eremit4 retweeted
From local banking trojans to foreign 🇨🇳 operators targeting Brazil 🇧🇷.
CPR uncovered #GamblingGoblin, a Chinese-speaking actor abusing Brazilian government sites for large-scale #SEO fraud.
Read more 👇: research.checkpoint.com/2026…
eremit4 retweeted
BraZetsu contains 27 distinct functions, with most focused on automated reconnaissance and intelligence gathering. It profiles browsers, running processes, network services, installed software, financial applications, ERP environments, security products, and more. It also searches for sensitive financial files such as .cnab, .240, and .400, along with .pfx and .p12 digital certificates, while enabling operators to execute commands and capture screenshots remotely. #ThreatIntelligence
Full write-up covering infrastructure mapping, deobfuscated code, Discord webhook exfiltration, and AI-assisted tooling:
sagehollow.world/posts/adver…
eremit4 retweeted
The abuse of #blockchain for #Magecart is continuing.
An additional 23 malicious domains were found hidden in smart contracts on the @ethereum Sepolia, bringing the total to 38 known contracts.
A full mapping of the contract IDs to their C2s is attached below. 👇
#EtherHiding #ThreatIntel #PCIDSS #DataSecurity #FormJacking #infosec #ecommerce #eskimming
eremit4 retweeted
New Research: We’ve uncovered two active phishing clusters (GSVerify & Knock) targeting YouTube creators with fake copyright strike lures and advanced Browser-in-the-Browser (BitB) Google login modals. The detailed report is available on urlscan Pro.
eremit4 retweeted
Observed a fully undetected (FUD) malicious browser extension targeting financial fraud.
Key capabilities include:
• Banking credential theft and user input interception.
• Exfiltration of browser cookies, localStorage, and sessionStorage.
• Phishing overlays designed to harvest device tokens, QR codes, 2FA codes, and digital signatures.
• Stealthy remote access through hidden Cobrowse.IO sessions.
• C2 using WebSockets to retrieve updated configurations.
The malware targets customers of major Brazilian financial institutions
1/2
eremit4 retweeted
We investigated active phishing/malware infrastructure impersonating the official GOV.BR / SEFAZ Electronic Invoice (Nota Fiscal Eletrônica) portal.
The domain acesso-pasta-segura.duckdns.… (IP 102.165.46.43 – AS270353 Tyna Host) redirects to sorrystorage.duckdns.org, which hosts a dashboard featuring 20 distinct methods for delivering malicious payloads under the lure of an “Authenticated Document” NFe (dated 28/07/2026).
Techniques include .lnk shortcuts, search-ms:, UNC, WebDAV, mshta, HTA, ISO, and .vbs/.cmd scripts — classic vectors used in Brazilian banking malware campaigns.
ZeroSSL certificate issued on 28/07/2026. Low-cost infrastructure (DuckDNS + domestic hosting) enables rapid rotation.
Recommendation: Do not download or open any “invoice” file received via email or external link. Always validate through official Receita Federal / SEFAZ channels.
Full IOCs and technical analysis available upon authorized request.
#CyberSecurity #ThreatIntelligence #Phishing #Malware #NFe #SEFAZ #InfoSec #OSINT #Brazil #CyberCrime #DigitalForensics #IncidentResponse
eremit4 retweeted
Research / Hunting @Huntio
🚨 New Brazilian stealer actively operating
Domain: x4m1k.com
Exposed origin IP: 144.172.103.98
Registered just 20 days ago. Already selling access to a full Stealer + RAT with real-time Discord injection.
Full technical breakdown below ↓
2/
Domain registration
•Created on June 3, 2026 (exactly 20 days ago)
•Registrar: Tucows
•Nameservers: Cloudflare
•Full WHOIS privacy enabled
Very fresh domain = low public footprint so far.
3/
What the service offers (KStealer / Kaido)
Hybrid Stealer + RAT sold as a service:
•Automatic theft of passwords, cookies, tokens, and crypto wallets from all browsers
•Real-time Discord injector (intercepts tokens, messages, and payment data)
•Full File Manager (browse, download, and delete any files)
•Live Screen Viewer + complete remote control
•Strong persistence and AV evasion
Features designed for mass data theft and full machine control.
4/
Sales model
Affordable pricing:
•Weekly: $24.99
•Monthly: $44.99 (includes full WebPanel)
•Lifetime: $209.99
Sold exclusively via Telegram bot
Website is entirely in Portuguese with direct marketing.
5/
Real infrastructure (OPSEC failure)
Despite Cloudflare protection, the origin IP is exposed:
144.172.103.98
•ASN: AS14956 – RouterHosting LLC (Cloudzy)
•Provider with a history of hosting AsyncRAT C2s and other malicious infrastructure
•Current /24 range has only 1 domain (x4m1k.com) → dedicated use
The provider has previously been linked to phishing campaigns and state-sponsored activity.
6/
Main IOCs
•Domain: x4m1k.com
•Exposed origin IP: 144.172.103.98
•Hostname: 98.103.172.144.static.cloudz…
7/
Recommended actions right now:
•Block the domain and IP 144.172.103.98 immediately
•Monitor the 144.172.103.0/24 range and ASN AS14956
•Submit abuse report to: [email protected]
•Hunt for connections to this IP + Discord process injection
8/
A new Brazilian stealer with solid engineering and dedicated infrastructure is now live.
The exposed origin IP makes detection and blocking significantly easier.
Share to increase visibility.
9/
#ThreatIntel #Malware #InfoStealer #RAT #Stealer #CyberThreats #OSINT #CTI #NewMalware #MalwareBR #BrazilianMalware #ThreatIntelligence #CyberSecurity
eremit4 retweeted
"Why are you reverse engineering malware on your main PC? Why don't you use a VM? If you used a VM you wouldn't have infected yourself"
eremit4 retweeted
Chat, let me tell you something
In cybersecurity there are two things of immense value that will determine your career prospects as well as how your peers will treat you.
1. Your knowledge base
2. Your ability to shut up
Literally nothing else matters.
You don't have to be some 1337 demigod zero day researcher to have respect, but if you're educated enough in your discipline (cloud security, physical security, malware, whatever), you're golden. Pick a topic, know your stuff, don't be a jerk.
The infinitely MORE valuable asset though is your ability to remain SILENT.
Hear some crazy rumor? Shut the fuck up and don't say anything to anyone.
Hear about a potential arrest coming from some Threat Intel people? Shut the fuck up and don't say anything to anyone.
Did you hear some Threat Actors discuss a compromise? Shut the fuck up and don't say anything to anyone.
See someone get "doxxed"? Shut the fuck up and don't say anything to anyone.
Did a colleague or peer disclose something to you that they shouldn't have? Shut the fuck up and don't say anything to anyone.
Are some Threat Actors having a conflict online? Shut the fuck up and don't say anything to anyone.
The only time, with little to no nuance, something can be discussed is if it is public-public. Otherwise, it is in your best interest to remain quiet and mind your own business. Being loud can cause many problems, but drama and conflict is a big no-no in our field especially with it being so relatively small
eremit4 retweeted
Deep dive on a recently compiled sample of the infamous #Prilex Ghost...
version 6.03.9048 | compiled 2026-04-29
Compared to prior build:
— added generic TEF middleware to target list
— new POS target added
Other relevant functions already documented by Kaspersky's prior research: securelist.com/prilex-modifi…
#Prilex #ThreatIntel #Fraud
eremit4 retweeted
For my Brazilian ThreaHunting/DFIR friends:
Been reversing a malware called “#CNABHunter” (NUikita), and this thing is way more interesting than a regular banking trojan.
At first I had to figure out what “CNAB240/400” even was — apparently it’s a financial file standard heavily used by Brazilian ERP/banking integrations.
The malware hunts for those files in environments running TOTVS, SAP, RM, Senior, Sankhya, etc., extracts transaction data, and waits for remote commands to modify payments.
Most interesting part: it doesn’t do dumb string replacement.
The malware appears to rebuild the entire financial record using the correct field positions to keep the file structurally valid for banking processing.
Maybe my interpretation of this behavior is wrong, but that’s what I’ve understood so far from reversing it.
C2: 104.245.245[.]50:5000
eremit4 retweeted
#Hunting some interesting samples — no confirmed TA attribution yet, but the infra is worth tracking.
- Rust agent: signed by 'PACN TECNOLOGIA E SOFTWARE LTDA'
- Go agent: lekrmmagent → machinesdelek[.]com
- C2: mnks[.]digital (#claudermm-server-1 v0.1.0 - wt?)
- MSI: AssistenteEmpresarial / NF-e themed
#nexus_agent #Nexus Access V3
Anyone tracking something similar? #ThreatHunting
eremit4 retweeted
🇰🇵 Call Kim Jong Un a “fat, ugly pig” to prove that you are not from North Korea
During a job interview at a U.S. IT company, a candidate was asked to call Kim Jong Un a “fat, ugly pig” to prove he wasn’t from North Korea. The candidate decided life was more important and walked out.
North Korean workers sometimes join U.S. companies remotely, then steal sensitive data or leave security vulnerabilities in the code.
eremit4 retweeted
> download kali linux
> the mostest 1337 hacker tool
> super dangerous
> over 9000 hackinging tools
> can hack anything, even cows
> age verification at os level becomes law
> dont age verify 1337 hacker os
> arrested
Is hacking illegal and for nerds?
eremit4 retweeted
🗞️ Hunting Malicious Mining Pools: Pivoting Through Crypto Mining Infrastructure
This blog post aims to demonstrate how we can correlate a small cluster of IOCs to identify a malicious mining pool associated with the Tangerine Turkey operation.
Check it out: theshadowslights.com/posts/t…
CC:
@johnk3r @_eremit4 @moval0x1 @akaclandestine @MichalKoczwara @1ZRR4H @struppigel
eremit4 retweeted
North Korean actor UNC1069 is targeting the crypto sector with AI-enabled social engineering, deepfakes, and 7 new malware families.
Get the details on their TTPs and tooling, as well as IOCs to detect and hunt for the activity detailed in our post 👇
bit.ly/4ckI3rD
