I'm a reformed black hat hacker who has contributed to 100+ bug bounty programs, and I ghostwrite for cybersecurity teams.
Work With Me→
Joined February 2022
- Tweets2.2K
- Following314
- Followers47.4K
- Likes5.9K
Pinned Tweet
Really enjoyed doing @DarknetDiaries Episode 117: Daniel The Paladin with @JackRhysider, it can be found below:
darknetdiaries.com/episode/1…
Daniel Kelley retweeted
In June, Operation Endgame took StealC offline, one of the world’s most widely sold infostealers. Its seller is back with Stadia, a remote access trojan (RAT).
• The stealer is now a module.
• The hidden desktop is new.
• The code matches StealC byte for byte.
Read more here: varonis.com/blog/stealc-retu….
Most companies think they have an AI policy, but what they really have is a document nobody checks against reality.
This leaves room for work data to be pasted into personal ChatGPT accounts, AI features to be switched on inside existing software, and coding agents to connect to unapproved servers.
@NordLayer AI Scout just launched to close that gap.
It flags shadow AI across web and desktop, checks prompts before they're sent, shows which MCP servers your agents use, and tracks adoption by activity, not seats.
You can book a 30-minute walkthrough here: go.nordlayer.net/aff_c?offer….
🤝 Paid partnership
Daniel Kelley retweeted
Varonis analyzes Stadia RAT, the StealC successor combining credential theft, hidden desktop access, remote commands, and persistent malware capabilities.
#varonisthreatlabs #windowscredentialtheft...Show more
In June, Operation Endgame took StealC offline, one of the world’s most widely sold infostealers. Its seller is back with Stadia, a remote access trojan (RAT).
• The stealer is now a module.
• The hidden desktop is new.
• The code matches StealC byte for byte.
Read more here: varonis.com/blog/stealc-retu….
Daniel Kelley retweeted
Four months after Operation Endgame, StealC's seller is back.
Dubbed Stadia, this new product is a full RAT with hidden desktop control, a command shell, a file explorer, and a loader. Varonis Threat Labs got the build the day it was listed, reversed it, and ran its panel against a host of our own, discovering that the code inside matches StealC's.
Operation Endgame forced StealC's seller to start from scratch with new servers, names, and panels, but it's clear they're not done yet.
Read more about our findings here: varonis.com/blog/stealc-retu…
Daniel Kelley retweeted
A storm is brewing... ⛈️
Varonis Threat Labs has uncovered a new infostealer, Storm, earlier this year. For $1,000 a month, Storm harvests browser credentials, session cookies, and crypto wallets, then quietly ships everything to the attacker's server for decryption.
Cybercriminals are now using a piece of malware called AvisLoader.
1. It's built to resist C2 domain takedowns.
2. It uses Tox for encrypted P2P communication.
3. There's no fixed C2 domain required.
4. Its persistence code modifies Windows shortcuts.
5. It has a web panel for managing infected devices.
6. Operators filter tasks by hardware and location.
7. It supports additional payload delivery through Tox.
8. It bundles UAC bypass and process-hiding tools.
varonis.com/blog/meet-avislo….
Probably a bunch of teenagers in a Telegram server somewhere.
Asos customers receive pop-up messages from retailer's app that appear to be from hackers bbc.in/4yyvukX
Daniel Kelley retweeted
Your website stays online. Your AI budget doesn’t.
Qrator Research Labs uncovered x47.c — a previously undocumented Windows botnet that packages AI API draining as one of 18 attack methods.
Full research 👇
qrator.net/blog/details/x47.…
#Botnet #DDoS #CyberSecurity
Varonis Threat Labs found TrustSink, a technique that turns Microsoft Entra ID logins into a password trap.
A rogue external MFA provider captures passwords on a fake Microsoft page, then lets the login finish. Resetting the password doesn't remove it.
varonis.com/blog/trustsink
A free option that does this really well is canarytokens.org/.
Daniel Kelley retweeted
I've found the "vibe-coded OTP" meme in the wild!
Yes - This is a real bug bounty program vulnerable because in their response to an OTP request, they include the secret 😅
Image 1: What I found
Image 2: The meme
I think cybersecurity has a weird definition of progress when finding more problems is enough to call a tool useful.
If your AI tool can generate a thousand findings in minutes, but someone has to spend the next week checking whether they're real, you've given that person more work.
They then need to find whoever owns the affected system and convince them to fix it.
I'd be more interested in something that helps get through that part. A longer list of things nobody has time to investigate is a strange thing to celebrate.
Daniel Kelley retweeted
‼️ One click could exfiltrate data from Copilot-connected apps.
New attack chain "CoSnitch" lets a crafted Copilot Personal link auto-run an attacker prompt in a signed-in session and pull data from services the user already authorized.
See how the chain works: thehackernews.com/2026/08/mi…
