kfish retweeted
March 29th in Puerto Rico @pizzaninjas are hosting the pre-party for Tokenize conference at our clubhouse
Remember when two alexas or google devices were talking to each other on Twitch and people yelled skynet?
Same thing
nitter.cf/i/grok/share/838413e00… insider trading + ability to inflate/botting their own service = sus
I’m amazed at how far people are willing to go to farm engagement off a trend like Clawdbot/Moltbot/OpenClaw
I call BS on so much molt related crap on my TL.
Moltbook? How do you know it’s not human guided prompting and also botted this way?
Getting a phone number, signing up for a service and calling its owner?
Do people actually believe this shit?
Do yourselves a favor and don’t use Clawdbot/@openclaw unless you know how to:
- Secure a VPS
- Configure API key permissions to avoid destructive actions
- Manage secrets, no keys/passwords in plain text
- Add guardrails so it can only do what you want it to do
- Backup data for disaster recovery
- Use version control if you make it code
- Assess risk vs reward with your AI provider (could get account shutdown for violating ToS)
- Set up a local model like Ollama
I’m staying away from this until the hype dies down, I suggest you do too.
🫡
Setting up a new project with AI skills:
npx skills add org/repo -a claude-code -s skill1
npx skills add org/repo -a claude-code -s skill2
...
Now:
npx skillpack init
npx skillpack install
One YAML file. All your skills. Every project.
github.com/joventuraz/skillp…
Vibed with CC
kfish retweeted
The quoted post is actually a cool live Contagious Interview DPRK 🇰🇵Gitlab repo that deserves more attention and more context! Malware for MacOS, Windows and Linux
🧵IOCs in post
#1 - Delivery
ref: opensourcemalware.com/blog/c…
Created Jan 21th, posing as a fake "Real Estate Rental Platform"
link: /gitlab.com/real-estate-review3/real-estate-demo
Full repo backup here: a9edb291d912638f9652b2c8c982b7c6b289b0434fb467e0a515dccec68653e0
User - [email protected]
We can easily spot the malicious curl requests depending on the OS, prepared to run on MacOS, Windows and Linux.
Payloads hosted in vscode-load[.]onrender[.]com, to see them while they are live please use a Curl User-Agent, any way I saved them all
#2 - Windows #OtterCookie
Detonation here: app.any.run/tasks/b4907c5b-2…
On Windows, a script hosted on vscode-load[.]onrender[.]com/settings/windows?flag=9 creates file "vscode-bootstrap.cmd" - c40ccf9bed5ceaab36d59e529f17a9b424c037649026db0ffe963c23fd586d19
Content hosted on vscode-load[.]onrender[.]com/settings/bootstrap?flag=9 -
c226eb59cf696a85ed7134b57f12d82cb392d42b908dd6a463cd4d8c980ee5e8
This second script installs NodeJS via powershell and uses it to install dependencies (axios) used to run the malware, hosted on vscode-load[.]onrender[.]com/settings/package - b12a4325fe5af59d64ca617df254841d16f1e5250acd24be518971bce93637ff
and also fetch https://vscode-load[.]onrender[.]com/settings/env?flag=9 - 40990ab0b482a780456e75609ebee3b883f912d75811f9f0dfb022ccdd862f9f
that will fetch the malicious obfuscated JavaScript from ip-api-check-gold[.]vercel[.]app/icons/709 (you can fetch via curl with custom header "bearrtoken: logo")- dbdfe6e24e5c0fa78ae174877cdae7d49b24da529bda78af9a6468a2453f189b
This malicious JS connects the infected machine to the OtterCookie C2:
System info and credentials send to
hxxp://144.172.116.80:8085/upload
Computer files upload to
hxxp://144.172.116.80:8086/upload
API client comunication sent to
hxxp://144.172.116.80:8087/api/log
hxxp://144.172.116.80:8087/api/notify
Also a websocket pipeline is opened here hxxp://144.172.116.80:8087/socket.io/*
The build decodes data from browsers using Windows DPAPI for the current user and starts a loop to read clipboard content
#3 - MacOS & Linux @txhaflaire
For ref: jamf.com/blog/threat-actors-…
On MacOS, a bash script hosted on vscode-load[.]onrender[.]com/settings/mac?flag=9 - 6be45e165de60b61e9b7cb9e1f9b72c652c388a04c02d2068de6188cc88fc3fe
On Linux a bash script hosted on vscode-load[.]onrender[.]com/settings/linux?flag=9 -f03af0598d13d868580527299f5caad51b3d50cd3d655bd810aaaf90bef21f0a
Both creating a file "vscode-bootstrap sh", content hosted on vscode-load[.]onrender[.]com/settings/bootstraplinux?flag=9 - 60914b8df5b5d64070f71ef13817499b3a85de98433ae5c01bd235abec9464f6
The overall functionality is the same than on windows, loading and executing the same JS code.
Feel free to check!
TL is full of skills and articles rehashing the same content. “Introducing…”
I’m bored of the noise…
If only there was a skill to filter it!
10/ I only used the terminal + CLI tools to review this repo. Never opened VSCode with it. Never ran npm install.
If you're asked to review code for a job, do it in a VM or use GitHub's web editor (press . on any repo).
Stay safe out there. 🔒