Picture

Luke Leal @rootprivilege

Threat Intel. lukeleal.com/research/posts/ United States Joined April 2019
  • Tweets
    245
  • Followers
    742
  • Following
    39
  • Likes
    416
rootprivilege Profile Picture

Luke Leal @rootprivilege

3 years ago

#Arkei #Stealer malware C2 panel using a login page that mimics the #WordPress login page but is actually connected to the C2 panel's database. Used to evade detection so the panel can stay active on compromised websites for longer. #malware #cybersecurity #C2

rootprivilege Profile Picture

Luke Leal @rootprivilege

3 years ago

#phishing operator #strox added a feature so their phishers can go to sleep and not have to be sit around waiting 24/7 for the phished #2FA #OTP codes due to the short time limit on using them 😂😂 #infosec #cybersecurity #malware

rootprivilege Profile Picture

Luke Leal @rootprivilege

3 years ago

#JavaScript #skimmer overlayed onto payment page of an infected #Magento ecommerce store to steal payment card data from visitors exfils to united81[.]com #magecart #infosec #cybersecurity #malware lukeleal.com/research/posts…

rootprivilege Profile Picture

Luke Leal @rootprivilege

3 years ago

#PHP #skimmer captures payment data fields on hacked #Magento site and #exfil via HTTP to malicious URL URL: ab[.]ro[.]lt/a1b2.php #magecart #malware #infosec #cybersecurity

rootprivilege Profile Picture

Luke Leal @rootprivilege

3 years ago

It will be interesting to see how retailer's return policy changes will impact the existing #refunding service groups that charge users a fee for their #socialengineering skills that they use to obtain the #refund for the user. cnn.com/2022/06/26/bus… #cybercrime #cyberfraud

Luke Leal retweeted
perimeterx Profile Picture

PerimeterX (now HUMAN) @perimeterx

3 years ago

[Tech blog] A cure for the obscure! PerimeterX researcher @ctrl__esc created a new open source #Javascript deobfuscator. Learn how it works. #infosec #supplychainattacks #magecart bit.ly/3v3hilm

rootprivilege Profile Picture

Luke Leal @rootprivilege

3 years ago

Fake GTM tag loads #JavaScript #skimmer from jsdelivr[.]at on a hacked #magento store's checkout page to steal credit card data. Skimmer URL: jsdelivr[.]at/js/jquery.ba.min.js lukeleal.com/research/posts… #infosec #cybersecurity #malware

rootprivilege Profile Picture

Luke Leal @rootprivilege

3 years ago

cdn-fonts[.]com used as the exfil for a #JavaScript #skimmer injected into the database on #hacked #Magento websites URL: cdn-fonts[.]com/skin/loading.gif lukeleal.com/research/posts… #infosec #cybersecurity #malware

rootprivilege Profile Picture

Luke Leal @rootprivilege

3 years ago

staticounter[.]net injected into #magento db and loading #JavaScript on a hacked store's checkout page. Can't seem to identify a #skimmer in the loaded JS... URL: js[.]staticounter[.]net/static/counter.js lukeleal.com/research/posts… #infosec #cybersecurity #malware

rootprivilege Profile Picture

Luke Leal @rootprivilege

4 years ago

#AnonymousFox 🦊 #FoxEx tool attempts LFIs on 80+ #WordPress plugin w known vulns. If the wp-config.php gets read then it's a huge problem if the host allows remote #SQL connections (but also problem for local only). #infosec #cybersecurity #cybercrime #webhosting

rootprivilege Profile Picture

Luke Leal @rootprivilege

4 years ago

#AnonymousFox 🦊 #FoxEx tool attempts LFIs on 80+ #WordPress plugin w known vulns. If the wp-config.php gets read then it's a huge problem if the host allows remote #SQL connections (but also problem for local only). #infosec #cybersecurity #cybercrime #webhosting https://t.co/ZIKG6AfUFe

rootprivilege Profile Picture

Luke Leal @rootprivilege

4 years ago

An overview of #AnonymousFox and their #PHP and #Python tools (e.g #FoxAuto) used for automating website exploits en masse & selling access to them on websites like #olux or #xleet. #malware #infosec #cybersecurity #cybercrime #wordpress #webhosting lukeleal.com/research/posts…

rootprivilege Profile Picture

Luke Leal @rootprivilege

4 years ago

Don't use root login for #WordPress wp-config.php (or any website config)! If someone is able to read the file (e.g vulns) then you've just made it much easier for them to get root access on the server. #infosec #cybersecuritytips #iamroot #opsec #webhosting

rootprivilege Profile Picture

Luke Leal @rootprivilege

4 years ago

Obfuscated #JavaScript found on legit bank login pages reveal a countermeasure that uses a tracking pixel to detect #phishing pages created from content scraping images-cdn[.]info content-cdn[.]com lukeleal.com/research/posts… #infosec #cybersecurity #cybercrime

rootprivilege Profile Picture

Luke Leal @rootprivilege

4 years ago

#JavaScript #skimmer found on infected #Prestashop websites and targeting Stripe payment data exfiltrates stolen data to ccfresh[.]co (currently 0 detections on VT) lukeleal.com/research/posts… #infosec #cybersecurity #malware

rootprivilege Profile Picture

Luke Leal @rootprivilege

4 years ago

#javascript skimmer targeting #Magento websites and #psigate payment fields exfil URL: dyneff[.]fr/health_check.php lukeleal.com/research/posts… @Dyneff_ES #Dyneff #magecart #infosec #cybersecurity #malware big ups @liamsmith86 for sample

rootprivilege Profile Picture

Luke Leal @rootprivilege

4 years ago

Large wave of recent #JavaScript #malware on #WordPress websites are grabbing their payload from trainresistor[.]cc which hides within img class tags instead of traditional <script> tags lukeleal.com/research/posts… #infosec #cybersecurity #webdeveloper #webhosting

rootprivilege Profile Picture

Luke Leal @rootprivilege

4 years ago

wtf() #skimmer continues to be used in-the-wild, targeting #WooCommerce #WordPress websites 💰 💳 ☠️ exfil: convert-server[.]com #magecart #infosec #cybersecurity #malware #javascript

rootprivilege Profile Picture

Luke Leal @rootprivilege

4 years ago

#S4LIM #phishing kit targets @n26 users w/ a multi-stage kit used for account takeover. Uses @PushoverApp API to send push notifications to attacker whenever a victim submits the first stage @veehaitch @ActorExpose #infosec #cybersecurity #cybercrime lukeleal.com/research/posts…

Trends for United States

Dodgers
40,1 B posts
Yamamoto
16,8 B posts
Michigan
107 B posts
Orioles
22,5 B posts
Mateer
7.364 posts
Underwood
7.602 posts
Tanner Scott
2.637 posts
Rand
17,8 B posts
Billy Napier
12,1 B posts
UCLA
5.613 posts
Oklahoma
25,9 B posts
Jackson Holliday
3.107 posts
Sherrone Moore
1.258 posts
Ryan Walker
#AEWCollision
15,5 B posts
Treinen
2.036 posts
Vicari Swain
1.147 posts
Vandy
2.991 posts
Kansas State
3.154 posts
Dave Roberts
1.404 posts

You might like

Malware slayer Member of @CuratedIntel
Arkbird
@Arkbird_SOLG
15K Followers
#Malware C2 hunter #infosec passionate. Tweets are my own.
Dee
@ViriBack
10K Followers
Expert in Credential Phishing and Phishing Kit Research. Working in Cyber Security - Threat Intelligence #Phishing
Jake | JCyberSec_
@JCyberSec_
10K Followers
malware analyst, reverse engineer.
reecDeep
@reecdeep
11K Followers
Your source for news and ideas on how to deal with spam trends. A spamauditor's perspective of life in the trenches battling the world of spam.
SpamAuditor
@SpamAuditor
623 Followers
phishing, scam, fraud, identity theft: helping fraudsters in searching for honest professional opportunities
illegalFawn
@illegalFawn
9K Followers
detection engineering, malware analysis, IR, threat hunting #DailyThreatHunt, threat intel, blue team, Qradar, Author of now archived @PhishKitTracker project
neonprimetime
@neonprimetime
3K Followers
#Mobile #threat HEXorcist 👹👼🏻💣 • Android/iOS/ARM malware analyst 🔎✏️ • Mobile apps exploiter 📲🧨 • #italiansdoitbetter 🇮🇹🍕🍝 🎸 • Opinions are mine 🤙
💥 𝕭𝖑4𝖈�...
@bl4ckh0l3z
4K Followers
Graph based Threat Hunting based on ~1.4mia/day DNS records from SIE Europe, ICANN CZDS, Certstream, urlscan, urlhaus, rapid7 sonar and more.
Gizmo
@TeamDreier
1K Followers
Wannabe Security Researcher | I do random projects every now and then | #InfoSec | contact@securereload.tech
Ryan Ashley
@SecureReload
904 Followers
National Cyber Incident Response Expert | Former CISO & DPO
Douglas Mun
@douglasmun
5K Followers