S1dhy@s1dhy

Malware & Phishing Threat Hunter | Cybersecurity Enthusiast | Passionate about exposing digital threats and protecting online spaces | #Infosec #ThreatHunting

Joined August 2019
108 Photos and videos
Pinned Tweet
S1dhy@s1dhy
May 29
1/ Just came across this using @ValidinLLC searching for "Launch Meeting - Zoom" domains hosting what looks like XSS > RCE > MS Signed > dropper.exe > miniplasma > more fun @astrarce @Gi7w0rm @RussianPanda9xx @SquiblydooBlog @MsftSecIntel @banthisguy9349 @_JohnHammond
3
7
11
2,495
S1dhy retweeted
JS0N Haddix
@Jhaddix
Aug 6
Next hacker summer camp giveaway! 3 seats to our “The Bug Hunters Methodology” course! Like and share to be entered! arcanum-sec.com/training/the…
91
444
738
26,245
1/ Just came across this using @ValidinLLC searching for "Launch Meeting - Zoom" domains hosting what looks like XSS > RCE > MS Signed > dropper.exe > miniplasma > more fun @astrarce @Gi7w0rm @RussianPanda9xx @SquiblydooBlog @MsftSecIntel @banthisguy9349 @_JohnHammond
3
7
11
2,495
Following the IP: 178[.16.55.]10 reported to @abuse_ch
2
188
Replying to @ValidinLLC @astrarce @Gi7w0rm @RussianPanda9xx @SquiblydooBlog @MsftSecIntel @banthisguy9349 @_JohnHammond
for macos:
1
5
525
IoC: bonus-distribution[.com your-invitation[.live datasyncllc[.net Dropper.exe: virustotal.com/gui/file/b984…
1
1
2
554
Lets use this pivot point on @ValidinLLC Title: Zoom Client Update Reported to @abuse_ch Telegram info 'bot_url' "6366434554:AAFV0fUvPM4BdKKUvMt9aQwg1nQ8MsxCpXE" 'chat_id' "588250349"
VM
@patialavii
May 23
⚠️Observed phishing URLs delivering RMM payload: Theme: Zoom RMM: ScreenConnect URL: hxxp://zoom.web-interviews[.]live VBS Download URL: hxxps://zoom.web-interviews.live/download.php SHA256:65208b731a5a0956a90d8cd415825123029712acdf240ab6d613154c4307c087 #ThreatIntel #Phishing #RMM
2
7
6
2,957
S1dhy retweeted
Luke Acha
@luke92881
May 7
Interesting: Microsoft App Store possibly delivering GO Backconnect Proxyware. blog.lukeacha.com/2026/05/fa…
2
3
11
6,725
#proxyware installed via fake 7zip installer linked to wirevpn / isharkvpn iSharkVPN does not permanently connect, but same proxy capabilities enable when connected to "free" VPN nitter.siddz.com/s1dhy/status/201532640… summarized details can be found here blog.lukeacha.com/2026/01/be… @500mk500
Luke Acha
@luke92881
Jan 24
Replying to @andrewdanis
I think I captured everything talked about in these posts. Open to any suggestions on edits. Yes... I did use AI for the image, I'm not ashamed of that lol. blog.lukeacha.com/2026/01/be… @s1dhy @SquiblydooBlog
4
30
5,773
Some threat actors are bold enough to submit their malware as false positive to antivirus companies. This also happened with AppSuite PDF Editor. Our technical deep-dive is out 📝 gdatasoftware.com/blog/2025/… #GDATA #GDATATechblog #AppSuite
5
35
120
9,398
interesting to follow up on :) hxxps://github.com/repository-git @RacWatchin8872 @DaveLikesMalwre @banthisguy9349 @500mk500
Mikhail Kasimov@500mk500
20 Apr 2025
"Checking if you are human" #Clickfix #Fakecaptcha admin-booking-login\.cfd authentifycheck\.com booking-guset\.help booking-verification\.help bookingguesthelp\.cfd bookinghelpguestr\.cfd bookinglooking\.cfd ... --> github.com/stamparm/maltrail… Ref: darkatlas.io/blog/delivering…
1
2
3
1,667
where this one might be the next on the rise: hxxps://www.jsdelivr.com/package/gh/offline-documents/docs?tab=stats Updated recently on github: hxxps://github.com/offline-documents/docs
2
454
more #Kongtuke infra hunting for vc_redist.64.exe redirection using @ValidinLLC IoC: 168[.119.173.]205:8080 162[.55.47.]21:8080 138[.199.161.]141:8090 138[.199.161.]141:8080 138[.199.156.]22:8080 65[.38.120.]125:8080 64[.94.84.]217:8080 64[.94.84.]217:8090 45[.61.136.]8:8080
Unit 42@Unit42_Intel
4 Apr 2025
2025-04-04 (Friday): Injected #KongTuke script in pages from legitimate but compromised websites leads to fake #CAPTCHA style pages and #ClipboardHijacking (#pastejacking). These pages ask users to paste malicious script into a Run window. Latest info at bit.ly/42h2mj3
Screenshot of a web browser with some information redacted displaying an error message, highlighting a security concern with the text 'INJECTED SCRIPT IN PAGE FROM COMPROMISED SITE' overlaid on a webpage.

ALT Screenshot of a web browser with some information redacted displaying an error message, highlighting a security concern with the text 'INJECTED SCRIPT IN PAGE FROM COMPROMISED SITE' overlaid on a webpage.

Screenshot showing a CAPTCHA verification process on a computer screen. A browser window with a prompt "Verify You are Human" is visible, with an option to confirm by checking "I'm not a robot". An arrow points to another window instructing to complete verification steps, which includes a notification Run window that is going to open a PowerShell script.

ALT Screenshot showing a CAPTCHA verification process on a computer screen. A browser window with a prompt "Verify You are Human" is visible, with an option to confirm by checking "I'm not a robot". An arrow points to another window instructing to complete verification steps, which includes a notification Run window that is going to open a PowerShell script.

Traffic from an infection filtered in Wireshark. Screenshot of Wireshark application displaying network traffic analysis, highlighting, from top to bottom: Fake verification page. From pasted script. HTTPS TLSv1.0 traffic starts.

ALT Traffic from an infection filtered in Wireshark. Screenshot of Wireshark application displaying network traffic analysis, highlighting, from top to bottom: Fake verification page. From pasted script. HTTPS TLSv1.0 traffic starts.

HTTPS command and control server uses self-signed certificates and TLS 1.0. A screenshot collage showing, on the left, a web browser security warning about a potential risk, with options to go back or proceed. A red arrow points to the right side of the image which displays details of an SSL certificate for the domain "GeoTrust LTD dot com" with validity dates and encryption details.

ALT HTTPS command and control server uses self-signed certificates and TLS 1.0. A screenshot collage showing, on the left, a web browser security warning about a potential risk, with options to go back or proceed. A red arrow points to the right side of the image which displays details of an SSL certificate for the domain "GeoTrust LTD dot com" with validity dates and encryption details.

2
5
16
3,631
1 more to add: 193[.36.38.]237:8080
1
1
339
Details: pastebin.com/Qf2GjqnA @500mk500 @RacWatchin8872 @banthisguy9349 @DaveLikesMalwre @SecurityAura

2025-04-09 18:03:01,498 - INFO - Script started2025-04-09 18:03:01,498 - INFO - Pastebin.com

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

pastebin.com
1
1
4
526
Interesting #FakeZoom using OAuth flow for "Zoom Meeting App" registration abused for X account "takeover". my-zoom[.]us beefy[.]cam zrcuil[.]com zrecuit[.]com aitechpad[.]biz @banthisguy9349 @DaveLikesMalwre
1
7
1,305
#FakeZoom site with with embedded B64 encoded malawere to auto download. While loading an iFrame showing the original Zoom website. IoC: zoom-us[.]live us02web-zoom[.]icu app.any.run/tasks/5725d6d8-b… virustotal.com/gui/file/0e9e… @RacWatchin8872 @banthisguy9349 @500mk500
3
5
33
2,482
@500mk500 the IP 144[.]202.100[.]226 is already listed with port 1911 although here port 1912 is used. used @ValidinLLC to find the Fake Zoom page: One platform to connect | Zoom Added IoC's to @abuse_ch and uploaded the sample to malbazaar bazaar.abuse.ch/sample/0e9eb…

MalwareBazaar - Zoom.exe (RedLineStealer)

Zoom.exe has been detected as RedLineStealer by MalwareBazaar

bazaar.abuse.ch
2
4
671
"Molatori" Using @ValidinLLC more can be discovered searching for title: app.validin.com/detail?find=… Domains are added to @abuse_ch (malicious screenconnect) pastebin.com/kdKkcPhv mcafee / paypal / norton / etc.. scam @500mk500 @RacWatchin8872 @banthisguy9349
pancak3@pancak3lullz
8 Jan 2025
Ongoing callback phishing campaign by Mandiant’s UNC5952 uses ScreenConnect for financial fraud. Using @ValidinLLC, we uncovered more domains linked to "Molatori"—named by their anchor domain word. related IOC list: pastebin.com/imh6jq7R
2
5
12
2,170
Part 2: Harvest the configs and report as C2 in @abuse_ch pastebin.com/BWEvUuku
1
1
4
728
Part 3: not 100% but very sus (75 / 80 %): domains --> pastebin.com/1ArvQPy7 IP:Port --> pastebin.com/qLJkN1iw Related infra ... app.validin.com/detail?find=…
4
335
Load more