Malware researcher exploring malware, APT groups, and their campaigns across the wild. | Threat Researcher @dexpose_io | GREM | Blog Author @anyrun_app
Egypt
Joined February 2023
- Tweets186
- Following365
- Followers702
- Likes4.9K
M4lcode retweeted
🚨 We identified #Mir0Auth, a new phishkit targeting M365 auth tokens, with primary activity observed against US organizations. It starts with DocuSign-themed lures, then moves victims into Device Code phishing through source-code-like endpoints including /task_queue.cs, /context.go, and /window.rs, with XOR-obfuscated C2 URLs and request bodies.
Review the flow and decoded network logic in #ANYRUN Sandbox: app.any.run/tasks/a1553640-c…
Network chain, traffic obfuscation, and #IOCs below ⬇️
#ExploreWithANYRUN
M4lcode retweeted
🔥 We “hired” Lazarus APT remote workers — and uncovered their toolkit.
@BirminghamCyber & @north_scan used #ANYRUN Sandbox to capture weeks of Famous Chollima activity inside a fake startup.
👀 How not to let a spy in? See full story and videos: any.run/cybersecurity-blog/l…
M4lcode retweeted
🔥 Q1 2026 Cyber Risk report by #ANYRUN is out!
Explore the cyber risks and threat shifts for CISOs, including:
❗️ +14.7% credential theft
❗️ +98.3% loader attacks
❗️ +58.4% LOLBAS attacks
Turn Q1 intel into Q2 security priorities. Get the report: any.run/cybersecurity-blog/c…
M4lcode retweeted
Hola
مساء الخير
ME & @M4lcode published Part 2 of our investigation into Lawxsz, the Argentinian threat actor behind the Valkyrie and Prysmax stealers.
What initially appeared to be fragmented online identities across Telegram, GitHub, Discord, forums, and other platforms ultimately revealed a much larger operational footprint through deep infrastructure correlation, alias analysis, breach intelligence, and OPSEC failures.
In this part of the investigation, we focused on:
* Mapping interconnected aliases and personas
* Tracking reused identifiers
* Correlating breach data and underground activity
* Analyzing attribution-relevant operational mistakes
* Linking historical and current identities tied to the actor
This research demonstrates how seemingly disconnected artifacts can be combined into a coherent attribution picture when viewed through multi-vector intelligence analysis.
In Arabic :
فريق dexpose باستخدام Investigation Portal الخاص بـ Dexpose و ال osint قدرنا نكشف واحد من أنشط مطوري الـ Stealers حالياً.Lawxsz هو المطور الرئيسي لي Valkyrie Stealer
Prysmax Stealer
تم تتبعه بشكل كامل بعد تحقيق OSINT طويل شوية ووضحنا بالتفصيل إزاي وصلنا للداتا دي خطوة بخطوة.في التقرير هتلاقوا:هويته الحقيقية
أخطاء OPSEC اللي وقع فيها
Read the full research here::
dexpose.io/unmasking-lawxsz-…
M4lcode retweeted
🚨 #Lazarus APT has weaponized new malware to hunt C-level credentials
This campaign poses a direct financial and business risk, bypassing detection to steal executive data via fake meeting invites ❗️
Check @MauroEldritch's breakdown for defense steps 👇
any.run/cybersecurity-blog/l…
M4lcode retweeted
❗ macOS VM is now live ❗
25K+ U.S. businesses already run on macOS. Yet #macOS threats remain a blind spot for many SOC teams.
👇 Close this gap now with a broader cross-platform threat visibility for faster and confident response!
any.run/cybersecurity-blog/a…
M4lcode retweeted
🚨 #Phishing on Trusted Cloud Infrastructure: Google, Microsoft, Cloudflare.
We’re tracking a growing trend where phishing kit infrastructure is hosted on legitimate cloud and CDN platforms, not newly registered domains. In some cases, these campaigns specifically target enterprise users. This creates serious visibility challenges for security teams.
We’ve observed this pattern across multiple #phishkits:
🔹 #Tycoon hosted on alencure[.]blob[.]core[.]windows[.]net (Microsoft Azure Blob Storage): app.any.run/tasks/29b53d89-9…
⚠️ #Sneaky2FA hosted on legitimate cloud platforms, filtering out free email domains via a fake Microsoft 365 login to target corporate accounts:
firebasestorage[.]googleapis[.]com (Cloud Storage for Firebase): app.any.run/tasks/8189dd5e-0…
cloudfront[.]net (AWS CloudFront): app.any.run/tasks/9a2d1537-e…
🔹 #EvilProxy hosted on sites[.]google[.]com (Google Sites): app.any.run/tasks/07995c22-6…
Victims see a “trusted” provider domain, while the network only sees normal HTML being loaded from cloud infrastructure. What looks clean at first glance is exposed by #ANYRUN Sandbox in under 60 seconds, directly reducing MTTD and MTTR.
🔍 Hunt for related activity and pivot from #IOCs using these search queries in TI Lookup:
🔹 Microsoft Azure Blob Storage abuse: intelligence.any.run/analysi…
🔹 Firebase Cloud Storage abuse: intelligence.any.run/analysi…
🔹 Google Sites abuse: intelligence.any.run/analysi…
Many security vendors will flag these domains as legitimate. Technically, they are. That’s why security teams need behavioral analysis and network-level signals to reliably uncover phishing before impact.
🚀 Speed up detection and gain full visibility into complex threats with #ANYRUN. Sign up: app.any.run/?utm_source=twit…
#ExploreWithANYRUN
#IOCs:
mphdvh[.]icu
kamitore[.]com
aircosspascual[.]com
Lustefea[.]my[.]id
I’m happy to share that I have passed the GIAC Reverse Engineering Malware (GREM) certification.
credly.com/badges/6d3df021-9…
M4lcode retweeted
🔴 LIVE from inside #Lazarus APT's IT workers scheme.
For weeks, @BirminghamCyber & @north_scan kept #hackers believing they controlled a US dev's laptop. In reality, it was our sandbox recording everything.
See full story and videos ⬇️
any.run/cybersecurity-blog/l…
M4lcode retweeted
👀 OpenSource Malware an open database for tracking malicious open-source packages from npm, PyPI, GitHub repos!
Great source of intel feed for supply-chain attacks! 👇
opensourcemalware.com/
M4lcode retweeted
Good morning! ☀️
#GootLoader woke up and chose violence (again)
Grab your coffee, this one's JUICY 💣
huntress.com/blog/gootloader…
Just published a deep dive into APT27 (Emissary Panda/Iron Tiger/Lucky Mouse), a Chinese state-sponsored cyber-espionage group active since 2010, known for spear-phishing, watering-hole attacks and exploitation of internet-facing applications.
dexpose.io/threat-actor-prof…
M4lcode retweeted
As-salamu Alaykum
I wrote 3 #yara rules about #RedLine stealer , #ArrowRAT, and #MilleniumRat.
RedLine:github.com/muha2xmad/yara_ru…
ArrowRAT:github.com/muha2xmad/yara_ru…
MilleniumRat:github.com/muha2xmad/yara_ru…
PureLogs is live. A new challenge created by me.
good luck
Open directory spotted: 20.243.255[.]185
Hosting multiple suspicious files, including:
shell_le: Metasploit ELF payload - recently submitted to VirusTotal.
true.png: PNG file with embedded VBScript (1/61 on VT) - recently submitted to VirusTotal
main_mips: ELF binary flagged by THOR APT Scanner related to github.com/Enelg52/KittyStag… (0/64 on VT)
CVE-2021-3156. zip: weaponized Sudo exploit
@500mk500 @ViriBack @JAMESWT_WT @skocherhan @1ZRR4H
#opendir #CTI
#clickfix #booking #fakecaptcha
bokparthub[.]click → (Under Construction)
apartmenr-di16[.]click → PowerShell (files.catbox.moe/09fd7c[.]tx…) → LightYellow4.zip → LightYellow4.pfx Hex-based ZIP reconstructed → payload cleaned → executed via regsvr32.exe abuse (LOLBins)
