Security Person @ Perpetual | Catching badness, calming nerves | Opinions mine, detections shared
Austin, TX
Joined August 2007
- Tweets47
- Following305
- Followers80
- Likes152
Jim Saveker retweeted
Shodan Membership sale is live until 2026-08-09 00:00 UTC (~48 hours from now): account.shodan.io/billing/me…
/dev/null is not a detection strategy.
Ingest everything.
Investigate what matters.
Less fatigue, more intrigue.
Jim Saveker retweeted
EDRUnChoker😀registers a permanent WMI subscription with a 5-second timer runs embedded VBScript (fileless) that deletes malicious MSFT_NetQosPolicySettingData policies targeting known security products or aggressive app-path throttles.
github.com/sbousseaden/EDRUn…
Interlock operators are running Volatility... the defender's memory-forensics tool against their own victims. {windows.hashdump} on a dump file → creds extracted, zero LSASS access. RunAsPPL / Credential Guard don't fire. Interesting finding from the DFIR Report.
Claude + Obsidian = 10x usefulness unlocked. Vault goes from static notes to thinking partner overnight. 🤯
I am reasonably reserved with respect to the AI hype train but tmux + Claude agent swarm? Absolute BEAST mode. Got my lead Claude bossing a squad of AI teammates, shared tasks, direct chit-chat via mailboxes, no race condition nightmares. Wow just wow.
Jim Saveker retweeted
A VS Code extension for a "Clawdbot Agent" was fake; it was actually malware that installed ScreenConnect on a target computer to be used as a remote access trojan!
YouTube video walking through the extension source code & Rust-based loader by DLL hijacking: youtu.be/7GS6Xs4hdvg
Hat tip to Aikido Security and Charlie Eriksen for catching this thing in the wild -- one of the domains looks to also be hosting a panel for Evelyn Stealer malware, so we reference some other research from Trend Micro and Koi Security as well to note the similarities in the Lightshot EXE and DLL naming & abuse of VS Code extensions for fake AI coding assistants.
While I was recording, the extension was changed and updated to a new version in real-time -- so we take a look at both and actually fire off the sample to see it work.
... it didn't work. (???)
Looking more closely at the syntax of the extension, even recreating how it is invoked, the logic seemed wrong. Was the whole thing vibecoded? Maybe I missed something, so I need your eyes! (Or your Clawdbot Moltbot Robot Botbot bot "eyes"😜)
youtube.com/watch?v=7GS6Xs4h…
Attackers are now using Microsoft's own App-V scripts as a LOLBin to proxy PowerShell and slip past your defenses. The payload? Amatera infostealer, served via fake CAPTCHA.
Microsoft really said "here, have a trusted binary" and threat actors said "don't mind if I do." bleepingcomputer.com/news/se…
Prohibited at NYC inauguration: Flipper Zero and Raspberry Pi.
Permitted: Notebook computers running Kali Linux, cellphones with full pentesting toolchains and SDR apps.
Classic security theater: banning specific hobbyist devices while allowing far more capable general-purpose hardware.
bleepingcomputer.com/news/se…
Pushin’ Vibes, not code! suno.com/s/qfLQpaOGvB7bDL8r
Graph API: “Trust me bro, here’s global admin.”
Actor tokens: “Say less.”
CVE-2025-55241: the bug that made every tenant a group project. 😬 bleepingcomputer.com/news/se…
Threat actors aren’t just recycling old tricks they’re bending them. Fake CAPTCHA, fake Cloudflare Turnstile, disguised MSI’s, Steganography and FileFix-style paths. bleepingcomputer.com/news/se…
TAG-150 speedrunning malware dev: CastleLoader > CastleBot > CastleRAT in months. Multi-tier C2, Python + C implants, abuse of legitimate services. recordedfuture.com/research/…
If you’re not abusing both DNS and ICMP in your RAT, are you even modern malware? gbhackers.com/weaponizing-dn…
UNC6395 abused compromised OAuth tokens from the Salesloft Drift integration to exfiltrate data from Salesforce, including AWS keys/Snowflake creds. So what: SaaS integrations expand your attack surface as much as your own code, but with far less visibility or control. cloud.google.com/blog/topics…
Bad actors are straight‑up ghosting your EDR by using Windows internals folks rarely monitor. No SYSTEM, no write‑to‑disk, just NtOpenKeyEx + SeBackupPrivilege + RegQueryMultipleValuesW = creds exfiltration in stealth mode. #Cybersecurity #EDRevasion