@_jamsec

security analyst

Joined April 2020
  • Tweets91
  • Following163
  • Followers176
7Media
New Open SSH Vulnerability dlvr.it/T96Gww

New Open SSH Vulnerability - Schneier on Security

It’s a serious one: The vulnerability, which is a signal handler race condition in OpenSSH’s server (sshd), allows unauthenticated remote code execution (RCE) as root on glibc-based Linux systems;...

schneier.com
17
24
6,272
How does a legitimate-looking Google #Chrome update turn into a gateway for #ransomware attacks? Learn more in our latest post. Research by @_jamsec and @unmaskparasites. #website-malware #malware #trojans sucur.it/3Mi5zrI
6
1
10
2,638
🔍 Magecart malware hidden in plain sight? In our latest post, security analyst @_jamsec reveals how ecommerce malware designed to skim sensitive credit card details from webstores is concealed through pixels and images. #magecart #malware #magento sucur.it/3RnRj3Q
4
6
858
🕵️‍♂️ What is that, wingdings?! Attackers are using #unicode and peculiar file extensions to avoid detection in #WordPress backdoors. Research by @_jamsec. #websitesecurity sucur.it/3JxxKkT
6
9
894
🚨 Essential Addons for #Elementor vuln = new #malware taste, classic #Balada flavor. Over 6k detections by SiteCheck already. Patch ASAP to mitigate risk. Research by @_jamsec & @unmaskparasites. sucur.it/3IpSieq
6
6
810
Analysis of the recent massive Balada Injector wave (cdn.scriptsplatform[.]com) that started right after the Essential Addons for Elementor plugin vulnerability disclosure. blog.sucuri.net/2023/05/vuln… Had the privilege to contribute to this post with @_jamsec

Vulnerability in Essential Addons for Elementor Leads to Mass Infection

Explore the impact of the critical privilege escalation vulnerability in the Essential Addons for Elementor plugin that led to mass-infection via Balada malware. Learn how the attackers exploited the...

blog.sucuri.net
2
1
2
3,611
🌐 It's raining water company defacements! ⛈️ 💧Our latest blog post explores the strange trend of Belarusian bottled water content appearing on #hacked #websites. Research by @_jamsec. #defacement #website-security sucur.it/3pMVeM5
2
2
4
404
Double GTM skimmer: urlscan.io/search/#filename%… GTM-KTGCVGT loads GTM-55SBK75 which loads a skimmer from gojqueryajax[.com/common.css and previously codesejquery[.com/gtm.js Related domains urlscan.io/ip/194.4.49.208 jspixjqurey[.com jspqurey[.com gojqwejs[.com Thanks @_jamsec
1
1
3
556
The long lasting massive WordPress infection campaign finally gets a name. Meet the Balada Injector and its 9 major approaches to compromising WordPress sites. blog.sucuri.net/2023/04/bala… Re: xitter.cf/unmaskparasites/status…
Denis@unmaskparasites22 Feb 2023
A new wave is coming! countstatisticsbook check.statisticline[.]com/scripts/tap.js The domain is created on Feb 15 2023 The same IP urlscan.io/ip/194.135.30.210 Re: xitter.cf/unmaskparasites/status…
1
5
1
23
5,551
🚨 Our 2022 Website Threat Research Report is here! 🚨 Key findings: - 50.58% of CMS applications outdated at point of infection - 69.63% of compromised sites had at least 1 backdoor - 46.76% of all infected sites had SEO spam sucur.it/3zxX4lq #WebsiteSecurity #Malware
8
8
650
Server-side part of the Kritec skimmers found by @_jamsec in vendor/magento/framework/View/Page/Config/Renderer.php shotsmob[.]sbs in this sample We also find this malware in WordPress database (theme settings) Re: malwarebytes.com/blog/threat…
2
7
2
18
7,301
Found small unwanted ads on your #WordPress website? Might want to check for hex2bin or other encoded #malware #injections in your database. Research by @_jamsec sucur.it/3moPDty
1
5
1
8
487
Malicious cron jobs can be aggressive. If your site keeps getting reinfected, make sure to check your #hosting control panel or use the crontab -l command. #malware #infosec #websitesecurity blog.sucuri.net/2023/02/atta…
5
4
427
Two weeks after "dns.firstblackphase[.com", we have the "get.sortyellowapples[.com" wave. urlscan.io/search/#%22sortye… Infected: index.php, .js files + backdoors Thanks @_jamsec for spotting it! Re: xitter.cf/unmaskparasites/status…
Denis@unmaskparasites30 Jan 2023
When the "violetlovelines[.com" infection count has exceeded 6,000 publicwww.com/websites/%22vi… here comes the "dns.firstblackphase[.com" wave publicwww.com/websites/%22fi… It started after Jan 25, 2023 urlscan.io/search/#%22firstb… Re: xitter.cf/unmaskparasites/status…
5
5
1
12
5,363
75+ new #domains pretending to be #URL shorteners are being used to redirect thousands of #hacked sites to fake #crypto Q&A sites and boost #AdSense revenues. By @_jamsec and @unmaskparasites. #websitesecurity #infosec sucur.it/3HQ2YC1
7
1
11
3,467
Found the core-stab or task-controller #plugin installed on your #WordPress #website? These are most likely #backdoors that you'll want to remove ASAP. #websitesecurity #malware sucur.it/3jvHuCA
2
5
455
Shady #browser #extensions, stealers downloads from #Discord, unwanted #redirects — thousands of hacked #WordPress sites with track.violetlovelines[.com injection work as a platform for a black hat ad network. Research by @unmaskparasites and @_jamsec. sucur.it/3wpOJP8
1
8
1
9
1,009
This new #SocGholish variant loads #malware from a zipped template and encoded #WordPress database record. Research by @_jamsec and @unmaskparasites. #infosec #websitesecurity sucur.it/3UV03O5
7
1
14
@publicww results show nearly 15,000 #websites have been affected by this #Malware. Research by @_jamsec and @unmaskparasites. #infosec #websitesecurity sucur.it/3tcTw4L
1
8
1
5
When #hackers are able to compromise an environment, they can tamper with important #security controls to evade detection and execute #malicious behavior. Research by @_jamsec #infosec #NCSAM2022 #websitesecurity #SEO sucur.it/3SiCIDJ
5
1
5
Load more