper appliance bugs, Windows & Linux LPEs. High-Impact Remote/Full Chains Browser Exploits: Firefox RCE, Safari RCE, Chrome RCE (Android/Windows), Tor Browser RCE+Sandbox escape. Mobile & Baseband: iOS 17.4–17.7 & iOS 18.0+ 0day full chains, Android 0-click RCE via Samsung Messenger, Samsung Exynos/QMI/QRTR baseband RCE. OS & Kernel: Windows LPE (various privilege levels & bypasses), Linux kernel LPE up to 6.1.81. Enterprise Security Appliances: Fortinet NAC/FortiSIEM/FortiWeb RCE, SonicWall SMA/GMS RCE, Juniper firewall/VPN RCE. Notable 2024 Exploits Fortinet, Bitdefender, RocketChat, Lacie NAS, Meta Platforms Identity Spoofing. Multiple MS Word & Adobe Reader RCE vectors via SMB/WebDAV. VMware Workstation VME, nginx RCE (TBD), IceWarp Mail Server RCE. Most of the vulns listed aren’t in CVE/advisories — think private 0-days & red-team stock: • iOS 17.4-18+ full chains • Android 0-clicks (Samsung Messenger, Chrome) • Safari/Firefox RCEs • Windows LPE chains (Low→System, Sandbox escapes) • Linux kernel 6.x LPEs • FortiSIEM/FortiWeb 0-days Rest are mostly patched CVEs.

keyboard_arrow_left Previous keyboard_arrow_right Next

FalconFeeds.io @FalconFeedsio

a year ago

⚠️ More drama unfolds with “Scattered LAPSUS$ Hunters” After Splunk blocked their access, the group vowed to “be back” & claimed to hold a Splunk 0day. If legit, it could threaten Splunk users globally.

1 12 48 15K 17

Scattered Spider, or Scattered Spider-adjacent group, is claiming to have compromised the Brazil government. They said, and this is a direct quote ..., "who wants all police and court records from brazil hmu no bap"

🚨 BreachForums Is Back Online BreachForums has returned. According to the official statement, all old accounts and posts remain unaltered, just as they were when the site was previously shut down.

🚨 Cloak Ransomware Alert 🚨 Department of Pensions 🇱🇰 The Department of Pensions in Sri Lanka is a government agency responsible for managing pension schemes for public sector employees, has fallen victim to Cloak Ransomware. Initially, on April 02, 2025, the group posted about an unidentified victim (pe*.lk). On May 26, 2025, they revealed the full domain name, and uploaded over 617 GB of compromised data for download on their dark web portal.

Group-IB’s Threat Intelligence team has investigated the #ClickFix technique—a new #SocialEngineering technique leveraging fake reCAPTCHAs and bot verification prompts to auto-copy malicious PowerShell commands straight to victims’ clipboards and lead them to executing it.

🚨 On Jan 23 2025, our 𝕏 account was compromised. We've restored access and investigated the attack. 🔍 Here’s the full report on the attack 📑 linkedin.com/feed/update/ur… Instead of greenwashing, we believe transparency is key. In line with our belief in Democratizing Cybersecurity.

@FalconFeedsio Nice to see you back 👍

🚨 Ransomware Alert 🚨 Bank Rakyat Indonesia, has fallen victim to Bashe Ransomware.

🔴 Cyber Incidents Overview: Nov 1-28, 2024 🔴 Total Incidents: 2,839 across various categories, industries, and regions. Here's an in-depth breakdown: 🔥 Category-wise Incidents: DDoS Attacks: 968 Data Breaches: 624 Ransomware: 555 Access Sales: 306 Defacements: 217 Data Leaks: 169 🏢 Top 5 Affected Industries: Government & Public Sector: 535 Technology & IT Services: 280 Education: 226 Manufacturing & Industrial: 193 Financials: 180 🌍 Top 5 Affected Countries: 🇺🇸 USA: 587 🇮🇳 India: 232 🇮🇱 Israel: 228 🇺🇦 Ukraine: 198 🇬🇧 UK: 119 💻 Ransomware Insights: Top Groups: RansomHub: 97 Kill Security & Qilin: 33 each INC Ransom: 27 SAFEPAY: 26 Notable Players: Hunters International (23), Medusa (18), Play (18), BlackBasta (15). 💡 Impact & Implications: Government & Public Sector: The highest target, highlighting risks to public services and critical infrastructure. Technology & IT Services: Heavily impacted, jeopardizing digital ecosystems. Education & Healthcare: Facing disruptions and privacy concerns. Global Reach: Incidents across 100+ countries underscore the worldwide scale of cyber threats. 📌 What’s Next? Focus on Critical Sectors: Prioritize security measures for government, IT, and public services. Adopt Threat Intelligence: Leverage real-time monitoring to detect and mitigate emerging threats. Enhance Cyber Awareness: Conduct regular training to empower employees against phishing and ransomware tactics. Strengthen Incident Response: Develop robust plans to minimize disruption during an attack. Foster Collaboration: Join forces with industry peers and security agencies to share insights and counteract threats. #CyberSecurity #ThreatIntel

keyboard_arrow_left Previous keyboard_arrow_right Next

#APT #CNC APT-C-48 #Threat #Malware Maybe related with #Patchwork #DroppingElephant 📍🇮🇳(Susp) 💥🇨🇳🌏 ⛓️ #Phishing > RAR|ZIP > EXE(Fake PDF) > Download next + execution > Anti DBG/VM > Persistence over Tasks > #C2 🔗360 Threat Intelligence: mp.weixin.qq.com/s?__biz=MzUyMj…

1/ An investigation into how the threat actor Serpent went from a pro Fortnite player to helping steal $3.5M via meme coin scams launched from 9+ account compromises on X & IG and gambling the proceeds away at online casinos.

keyboard_arrow_left Previous keyboard_arrow_right Next

ZachXBT @zachxbt

2 years ago

1/ Over the past few months I have been tracking a series of related compromises for McDonald’s, Usher, Kabosu Owner, Andy Ayrey, Wiz Khalifa, SPX 6900, etc on X & IG which has resulted in an estimated $3.5M+ stolen via launching Pump Fun meme coins.

315 695 5K 2.2M 1K

🚨 Fatimion Cyber Team Announcement 🚨 Fatimion cyber team claims to have launched an electronic attack targeting the phone lines of the Israeli embassy in Amsterdam. According to their statements, thousands of messages were sent to disrupt communications and create confusion over legitimate messages from citizens. Additionally, the team claims to have sent waves of messages from various programmed international numbers to the phones of the Israeli Ministry of Foreign Affairs and the embassy’s emergency contact in Amsterdam. #Israel #Amsterdam #FatimionCyberTeam #CyberAttack #InfoSec #ThreatIntel #CyberWarfare

Beware of fraudulent trading apps! A recent #PigButchering scam was discovered on the #AppleStore & #GooglePlay. #Cybercriminals are exploiting trust in official platforms.

I like Dan’s anti-FUD common sense diagram lol

@

57 years ago

0 0 0 0 0