Who said what?
@g0njxa
Followers
5K
Following
5K
Media
979
Statuses
3K
ChatGPT says I'm a cyber researcher :) | donate 💸 to g0njxa.eth 💖 | Bad student, enthusiast, defo not an expert DMs are open, feel free to reach! 😼☂️🟣
Valencia, Spain 🇪🇸
Joined January 2023
In the past weeks I interviewed the staff from the major infostealers projects, a total of 7: Lumma,Raccoon,Meduza,Vidar,Amadey,StealC,Meta. Below you will find a short summary of this series that ends today, and also the ones who refused to talk. 👀👇.
4
20
110
StealC V2 issued an update recently:. Featuring enhanced app-bound decryption of browser password and cookies, and a panel Rest API for clients. Changelog 👇👇
StealC v2 infostealer updated recently:. featuring "decryption of Google Chrome v135 passwords". and also removing the thing we reported days before 😜
1
5
40
He replied back🤷♂️:. @saiyangod0x says: Why malware? Is your purpose to create or destroy?. Everyone has their own standards of morality, my belief is that without destroying something, something new will not be built. @vxdb says: How did you get into malware development?.
Some active malware coder has accepted to do a "Questions & Answers" for the infosec community. He has been active for some years, serving and developing malware to individuals and on traffer teams. What you will ask him? Share it in the comments!📣📝.Soon in a blog.
5
2
31
Just been across interesting signed MSI files creating persistence via VMI and hiding a C2 server on a Ethereum Smart Contract (sending botnet information), also installing Anydesk for Remote Access. Detonation: Stages: .(Photo 1) MSI file drops Anydesk
1
8
46
Read about "Meowsterio" - The comeback of an OG traffer's group and it's own malware campaign targeting crypto users worldwide. Featuring the use of ClickOnce applications to bypass Windows SmartScreen without using EV certificates ⚙️. Read now 👇👇:.
3
11
34
RT @NexusFuzzy: I found a what I think novel approach which allowed me to list some of the content of #Lumma #Infostealer Command & Control….
0
26
0
An Spanish 🇪🇸 individual and MacOS user just lost over $62k in cryptocurrencies after being targeted by traffer scammers making them downloading an AMOS build from an already flagged fake project @VidoriumApp in a timestamp of ~2 hours. Sample from site available here:
2
16
50
The infamous CC and access market "BidenCash" apparently had its domain seized by Law Enforcement in the past hours, the store is allegedly down. Clearnet domain "/bidencash.asia" and onion (which now redirects to "/bidencash.usssdomainseizure.com") displays a seizure banner.
0
11
49
Some active malware coder has accepted to do a "Questions & Answers" for the infosec community. He has been active for some years, serving and developing malware to individuals and on traffer teams. What you will ask him? Share it in the comments!📣📝.Soon in a blog.
11
8
54
Read about an ongoing malware campaign delivering "PayDay Loader" to Windows users and Poseidon Stealer to MacOS individuals on fake AI and software websites. A bit of malware analysis and threat hunting, thanks to @anyrun_app @urlscanio. 🤠👇👇.
5
16
62
After the announcement of seizure of some of the Lumma Stealer panel domains, new ones were opened shortly in the following hours. Please remember that the whole activity has not ceased👀. /yuriy-andropov.com @ViriBack
0
1
12
After the announcement of seizure of some of the Lumma Stealer panel domains, new ones were opened shortly in the following hours. Please remember that the whole activity has not ceased👀. /yuriy-andropov.com @ViriBack
First thoughts about #Lumma Stealer "disruption" (?):. There's no need in calling big names on something that (from what I've read and tested) has not happened in the magnitude I'm watching on the media. At the moment, Lumma still works, still has working C2s and *apparently* no
0
8
56
Let's have a look on the HTML content of one the seized Lumma panels before the seizure (/tsoi-zhiv.com). 👉May 15th (normal).👉May 20th (changed). As we can see, the DOM content was modified to add this script. Someone messing
Lumma customers claim to have received this message on Telegram, apparently on Lumma customers group
5
5
58
