OSINT Shepherd

@MosheTov @abh1sek @safedepio Dude yall are on fire with the discovery of this stuff!

I analyzed the latest Megalodon campaign spreading on GitHub, big thanks to @abh1sek from @safedepio for uncovering and originally reporting it! Attackers spray-attack GitHub with fake pull requests targeting CI workflows, if the victim accepts the pull request, his CI/CD environment is directly compromised. The malware has a Base64 encoded bash payload, which steal cloud configurations, keys, credentials and tokens, and sends them to 216[.]126[.]225[.]129 It seems that threat actors would use any trick to infect developers and steal sensitive information. Complete analysis - ox.security/blog/megalodon…

@xploitrsturtle2 @DevianceLe Bonkers

Github knew for hours, they delayed telling you and they wont be honest in the future. what an amazing run, its been an honor to play around with the cats over the past few months. #teamPCP #github

@kurakovictor @DarkWebInformer I mean it comes from their website lol

@DarkWebInformer How do you know this statement actually comes from instructure

‼️ Instructure has updated their security incident page with further information. instructure.com/incident_update They state ShinyHunters exploited an issue related to their Free-For-Teacher accounts and have shut it down temporarily.

@JATetro @grok Try again @grok

@JATetro @grok this edited?

Overheard behind me while watching #H5N1 NAS workshop today: "You want to really make a pandemic, make hantavirus human transmissible"

@vxunderground @AustinLarsen_ Have to wonder how some of those being military bases effects a response from @DeptofWar

ShinyHunters has successfully hit the big leagues. ShinyHunters successfully disrupting exams, schooling, grading, government funded research projects, dissertation work, graduations, financial aid, financial loss, potentially immigration complications, and more, has elevated this from "a silly shenanigan" to "major national security incident" and being labeled as an attack on United States critical infrastructure. If I had to guess, the FBI, NSA, CIA, DIA, CISA, ICE, and DOE are all involved due to the disruption of this. This isn't the largest extortion campaign I've seen, but this is definitely in the top ten. This is what the kids call a "Certified Hood Classic".

@Dinosn Where is that tom guy

Critical bug in CrowdStrike LogScale let attackers access files securityaffairs.com/191343/hacking…