Security Chat (@PhishSecurity) header
Security Chat (@PhishSecurity) profile picture

Keeping an eye on the cyber security sector. How much is marketing nonsense?

Reston
Joined September 2015
Photo by Security Chat (@PhishSecurity)Photo by Security Chat (@PhishSecurity)Photo by Security Chat (@PhishSecurity)Photo by Security Chat (@PhishSecurity)Photo by Security Chat (@PhishSecurity)Photo by Security Chat (@PhishSecurity)
Security Chat retweeted
🚨 𝘏𝘦𝘭𝘱𝘥𝘦𝘴𝘬‑𝘵𝘩𝘦𝘮𝘦𝘥 𝘥𝘰𝘮𝘢𝘪𝘯𝘴 impersonating major corporate brands I am seeing a surge of 𝘩𝘦𝘭𝘱𝘥𝘦𝘴𝘬‑𝘵𝘩𝘦𝘮𝘦𝘥 𝘥𝘰𝘮𝘢𝘪𝘯𝘴 impersonating major corporate brands — each flagged with 𝗿𝗶𝘀𝗸 𝘀𝗰𝗼𝗿𝗲 𝟭𝟬𝟬 (𝗰𝗿𝗶𝘁𝗶𝗰𝗮𝗹). These domains are not legitimate and are being weaponized in 𝗽𝗵𝗶𝘀𝗵𝗶𝗻𝗴 + 𝘀𝗼𝗰𝗶𝗮𝗹 𝗲𝗻𝗴𝗶𝗻𝗲𝗲𝗿𝗶𝗻𝗴 𝗰𝗮𝗺𝗽𝗮𝗶𝗴𝗻𝘀. 𝗗𝗼𝗺𝗮𝗶𝗻𝘀 𝗼𝗯𝘀𝗲𝗿𝘃𝗲𝗱: • helpdesk‑blackrock.com • helpdesk‑uber.com • helpdesk‑nike.com • helpdesk‑affirm.com • helpdesk‑westernunion.com • helpdesk‑x.com • helpdesk‑optus‑au.com ⚠️ 𝗔𝘁𝘁𝗮𝗰𝗸𝗲𝗿𝘀 𝗮𝗿𝗲𝗻’𝘁 𝘀𝘁𝗼𝗽𝗽𝗶𝗻𝗴 𝗮𝘁 𝗱𝗼𝗺𝗮𝗶𝗻𝘀. They’re pairing these lookalikes with 𝗧𝗲𝗮𝗺𝘀 𝗶𝗺𝗽𝗲𝗿𝘀𝗼𝗻𝗮𝘁𝗶𝗼𝗻 and other social engineering tactics — tricking users into believing they’re talking to internal IT or helpdesk staff. Once trust is gained, attackers push malicious links, request credentials, or pivot into 𝗱𝗮𝘁𝗮 𝗲𝘅𝗳𝗶𝗹𝘁𝗿𝗮𝘁𝗶𝗼𝗻 𝘃𝗶𝗮 𝗥𝗠𝗠 𝘁𝗼𝗼𝗹𝘀. Sharing is caring 🫡 #Cybersecurity #SilentPush #Phishing #SocialEngineeringAttack
5
13
54
4,750
Security Chat retweeted
As we prepare for 2026, we can look back on what happened in 2025 to forecast the types of threats the global community will encounter in the new year. Kasey Best of @SilentPush offers #predictions and #trends to watch out for. vmblog.com/archive/2025/11/2… #AI #ransomware #security
1
73
Security Chat retweeted
Expanding Google Careers phishing indicators with @ValidinLLC Lookalike Domains & @silentpush WHOIS Scanner 807 total indicators - This campaign is massive. sample regex: /^(apply|hire|start)\.g(recruit|talent|team|app|hiring|hire|career)[a-z]+\.com$/ pastebin.com/UxmPwpQJ
4
15
2
66
7,326
Security Chat retweeted
The @FBI has reported a series of fake websites impersonating the Internet Crime Complaint Center (IC3) for phishing attacks. The sites are near pixel perfect copies of the official IC3 site, and are used to gather personal information from users for later targeting with #phishing. By looking at web content "borrowed" from the official IC3 site, we can discover some of the fake pages with a web query.
9
1
12
2,060
Security Chat retweeted
Rumors are spreading about a mayor #LawEnforcement operation against #Rhadamanthys #Stealer. @g0njxa and me have been monitoring the situation closely. -Rhada domains under active law enforcement control - Customers are adviced to delete all servers Image via club1337
10
35
3
100
26,313
Security Chat retweeted
Some more PoisonSeed domains! The ones at the top were created just 30 minutes ago! They don't appear to be up yet. Block it proactively! ytcareersstaffing[.]com ytcareersprospect[.]com ytcareersdesk[.]com ytcareersjob[.]com ytcareersgroup[.]com ytcareersopportunity[.]com ytcareersprogress[.]com ytcareersregister[.]com ytcareersgrow[.]com ytcareersselect[.]com ytcareersenroll[.]com ytcareersjoin[.]com ytcareersinvite[.]com ytcareerssearch[.]com ytcareersapplication[.]com ytjobsgroup[.]com ytjobsinvite[.]com ytjobsprogress[.]com ytjobspeople[.]com ytjobsopenings[.]com ytjobssubmit[.]com ytjobsadvance[.]com ytjobsnetworkhub[.]com ytjobsteams[.]com ytjobsenrollment[.]com ytjobsstaffing[.]com ytjobsconnects[.]com ytjobslist[.]com ytjobshires[.]com ytjobsworkplace[.]com ytjobsprospects[.]com ytjobsplatform[.]com ytjobsgoals[.]com ytjobscenterhub[.]com ytjobslisting[.]com ytjobscareerpath[.]com ytjobspathway[.]com ytjobsfocus[.]com ytjobsrecruiters[.]com ytjobscareer[.]com ytjobsflow[.]com ytjobszone[.]com ytjobsglobal[.]com ytjobsvacancies[.]com ytjobsapplynow[.]com ytjobsworks[.]com ytjobsunit[.]com ytjobscenter[.]com ytjobslaunch[.]com ytjobsrecruitment[.]com ytjobshiring[.]com ytjobsgrow[.]com ytjobsselect[.]com ytjobssuccess[.]com ytjobsgrowth[.]com ytjobsline[.]com ytjobslink[.]com ytjobsstaff[.]com ytjobsmatch[.]com ytjobssquad[.]com ytjobssearch[.]com ytjobsbridge[.]com ytjobsbuild[.]com ytjobsapplyhub[.]com ytjobsnetwork[.]com ytjobsplace[.]com ytjobsnext[.]com ytjobspath[.]com ytjobspartner[.]com ytjobsnow[.]com ytjobsdesk[.]com ytjobsmember[.]com ytjobsrecruiting[.]com ytjobsemployment[.]com ytjobscollab[.]com @500mk500 teapawt.net/MalasadaTech808/status…
More PoisonSeed domains. These ones are Aquent-themed. EXFIL: hxxps://bxcback2025xxx23vnvn.onrender[.]com/api/login aquent-recruitment[.]com aquent-career[.]com aquent-scheduling[.]com aquent-staffing[.]com aquent-hiring[.]com aquent-professionals[.]com aquent-recruiting[.]com aquent-updates[.]com @500mk500
1
4
11
1,145
Security Chat retweeted
NEW THREAT REPORT 🚨 We're tracking the spread of a new malware loader we have named “CountLoader,” that is strongly associated with Russian ransomware gangs. 🇷🇺 Read: hubs.ly/Q03JNJMJ0 #countloader #threat #russia #ukraine #cybersecurity #ransomware
24
75
8,249
searching on keywords that are often used by threatactors can bring you to juicy open directories! hxxp://84.247.147.214:8080/ uhoh, the worst ransomware I have seen.
1
5
1
9
1,411
Pivoting on a file named google-privacy-policy-Cb0CGVRT.svg was used in a ClickFix campaign. hash: 51da32d8582706c6229f9a548da21b9845cb51ee55736a252addcdf2b1df5848 @silentpush @banthisguy9349 @RacWatchin8872 @SquiblydooBlog @skocherhan @500mk500 @volrant136 @smica83
3
8
2
24
5,110
#NetSupportRat #C2 5[.]181[.]159[.]204 94[.]158[.]244[.]161 AS39798 MivoCloud SRL 🇺🇸 @Huntio @abuse_ch @JAMESWT_WT @500mk500 @anyrun_app @silentpush @MivoCloud
3
4
384
Security Chat retweeted
Our team @silentpush just dropped a definitive look at SocGholish (operated by TA569) and the initial access broker ecosystem they are facilitating. Big thanks to past researchers who have worked on SocGholish! We've got details about our visibility @ silentpush.com/blog/socgholi… 🖖🏻
2
3
488
Security Chat retweeted
We're seeing lots of similar #phishing domains to those reported by @_JohnHammond 🚨 The actors are using consistent naming schemes and web hosting software that we can capture with a search query. The actors have also made two other woopsies that we'll show down below👇
Digging into a Twitter/X based phishing email I received -- exploring the source code (very similar to the one that hit Linus Tech Tips), finding the hacker's API keys, pulling message logs... and a little extra spice to try to call and confront them 🙃 youtu.be/CFjATtMAm8A
1
5
11
2,317
In this type of field its important to never rely on one tooling. Nothing is the holy grail in my opinion. So combine the bunch to that overview going. I just learned that you can use several datasources @silentpush Lets see what I can find with open-dir datasource.
2
4
25
2,827
Fake Google Chrome download site: https://google.[tw].cn/ The SSL cert for this domain has been given by "Google Trust Services". Not think I have to say anything about it... 🤷‍♂️
7
24
4
101
72,590
Security Chat retweeted
Definite threat alert: https://d[.]goldmansachserfd[.]top/?jp=1 found on app.silentpush.com/shared/eb… via @silentpush @GoldmanSachs
1
1
190
Security Chat retweeted
Nice and Simple Scattered Spider Pivots - Thanks to Initial Intel and previous posts from @TLP_R3D 1⃣ Regex Pattern And Server Header 2⃣ Regex, Server Header and ASN 3⃣ Regex, Dates, ASN and Name Server Utilising Domain Search and Web Scanner from @silentpush
🔥After a Long Break - New #ScatteredSpider Domain: revolut-okta[.]com IP Address: 80.78.27.6 AS Owner: ABSTRACT, FI
24
106
8,458
404media.co/a-network-of-ai-… Very interesting watering hole attack by Fin7- going for the AI nude audience #ThreatIntelligence #cybersecuritytips initial investigation by @silentpush
139