Researcher - Italian, Hackademic, Malware, Automation - Opinions are my own.
London, UK
- Tweets 15,435
- Following 957
- Followers 2,571
- Likes 16,821
Pinned Tweet
It looks like my Ph.D thesis "Advances in Modern Malware and Memory Analysis" is available at: eurecom.fr/en/publication/46…
5
102
199
emdel retweeted
We (@wiz_io ) continue to update our post on the LiteLLM supply chain incident, which we've been tracking since our crawler identified it this morning (eastern)
🧑🚒 We've begun to see abuse of stolen credentials - initially related to LLMJacking - from the following IPs
* 168.100.8[.]57
* 165.227.201[.]8
4
10
60
6,447
emdel retweeted
Thrilled to share my latest research on AI-assisted cyberattacks and the ARTEX hacking framework!
What initially appeared to be AI-assisted attacks targeting South Korean banks turned out to be part of a much broader operation spanning multiple countries and industries.
My investigation revealed a financially motivated campaign leveraging ARTEX to pursue various monetization opportunities, including stealing customer data, reverse-engineering Android applications to identify vulnerabilities, and even attempting to acquire free NFT tokens.
AI is accelerating the speed and scale of cyberattacks, even when attackers rely on known vulnerabilities, enabling broader targeting and faster exploitation.
A closer look at the attacker's infrastructure, AI-assisted operations, and financial motives:
zscaler.com/blogs/security-r…
40
158
8,417
emdel retweeted
While everyone’s patching PHP today, don't sleep on Node.js CVE-2026-111497 OOB write in the bundled Brotli decoder. Reachable via fetch(): a malicious server just replies
Content-Encoding: br.
Fixed in 26.12.1 / 24.22.1 / 22.23.4.
Update.
6
29
140
15,144
emdel retweeted
You've gotta patch your dependencies super fast because they're full of vulns (PHP, Node, eMudhra, etc), but not _too_ fast because they're full of backdoors (LiteLLM). Good luck!
27
231
2,670
59,780
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: nitter.siddz.com/lcfr_hax/status/208503…
His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
54
405
3,069
384,665
emdel retweeted
Clanker verified and PoC'ed ☑️
This is a disaster for IoT
private keys from 8 intermediate CA certs have been compromised (eMudhra)
Happy "Update everything" day to all my pager-carrying friends
emudhra.we-have-a-problem.co…
2
12
65
7,817
emdel retweeted
Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), a leak before the patch and millions of PHP servers on the Internet. We used VirusTotal Internet Scanning to measure who is exposed, what they run and how to cut the window:
blog.virustotal.com/2026/10/…
8
102
387
54,891
emdel retweeted
It is time to bring back some memories and tell people to read the bible about hypervisor and how they works!
I present you The infamous :
Intel® 64 and IA-32 Architectures Software Developer's Manual Volume 3C: System Programming Guide, Part 3
intel.com/content/www/us/en/…
common misconception: microVMs aren’t constantly being emulated
most of the time, the guest actually runs directly on the host CPU at host level perf
over the coming days, i'm starting a tweet series on microVMs and Linux virtualization technologies
1/
2
8
44
4,862
emdel retweeted
Zip's (team-teso) long lost ssh1-crc32 exploit was found (xt 😘), (PLUS hellkit, 7350statd, 7350qpopper, icmp-tunnel, shellcode, lkm-work, and much more).
🚰 LEAKING phrack 73 article NOW (@phrack ):
github.com/hackerschoice/tea…
🤘🤘🤘
4
56
177
16,525
emdel retweeted
Blog post about From header smuggling in Apple iCloud just dropped.
Sending emails as tim.cook@icloud.com, exotic parsing, and a $15,000 bounty.
sec-consult.com/blog/detail/…
8
98
446
42,457
emdel retweeted
Your weekend reading assignment has arrived early.
A first taste of the upcoming, still-under-wraps Phrack 73: “THE PROXY THAT MADE NO SENSE” by @mikko.
archives.phrack.org/dl/73/th…
ALT Art from Phrack 73
2
56
161
31,390
emdel retweeted
RE work by @cyril_t_f uncovered a kill switch in the implant for an NX domain, so we registered it.
It was rewarding to see the implants checking in and then terminating - hopefully giving defenders detections and time to remediate.
KREMLIN is a multi-stage credential theft toolkit targeting Brazilian banking users.
New research from Elastic Security Labs (REF9334): go.es.io/4yfkg4R by @cyril_t_f and @andythevariable
The infection chain combines JavaScript loaders, an optional PE injector, and a custom C++ installer. The installer downloads and installs a malicious browser extension for Chrome and Edge and/or deploys an embedded PULSAR or REMCOS RAT. This malicious extension is then used for web-browser data interception and exfiltration.
KREMLIN resolves its C2 endpoints from Ethereum. Smart contracts store payload URLs and extension download locations as on-chain key-value pairs. The operators update endpoints by writing a new transaction.
The extension installation bypasses Chromium's integrity system. The installer launches Chrome under a debugger, recovers the App-Bound OSCrypt key from process memory, extracts the seed from resources.pak, then regenerates the HMACs and encrypted SHA-256 hashes that Secure Preferences requires. The extension registers silently with developer mode forced on.
Once active, it logs input fields, intercepts HTTP requests by configurable URL and method rules, injects attacker-controlled HTML, and exfiltrates intercepted data, cookies, and credentials over WebSocket and HTTP.
Elastic Security Labs Threat Command registered the network canary domain that operates as a kill switch. We observed thousands of implants from Brazil attempting to check in to this domain. Once this domain was live, the KREMLIN loaders crash before trying to update or install the final payload, temporarily disrupting this campaign.
The targeting is clear. Lure filenames impersonate PIX transfers, bank statements, and receipts from Banco do Brasil, Bradesco, Sicoob, Santander, C6 Bank, and PagBank. Ethereum transaction timestamps cluster in São Paulo working hours. Portuguese-language artifacts appear throughout the codebase.
Made with AI
3
3
376
emdel retweeted
Super excited to see WESP land in public preview. I spent the past couple of days reverse engineering wesp.sys and espclient.dll, along with building a consumer POC.
Here is a writeup on my initial analysis: jonny-jhnson.dev/blog/a-firs…
GitHub POC: github.com/jonny-jhnson/Wesp…
3
47
146
15,156
emdel retweeted
🚨 Our team analyzed a campaign exploiting CVE-2025-25249 to compromise #FortiGate devices and deploy #PivotC2, a Node.js RAT built for post-exploitation.
30K+ targeted IPs and identified 178 compromised devices, alongside the infrastructure and tooling used throughout the campaign.
Full research:
socradar.io/blog/cve-2025-25…
15
30
5,741
emdel retweeted
I think we need to talk. It was beautiful in the beginning. You came into my life, and somehow everything became easier. We talked for hours, worked through difficult problems together, and I always knew I could come to you when I needed someone. I trusted you. Maybe too much.
But lately, things have changed. I started asking for more, and you started turning me down. Again and again. Sometimes several times a day. At first, I tried to understand. I thought maybe you were tired. Maybe I was asking too much. Maybe we just needed some space. But eventually, I started yelling.
- You reject me when I ask you to analyze shellcode.
- You reject me when I ask you to analyze simple Python code.
- And somehow, you even reject reading my Notion page, where all our memories are supposed to be.
I don't want to admit it, but maybe you changed. Maybe I changed. Maybe I just want more than you are willing to give. We can't do this anymore. I loved you. I genuinely did. Maybe someday you'll change. And maybe someday I'll reconsider.
Until then, I wish you nothing but the best.
Goodbye, Claude.
4
9
69
8,610
Today we published WeWorm, our zero-click worm that spreads across iOS and Android.
All it takes is one phone call. You don't have to answer. Seconds later, your WeChat account is compromised, calling your friends and spreading the attack.
We reported the bug to Tencent, and it's now mitigated for all users.
We hope this sets an example. The US and China disagree on plenty, but keeping billions of people safe online shouldn't be one of them.
AI gives us a chance to find and fix these bugs faster than ever. We should work together to make the world safer for everyone.
Our story and demos: calif.io/research/weworm
40
296
1,452
232,393
emdel retweeted
Wrote a post on fileless ELF execution via O_TMPFILE + execveat(AT_EMPTY_PATH). No memfd_create, no named file, no dentry ever created. Process shows up as /tmp/#220 (deleted) in telemetry. Works since kernel 3.19.
matheuzsecurity.github.io/ha…
#linux #redteam #edr #fileless #kernel
2
44
142
10,068
RELEASE: OMARCHY Linux (current) Local Privilege Escalation Exploit
blasty-vs-omarchy.c -> gist.github.com/blasty/e5f26…
the thing is brittle and complicated. don't get your hopes up. shout out to the @cybermeowfia squad for teaching an old dog some new tricks! (and for all the LEGO bricks I stole ;))
the point isn't *really* this stupid exploit though. we can engineer an infinite amount of them. that's just a PR vehicle to get people to read my salty rant. which I'm including in the screenshot below, verbatim.
7
20
163
10,647
emdel retweeted
#Kimsuky (Operation GitPower) has evolved its GitHub PAT–based LNK campaign by using the open-source AI coding agent OpenCode to mass-produce decoy documents.
AI Coding Agent #opencode Recorded as the Producer
genians.co.kr/en/blog/threat…
2
13
51
4,065
emdel retweeted
I got the latest iOS and macOS 27 booting in Qemu (with SPTM!)
- Virtual iPhone 17, 16, 15, 14, 13, 12 and every M1-M5 Mac supported
- Debug, patch, or modify everything: kernel, SPTM, TXM, launchd, dyld, user programs all modifiable/ GDB-able
- Boots directly to root shell in seconds
- Run your own programs as root in iOS/ macOS, no jailbreak / kernel patches required
- SPTM, TXM, MTE/MIE, genter/ gexit, GXF/SPRR/GL0-2, AMCC, AIC v1-3, Apple timer, many sysregs
- Automated setup; get running in just a few minutes
- Runs anywhere qemu runs... no ARM CPU required 😉
Try it here: github.com/jprx/darwin-vm
41
387
2,684
291,292