@BlockmageSec

Web3 Native Threat Intelligence.

 The Ether
blockmage.dev
Joined December 2022
  • Tweets268
  • Following151
  • Followers1.3K
16Media
👀 [email protected] 53783AD54B35D818 8E76889A6701DFE88BE8B569 mirror.xyz/blockmage-labs.et…
1
1
1
1
1,862
We have updated our PGP keys. The key referenced in this post remains valid, but defunct UIDs have been removed. The article has been updated to reflect these changes. All keys have been cross-certified (the old with the new, and both with our new hardware master key).
1
34
For emails, the email referenced in this post is now defunct. New emails should be addressed to: [email protected] Please refer to the post for the most up-to-date information: on.blockmage.dev/2023-04-25
32
Earlier today, we flagged a VS Code extension (rphlmr.vscode-drizzle-orm) based on 21 critical YARA hits from vsix-audit. After manual inspection and deeper analysis, inspecting the .vsix, and reversing the WASM binaries, we’ve confirmed this is a False Positive.
1
1
295
- The SOL wallet identified was actually a character property table in the Oniguruma regex engine. - The "Dropper" patterns were standard Emscripten/LLHTTP boilerplate. - The "Stealer" hits were bundled dotenv and undici dependencies.
1
158
Takeaway: Automated scanners are essential for flagging capabilities, but manual verification is the only way to determine intent. We acted quickly in hopes of preventing harms, but in this case, we were mistaken. We've removed the post to avoid any confusion (sorry!).
1
2
119
BLOCKMAGE retweeted
Fantasy@0xFantasy7 Aug 2025
1/ I've been doing some research into how Unity Packages (similar to Node or Pip packages) could be weaponized for malware delivery Let me tell you, it doesn't exactly look good... 🧵
4
3
5
19
4,297
Links: CVE-2025-31201: Apple CVE-2025-31200: Apple and Google Threat Analysis Group macOS Sequoia 15.4.1: support.apple.com/en-us/1224… iOS 18.4.1 and iPadOS 18.4.1: support.apple.com/en-us/1222… visionOS 2.4.1: support.apple.com/en-us/1224…
1
2
3
698
No excuses. These are live use, not theoretical CVEs. Apple doesn’t push same-day cross-platform updates and delete vulnerable code unless the stakes are real. Stay sharp. Patch everything. Watch your traffic. 🧙‍♂️
1
1
3
355
Two #CVE's, patched across every Apple platform, both marked as actively exploited in the wild: #Apple just released: - macOS 15.4.1, - iOS 18.4.1 - iPadOS 18.4.1 - tvOS 18.4.1 - visionOS 2.4.1 — and you should stop what you're doing and update now.
1
1
4
608
July 2023 #TornadoCash exit worth 1,400 ETH ($2.6M) Exit via 100 ETH Contract, swaps for USDC, heads out over the Synapse bridge, to Polygon 0xc09d3c2 and get gambled away at @Stake. I see this fairly often when analysing TC. Tool: @MetaSleuth
4
5
21
6,895
BLOCKMAGE retweeted
ZachXBT
@zachxbt5 Nov 2023
Replying to @zaingaziani @Ledger @Microsoft
Sadly received two messages about this from victims today. Seems another person lost funds in just past few min.
18
5
72
20,369
BLOCKMAGE retweeted
ZachXBT
@zachxbt5 Nov 2023
Community Alert: There is currently a fake @Ledger Live app on the official @Microsoft App Store which was resulted in 16.8+ BTC ($588K) stolen Scammer address bc1qg05gw43elzqxqnll8vs8x47ukkhudwyncxy64q
338
1,512
269
3,870
1,089,661
BLOCKMAGE retweeted
ZachXBT
@zachxbt25 Oct 2023
1/ An investigation into the Canadian scammer known as Yahya for their involvement in 17+ SIM swaps which resulted in more than $4.5M stolen.
288
810
131
3,756
825,280
BLOCKMAGE retweeted
Fantasy@0xFantasy19 Oct 2023
Replying to @PeckShieldAlert
This is another MakerDAO deposit. Now, I dont understand the exact mechanics of this, but after a bit of digging, funds seem to get withdrawn from Maker as USDC and deposited into Coinbase xitter.cf/0xFantasy/status/16977…
Fantasy@0xFantasy2 Sep 2023
Replying to @MistTrack_io
seems that it was a deposit into maker. call trace and debank show it properly, but etherscan doesnt for some reason docs.makerdao.com/smart-cont…
3
2
2
6
2,270
BLOCKMAGE retweeted
Caido
@CaidoIO3 Oct 2023
It's release time 🎃 - Responses can now be intercepted and modified - Delete requests from HTTP History - [Pro] Import/export your projects using our new "backups" page - [Pro] Add shell commands to your convert workflows with the new "Shell" node github.com/caido/caido/relea…
1
10
1
75
11,517
GM GMers! Tagging people who do great work in this space but I feel are not shown enough love! Go follow ⬇️ @CryptoaaService @WoAS_Necksus @0xFantasy @0xSaiyanElite @1c4m3by @Plumferno @BlockMageSec @boringsecurity @brookejlacey @ManicalEngineer Who did I miss? Tag them!
6
4
1
17
2,005
BLOCKMAGE retweeted
Vaana❤️@Vaana2K18 Aug 2023
Replying to @PocketUniverseZ @1c4m3by @oxsaiyangod @BlockmageSec @Plumferno @opensea @Server_Forge
@1c4m3by saved me the other day 🤝 appreciate your work ♥️
1
2
5
1,340
Introducing the Pocket Guardians They've already saved *hundreds* of you from dangerous websites Here's a quick intro ⬇️
24
51
8
176
16,937
3/ - @1c4m3by is a security researcher who's already blocked hundreds of scams - @OxSaiyanGod is a security researcher from @BlockMageSec - @plumferno works at @opensea's trust & safety team and founded @Server_Forge
5
3
2
33
4,429
BLOCKMAGE retweeted
Tay 💖
@tayvano_18 Jul 2023
dprk once again rekting you via the platforms you use: github, slack, tg, npm. not checking email won't protect you anymore. 😭 admin keys and build/deploy systems gunna end up pwnd by this campaign. gl & rip.🪦 github.blog/2023-07-18-secur…
12
57
13
182
51,757
Load more