Daniel Stepanic

320 posts

Daniel Stepanic

Daniel Stepanic

@DanielStepanic

Malwarez at @elasticseclabs | Macrodata Refinement

Katılım Mart 2011
642 Takip Edilen1.3K Takipçiler
Daniel Stepanic retweetledi
Elastic Security Labs
Elastic Security Labs@elasticseclabs·
7 trojanized repos targeting developers. Zero detections across every AV vendor. Elastic Security Labs is tracking a new Contagious Interview campaign (REF9403) where DPRK-aligned actors distribute fake coding challenges through Slack job postings. The repos masquerade as real Next.js e-commerce projects. The code was copied from a legitimate template called GoCart. The difference is steganography. Base64 payload fragments are hidden inside HTML comments in SVG flag images. A script reassembles them alphabetically, decodes with a custom function, and runs on server start. What deploys: - Credential stealer targeting 25 crypto wallet extensions plus browser login data - File stealer scanning for .env, .pem, .ssh, .aws, documents, images, shell history, and source code - Socket. IO RAT providing real-time interactive shell access - Clipboard stealer polling every 500ms, plus a Windows dropper downloading 3 disguised executables from the C2 Full analysis from Elastic Security Labs by @danielstepanic : go.es.io/4fqEhgp
Elastic Security Labs tweet media
English
1
24
65
3.3K
Daniel Stepanic retweetledi
Elastic Security Labs
Elastic Security Labs@elasticseclabs·
TELEPUZ is a new modular malware spreading via CLICKFIX-VIDAR chains. Elastic Security Labs is tracking it. Active since late April 2026. The delivery path: ClickFix social engineering tricks users into running a PowerShell command that downloads a VIDAR Go variant, which then fetches a lightweight stager and the main TELEPUZ payload. The core DLL communicates over WebSockets and pulls additional modules from C2 on demand: Keylogger Stealer Web injector: intercepts browser sessions via CDP and WebDriver BiDi, with default configs targeting financial form fields like IBANs 36 commands. Indirect syscalls. AMSI and ETW patching. NTDLL unhooking. Multiple UAC bypasses. Still in active development: the shellcode injection command returns a TODO placeholder. C2 infrastructure is small (2 domains), but fallback methods include Telegram channels, Steam profiles, DNS records, and a Polygon smart contract that doubles as a kill switch. New builds hit VirusTotal daily. The C2 footprint is small, but this thing is moving fast for something that started 2 months ago. Full technical analysis: go.es.io/4wg6i1p
Elastic Security Labs tweet media
English
0
20
64
6.1K
Daniel Stepanic retweetledi
SolidSnake
SolidSnake@soolidsnakee·
Ongoing #infostealer #campaign hitting devs. It's the "Contagious Interview" (DPRK style). Shows up as a coding test or job-interview repo. You run it, it beacons out, steals your whole environment, and opens a JS eval() backdoor. Been collecting #IOCs, sharing below 🧵
bitangel84@bitangel84

This morning I was HACKED! I’m a blockchain developer with over 8 years of experience. I’m familiar with many of the techniques hackers use, but they are often one step ahead. They strike when you are most vulnerable. What happened: - A few days ago, I was contacted on LinkedIn by Kostiantyn Pustovyi. They offered me a collaboration opportunity on a Web3 game. - I immediately suspected they would send me a suspicious link, ask me to download some software, or something similar. But they didn’t. - This morning, I started the interview. The person explained the role, how I would be expected to help manage the team, and other details. - They showed me the repository I was supposed to work on. - I cloned it and ran yarn install. That’s when they got me. - An obfuscated script sent the credentials stored in process.env to their server. - They also asked me to test their online game and connect my wallet. They almost certainly intercepted my wallet password as well. I’M DESPERATE! I haven’t finished investigating yet, and I still don’t know exactly how many wallets were drained. I’ll continue posting updates as I learn more. BTSG, the bridge, and other related systems do not appear to be affected.

English
3
12
29
6.4K
Daniel Stepanic retweetledi
Elastic Security Labs
Elastic Security Labs@elasticseclabs·
We tracked a new activity cluster targeting Mexican banking customers. Elastic Security Labs discovered REF6045, an operator-assisted banking fraud campaign targeting customers of Mexican banks, fintechs, and cryptocurrency platforms through ClickFix fake-CAPTCHA lures. The operation exhibits a reliance on AI-generated code and suffers from significant operational security (OPSEC) failures that exposed their infrastructure and their toolkit. The toolkit gives operators a full fraud workflow from: •Vishing overlay: lock the screen behind a fake bank warning •Browser redirect: paste a phishing URL via automated keystrokes •Clipboard swap: replace CLABE or card numbers mid-transfer •Remote access: install Remote Utilities for hands-on takeover Research by @k33b0i and @soolidsnakee. Full analysis from Elastic Security Labs: go.es.io/4eP6VZF
Elastic Security Labs tweet media
English
3
25
70
6K
Daniel Stepanic retweetledi
cr3ghost
cr3ghost@cr3ghost·
LLMs can now reverse engineer obfuscated malware. But what happens when malware authors use LLMs to iteratively obfuscate back? Elastic Security Labs explored the arms race between LLM-driven reverse engineering and LLM-driven obfuscation. Who wins when both sides have the same tools? This is the question every malware analyst, detection engineer, and red or blue teamer needs to be thinking about right now. elastic.co/security-labs/… Author: @elasticseclabs #MalwareAnalysis #ReverseEngineering #InfoSec
cr3ghost tweet mediacr3ghost tweet mediacr3ghost tweet mediacr3ghost tweet media
English
8
64
304
18.8K
Daniel Stepanic retweetledi
Elastic Security Labs
Elastic Security Labs@elasticseclabs·
OXLOADER is staging shellcode in the PE .reloc section. Detection rates are low. New research from Elastic Security Labs. Legitimate toolchains don't emit code into .reloc. It's a static-analysis red flag, but most engines aren't catching it in practice. Before dropping the payload, OXLOADER runs 5 checks: - Emulation: malformed WNetAddConnection2W call, expects ERROR_BAD_NAME (0x43) - CPU count: 3+ CPUs required - RAM: 3 GB minimum via GlobalMemoryStatusEx - Display refresh rate: 20 Hz floor via WMI Win32_VideoController - Geography: CIS GEOIDs and Russian LANGID excluded Pass all five, and a copied system DLL gets a new .xtext section injected with the shellcode. DonutLoader wraps the final payload: CASTLESTEALER. Distributed via Google Ads impersonating Node.js. The ad campaign targeted US-based victims. The advertiser account has since been removed. Elastic Defend catches the full chain behaviourally. Static engines largely miss it. Full technical breakdown, YARA rules, and IOCs visit go.es.io/4w1aq4V from @DanielStepanic and @k33b0i:
Elastic Security Labs tweet media
English
2
25
99
13.9K
Daniel Stepanic retweetledi
ESET Research
ESET Research@ESETresearch·
#ESETresearch has discovered a supply-chain attack targeting stock investors in 🇻🇳Vietnam, distributing SPECTRALVIPER through the update mechanism of the FireAnt Metakit stock investment platform. welivesecurity.com/en/eset-resear… 1/4
ESET Research tweet media
English
2
31
110
9K
Daniel Stepanic retweetledi
Elastic Security Labs
Elastic Security Labs@elasticseclabs·
PHANTOMPULSE routes C2 through Ethereum/Base/Optimism transaction inputs. The blockchain resolver has zero sender verification. That means one transaction from a defender overrides the C2 URL for every active implant simultaneously. @soolidsnakee reverse-engineered the full implant: three injection techniques, a shared HWBP primitive that kills AMSI/WLDP/ETW in a single handler, and a 580c XOR signature you can use to hunt sibling wallets right now. go.es.io/43Puuep
Elastic Security Labs tweet media
English
0
14
25
2.1K
Daniel Stepanic retweetledi
Elastic Security Labs
Elastic Security Labs@elasticseclabs·
We uncovered a new Brazilian banking trojan campaign: TCLBANKER. What makes TCLBANKER notable isn’t just the malware itself, but how it spreads. The campaign uses compromised WhatsApp and Outlook accounts to propagate through trusted user relationships, deploys targeted banking overlays, and incorporates anti-analysis techniques designed to evade detection. For defenders, it’s another example of malware increasingly blending into legitimate user behavior and everyday communication channels, making detection harder and trust easier to exploit. Our latest research breaks down the infection chain, propagation methods, evasion tactics, and detection opportunities observed across the campaign. Read the full analysis: go.es.io/4ewvCKF
Elastic Security Labs tweet media
English
1
32
86
14K
Daniel Stepanic retweetledi
Elastic Security Labs
Elastic Security Labs@elasticseclabs·
LLMs have gotten good enough at reverse engineering to recover source code from obfuscated binaries with real accuracy. So we asked the obvious next question: how fast and cheap is it to use one to build obfuscation specifically designed to beat it? We benchmarked Claude Opus 4.6 against the Tigress obfuscator across 20 targets first, to map its strengths and failure modes. 40% solve rate. Phase 3 multi-layer combos hit 0%, with cost explosions that killed the runs. Then we ran a dev/test/refine loop to build 3 purpose-built obfuscation variants targeting the same crackme, iterating directly against the model's known weaknesses. The finding: LLM-targeted obfuscation is fast and cheap to develop. Context windows, budget caps, and shortcut biases are all exploitable attack surfaces. The arms race just shifted.
Elastic Security Labs tweet media
English
5
88
318
30.6K
Daniel Stepanic retweetledi
SolidSnake
SolidSnake@soolidsnakee·
Here's a fun one from our latest research: PHANTOMPULSE resolves its C2 from blockchain transactions. The malware reads the most recent transaction of a wallet to decrypt the input data, and uses it as the C2 URL. The problem? It doesn't verify the sender. 🧵
SolidSnake@soolidsnakee

New #research together with @SBousseaden and @DanielStepanic at @elasticseclabs. We uncovered a campaign abusing Obsidian plugins and vault feature to deliver multi-platform payloads targeting both #Windows and #macOS. The final stage is #PHANTOMPULSE, an AI-built RAT that resolves its #C2 from Ethereum blockchain transactions and its loader #PHANTOMPULL A deep dive into the RAT internals is coming next. Stay tuned. elastic.co/security-labs/…

English
1
3
8
1K
Daniel Stepanic retweetledi
Elastic Security Labs
Elastic Security Labs@elasticseclabs·
We have identified a novel social engineering campaign abusing Obsidian, the popular note taking app, to deliver a previously undocumented RAT #PHANTOMPULSE and it’s loader #PHANTOMPULL targeting individuals in finance and crypto. The attack never exploits a vulnerability. It abuses Obsidian's own plugin ecosystem to execute code the moment a victim opens a shared vault. Full analysis: go.es.io/4cld0dB
English
3
42
116
14.6K
Daniel Stepanic retweetledi
Joe Desimone
Joe Desimone@dez_·
We published a pair of articles on the axios compromise and deep dive on the malware, alongside detection strategies elastic.co/security-labs/…
English
6
27
138
16.3K
Daniel Stepanic retweetledi
Devon Kerr
Devon Kerr@_devonkerr_·
@soolidsnakee another banger, man
DFIR Radar@DFIR_Radar

Elastic Security Labs exposes BRUSHWORM backdoor and BRUSHLOGGER keylogger targeting South Asian financial institution. Custom malware pair features USB worm spreading, broad file theft, and system-wide keystroke capture via DLL side-loading. Key technical details: • BRUSHWORM (paint.exe): Modular backdoor with AES-CBC encrypted config, scheduled task persistence (MSGraphics), anti-analysis checks (screen resolution, hypervisor detection), and C2 communication to resources.dawnnewsisl[.]com/updtdll • Creates hidden directories: C:\ProgramData\Photoes\Pics\, C:\Users\Public\Libraries\, stages stolen files in C:\Users\Public\Systeminfo\ • USB spreading uses social engineering filenames (Salary Slips.exe, Documents.exe) and exfiltrates 40+ file extensions including .doc, .pdf, .pst, .py • BRUSHLOGGER (libcurl.dll): DLL side-loading keylogger with WH_KEYBOARD_LL hook, XOR encryption (key 0x43), logs to C:\programdata\Photoes\_.trn Attack methodology employs T1053.005 (scheduled tasks), T1574.002 (DLL side-loading), T1056.001 (keylogging), T1091 (removable media replication), and maintains persistence across reboots. Hunt for scheduled tasks named MSGraphics/MSRecorder, monitor file creation in ProgramData\Photoes\ directory, and detect abnormal rundll32.exe execution patterns. #DFIR_Radar

English
1
4
20
4.2K
Daniel Stepanic retweetledi
Virus Bulletin
Virus Bulletin@virusbtn·
Elastic Security Labs has been observing malicious campaigns delivering a multi-stage infection involving a previously undocumented loader. The SILENTCONNECT loader delivers ScreenConnect - a RMM tool used to control victim machines - as its final payload. elastic.co/security-labs/…
Virus Bulletin tweet media
English
0
12
39
8.8K
Daniel Stepanic retweetledi
Joe Desimone
Joe Desimone@dez_·
Patch Diff to SYSTEM - using LLMs to exploit a LPE vuln on Windows. More importantly, some thoughts on model capabilities the implications on our security industry elastic.co/security-labs/…
Joe Desimone tweet media
English
3
75
261
22.8K
Daniel Stepanic retweetledi
Elastic Security Labs
Elastic Security Labs@elasticseclabs·
Elastic Security Labs uncovered a large-scale SEO poisoning campaign deploying #BADIIS malware on 1,800+ IIS servers worldwide. Compromised systems—spanning government, corporate, and education sectors—are monetized to push gambling and illicit content. Learn more here: ela.st/badiis
English
0
22
99
16.3K
Daniel Stepanic retweetledi
SolidSnake
SolidSnake@soolidsnakee·
We are tracking #clickfix campaign hosted and served by two compromised websites. Lua in-memory script loader and a #RAT that we are naming #MimicRat. A blog post will follow soon on @elasticseclabs. www.ndibstersoft[.]com d15mawx0xveem1.cloudfront[.]net xMRi[.]neTwOrk
English
2
7
24
2K

Keşfet

@k33b0i @soolidsnakee @elasticseclabs @elonmusk @BarackObama @taylorswift13 @cristiano @BillGates