ILens: dnSpy-style .NET decompilation in your browser. No backend required. Inspect DLL/EXE files, view C#/IL, and detect obfuscation. Improved EXE support + automatic .NET references. Try it: yusufgenc34.github.io/ILens/ Repo: github.com/yusufgenc34/ILens #ReverseEngineering #dotnet

Financially Motivated Threat Actor BREEZE COMET Targets Brazil | Google Cloud Blog cloud.google.com/blog/topics…

How to create Unlimited Accounts on AI platforms like chatgpt and claude (For educational purpose only)

*me inscribo en el torneo de farmear aura* Mi primer contendiente:

Mapping the Digital Network of “Tropa do Arranca”: Inside a Brazilian Phishing Kit | by Criminal IP | OSINT Team osintteam.blog/mapping-the-d…

🚨 THREAT INTEL ALERT
New Android financial fraud tool identified: Alpha v3.5Pro / openAlpha PANEL Full analysis of the control panel + changelog. This is a highly sophisticated Android RAT / Banking Trojan that abuses the Accessibility Service for full device control, password capture, ATS (Automated Transfer System), and remote NFC. Confirmed key capabilities: • Silent remote control via Accessibility
• Password and PIN capture tested across all models
• Expanded remote NFC for card fraud (POS/ATM)
• Payment detection bypass systems (Japan, Indonesia, India, Vietnam, South Korea, Venezuela, Pakistan, and Europe)
• AI-powered Dissemination Mode (WeChat, Telegram, TikTok, contacts + intelligent conversation)
• Funtouch OS (vivo) compatibility + Android 15/16/17 support
• AI-driven automation + Map optimization
• Inclusion of real apps: MetaMask, TokenPocket, OVO, ShopeePay, MoMo, Paotang, PayMaya, Taobao, Xianyu, Zhuanzhuan, Tencent Meeting, and dozens of digital wallets The panel shows bots filtered by country (strong presence in SG/MY/PH/TH/VN, Indonesia, Japan, India, and South Korea) and allows individual app hooks to be enabled. This is not a legitimate app. It is an actively evolving financial fraud tool focused on Asian e-wallets, crypto, and contactless payments. The combination of Accessibility + NFC Relay + AI-driven automated propagation represents the current state of the art in mobile banking trojans. Be cautious of any APK requesting Accessibility + NFC permissions together. #CyberSecurity #ThreatIntel #AndroidSecurity #Malware #BankingTrojan #MobileSecurity #InfoSec #NFC #AccessibilityAbuse #CyberCrime #RAT Thread 2/3 – Technical details: The panel (Alpha PANEL / openAlpha) displays: •App list with “Enable” buttons •Extremely granular geographic filters •Real-time bot status •Stream quality and automation controls The v3.5Pro changelog confirms deliberate focus on: •Expanding remote NFC •Bypassing regional payment detection systems •Stability on modern Android versions •AI-powered social propagation (high token consumption) This profile aligns with the 2025-2026 trend of Chinese-speaking actors combining Accessibility VNC + Ghost Tap/NFC Relay + ATS. Thread 3/3 – Recommendations: 1Never grant Accessibility Service to apps from unknown sources 2Disable installation from unknown sources 3Monitor apps requesting both Accessibility + NFC permissions 4Financial institutions in Asia and emerging markets: implement anomalous Accessibility behavior detection and anti-NFC relay protections Investigation ongoing. More indicators coming soon. #ThreatIntelligence #CyberThreat #AndroidMalware #FintechSecurity #CryptoSecurity

DeadLock ransomware uses blockchain to resist infrastructure takedown bleepingcomputer.com/news/se… bleepingcomputer.com/news/se…

🚨 Potential SideWinder initial access document identified by Joe Sandbox & Joe Reverser... A document consistent with SideWinder APT tradecraft uses a convincing DHA (Defence Housing Authority) Gandhara Phase-9 housing notification as a decoy to initiate compromise. 📄 The lure appears as a legitimate, read-only Word document, but opening it causes Microsoft Word to retrieve a remote template from defense-housing-authority[.]vagued[.]live via an external relationship defined in word/_rels/settings.xml.rels. 🔬 Analysis revealed: • 🎭 Remote Template Injection • 🔐 Obfuscated .NET BinaryFormatter payload • 📦 Embedded .NET DLL loader • 🖥️ Host fingerprinting & AV discovery • 🌐 Multi-stage C2 communication • 💾 Fileless in-memory .NET assembly loading A reminder that macro-less Office documents continue to be an effective initial access vector. 📑 Reports: • Joe Reverser: joesandbox.com/joereverser/a… • Joe Sandbox: joesandbox.com/analysis/1953… #ThreatIntel #SideWinder #APT #MalwareAnalysis #CyberSecurity #DFIR #ReverseEngineering

‼️ Windows malware can silently sign into passkey-protected accounts without a PIN, fingerprint, or visible prompt. In case you missed it 🠖 Researchers found 3 post-compromise paths in Google Password Manager, including one that could expose synced passkeys. Read: thehackernews.com/2026/08/go…

Inside the Underground Business of the Android BTMOB RAT malware bleepingcomputer.com/news/se…

Hacker uses DeepSeek AI to autonomously attack vulnerable servers bleepingcomputer.com/news/se… bleepingcomputer.com/news/se…

⚠️ Monero + Tor : une faille réseau vient d’être exposée !! Le Monero Research Lab se réunit demain 29 juillet pour en discuter... Monero est conçu pour cacher : 👉 qui envoie 👉 qui reçoit 👉 et combien Pour protéger aussi l’adresse IP de l’utilisateur, beaucoup de gens (et de nœuds) font passer leurs transactions via Tor Le paper montre qu’il existe une faille au niveau du réseau (pas dans la cryptographie de Monero elle-même) quand on utilise Tor avec Monero Explication... Quand un nœud Monero tourne derrière Tor : ➡️ Il crée une adresse oignon (hidden service) ➡️ Quand il veut envoyer une transaction, il ne la diffuse pas directement sur internet clair ➡️ Il l’envoie d’abord uniquement à deux nœuds Tor proxy (des hidden services sortants) avant que la transaction ne passe sur le réseau Monero normal (clearnet) C’est une particularité de la façon dont Monero gère les connexions Tor Un attaquant peut : 👉 Prendre la place de ces deux connexions sortantes du nœud cible 👉 Capturer les transactions qui sortent de ce nœud 👉 Puis utiliser une technique appelée watermarking (marquage du trafic) pour lier l’adresse oignon Tor à la vraie adresse IP de la machine Ils appellent leur méthode ProxyMark Elle se déroule en trois étapes : ➡️ Identifier le rôle des nœuds (qui est un proxy, qui est un client, etc.) ➡️ Capturer les transactions qui originent du nœud cible ➡️ Dé-anonymiser la localisation (trouver l’IP réelle) Les auteurs ont testé leur attaque sur : 👉 le réseau Tor réel 👉 le mainnet Monero 👉 et le testnet Résultats rapportés : Identification des adresses oignon : 100% de précision ‼️ Occupation des connexions sortantes : Très efficace (7 à 11 sur 12 connexions selon les conditions) Watermarking : 100% de précision et plus de 91-93% de rappel Autrement dit, dans les conditions de leurs expériences, l’attaque fonctionne très bien ! 👉 Ça ne casse pas les ring signatures, les stealth addresses ni RingCT 👉 Ça ne permet pas de lire le contenu des transactions Monero 👉 Ça ne dé-anonymise pas les utilisateurs qui n’utilisent pas Tor de cette façon (ou qui utilisent Tor correctement avec d’autres précautions) C’est une attaque réseau... elle exploite la façon dont Monero et Tor interagissent ensemble, pas la crypto on-chain Le Monero Research Lab en discute demain 29 juillet Ils vont regarder s’il faut changer quelque chose dans le code Bref... Dès que deux protocoles se rencontrent, un point faible apparaît souvent 😉 #Monero #Tor #Privacy

HOLY SHIT ITS A DEFACEMENT IN 2026 WOAWOAWOAWOAOAOAO (I'm actually surprised by that)

#Malware - NFC Relay 💳 🇧🇷 ℹ️ - APK maliciosa realizando ataques de NFC Relay - Intercepta la comunicación NFC y retransmite los datos hacia el C2 IOCs 🔍 semprecardsecure[.]com dashboardcloud[.]app api[.]dashboardcloud[.]app/api/ cupworldcup[.]site

Brazilian Banking Trojan Actively Spreading in Portugal: bit.ly/4ft7qHN by Nate Nelson #DRGlobal

CyberDrama en grupo criminal 🇧🇷 - Cibercriminal acusando a otro miembro de "Eclypse" (Variante BTMOB) de fraude 🤷‍♂️ - El desafectado refundó una nueva variante bautizada como "KL RAPTOR" (Mismo Panel que Eclypse) - En la carta muestra su prontuario como un CV😆

Treinei vários modelos de ML pra detectar padrão no Crash. Mas... NO FINAL DESSE VÍDEO, eu mostro o verdadeiro algoritmo usado pela Blaze... Vocês tem que assistir pra ficar em choque. VÍDEO AQUI 👇

🚨 PhantomEnigma Hijacks 20+ Brazilian Government Sites to Spread Malware dailysecurityreview.com/phis… PhantomEnigma is the name given to a new campaign in which more than 20 Brazilian government domains were hijacked to deliver malware through police-themed phishing emails. The messages were sent through compromised gov[.]br infrastructure, so they passed SPF, DKIM, and DMARC checks. Victims were pushed through trusted government domains using QR codes and malicious links, then served a modular Node.js backdoor capable of loading additional payloads. #ThreatIntelligence #Malware #Phishing

Exilio404: Inside Brazil's Cybercrime Forum kelacyber.com/blog/exilio404…