@jonasl

Cyber Security since 1998 ✌️ Also known as @kryptera — Founder of @scanmalware and @wpsecscanner

 Funäsdalen
triop.se
Joined April 2008
  • Tweets14.8K
  • Following13.5K
  • Followers26.9K
579Media
Jonas Lejon retweeted
Scan Malware@scanmalwareOct 20
Hidden text fooled ScanMalware’s AI into calling phishing pages safe 😱 In our tests, 8 of 18 AI verdicts flipped to legitimate. Here’s what I learned fixing it Read the post: scanmalware.com/blog/we-were… #PromptInjection #AISecurity #LLMSecurity #CyberSecrity

We Were Vulnerable to Prompt Injection. Here Is What We Learned

Our AI Security Verdict reads web pages written by the people we are trying to catch. We attacked it ourselves and found that one hidden paragraph could talk it out of a phishing verdict. This is...

scanmalware.com
1
3
127
CapLoader 2.2 is here! 🚨 New alert types for abused services ⬆️ Navigate flow transcripts with the arrow keys 🎨 Alert severity row coloring 🔎 Better BPF filter feedback netresec.com/?b=26A4762

CapLoader 2.2 Released

CapLoader 2.2 adds new alerts for services and infrastructure that may be abused, makes flow transcripts easier to navigate and improves alert-based coloring. It also includes more helpful BPF filter...

netresec.com
4
10
607
🆒 Cool new feature at Scan Malware: You can now explore relationships between websites using interactive graph visualizations, with multiple layout options This makes it easier to discover connections between malicious websites that share common indicators, even when they're one or two hops away The feature is on the "Pivot" tab ➡ and click "Open in graph". Also useful in OSINT investigations #CyberSecurity #ThreatIntelligence #MalwareAnalysis #OSINT #GraphVisualization #ThreatHunting #ScanMalware
2
2
12
58,157
URL for ScanMalware is: scanmalware.com

Free AI URL Scanner - Check Links for Malware & Phishing | ScanMalware

Scan any URL for free. We inspect its scripts, network activity and content, and an AI verdict tells you if it's malware, phishing or a scam.

scanmalware.com
81
Jonas Lejon retweeted
Jonas Lejon
@jonaslOct 16
🆒 Cool new feature at Scan Malware: You can now explore relationships between websites using interactive graph visualizations, with multiple layout options This makes it easier to discover connections between malicious websites that share common indicators, even when they're one or two hops away The feature is on the "Pivot" tab ➡ and click "Open in graph". Also useful in OSINT investigations #CyberSecurity #ThreatIntelligence #MalwareAnalysis #OSINT #GraphVisualization #ThreatHunting #ScanMalware
2
2
12
58,157
"Just sign in" .. 🤔
Scan Malware@scanmalwareOct 7
🚫 Web Malware Scan Results Website: excel-ccbxikmgwcimiopmonpglgrf[.]pages[.]dev Security Verdict: CONFIRMED SCAM Full analysis & details: scanmalware.com/result/40607… #GRC #CloudSecurity #CISControls #OnlineSafety

Security Scan: Sign in to view Sheet

☠️ Malicious - http://excel-ccbxikmgwcimiopmonpglgrf.pages.dev/

scanmalware.com
1
448
Jonas Lejon retweeted
Scan Malware@scanmalwareOct 7
Using our own data, we identified and reported 3 malicious websites to CERT-UA, linked to the UAC-0277 ClickFix campaign targeting Ukraine Slava Ukraini! 🇺🇦 scanmalware.com/hunts/6a0945… #LUNEXSTEALER #Ukraine #ClickFix #blueteam #malware @_CERT_UA

UAC-0277 (LunexStealer): fake-Cloudflare ClickFix injection on compromised sites — Threat Hunting |...

UAC-0277: script injected into compromised, mostly Ukrainian, websites. The current version reads a traffic-distribution (TDS) domain and an on/off mode from a Polygon smart contract (EtherHiding:...

scanmalware.com
1
1
130
This is a screenshot of a ClickFix attack discovered today that targets macOS. When you click "I'm not a robot", it copies the payload to your clipboard. The next step in the lure is: - Press ⌘ + Space to open Spotlight - Type Terminal and press Return ↵ - Hit ⌘ + V to paste the token and hit Return ↵ It installs the Phexia macOS dropper. And contacts the following domains: - hahah1101[.]mom - hugg1ngvx[.]top - nomaiei[.]sbs #ClickFix #Malware #blueteam #DFIR #macos
1
4
7
1,111
Link to the scan: scanmalware.com/result/a129a…

Security Scan: Secure Gateway • Quick Verification

☠️ Malicious - https://securecheckv1-proceed.pages.dev/

scanmalware.com
4
107
”Authorised support” 🤔
Scan Malware@scanmalwareSep 27
🚫 Web Malware Scan Results Website: microsoft[.]authorised-support[.]com Security Verdict: CONFIRMED SCAM Full analysis & details: scanmalware.com/result/3471e… #CyberDefense #AIinSecurity #Malware

Security Scan: Sign in to your Microsoft account

⚠️ High Risk - https://microsoft.authorised-support.com/new-account/tjC7wb3EZWXveDcoaRRuUPU6lUJz_mkI0UUU=3Ag==3XlpQQVxAXFVHbF9cVFpdbERaR1tsQ1JAQERcQVc=/bPff8F1EDEYpbJqOQJgr65cBc08Bqase/

scanmalware.com
3
907
Sign in to Microsoft 🤔
Scan Malware@scanmalwareSep 24
🚫 Web Malware Scan Results Website: psyrusec[.]com Security Verdict: CONFIRMED SCAM Full analysis & details: scanmalware.com/result/25b5b… #ThreatDetection #EmailSecurity #RiskManagement

Security Scan: Sign in to your account

☠️ Malicious - https://psyrusec.com/wildlan

scanmalware.com
6
911
Malware family identification is hard, especially when samples are packed, encrypted or poorly classified. FlowCarp can help identify the correct malware family and reduce alert overlap. netresec.com/?b=2692109

Unmasking Malware Families

Identifying malware families is hard. Malware samples are often packed, strings encrypted and configurations may only appear after several stages of execution. Even experienced reverse engineers can...

netresec.com
1
36
172
6,310
Jonas Lejon retweeted
Scan Malware@scanmalwareSep 21
🚫 Web Malware Scan Results Website: squidscript[.]com Security Verdict: CONFIRMED SCAM Full analysis & details: scanmalware.com/result/42850… #EthicalHacking #SecurityScanning #CyberResilience

Security Scan: Cloudflare Verification

☠️ Malicious - https://squidscript.com

scanmalware.com
1
3
109
Jonas Lejon retweeted
Cyberbro@cyberbro_ctiSep 19
✅ Cyberbro v0.15.0 - ScanMalware, DFIR-IRIS and deps - First contribution of @jonasl : addition of ScanMalware - Thank you! - Update DFIR-IRIS engine to search for IoCs in notes by @sdaaish Thanks as well :) You rock! #cybersecurity #ioc #osint github.com/stanfrbd/cyberbro…

Release v0.15.0 - DFIR-IRIS, ScanMalware & Dependencies Updates · stanfrbd/cyberbro

What's Changed Update tldextract requirement from >=5.3.1 to >=5.3.2 by @dependabot[bot] in #213 Update pre-commit requirement from >=4.6.1 to >=4.6.2 by @dependabot[bot] in #21...

github.com
2
5
223
Can you tell which of these websites is fake? 👺 One of them is legit. The other is a typosquatted website designed to lure visitors into running two PowerShell commands: ☑️ irm (Invoke-RestMethod) - Fetches content from a remote URL ☑️ iex (Invoke-Expression) - Executes the returned data #malware #scam #cybersecurity #typosquatting #blueteam @scanmalware
2
1
5
687
New version of AD AutoPwn v4.13.0 released: github.com/jonaslejon/ad-aut… #redteam #pentest #windows #blueteam #windowsad #kali #cybersecurity

GitHub - jonaslejon/ad-autopwn: AD AutoPwn v4.13.0 — automated AD attack chain, zero-auth to Domain...

AD AutoPwn v4.13.0 — automated AD attack chain, zero-auth to Domain Admin. Discover/Kerberoast/AS-REP/AD CS ESC1-16/Shadow Creds/RBCD+KCD/Ghost-SPN/TGS-rewrite/Dollar-Ticket/WPAD/WSUS/PXE/SCCM/Bloo...

github.com
8
441
New @coinbase phishing website found by @scanmalware scanmalware.com/result/1f8f1… @CoinbaseSupport #phishing #malware #scam

Security Scan: Coinbase

☠️ Malicious - https://coinbaise.vercel.app/

scanmalware.com
1
3
681
We checked 14,114 WordPress sites. Nearly half had issues a version-based vulnerability scan wouldn’t catch! Meet WPSec Site Security: checks for exposed files and configuration gaps, plus an A–F security grade. See how it works: blog.wpsec.com/introducing-s…

Introducing Site Security: A Security Grade for Your WordPress Site - WPSec

A vulnerability scan tells you whether anything you installed is known to be broken. Site Security answers a different question: what is your WordPress site giving away right now. Here is what we...

blog.wpsec.com
2
3
529
Load more