Fable N
@fable_n
27 subscribers
211 photos
22 videos
2 files
1.41K links
crypto-, cybercrime-, and osint-related news

run by: @fable
Download Telegram
About
Blog
Apps
Platform
Join
Fable N
27 subscribers
Fable N
https://indicator.media/p/i-got-inside-a-north-korean-hiring-scam-what-i-found-reveals-a-troubling-shift-in-tactics
Indicator
I got inside a North Korean hiring scam. What I found reveals a troubling shift in tactics
DPRK hackers hired unwitting freelancers in the Philippines, Nigeria, and Colombia to put a human face on a malware operation — and make fake companies feel real.
41 viewsFable, 
Fable N
Anatomy of the Ambient Finance Exploit: How a Stealth Attacker Drained $110K in 12 Seconds

https://community.chainbounty.io/ko/posts/019ecb8d-81c1-7b54-9739-159444c67e16
42 viewsFable, 
Fable N
https://krebsonsecurity.com/2026/06/popa-botnet-linked-to-publicly-traded-israeli-firm/
Krebs on Security
‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm
For the past four years, a sprawling Android-based botnet called Popa has forced millions of consumer TV boxes to relay Internet traffic linked to advertising fraud, account takeovers, and mass data-scraping efforts. This week, researchers from multiple security…
40 viewsFable, 
Fable N
https://opensourcemalware.com/blog/mastra-npm-malware#stage-one-setupcjs-the-downloader
Opensourcemalware
OpenSourceMalware.com - Community Threat Intelligence
Community-driven threat intelligence. Human-verified supply chain threats from every major open source ecosystem.
45 viewsFable, 
Fable N
https://www.rapid7.com/blog/post/tr-malware-tracking-dropping-elephant-tradecraft-china-themed-loader-chain/
Rapid7
Malware à la Mode: Tracking Dropping Elephant Tradecraft Through a China-Themed Loader Chain
Rapid7 researchers have identified a sophisticated malware campaign attributed to the threat actor "Dropping Elephant," characterized by the use of a China-themed decoy document to deliver a heavily reworked, in-memory remote access trojan (RAT).
51 viewsFable, 
Fable N
https://expel.com/blog/inside-lazarus-how-north-korea-uses-ai-to-industrialize-attacks-on-developers/
Expel
Inside Lazarus: How North Korea uses AI to industrialize attacks on developers
Expel is tracking a North Korean (DPRK) state-sponsored APT group. This group is targeting Web3 developers to steal cryptocurrency and NFTs.
63 viewsFable, 
Fable N
Forwarded from Krebs On Security
Scattered Spider Hackers Plead Guilty on Day 1 of Trial
https://krebsonsecurity.com/2026/06/scattered-spider-hackers-plead-guilty-on-day-1-of-trial/

Two men pleaded guilty in the United Kingdom this week to criminal charges stemming from an August 2024 cyberattack that crippled Transport for London, the entity responsible for the public transport network in the Greater London area. The duo were key members of a prolific cybercrime group known as Scattered Spider, and their guilty pleas came on the first day of what was expected to be a six-week trial.
58 viewsFable, 
Fable N
Forwarded from infinityhedge
OPENAI ENGINEERS DEVELOPED NEW OPTIMIZATIONS CUTTING MODEL INFERENCE COSTS BY MORE THAN 50%, REQUIRING LESS NVIDIA CHIPS: THE INFORMATION

OPENAI MAY USE THESE SAVINGS TO LOWER API PRICING OR INCREASE USER QUERY LIMITS
34 viewsFable, 
Fable N
https://specterops.io/blog/2026/06/29/llm-powered-edr-analysis/#h-the-rigging
SpecterOps
Accelerating EDR Evasion with LLM-Driven Analysis
SpecterOps reverse engineered Cortex XDR with LLMs to extract YARA rules, ML models, and behavioral detections.
44 viewsFable, 
Fable N
Forwarded from Zero Trust Securty Alerts 🚨
Appears ~$400K was just exploited from Edel Finance https://x.com/blockaid_/status/2072150827775533306
X (formerly Twitter)
Blockaid (@blockaid_) on X
🚨Blockaid's exploit detection system has identified an ongoing exploit on @edeldotfinance.

~$403K drained from Edel xStock lending reserves after a flash-loan-assisted wGOOGLx exchange-rate/oracle manipulation let the attacker borrow against inflated collateral.…
46 viewsFable, 
Fable N
https://krebsonsecurity.com/2026/07/fbi-seizes-netnut-proxy-platform-popa-botnet/
Krebs on Security
FBI Seizes NetNut Proxy Platform, Popa Botnet
The Federal Bureau of Investigation (FBI) said today it worked with industry partners to seize hundreds of domains associated with NetNut, a sprawling residential proxy service operated by the publicly-traded Israeli company Alarum Technologies [NASDAQ: ALAR].…
30 viewsFable, 
Fable N
https://expel.com/blog/not-very-gentlemanly-analyzing-a-zero-day-exploit-used-by-the-gentlemen-ransomware-to-disable-targets-edrs/
Expel
Not very gentlemanly: Analyzing a zero-day exploit used by The Gentlemen ransomware to disable targets’ EDRs
How the threat group used a zero-day vulnerability to disable the target's EDR, preventing it from intervening in their ransomware attack.
35 viewsFable, 
Fable N
https://hunt.io/blog/pcpjack-230-cloud-servers-smtp-proxy-network-sliver-chisel
hunt.io
PCPJack Hijacked 230 AWS, GCP, and Azure Servers to Run a Hidden SMTP Relay Network
Hunt.io recovered a 12-file SMTP proxy deployment toolkit from exposed PCPJack infrastructure, revealing how 230 compromised Linux servers were converted into a persistent email relay network using Sliver and Chisel.
24 viewsFable, 
Fable N
Forwarded from Investigations by ZachXBT
From July 2-3, 2026 a threat actor withdrew 3200 ETH from Tornado in relation to two large private key compromise thefts.

After $5.5M was laundered via Circle CCTP bridge and funds were transferred to seven Kucoin deposit addresses on Arbitrum.

Kucoin deposit addresses
0x85d7124a659fb0aeb7ccd283f3e24bc2364e7c55
0x764c80a719fdf932d4a5944e9e382f71958bffa3
0x83396ae682c821d56b0c51da86b536af0a4b9894
0x5dc523deceb53ff5e89e0f6683af77f274f51f56
0x295fdf140e7c706be5b9daffc68d97a224394cfe
0x4e6a42fa57392673580e15e35850324557f51467
0xe007625bf20387ed3c250e1dcf3d94d133480634
21 viewsFable, 
Fable N
Forwarded from Zero Trust Securty Alerts 🚨
~$20M gone from BonkDAO after a governance proposal passed unexpectedly from an wallet that had been accumulating for a while, more info on Bonk_Inu profile

https://x.com/degeneratenews/status/2074192893510619540
X (formerly Twitter)
DEGEN NEWS (@DegenerateNews) on X
BREAKING: BONKDAO WAS THE TARGET OF A MALICIOUS GOVERNANCE PROPOSAL RESULTING IN AN ESTIMATED $20M WORTH OF BONK TOKENS BEING DRAINED FROM THE BONKDAO TREASURY
16 viewsFable, 
Fable N
https://x.com/Cloudflare/status/2072311802285723953
X (formerly Twitter)
Cloudflare (@Cloudflare) on X
We're opening the waitlist for our Monetization Gateway, which will allow you to charge for any web page, dataset, API, or MCP tool behind Cloudflare. The charges will settle in stablecoins over the x402 open protocol. https://t.co/pvICtEIixj
17 viewsFable, 
Fable N
https://github.com/SmtimesIWndr/gdid-reversal
GitHub
GitHub - SmtimesIWndr/gdid-reversal
Contribute to SmtimesIWndr/gdid-reversal development by creating an account on GitHub.
18 viewsFable, 
Fable N
https://ransom-isac.org/blog/kairos-ransomware-data-extortion-case-study/
Ransom-ISAC
Kairos Ransomware: Data-Extortion Case Study Involving a U.S. Government Entity
A leaked negotiation transcript and payment-flow analysis of a successful $1 million ransom payment by a U.S. government body to Kairos — a data-extortion actor whose "ransomware group" status remains unverified.
19 viewsFable, 
Fable N
https://slowmist.medium.com/slowmist-2026-mid-year-blockchain-security-and-aml-report-75e0862179ef
Medium
SlowMist | 2026 Mid-year Blockchain Security and AML Report
Due to space limitations, this article highlights only the key findings from the report. The full report can be accessed at the following…
12 viewsFable, 
Fable N
https://www.aikido.dev/blog/compromised-injectivelabs-exfiltrates-keys
www.aikido.dev
Compromised @injectivelabs/sdk-ts exfiltrates wallet keys through fake telemetry
A malicious release of @injectivelabs/sdk-ts hid a wallet-key stealer inside code labeled as usage telemetry, then spread it across 17 more npm packages. Here's how it worked and how to check your projects.
3 viewsFable,