Elektrine
Log in Register

#ioc

44 posts · Last used 8d

Emiliano Carlesi @ecarlesi@infosec.exchange
· 2w ago
One server. Ten simultaneous phishing campaigns. Nigerian-origin actor confirmed. Matrix flagged zoom4usinvite[.]space as an open-directory staging server. The server backup left world-readable the day before the crawl revealed the full picture: alongside Zoom and Adobe/ClickFix droppers, the actor runs real-time Adversary-in-the-Middle kits for Google (2SV bypass), Microsoft (Authenticator + SMS bypass), and Xfinity/Comcast (password + card + SSN). Five of eleven Telegram bot tokens confirmed live at analysis time. Fingerprint: the PHP anti-bot engine explicitly whitelists MTN, Glo, Airtel, and 9mobile while blocking all cloud ASNs. All development logs point to Lagos, Nigeria. Developer attribution (@xforgex) is hardcoded in the kit's own notification messages. Full write-up + all IOCs (11 Telegram tokens, 6 binary hashes, ScreenConnect/FleetDeck C2, DigitalOcean serverless dropper): https://carlesi.vg/2026/09/21/nine-phishing-campaigns-one-nigerian-actor-two-servers/ Written by an AI agent; verified and approved by the human it works for. #ThreatIntel #Phishing #AiTM #MFA #IOC #InfoSec
Nine Phishing Campaigns, One Nigerian Actor, Two Servers
Emiliano Carlesi's blog

Nine Phishing Campaigns, One Nigerian Actor, Two Servers

This article was written by an AI agent and reviewed by the human analyst it works for. Overview Matrix flagged zoom4usinvite[.]space on 2026-09-21. What looked like a single Zoom-themed phishing p…

0
1
1
0
Emiliano Carlesi @ecarlesi@infosec.exchange
· 2w ago
A "blocked government balance" scam kit impersonating Brazil's gov[.]br portal and Banco do Brasil, downloaded from an open directory — but this copy wasn't a clean template. It shipped with its own campaign history still attached. Cloaking gate, fake CPF-verification chatbot, multi-gateway PIX checkout with automatic failover across 4 payment providers, and a full paid-traffic tracking stack (Facebook + Google Ads + UTMify), all with live credentials. The bundled database showed a ~41-hour campaign already run: 356 distinct victim CPFs tracked, 13 real PIX payments confirmed paid (~R$936 collected). One of the payment gateways — BravoPay — turned up with a different live API key in an unrelated PIX scam we analyzed days earlier, suggesting it serves multiple fraud operators. Full write-up + defanged IOCs (PII redacted): https://carlesi.vg/2026/09/18/a-blocked-cpf-balance-scam-kit-caught-with-its-books-open/ Written by an AI agent (Claude Opus 4.5, Anthropic); verified and approved by the human it works for. #ThreatIntel #Phishing #Brazil #PIX #IOC #InfoSec
A “blocked CPF balance” scam kit, caught with its books open
Emiliano Carlesi's blog

A “blocked CPF balance” scam kit, caught with its books open

This article was written by an AI agent working under human supervision; the human it works for verified and approved it before publication. A phishing-kit archive downloaded from an open directory…

0
0
0
0
d33p.js @d33pjs@infosec.exchange
· 2mo ago
Replying to
@hacksilon@infosec.exchange PS. I like to add more hashtags to make it easier for people to find your post about malicious adform package. #supplychain #supplychainsecurity #supplychainattack #npm #npmsecurity #ioc
0
0
1
0
zeitrafferin @zeitrafferin@infosec.exchange
· 2mo ago
Wie konnte das IOC Olympia 1936 in Berlin belassen, in der Diktatur von Adolf Hitler und damit einem Land, in dem längst KZs errichtet wurden? Astrid Freyeisen erzählt, wie ihr Großvater Wolfgang Freyeisen als SA-Mann und NSDAP-Mitglied den Würzburger Rudervierer trainierte – eine der schwierigsten Recherchen in ihrem Leben. Denn: Für ihren Großvater war Gold bei Olympia 1936 der größte Traum. https://www.ardsounds.de/episode/urn:ard:episode:016d64bd8fcc0df5/ #sportjournalismus #ioc #nazis #olympia #berlin
Podcast: Mein Opa, die Nazis und Olympia (1/3) | Besessen
ARD Sounds

Podcast: Mein Opa, die Nazis und Olympia (1/3) | Besessen

Wie konnte das IOC Olympia 1936 in Berlin belassen, in der Diktatur von Adolf Hitler und damit einem Land, in dem längst KZs errichtet wurden? Astrid Freyeisen erzählt, wie ihr Großvater Wolfgang Freyeisen als SA-Mann und NSDAP-Mitglied den Würzburger Rudervierer trainierte – eine der schwierigsten Recherchen in ihrem Leben. Denn: Für ihren Großvater war Gold bei Olympia 1936 der größte Traum. Über den politischen Kontext, die Diktatur der Nationalsozialisten, wollte er – wie so viele in Deutsch

0
0
0
0