vx-underground
45.5K subscribers
3.9K photos
413 videos
83 files
1.42K links
The largest collection of malware source, samples, and papers on the internet.

Password: infected

https://vx-underground.org/
Download Telegram
vx-underground
Wtf I went to nappy noo noo city and woke up to everyone yappin about another NPM supply chain attack
NPM is for nerds bro you don't need to install a third party dependency to do division ok

Jk idk I'm just talking shit idk what's going on yet
πŸ₯°46πŸ’―15❀8πŸ€”2😒1🀣1
While everyone was discussing the NPM supply chain attack, what else happened?

- _CPResearch_ did some article on some nerd named PureCoder (???) who was doing some ClickFix malware campaign with fake job offers. They did some kind of campaign, compromised some place for a few days, or something. They found the builder and cryptor and some other stuff. New malware guy on the block doing malware and stuff

- Securelist did an article on RevengeHotel. They target hotels, and steal credit cards, etc. They're back again and using AI for phishing and malicious scripts. Claude and/or ChatGPT is helping Threat Actors I guess

- PointWild discovered a new Information Stealer named Raven. It's written in C++ and Delphi.

- proofpoint did some news on TA415 (China?) targeting the United States think tanks and universities. They're using Visual Studio dev tunnels, Google Calenders, and Google Sheets as a C2

- Acronis discussed a new malware campaign that uses ClickFix and steganography together to be extra cool and badass. This malware campaign is in multiple languages or whatever. It just delivers an infostealer

- sekoia_io did a thing on APT28 (Russia?) and some new campaign Russia hacking thingy named "Phantom Net Voxel". They uncovered it when they looked at some stuff from the Ukraine government. It does a bunch of stuff and lands on BeardShell and SlimyAgent.

- GDATA released another paper on ManualFinder. They found some more malware campaigns, and deception, and blah blah blah. It's called AppSuite and OneStart

That's all in just 1 day. Smh yall gotta LOCK IN (its like this everyday, everyday is an inescapable nightmare)
❀41πŸ₯°11😱10😒1
vx-underground
While everyone was discussing the NPM supply chain attack, what else happened? - _CPResearch_ did some article on some nerd named PureCoder (???) who was doing some ClickFix malware campaign with fake job offers. They did some kind of campaign, compromised…
Note: I skimmed the paper too skimmingly. PureCoder and pure stuff is known. I misread when skimming (I skim stuff).

I'm sorry to everyone who I let down. Please stop bonking me.
🀝45πŸ€“8❀5😒1🫑1
tl;dr

- By default it uses the Perplexity search engine
- Installing the browser requires a Perplexity account
- Not available on Linux (yet)
- The browser "uses AI to securely handle your data"(?)
- Generic features of all modern web browsers
- Probably Chromium based
😁72😱15❀6😒3πŸ€”1🀩1
vx-underground
tl;dr - By default it uses the Perplexity search engine - Installing the browser requires a Perplexity account - Not available on Linux (yet) - The browser "uses AI to securely handle your data"(?) - Generic features of all modern web browsers - Probably…
In my opinion, this will probably secure your password, ya. It is 1Password. However, I'm inclined to believe this is an attempt at harvesting more data for AI research.

They no longer need to scrape when they're inside your machine.
πŸ’―73😱9πŸ‘5❀1😒1
HOLY FUCK.

Department of Justice nabbed one of the Scattered Spider guys. They got him on 120 counts of computer intrusions.

He's facing over 95 years in prison. I've NEVER seen a cyber crime charge this high.
🀯79❀12🀣11😒6πŸ€”2πŸ‘1πŸ‘1
what the fuck thats me
🀣91πŸ₯°12πŸ‘10😁4❀2😒1
I received this image quite some time ago. I've been sitting on it. Staring at it. Contemplating the duality of life.

Can anyone guess what this image is?
🀣71πŸ₯°11❀7πŸ”₯3😒1
vx-underground
I received this image quite some time ago. I've been sitting on it. Staring at it. Contemplating the duality of life. Can anyone guess what this image is?
This is (allegedly) Transport For London. I received this image over 1 year ago.
😱26🀣17πŸ‘8πŸ”₯5😒1
Dawg, one of the Scattered Spider guys ransomed a bunch of companies, made $36,000,000, then used the money for Uber Eats and Steam 😭

They had him from Uber Eats bro 😭
🀣121😁11😎7🫑5😒2
DAWG. They social engineered the United States judicial system (???), reset someone's password by pretending to be helpdesk, and LOOKED THEMSELVES UP
🀣84😎7πŸ€“6❀2😒1🀩1
jubair.complaint.pdf
214.7 KB
Official court document on United States v Jubair (Scattered Spider, Earth2Star)
πŸ₯°18πŸ”₯7❀2😒1
vx-underground
DAWG. They social engineered the United States judicial system (???), reset someone's password by pretending to be helpdesk, and LOOKED THEMSELVES UP
Imagine being "INDIVIDUAL-1". The FBI just kicks in your door asking who "Austin" is 😭
🀣50😒5❀2
Chat, I'm not a crypto nerd.

In this Scattered Spider court document, they state Mr. Jubair a/k/a Earth2Star received approx. 920.16BTC from performing ransomware attacks.

How difficult is it to safely launder 920.16BTC?

(approx. $108,062,646 as of this writing)
😱47❀9πŸ’―5😁2😒1
> Scattered Spider ransoms company for 964BTC
> wtf_thats_alot.jpeg
> Document says "Cost of BTC at time was $36M"
> $36M / 964BTC = $37.5K
> BTC value was $37.5K in November, 2023
> Google "Ransomware, November, 2023"
> omfg.exe
🀯89🀣22πŸ‘11❀3😒1
There's people on Xitter saying "The COM" is an ANTIFA, LGBTQIA, Furry, Transexual anti-American gang funded by George Soros

This has occured because FBI Director Kash Patel mentioned 764 in a Senate hearing. Ameriburgers who don't do computers looked up 764, found "The COM" on Wikipedia, and now think "the COM" is some sort of Democrat (American Liberal) funded organization

Dawg wtf LOL
🀣86😁9πŸ”₯4❀2😱1😒1