DFIR & AI Security
Malaysia
Joined October 2017
- Tweets1.2K
- Following345
- Followers314
- Likes4.1K
Blue Lobster retweeted
You know what, since ClickFix is still a thing, why not write ANOTHER blog about it?! Yeah? So enjoy 💙
tenex.ai/blog/wordpress-clea…
Spent all week absolutely grinding on Gray Swan Arena, and honestly? Not only did I have a blast playing, but I actually won a challenge last week too! Safe to say I'm officially hooked and my wardrobe is getting an upgrade. Gift from @GraySwanAI. Go play!😁
#GraySwanArena #ad
Blue Lobster retweeted
I do not "make smurfs" I do not "ask my family to enter the drawing" I do not "use bots" I ENTER THE RIFTBOUND x K/DA: COUTURE COLLECTION DRAWING with my only account, and if I do not get it, I QUIT RIFTBOUND.
Blue Lobster retweeted
> be Malaysian company
> get invoice
> invoice_name.iso
> 3 files
> "open.exe", libcef.dll, wuaueng_ui.ime.png
> open.exe uses libcef.dll
> Chromium Embedded Framework
> hmmmm
> open.exe just does libcef.dll!cef_execute_process
> isnt even called correctly
> hmmmm
> look inside libcef.dll
> not the same libcef.dll
> libdef.dll!cef_execute_process reads png file
> extracts shellcode out of it
> low detection on VirusTotal
> no notes
> first seen yesterday
i guess we bonking this now
Blue Lobster retweeted
📢 Ransomware Alert: 🇲🇾
Mah Sing Group Bhd (mahsing.com.my), a Malaysia-based real estate company, has reportedly fallen victim to SCARLETTGROUP ransomware.
NB: The group intends to publish the data within 4–5 days.
🔍 Key Details:
🛡️ Threat Actor: SCARLETTGROUP
📅 Reported on: 26/10/26
Blue Lobster retweeted
Silver Fox phishing email targeted Malaysia.
Domain IOCs
homescapestaging[.]com
segertribute[.]com
musicmaxentertain[.]com
celialinde[.]com
samoliveira[.]com
thinnected[.]com
brendaeverson[.]com
ccaselma[.]com
ecomteck[.]com
shengshunxin[.]com
mohammadinuts[.]com
cc @salmanvsf
Blue Lobster retweeted
🚨 Important Security Notice
Commanders,
We've received reports of a suspicious verification page appearing on gfl-store.com.
⚠️ Please DO NOT follow any instructions asking you to open PowerShell, run commands, or install software. These are NOT part of our legitimate security verification process.
We're urgently investigating the issue with our technical team and will share updates as soon as possible.
We're sorry for the concern this has caused, and thank you to everyone who brought this to our attention.
Stay safe, Commanders. 🛠️
— IOP Gear Division
Blue Lobster retweeted
1/ EZ Tools 2026.10 is out, all on .NET 10 (LTS)
✅ More accurate: 331K more event log records, hive logs replayed as Windows does, every test hive loads
⚡ Faster: up to 9x; EvtxECmd and Registry 2x
📉 Less memory: up to 82% less
Update with Get-ZimmermanTools 🧵 #DFIR
Blue Lobster retweeted
Evolving threat 🚨 CVE-2026-111497, previously known to affect Node.js (node2shell) and Python has evolved into “HTTP2Shell.”
A significant blast radius.
This vulnerability leaves many libraries and applications using HTTP vulnerable to pre-auth RCE via Brotli decompression.
Please be aware. Fixes not yet available for all affected services. Look for Brotli (1.2.1) dependency upgrades when they become available.
Blue Lobster retweeted
Imagine how bad a vuln is that MyCERT's X/Twitter woke up from deep slumber since 2019.
MA-1484.102026: MyCERT Advisory - Critical PHP2Shell Vulnerabilities in PHP Allowing Unauthenticated Remote Code Execution
#php2shell
mycert.org.my/portal/details…
Blue Lobster retweeted
Just published our high fidelity scanner for php2shell: github.com/assetnote/php2she…
See our detection logic here: slcyber.io/research/high-fid…
We've taken care in our detection logic and hope it helps defenders. Congrats to @calif_io and @lcfr_hax for the discovery.
