Cyber Security since 1998 ✌️ Also known as @kryptera — Founder of @scanmalware and @wpsecscanner
Funäsdalen
Joined April 2008
- Tweets14.8K
- Following13.5K
- Followers26.8K
- Likes2.6K
Jonas Lejon retweeted
🆕 Advanced search can now find a cryptocurrency wallet or contract address anywhere in a page's scripts with the new script_address filter, whether the script spells it out or hides it until decoded, so pages carrying the same loader contract on…
scanmalware.com/changelog?mt…
Jonas Lejon retweeted
🆕 Scans now record the scanned site's DNS records when the scan runs - addresses, CNAME chain, mail servers, nameservers, TXT, SPF, DMARC and reverse DNS - and keep their history. …
scanmalware.com/changelog?mt…
You can now check URLs against @ScanMalware directly from Velociraptor, bringing URL threat intelligence into your DFIR workflow:
ScanMalware is now in the Velociraptor Artifact Exchange
Look up a domain, IPv4 or URL from a notebook and get its verdict, no key. Only the host's own scans count: 97 of the 100 newest scans under facebook[.]com are lures that ended there: docs.velociraptor.app/exchan…
@velocidex
Jonas Lejon retweeted
Hidden text fooled ScanMalware’s AI into calling phishing pages safe 😱
In our tests, 8 of 18 AI verdicts flipped to legitimate.
Here’s what I learned fixing it
Read the post: scanmalware.com/blog/we-were…
#PromptInjection #AISecurity #LLMSecurity #CyberSecrity
Jonas Lejon retweeted
CapLoader 2.2 is here!
🚨 New alert types for abused services
⬆️ Navigate flow transcripts with the arrow keys
🎨 Alert severity row coloring
🔎 Better BPF filter feedback
netresec.com/?b=26A4762
🆒 Cool new feature at Scan Malware:
You can now explore relationships between websites using interactive graph visualizations, with multiple layout options
This makes it easier to discover connections between malicious websites that share common indicators, even when they're one or two hops away
The feature is on the "Pivot" tab ➡ and click "Open in graph". Also useful in OSINT investigations
#CyberSecurity #ThreatIntelligence #MalwareAnalysis #OSINT #GraphVisualization #ThreatHunting #ScanMalware
Jonas Lejon retweeted
🆒 Cool new feature at Scan Malware:
You can now explore relationships between websites using interactive graph visualizations, with multiple layout options
This makes it easier to discover connections between malicious websites that share common indicators, even when they're one or two hops away
The feature is on the "Pivot" tab ➡ and click "Open in graph". Also useful in OSINT investigations
#CyberSecurity #ThreatIntelligence #MalwareAnalysis #OSINT #GraphVisualization #ThreatHunting #ScanMalware
"Just sign in" .. 🤔
🚫 Web Malware Scan Results
Website: excel-ccbxikmgwcimiopmonpglgrf[.]pages[.]dev
Security Verdict: CONFIRMED SCAM
Full analysis & details:
scanmalware.com/result/40607…
#GRC #CloudSecurity #CISControls #OnlineSafety
Jonas Lejon retweeted
Using our own data, we identified and reported 3 malicious websites to CERT-UA, linked to the UAC-0277 ClickFix campaign targeting Ukraine
Slava Ukraini! 🇺🇦
scanmalware.com/hunts/6a0945…
#LUNEXSTEALER #Ukraine #ClickFix #blueteam #malware @_CERT_UA
This is a screenshot of a ClickFix attack discovered today that targets macOS. When you click "I'm not a robot", it copies the payload to your clipboard.
The next step in the lure is:
- Press ⌘ + Space to open Spotlight
- Type Terminal and press Return ↵
- Hit ⌘ + V to paste the token and hit Return ↵
It installs the Phexia macOS dropper. And contacts the following domains:
- hahah1101[.]mom
- hugg1ngvx[.]top
- nomaiei[.]sbs
#ClickFix #Malware #blueteam #DFIR #macos
”Authorised support” 🤔
🚫 Web Malware Scan Results
Website: microsoft[.]authorised-support[.]com
Security Verdict: CONFIRMED SCAM
Full analysis & details:
scanmalware.com/result/3471e…
#CyberDefense #AIinSecurity #Malware
Sign in to Microsoft 🤔
🚫 Web Malware Scan Results
Website: psyrusec[.]com
Security Verdict: CONFIRMED SCAM
Full analysis & details:
scanmalware.com/result/25b5b…
#ThreatDetection #EmailSecurity #RiskManagement
Jonas Lejon retweeted
Malware family identification is hard, especially when samples are packed, encrypted or poorly classified. FlowCarp can help identify the correct malware family and reduce alert overlap.
netresec.com/?b=2692109
Jonas Lejon retweeted
🚫 Web Malware Scan Results
Website: squidscript[.]com
Security Verdict: CONFIRMED SCAM
Full analysis & details:
scanmalware.com/result/42850…
#EthicalHacking #SecurityScanning #CyberResilience
Jonas Lejon retweeted
✅ Cyberbro v0.15.0 - ScanMalware, DFIR-IRIS and deps
- First contribution of @jonasl : addition of ScanMalware - Thank you!
- Update DFIR-IRIS engine to search for IoCs in notes by @sdaaish
Thanks as well :)
You rock!
#cybersecurity #ioc #osint
github.com/stanfrbd/cyberbro…
Can you tell which of these websites is fake? 👺
One of them is legit. The other is a typosquatted website designed to lure visitors into running two PowerShell commands:
☑️ irm (Invoke-RestMethod) - Fetches content from a remote URL
☑️ iex (Invoke-Expression) - Executes the returned data
#malware #scam #cybersecurity #typosquatting #blueteam @scanmalware
New version of AD AutoPwn v4.13.0 released: github.com/jonaslejon/ad-aut…
#redteam #pentest #windows #blueteam #windowsad #kali #cybersecurity
