MalasadaTech (@MalasadaTech) header
MalasadaTech (@MalasadaTech) profile picture

ALOJAHZ WORLD! HOBBYIST THRUNTELLISEARCHER. VIEWS ARE MY OWN! 808 https://nitter.cf/t.co/5AFyJj7uay

ON-ISLAND
Joined August 2025
Photo by MalasadaTech (@MalasadaTech)Photo by MalasadaTech (@MalasadaTech)Photo by MalasadaTech (@MalasadaTech)Photo by MalasadaTech (@MalasadaTech)Photo by MalasadaTech (@MalasadaTech)Photo by MalasadaTech (@MalasadaTech)Photo by MalasadaTech (@MalasadaTech)Photo by MalasadaTech (@MalasadaTech)Photo by MalasadaTech (@MalasadaTech)Photo by MalasadaTech (@MalasadaTech)
MalasadaTech retweeted
⚠️Observed phishing URLs delivering RMM payload: RMM: Action1 Theme: Microsoft Teams URL: hxxps://teamsmeeting[.]site #ThreatIntel #Phishing #RMM
2
3
10
585
MalasadaTech retweeted
⚠️Observed phishing URLs delivering RMM payload: RMM: ScreenConnect Theme: Adobe URL: hxxps://ashland-energy[.]com/aa/ Download URL: hxxps://cleaningbyme.screenconnect[.]com/Bin/ScreenConnect.ClientSetup.exe #ThreatIntel #Phishing #RMM
1
4
8
478
Allegedly compromised - St. Francis Healthcare Systems of Hawaii WallStreet lists St. Francis Healthcare Systems of Hawaii on their dedicated leak site. The WallStreet group lists documents, financial, personal data, and media data types in the post with a timer set to expire at about 0200 HST 09OCT26.
117
MalasadaTech retweeted
🚨 Found another ClickFix page using a fake Windows Security verification prompt. The page copies an mshta command to the clipboard, which downloads the payload from MediaFire, saves it as %TEMP%\verification.exe, and executes it. The payload was observed attempting to exfiltrate data to Telegram using /sendDocument with the Everest/1.0 User-Agent. IOCs: ClickFix: hxxps://acmaturaky[.]cz Payload: e5233db1 (1).exe 51ad155fbf524318fb773d2334b0975c90e1cbbcaae1c58c98f0353fa530143e Payload host: hxxps://www[.]mediafire[.]com/file/yldoq9125h0znvl/e5233db1+(1)[.]exe/file?dkey=id39ilo7cpx&r=40 Dropped as: %TEMP%\verification.exe Telegram C2: api[.]telegram[.]org Bot ID: 8661764894 Chat ID: -1003967691004 Method: sendDocument User-Agent: Everest/1.0 #ClickFix #Malware #Infostealer #ThreatIntel #Telegram #mshta #CyberSecurity #IOC @malwrhunterteam @500mk500 @skocherhan @James_inthe_box @KirkDerpca @getbstr @urlyzeio @smica83
4
8
1
43
2,875
Ransomware group "WallStreet" lists Breast Implant Center of Hawaii on their dedicated leak site. The WallStreet group lists documents, credentials, and personal data in the post with a timer set to expire at about 0530 HST on the new federal fiscal year. "The team at the Breast Implant Center of Hawaii is made up of highly-trained professionals in the fields of patient coordination, administration, nursing and plastic surgery. Our team has come together to assure you, the patient, of the best surgical experience possible. Our goal is not only to do excellent surgery, but to do excellent patient care. Be sure to get to know our amazing anesthesiologists and learn about the role they will play in your treatment." - Breast Implant Center of Hawaii (About Us).
125
Possible threat actor developing anti-AnyRun capability? They run a BAT script checking system info and for processes that contain "vmware vmtools qemu prl anyrun triage" among other things. WASHOOOOODOING? app.any.run/tasks/1dede8db-9…
1
120
MalasadaTech retweeted
The ENKI WhiteHat Threat Research Team has identified a number of recent Kimsuky spear phishing cases against South Korean and Japanese targets. Aug 20, 2026 enki.co.kr/en/media-center/b…
8
1
59
4,832
MalasadaTech retweeted
7c:c2:55:75:de:bd win-n10se95a1ib
The ENKI WhiteHat Threat Research Team has identified a number of recent Kimsuky spear phishing cases against South Korean and Japanese targets. Aug 20, 2026 enki.co.kr/en/media-center/b…
1
3
17
1,210
MalasadaTech retweeted
The code-signing certificate for "OpsBridge LLC" is revoked. We continue to see new brands of RMM tools pop up and drop ScreenConnect immediately. We (CertGraveyard) didn't report the cert, but other's aren't putting up with this either. Others reported that OpsBridge was all kinds of suspicious: registered with throw-away email accounts, sold via Telegram, etc. virustotal.com/gui/file/7c6a… Thanks for those reviewing, writing, tweeting, about this type of stuff. @ExpectedErr0r @0xBurgers @devmihaylov. Your work is seen and appreciated.
OpsBridge - EV-signed MSI, RMM implant, silent ScreenConnect deploy. flavourworld[.]es/invite/ opsbridge[.]digital pub-45afe949f9564e33acd276c93be952c8[.]r2[.]dev relay[.]tolreanrust[.]site:8041 server[.]tolreanrust[.]site medium.com/@devmihaylov/an-o…
1
11
25
3,266
MalasadaTech retweeted
Fake Microsoft websites are tricking victims into uninstalling their antivirus. We found eleven of these sites on a single host that run a fake security scan designed to get victims to remove their security software and hand over personal, banking, and remote-access information.
2
22
3
78
6,179
Massive #ClickFix campaign
Compromised Site -> #ClickFix Malicious Domain: ultraspeed[.]pro urlscan.io/search/#ultraspee… #malware
1
12
96
11,869
MalasadaTech retweeted
New #ClickFix campaign leverages on-the-fly WebAssembly and #steganography through SVG files. Pages from legitimate but compromised sites lead to fake verification pages that instruct viewers to paste content into a Run window. Details at bit.ly/4gCuNAZ
2
55
4
212
20,947
🚨 UPDATE: The Google-abusing #Magecart campaign we exposed in late 2024 nitter.cf/sdcyberresearch/status… Is now being used for #ClickFix attacks 👇 1️⃣ A WebSocket opens to metrics.brandiser.\net 2️⃣ Its incoming message runs & fires a fake request to accounts.google[.]com 3️⃣ The reflected code calls consent.trandiqs.\com 4️⃣ The response serves the ClickFix attack #ClientSideSecurity #infosec #malware #magecart
2
4
615
MalasadaTech retweeted
SharePoint Online "Secure Document Access" portal The phishing page impersonates a SharePoint Online "Secure Document Access" portal and targets multiple email providers: - Microsoft 365 / Outlook - Gmail - Apple iCloud - Yahoo Mail - AOL Mail - Proton Mail - Zoho Mail - Generic Webmail Testing showed it accepts arbitrary usernames/passwords, presents a fake 2FA prompt, accepts any 6-digit code, then redirects victims to the legitimate provider website after exfiltrating the data. IOCs: 208.73.204[.]157:8080 /submit.php api[.]ipify[.]org ipapi[.]co #Phishing #CredentialHarvesting @500mk500 @skocherhan @abuse_ch #zoho
2
6
24
2,239
Unknown Thractor Abusing Faronics Deploy Observed a new one (new to me) in a public Any Run session - Faronics Deploy (UEM or RMM?). Looks like it's delivered via the "Shared Document" theme. Monitor for connections to faronicsdeploy[.]com.
1
1
1
395
MalasadaTech retweeted
Replying to @TheHackersNews
Great article. My YARA rule does detect some of these beyond just the original 7Zip campaign. crowdsourced_yara_rule:00f8244cec|hero_re_quest
2
4
418