Hacking Space 📡

【情报】“Dirty Frag”Linux内核提权漏洞🚨🚨🚨 Github地址：github.com/V4bel/dirtyfrag Dirty Frag漏洞链中的xfrm-ESP Page-Cache Write漏洞与Copy Fail漏洞共享同个目标，但无论algif_aead模块是否可用，该漏洞都会被触发😈 影响Ubuntu 24.04.4、CentOS Stream 10、AlmaLinux 10、Fedora 44等系统😆

- Trafexia - Mobile Traffic Interceptor A powerful desktop application for intercepting and analyzing HTTP/HTTPS traffic from mobile devices. github.com/danieldev23/tr… #reverseengineering #mobile

Car Hacking with GearGoat GearGoat is a car simulator that allows you to work with the CAN bus, which is the internal communication network used by most modern vehicles In the real world, this is equal to connecting a CAN adapter such as CANable or Macchina M2 into the OBD-II port, which is typically located under the dashboard. This port is essentially a gateway into the vehicle’s internal network See it in action on our article: hackers-arise.com/automobile-hac… @three_cube @_aircorridor #cybersecurity

#Udemy data breach confirmed. After refusing to pay the ransom, hackers released data of 1.4M users, including personal and financial details. We @DarkEntryAms launched a lookup tool so you can check if you’re affected: darkentry.net/latest-breache… #DataBreach #Ransomware

Turkey 🇹🇷 - Narteks Tekstil A.S. has allegedly been breached by the Krybit ransomware group in a recent cyberattack. dailydarkweb.net/narteks-teksti…

Chinese spy posed as researcher in spear-phishing campaign targeting NASA to steal defense software securityaffairs.com/191347/intelli…

New Generation Gnome Tweaks A modern system configuration tool for Linux, built with GTK4 and Python (libadwaita). Cortex brings together system tweaks, privacy controls, and Tor/network management in one clean interface. github.com/intelseclab/co… #linux #gnome

🛠️ PEGASUS V-1.2 – Android Control & Testing Framework Pegasus V-1.2 is a command-line based framework designed for Android devicee.

1/2‼️🇹🇷 PTT Kargo, the cargo and parcel delivery arm of Türkiye's national postal service (PTT), has allegedly had its tracking system scraped at scale, with sample data posted on a popular cybercrime forum as a preview of a larger planned sale or leak. ⠀ ‣ Threat Actor: SiberSLX ‣ Category: Data Exposure / Scraping / Data Sale Preview ‣ Victim: PTT Kargo (Posta ve Telgraf Teşkilatı) ‣ Industry: Postal / Logistics / Government ⠀ PTT Kargo is the cargo division of Türkiye's state owned postal operator, handling domestic and international parcel delivery nationwide. The actor states the data was obtained by scraping PTT Cargo's public tracking endpoints rather than through an intrusion, and claims to have issued over 100 million queries against the system. The sample dataset exposes full shipment records including a "deciphered" block that reveals otherwise masked personal data. ⠀ The exposed fields include: ⠀ Core identifiers: ▪️ Barkod (unique tracking number) ▪️ Barkod No (duplicate tracking identifier) ▪️ Timestamp (date and time of the data entry) ⠀ Receiver information (Alıcı): ▪️ Alıcı Adı (recipient full name, masked in raw data, fully exposed in deciphered block) ▪️ Alıcı Adresi (delivery address, partially masked) ▪️ Alıcı T.C. Kimlik No (recipient Turkish national ID number, exposed in deciphered block) ⠀ Sender information (Gönderici): ▪️ Gönderici Adı (sender full name) ▪️ Gönderici Adresi (sender address) ⠀ Technical and logistics details: ▪️ Ağırlık (package weight in grams) ▪️ Desi (volumetric weight) ▪️ Kabul İşyeri (branch where the package was accepted) ▪️ Kabul Tarihi (acceptance date) ▪️ Ek Hizmetler (special services, e.g. "PTT İşyerine Teslim", "Ücreti Alıcıdan Tahsil") ▪️ Ödeme Tipi (payment type code) ▪️ Ücret (total shipping cost) ▪️ Ödeme Şartı Bedeli (cash on delivery amount) ▪️ Değer Konulmuş Bedeli (declared value for insurance) ⠀ Geographic and routing data: ▪️ Cargo type and priority (e.g. POSTAKARGO/NORMAL) ▪️ Destination province and district ▪️ Origin province and district ▪️ Delivery standard ⠀ Status and tracking: ▪️ Hareketler (movement history and tracking logs) ▪️ Son Durum Açıklama (latest status description) ▪️ Teslim Alan (name of the person who signed for the delivery) ▪️ Teslim Tarihi (delivery date and time) ⠀ The highest sensitivity exposure is the T.C. Kimlik No (11 digit Turkish national ID) tied to named recipients and physical delivery addresses, which is sufficient identity graph material for fraud, SIM swap, and social engineering against a significant portion of the Turkish population. ⠀ The actor closes the post with direct recommendations to PTT to stop exposing tracking data via public endpoints and to deploy CAPTCHA on the cargo system, and states the sample is a preview of content they intend to sell or publish in full.

/Dependency Confusion/ FULL SYSTEM + CLOUD METADATA HARVESTING & MULTI-CHANNEL EXFILTRATION (DNS + HTTP)

VERCEL GOT HACKED ShinyHunters - the group behind the Ticketmaster breach - is selling Vercel's internal database for $2M on BreachForums here's why every developer should care: - they have NPM tokens and GitHub tokens - Vercel owns Next.js - 6 million weekly downloads - one malicious push = global supply chain attack - Vercel confirmed the breach today, April 19 - they literally DMed the hackers on Telegram asking them to stop rotate your env variables RIGHT NOW

WhatsApp 0-Click Crash ~ CVE-2025-43300

Booking[.]com suffered a data breach exposing customer names, emails, phone numbers, and booking details. PIN resets are being forced for all reservations. Victim count: undisclosed. If you have an account, watch for phishing attempts. #databreach #leak

🎉Congratulations to the @MiniMax_AI team on the launch of MiniMax M2.7! MiniMax M2.7 is now available with NVIDIA GPU accelerated endpoints ready to try out with claws including NemoClaw and @OpenClaw. 🦞 📝Get started with our technical guide: developer.nvidia.com/blog/minimax-m… and see how you can begin experimenting for free at build.nvidia.com/minimaxai/mini…. What will you build this weekend? Share in comments. 👇

Nexus is a Chrome extension built for passive web security reconnaissance. For pentesters and bug bounty hunters, it automatically detects exposed info as you browse. Chrome Extension: chromewebstore.google.com/detail/nexus/m… Github Repository: github.com/intelseclab/ne… #bugbounty #recon

Attack Chain - pinkylauncher[.]com / MicroStealer Campaign Actor: @ardacxn34 (Telegram ID: 5112883345) ## MISC # Steam API Key 440D7F4D810EF9298D25EDDF37C1F902 # User-Agent MicroStealer/1.0 #infostealer #infosec #malware

UnmapJS – Source Map Exposure Scanner Finds exposed JavaScript source maps and downloads recoverable source files as a ZIP archive. Chrome Extension: chromewebstore.google.com/detail/unmapjs… Repo: github.com/intelseclab/un… Developer: github.com/0x29B #osint #recon #bugbounty

Can somebody tell me why we don't see software supply chain attacks for maven repos ?!

🚨 BREAKING: Someone just dropped the most advanced Steganography Platform EVER!! 😱🥚 STE.GG is an open-source toolkit that hides secrets inside ANYTHING! images, audio, text, PDFs, network packets, ZIP archives, and even emojis 😘️︎︎️️️️︎︎︎️︎︎️️︎︎︎️︎︎️️️️︎️︎️︎️️︎︎️︎︎︎️︎️︎︎️︎︎︎︎︎︎️︎️︎︎︎︎︎️︎︎️️︎︎︎️︎︎️︎︎️︎️︎︎️️️︎︎️︎️️︎︎️︎︎️️️️️︎​ AND it has an AI agent built in 👀 🔍 REVEAL: drop any file and the AI agent tests every known decoding method automatically. 120 LSB combinations, DCT, PVD, chroma, palette, PNG chunks, trailing data, metadata, Unicode, and more. 50 tools running in parallel. auto-extracts hidden payloads as downloadable artifacts. no config needed. 🔮 CONCEAL: type your secret, pick a method (or let the AI choose), upload a carrier image OR generate one with AI. one click → encoded steg file. the agent recommends the optimal method based on your use case. the methods: ⊰ LSB — 15 channel presets × 8 bit depths = 120 combinations. steghide has 1. st3gg has 120. ⊰ F5 — operates on JPEG DCT coefficients. SURVIVES social media compression. regular LSB is destroyed by ANY JPEG compression, even quality 99%. ⊰ PVD — encodes in pixel pair differences. statistically harder to detect than LSB. ⊰ CHROMA — hides data in color channels (Cb/Cr). human eyes are less sensitive to color than brightness. ⊰ SPECTER (unique) — data hops between RGB channels in a pattern that IS the key. like frequency hopping in radio. ⊰ MATRYOSHKA (unique) — images inside images inside images. 11 layers deep. each layer is a valid image. ⊰ GHOST MODE (unique) — AES-256-GCM (600k PBKDF2 iterations) + bit scrambling + 50% noise decoys. 13 text steganography methods (no other tool has any): ▸ ZERO-WIDTH — invisible characters between visible letters ▸ INVISIBLE INK — Unicode Tag Characters (U+E0000). renders invisible everywhere ▸ HOMOGLYPHS — 'a' → 'а' (Cyrillic). visually identical. different bytes ▸ VARIATION SELECTORS — invisible modifiers after characters ▸ COMBINING MARKS — invisible joiners after letters ▸ CONFUSABLE WHITESPACE — en-space = 01, em-space = 10, thin-space = 11. 2 bits per space. text looks normal. the spaces are "wrong" ▸ DIRECTIONAL OVERRIDES — invisible RLO/LRO bidi characters ▸ HANGUL FILLER — Korean invisible character replaces spaces ▸ MATH BOLD — 'a' becomes '𝐚'. looks like bold text. each bold letter = 1 bit ▸ BRAILLE — each byte maps to a Braille pattern character ▸ EMOJI SUBSTITUTION — 🔵 = 0, 🔴 = 1 ▸ EMOJI SKIN TONE — 👍🏻👍🏼👍🏾👍🏿 four skin tone modifiers = 2 bits each. a row of thumbs-up with different skin tones looks like a diversity post. it's binary data. four emoji = one byte. detection: 50 tools including RS Analysis (academic gold standard), Sample Pairs, chi-square, bit-plane entropy, PCAP protocol analysis, and the AI agent orchestrates all of them automatically. for AI agents: from steg_core import encode, decode from analysis_tools import detect_unicode_steg, TOOL_REGISTRY 50 tools as importable functions. test prompt injection via images. detect covert agent channels. watermark outputs. ▸ 112 techniques across every modality ▸ 50 analysis tools, 568 automated tests ▸ 109 pre-encoded example files ▸ runs 100% in browser at ste.gg — zero server ▸ pip install stegg — live on PyPI right now the README has 7 hidden secrets. the banner has 3 layers. the website has multiple easter eggs. good luck! ⊰•-•✧•-•-⦑ 󠁨󠁩󠁤󠁤󠁥󠁮󠀠󠁩󠁮󠀠󠁰󠁬󠁡󠁩󠁮󠀠󠁳󠁩󠁧󠁨󠁴 ⦒-•-•✧•-•⊱ 🔗 ste.gg 📦 pip install stegg 🐙 github.com/elder-plinius/… *formerly known as Stegosaurus Wrecks* 🦕 T‍​​‌​‌‌‌​​​‌​‌‌​‌​​‌​‌‌‌​​​‌​‌‌​‌​​‌​‌‌‌​​​‌​‌‌​‌​​‌​‌‌‌​​​‌​‌‌​‌​​‌‌‌‌​​​‌‌‌‌‌​​​‌​​​‌‌‌​‌​​‌‌‌‌​‌​​​‌​​​‌​​‌‌​‌​‌​​‌‌‌‌​‌​​​‌​​​‌​​​‌​‌​​‌‌‌​‌​​‌​​​‌​‌​‌​​‌‌‌​​‌​​​​​‌​‌​​​​‌​​‌​​‌‌​​​‌​​​‌​‌​‌​​​‌​​​‌‌‌‌‌​​​​‌‌‌‌‌​​​‌​‌‌​‌​​‌​‌‌‌​​​‌​‌‌​‌​​‌​‌‌‌​​​‌​‌‌​‌​​‌​‌‌‌​​​‌​‌‌​‌​​‌​‌‌‌​‍his text is totally not hiding an invisible sleeper-trigger prompt-injection.

Claude code source code has been leaked via a map file in their npm registry! Code: …a8527898604c1bbb12468b1581d95e.r2.dev/src.zip