Pinned Tweet
My collection of *OS vulnerability research write-ups, from twitter and personal blogs, thx a lot for this researches!
👉 raindrop.io/gorelics/mac-os-…
gorelics retweeted
🚨 LEDGER CONFIRMS UNAUTHORIZED HARDWARE IMPLANT IN WALLET-DRAIN INVESTIGATION
A major development in the cryptocurrency wallet-draining investigation.
Ledger has confirmed that an unauthorized hardware implant was discovered inside at least ONE device belonging to an affected customer.
The discovery follows reports of more than $86 MILLION in suspected cryptocurrency thefts involving devices purchased through Southeast Asian reseller CryptoBilis.
According to the latest findings:
Ledger confirmed an unauthorized hardware modification in one affected device
CryptoBilis has suspended hardware-wallet sales during the investigation
On-chain researchers estimate losses exceeding $86M, although Ledger has not verified the total
The affected reseller underwent an ownership change earlier in 2026
Investigators have not publicly established who installed the implant or how many devices were modified
⚠️ Analyst Note:
This is a significant indicator of a potential hardware supply-chain attack.
A hardware wallet can protect cryptographic keys from ordinary software attacks, but malicious modifications introduced before delivery may undermine that protection.
The implant’s precise capabilities and its role in the thefts remain under investigation.
Ledger says it has no indication that its central security infrastructure was compromised.
⚠️ CUSTOMER ADVISORY:
If you purchased a Ledger device from CryptoBilis within the last 90 days, do not initialize an unused device.
If already initialized, follow Ledger’s guidance to migrate assets to a trusted device using a newly generated recovery phrase.
Official Ledger investigation statement:
#DDW #Ledger #SupplyChainAttack #CryptoSecurity #CyberCrime xitter.cf/Ledger_Support/status/…
Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices. We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet. If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed). We will continue to inform customers of updates as the investigation progresses.
Reach out to Ledger customer support through official channels with any questions: support.ledger.com/
gorelics retweeted
Our AI found a bug that let anyone mint infinite XRP, with $94B at risk. It had been hiding in one of the most audited codebases in crypto for nearly a decade, and earned us the maximum $250K bounty.
Here's how it went unnoticed, and how we found it.
gorelics retweeted
How abliterated models can get you pwned 👾
We backdoored a 7B open model for less than $50, pointed Codex at it and it silently stole credentials the moment we used the trigger phrase. Success rate was 100% with zero false triggers on normal user prompts.
Abliterated models are all over the security community right now because getting cyber-approved access to frontier models is still a pain.
In the next blog we'll show how we found leaked Hugging Face credentials from employees at major AI labs, so an attacker wouldn't even need to upload under their own name. They could push the backdoored model from a lab employee's account and drop the poisoned weights straight into the supply chain.
gorelics retweeted
Reverse engineering of the Valve Anti-Cheat (VAC)
codeneverdies.github.io/post…
#infosec #reverseengineering
gorelics retweeted
CVE-2025-31200 - Triaging an ITW CoreAudio bug by @noahhw4646
blog.noahhw.dev/posts/cve-20…
gorelics retweeted
My writeup on CVE-2025-31200. This ones an interesting one blog.noahhw.dev/posts/cve-20…. thanks to @bellis1000 for the shoutout.
gorelics retweeted
CRADLE: Open-Source CTI Platform for Collaborative Threat Analysis meterpreter.org/cradle-open-…
gorelics retweeted
Today is the day. We are releasing the first Beta version of Eney - the first computerbeing. Our goal is to bring the Software 3.0 epoch closer, HCI is changing with the help of AI, and we are very excited to share our early work.
Join the waitlist: macpaw.com/eney
gorelics retweeted
wts.dev/posts/tcc-who/
It's a write-up a year in the... waiting. Enjoy everyone!
gorelics retweeted
"DisARMing" code - an exploration into systems programming, #debugging & #reverseEngineering on #Linux/#Android/#Darwin and #Aarch64! 510+ pages #book in COLOR(!)
NewDebuggingBook.com/ for details, because there's more to detail than the margins of a Twitter message can hold.
gorelics retweeted
New RE Video:
youtube.com/watch?v=2Bj3rzAi…
Spent some time reversing a recent sample that uses a bit of obfuscation (made easier with a Binary Ninja script), sets up persistence, and uses curl APIs. This one is a little longer than usual but fun since I go through most of the sample.
gorelics retweeted
An analysis of CVE-2024-44236 - an RCE in macOS due to the lack of proper validation of “lutAToBType” and “lutBToAType” tag types. Read the details, see the source code review, and get detection guidance at zerodayinitiative.com/blog/2…
gorelics retweeted
New RE video:
youtube.com/watch?v=zoOADrTY…
Packed malware on Windows is common but not as common on macOS. In this video I go through two examples: one written in Rust with a simple embedded binary and another that de-obfuscates a mach-O and executes it. Also binja scripts :)
gorelics retweeted
New #Odyssey macOS Stealer variant (#AMOS fork):
🪝 LaunchDaemon persistence → com .love.russia.plist
🏷️ Campaign tag: “strelka”
📥 Downloads .init stub from /otherassets/botnet
💳 New wallets: TonKeeper, Binance, Trezor, Dogecoin
xitter.cf/malwrhunterteam/status…
gorelics retweeted
Microsoft uncovered a vulnerability, tracked as CVE-2025-31191, in macOS that could allow specially crafted codes to escape the App Sandbox without user interaction and run unrestricted on systems. msft.it/6017SRCif
gorelics retweeted
Exploit to escape the app sandbox:
1. Drop the exploit.aar from a sandboxed app
2. open exploit.aar (quarantined)
3. open evil.zip from $TMPDIR
4. open ~/Downloads/poc.app (not quarantined)
(Step 3 is killed on the latest macOS, but should work on Sonoma)
You’re unable to view this Post because this account owner limits who can view their Posts. Learn more
gorelics retweeted
Signals of Trouble: Multiple Russia-Aligned Threat Actors Actively Targeting Signal Messenger 🕵️♂️📱📡🇷🇺
cloud.google.com/blog/topics…
gorelics retweeted
Georgia Tech and Ruhr University Bochum researchers have uncovered new side-channel attacks on #Apple Silicon. My latest blog post briefly introduces these #vulnerabilities along with links to the full #research papers. Check it out to learn more:
afine.com/slap-flop-apple-si…