ShadowOpCode

🚨 New #JavaStealer “MaksStealer” uncovered! Fully in-memory, FUD, DES–Blowfish runtime decryption, WebSockets on 4025/4028/6662. Author “Max, 17yo” left his signature in the payload 🤯 Full report & IoCs 👉 github.com/ShadowOpCode/M… #infosec #malware #ThreatIntel @malwrhunterteam

@AndreaDraghetti @n26 @JAMESWT_WT @tobersotski @illegalFawn @AgidCert @guelfoweb @marsomx_ @skocherhan great write up!

@ShadowOpCode @n26 @JAMESWT_WT @tobersotski @illegalFawn @AgidCert @guelfoweb @marsomx_ @skocherhan Full details: d3lab.net/inside-an-n26-…

🚨ALERT🚨 @n26 fake phishing website hxxps://web[.]n26portale[.]com Source: reddit.com/r/ItaliaPerson…

bazaar.abuse.ch/browse/tag/204… bazaar.abuse.ch/sample/0da0e50… bazaar.abuse.ch/sample/5cae777… Thanks @JAMESWT_WT for the original two uploads

📧"Richiesta rimborso nota di credito n.5 del 30/06/2026 - Ambiente S.r.l." ⛓️.eml > .img > .exe (DLL Sideloading) > PureLogs Stealer ☠️DLL > CreateProcessW > Write PE > ... > SetThreadContext > ResumeThread 📡C2: hxxps://204.44.93[.]88:8449 👇Bazaar with DLL and dumped malware👇

@vxunderground I mean, I started analysing malware and I can't go back now

@vxunderground The most satisfying piece of software you can reverse. The most satisfying job in cybersecurity (reversing malwares)

Malware

@D3LabIT another sample: 📧RE:Fattura proforma MD5: c89590f65fd2b9f8fcdf9abdc6f32280 C2 (likely not decoy): heike-stiasny[.]de

🚨 #Formbook torna a colpire gli utenti italiani 🇮🇹 Una nuova campagna distribuisce Formbook tramite una falsa email con oggetto "Ns. ft. n. 1266595 del 30/06/2026". 🔎 IOC MD5: 12041896b590fb738d63dc5bccb77747 C2: hzdfthr018[.]top/bvy8/ 🔥 Attenzione agli allegati sospetti!

@JAMESWT_WT @UniCredit_IT @AgidCert @VirITeXplorer @Certego_Intel @D3LabIT The loader creates ngen.exe in a suspended state, injects an x86 shellcode into a private executable memory region, and redirects the main thread to it. The shellcode performs PEB walking, locates kernel32.dll, and manually resolves the required exports.

"UniCredit, disposizione di bonifico in entrata" from server8-node2.iworx-host[.]com 5.56.37[.]133 #spam mail spread #RemCosRat c2 37.27.30.]5:2404 Samples👇 bazaar.abuse.ch/browse/tag/37-… cc @UniCredit_IT

@illegalFawn @JAMESWT_WT @guelfoweb @skocherhan #FUD domain 🤡

#phishing #AiTM hxxps://egisss[.]net/

⚠️ UPDATE on my #GuLoader report. 📖 Step-by-step analysis of its VEH abuse and how to bypass it. 🧠 A deep-dive tutorial on modern malware loaders. 📈 Built for the community. Time to give something back. 📄 75 pages and counting. #MalwareAnalysis #ReverseEngineering

@rapid7 @tobersotski @JAMESWT_WT @guelfoweb @James_inthe_box you are quoted as well

Glad to see my analysis of a #Vidar infection chain referenced by Rapid7. Independent malware research, shared publicly, can still add useful context to wider threat intelligence. Thanks for the mention, @rapid7 rapid7.com/blog/post/tr-m…

@vxunderground We need AC to dissect malware

Hey Europoors, while you're complaining about your so-called "heat wave" us Americans are enjoying the luxury of air conditioning. I just installed this bad boy myself.

⚠️@NetflixIT #Phishing red-netf[.]dcsscs[.]top 👇 netflix[.]renew-service01373[.]net RELATED x.com/skocherhan/sta… #fraud #malware #CyberSecurity #InfoSec #Italy #IT

@Saffron_Sniper1 In Italy you can have it without problems, we have articolo 1102 codice civile ✨

Chinese people are trolling Europeans by posting videos on social media showing that even their pigs have air conditioning, while many Europeans can’t because of government rules.

OT: I was driving in France and saw a city called APT. That's all for today 💀

@degartil @RussianPanda9xx Safer against reverse 💀

@RussianPanda9xx malware is getting safer

Way too many Rust malware lately ...🥴😵‍💫

@vxunderground @RussianPanda9xx Oh mate, I am seeing a lot of LUA bullshit too 💀

@RussianPanda9xx I keep getting this obfuscated JavaScript and Lua bullshit. Trade me please

@vxunderground Here for the free malware

According to new X algorithm stuff, this account is #36 in the world for software related content (under the "Dev tools" category). That is a very big achievement. To celebrate, I will be giving everyone 1 (one) free malware.