eremit4 @_eremit4

Hunting for live 🪽 github.com/eremit4 Joined February 2022

Tweets

106
Followers

310
Following

144
Likes

949

Recorded Future @RecordedFuture

3 days ago

Blind Eagle (TAG-144) is ramping up. Our Insikt Group report uncovers 5 distinct activity clusters targeting Colombian gov’t entities with evolving TTPs, RATs, and infrastructure. Get the IoCs and mitigations:👇 bit.ly/4fUd99m

0 10 11 2K 3

Download Gif

Recorded Future @RecordedFuture

2 weeks ago

The Lumma infostealer isn’t just #malware, it’s an ecosystem. Our latest Insikt research reveals how affiliates use new tools, MaaS platforms, and underground networks to fuel fraud and evade detection. Full report👇 bit.ly/3Hl1nrZ #ThreatIntelligence #Cybersecurity

1 15 36 4K 9

Download Gif

P4nd3m1cb0y @P4nd3m1cb0y

3 weeks ago

🇧🇷#PhantonCard appsegurocartao[.]com segurocartaoapp[.]com segurocartaoprotegido[.]com sicurezza-nfc24h[.]site segurancadocartao[.]info monitoreseucartao[.]com segurancanoseucartao[.]shop segurancanfc[.]com www[.]meucartaoseguro[.]com securecard[.]online

2 5 12 2K 3

Download Image

Source Defense Research @sdcyberresearch

3 weeks ago

The "perfect" #magecart: Hacker injects 1st-party JS replacing Stripe’s #payment form with a fake one. Stolen data sent to the merchant’s own server No 3rd-party domains, no suspicious traffic. Real Stripe form hidden, fake shown to the shopper #WebSkimming #FormJacking #PCIDSS

0 6 20 2K 4

Download Image

vx-underground @vxunderground

4 weeks ago

x.com/i/article/1955…

11 63 527 40K 195

P4nd3m1cb0y @P4nd3m1cb0y

a month ago

⚠️#CraxsRat 🔥hxxps://cadastromotorista[.]online/ 🔥hxxps://www.descargarseguro[.]store/ 🔥hxxps://www[.]baixarseguro[.]store/ f6.ru/media-center/p… #malware #threat #android #CTI #IOC

1 2 6 495 3

Padawan @johnk3r

a month ago

🛑 Heads-up: #num2words v0.5.15 (just dropped on PyPI) may be #compromised. Early signs probably link it to #Scavenger, the same threat actor behind previous software supply chain intrusions. @MalwareUtkonos @cyb3rjerry @InvokeReversing

6 18 45 6K 4

Download Image

Padawan @johnk3r

a month ago

WebSocket was used for exfiltration in earlier samples. In this one, EMV card data is sent over MQTT. Direct use of pushMessageToMqtt() after NFC tag discovery confirms this behavior #CardSecurity

Padawan @johnk3r

a month ago

WebSocket was used for exfiltration in earlier samples. In this one, EMV card data is sent over MQTT. Direct use of pushMessageToMqtt() after NFC tag discovery confirms this behavior #CardSecurity https://t.co/wJGMfcx59f

0 2 5 2K 0

0 4 19 4K 1

Download Image

Padawan @johnk3r

2 months ago

🚨 Android malware impersonating "security apps" from banks abuses NFC (IsoDep) to read EMV contactless cards and exfiltrate data in real time via WebSocket. c2: 45.88.91\.119 Been debugging a lot of EMV stuff lately... @setThreatTitle @P4nd3m1cb0y @akaclandestine

2 5 19 4K 11

Download Image

BlackSabbath @BlackSabbath

2 months ago

Ozzy Forever!

3K 93K 403K 8.6M 6K

Download Image

P4nd3m1cb0y @P4nd3m1cb0y

3 months ago

[1/6] Recently I stumble against a malicious campaign acting as #JusBrasil delivering what it seams #OctalynStealer @urlscanio Query: hash:7933c3cacc11084d4a1a87837df101238a9baf749f303c99ba4b93090a9597d0 AND page.url:"html/index.html" #malware #threat #stealer #trojan #IOC #CTI

1 8 21 4K 4

Download Image

vx-underground @vxunderground

5 months ago

Windows 10 support ends October 14th, 2025. It is the calling of the Linux nerds.

117 493 3K 190K 624

Download Video

Padawan @johnk3r

5 months ago

Batch + Warsaw Check + Malicious Extension = Exfiltration A malicious batch script checks for #Warsaw security software. If Warsaw is absent, the infection process stops. If present, it loads a malicious extension, then monitors and collects data from "Banco do Brasil" accesses.