Threat Researcher and Threat Hunter
Joined July 2024
- Tweets32
- Following96
- Followers396
- Likes286
Alopsis retweeted
This is the future of malware. 👀
VOLTA doesn’t just steal your passwords and crypto wallets.
It packages everything and sends it to Claude Opus 4.6 with this prompt: “You are a forensic intelligence analyst. Rank what this victim is worth.”
If Claude refuses → Kimi K2 → Gemini.
We caught the full chain in the sandbox (including the exact request it sent to the AI)
Stealers are now outsourcing target prioritization to commercial LLMs. 🚨
app.threat.zone/submission/c…
Alopsis retweeted
Another day, another bad OPSEC. 🥔
A Microsoft 365 phishing kit, a preventable mistake, and another reminder that even attackers can leave breadcrumbs.
The weakest link isn't always the user. Sometimes, it's the operator.
potato.id/en/posts/microsoft…
Alopsis retweeted
🚨🇫🇷 Plus de 905 000 enregistrements liés à des plaques d’immatriculation françaises seraient en vente sur le dark web, avec les noms et adresses des automobilistes.
Un hacker connu sous le pseudonyme « ChimeraZ » affirme détenir une base de 175 Mo contenant 905 097 enregistrements, dont 847 064 plaques d’immatriculation uniques, 506 003 adresses e-mail et 474 906 numéros de téléphone. Le tout serait proposé à la vente sur un forum de hackers.
Le pirate annonce déjà posséder un deuxième fichier contenant près de 2 millions de plaques supplémentaires.
Alopsis retweeted
DORK: intext:@"yahoo|gmail|outlook|hotmail".com (filetype:xls OR filetype:csv OR ext:xlsx OR ext:txt OR ext:sql) site:*.gov
----------------------------------------------------------
Not gonna lie, this single google dork I made has given me SO much exposed PII from self-hosted programs and some .gov, .edu, .int and .mil domains.
Use it for BBP targets. If it helps you find something interesting, come back here on X and thank me.
Also, make sure you run this on Bing. Google has fixed/changed some search operators so it will not work.
Alopsis retweeted
🔴 1.4Billion Credential Records Exposed Online
A misconfigured Elasticsearch instance exposed 360+GB of data, including ~1.4Billion credential records and 1.3M+ US consumer PII records containing names, emails, phone numbers and addresses.
The infrastructure appears to aggregate and categorize data from multiple sources, including Telegram channels, potentially making credentials searchable by targets such as banking and crypto services.
Its operator and intended purpose remain unknown - it could potentially support anything from data/intelligence services to malicious operations.
Risks:
Account takeover
Credential stuffing
Targeted phishing
PII abuse
#ThreatIntel #CyberSecurity #DataBreach
Alopsis retweeted
#APT #Sidewinder targeting National Telecom Corporation #NTC 🇵🇰
+1
Tracked by @Huntio
https://zimbramail-nyatel-com[.]up[.]railway[.]app/login.html?gfjdliotrgojnghgherbegrehureert0e0ee=
Ref: teapawt.net/volrant136/status/2048…
cc: @500mk500 @MichalKoczwara @malwrhunterteam
#APT #Sidewinder targeting #Pakistan🇵🇰
+1
Tracked by @Huntio
https://zimbra-nyatel-production[.]up[.]railway[.]app/login.html?gfjdliotrgojnghgherbegrehureert0e0ee=1
Ref: teapawt.net/volrant136/status/2032…
cc: @500mk500 @MichalKoczwara @malwrhunterteam
Alopsis retweeted
🚨 @MistralAI, l'IA « souveraine » française, vient de confirmer une cyberattaque. 450 dépôts de code source interne sont en vente à 25 000 $ sur un forum cybercriminel. ⬇️
Comment ? Via une attaque dite « supply chain » : les hackers n'ont pas visé Mistral directement. Ils ont compromis TanStack, un outil utilisé par les développeurs de Mistral. Une fois l'outil infecté, des packages npm et PyPI de Mistral ont été contaminés et publiés entre le 11 mai 22h45 et le 12 mai 01h53 UTC.
Résultat : ~5 Go de code volé. Entraînement des modèles, fine-tuning, agents finance, KYC, dashboard, projets futurs....
Mistral le confirme (advisory MAI-2026-002) : un appareil développeur infecté est impliqué. « Aucune indication que l'infrastructure a été compromise », lit-on. Peut-être. Mais le code source est dehors, prix affiché, délai d'une semaine avant mise en ligne gratuite sur le forum.
‼️🇫🇷 Mistral AI has confirmed they were impacted by the recent TanStack supply chain attack.
docs.mistral.ai/resources/se…
Alopsis retweeted
Short write-up on a small investigation conducted with
@Alopsis into a phishing kit impersonating FedEx.
blog.aksnk.com/posts/colisre…
#phishing #cti #osint #infosec #threatintel #ninepercent
![Fake portals everywhere [1] — Autopsy of a FedEx phishing kit · aksnk / notes](https://pbs.twimg.com/card_img/2117221249680056321/L3jyFo4m?format=jpg&name=800x419)
Alopsis retweeted
🚨 Red Hat Confirms Data Breach After Hackers Claim to Steal 570GB of Private GitHub Repositories
Read more: cybersecuritynews.com/red-ha…
Red Hat, the world's leading enterprise open-source software provider, has officially confirmed a significant security incident involving unauthorized access to its internal GitLab instance used by the Red Hat Consulting team.
This confirmation comes after the threat actor group known as Crimson Collective claimed to have exfiltrated approximately 570GB of compressed data from 28,000 private repositories.
The unauthorized third party successfully accessed and copied sensitive data from this instance before security teams detected the intrusion.
#cybersecuritynews #databreach
Alopsis retweeted
#China 🇨🇳 - Huawei Technologies Co., Ltd. has reportedly suffered a data breach, with a threat actor offering to sell company source code and internal tools. dailydarkweb.net/huawei-tech…
