Security Chat retweeted
🚨 𝘏𝘦𝘭𝘱𝘥𝘦𝘴𝘬‑𝘵𝘩𝘦𝘮𝘦𝘥 𝘥𝘰𝘮𝘢𝘪𝘯𝘴 impersonating major corporate brands
I am seeing a surge of 𝘩𝘦𝘭𝘱𝘥𝘦𝘴𝘬‑𝘵𝘩𝘦𝘮𝘦𝘥 𝘥𝘰𝘮𝘢𝘪𝘯𝘴 impersonating major corporate brands — each flagged with 𝗿𝗶𝘀𝗸 𝘀𝗰𝗼𝗿𝗲 𝟭𝟬𝟬 (𝗰𝗿𝗶𝘁𝗶𝗰𝗮𝗹). These domains are not legitimate and are being weaponized in 𝗽𝗵𝗶𝘀𝗵𝗶𝗻𝗴 + 𝘀𝗼𝗰𝗶𝗮𝗹 𝗲𝗻𝗴𝗶𝗻𝗲𝗲𝗿𝗶𝗻𝗴 𝗰𝗮𝗺𝗽𝗮𝗶𝗴𝗻𝘀.
𝗗𝗼𝗺𝗮𝗶𝗻𝘀 𝗼𝗯𝘀𝗲𝗿𝘃𝗲𝗱:
• helpdesk‑blackrock.com
• helpdesk‑uber.com
• helpdesk‑nike.com
• helpdesk‑affirm.com
• helpdesk‑westernunion.com
• helpdesk‑x.com
• helpdesk‑optus‑au.com
⚠️ 𝗔𝘁𝘁𝗮𝗰𝗸𝗲𝗿𝘀 𝗮𝗿𝗲𝗻’𝘁 𝘀𝘁𝗼𝗽𝗽𝗶𝗻𝗴 𝗮𝘁 𝗱𝗼𝗺𝗮𝗶𝗻𝘀. They’re pairing these lookalikes with 𝗧𝗲𝗮𝗺𝘀 𝗶𝗺𝗽𝗲𝗿𝘀𝗼𝗻𝗮𝘁𝗶𝗼𝗻 and other social engineering tactics — tricking users into believing they’re talking to internal IT or helpdesk staff. Once trust is gained, attackers push malicious links, request credentials, or pivot into 𝗱𝗮𝘁𝗮 𝗲𝘅𝗳𝗶𝗹𝘁𝗿𝗮𝘁𝗶𝗼𝗻 𝘃𝗶𝗮 𝗥𝗠𝗠 𝘁𝗼𝗼𝗹𝘀.
Sharing is caring 🫡
#Cybersecurity #SilentPush #Phishing #SocialEngineeringAttack
Security Chat retweeted
As we prepare for 2026, we can look back on what happened in 2025 to forecast the types of threats the global community will encounter in the new year. Kasey Best of @SilentPush offers #predictions and #trends to watch out for. vmblog.com/archive/2025/11/2…
#AI #ransomware #security
Security Chat retweeted
Expanding Google Careers phishing indicators with @ValidinLLC Lookalike Domains & @silentpush WHOIS Scanner
807 total indicators - This campaign is massive.
sample regex: /^(apply|hire|start)\.g(recruit|talent|team|app|hiring|hire|career)[a-z]+\.com$/
pastebin.com/UxmPwpQJ
Security Chat retweeted
The @FBI has reported a series of fake websites impersonating the Internet Crime Complaint Center (IC3) for phishing attacks.
The sites are near pixel perfect copies of the official IC3 site, and are used to gather personal information from users for later targeting with #phishing.
By looking at web content "borrowed" from the official IC3 site, we can discover some of the fake pages with a web query.
Security Chat retweeted
Rumors are spreading about a mayor #LawEnforcement operation against #Rhadamanthys #Stealer.
@g0njxa and me have been monitoring the situation closely.
-Rhada domains under active law enforcement control
- Customers are adviced to delete all servers
Image via club1337
Security Chat retweeted
Some more PoisonSeed domains! The ones at the top were created just 30 minutes ago! They don't appear to be up yet. Block it proactively!
ytcareersstaffing[.]com
ytcareersprospect[.]com
ytcareersdesk[.]com
ytcareersjob[.]com
ytcareersgroup[.]com
ytcareersopportunity[.]com
ytcareersprogress[.]com
ytcareersregister[.]com
ytcareersgrow[.]com
ytcareersselect[.]com
ytcareersenroll[.]com
ytcareersjoin[.]com
ytcareersinvite[.]com
ytcareerssearch[.]com
ytcareersapplication[.]com
ytjobsgroup[.]com
ytjobsinvite[.]com
ytjobsprogress[.]com
ytjobspeople[.]com
ytjobsopenings[.]com
ytjobssubmit[.]com
ytjobsadvance[.]com
ytjobsnetworkhub[.]com
ytjobsteams[.]com
ytjobsenrollment[.]com
ytjobsstaffing[.]com
ytjobsconnects[.]com
ytjobslist[.]com
ytjobshires[.]com
ytjobsworkplace[.]com
ytjobsprospects[.]com
ytjobsplatform[.]com
ytjobsgoals[.]com
ytjobscenterhub[.]com
ytjobslisting[.]com
ytjobscareerpath[.]com
ytjobspathway[.]com
ytjobsfocus[.]com
ytjobsrecruiters[.]com
ytjobscareer[.]com
ytjobsflow[.]com
ytjobszone[.]com
ytjobsglobal[.]com
ytjobsvacancies[.]com
ytjobsapplynow[.]com
ytjobsworks[.]com
ytjobsunit[.]com
ytjobscenter[.]com
ytjobslaunch[.]com
ytjobsrecruitment[.]com
ytjobshiring[.]com
ytjobsgrow[.]com
ytjobsselect[.]com
ytjobssuccess[.]com
ytjobsgrowth[.]com
ytjobsline[.]com
ytjobslink[.]com
ytjobsstaff[.]com
ytjobsmatch[.]com
ytjobssquad[.]com
ytjobssearch[.]com
ytjobsbridge[.]com
ytjobsbuild[.]com
ytjobsapplyhub[.]com
ytjobsnetwork[.]com
ytjobsplace[.]com
ytjobsnext[.]com
ytjobspath[.]com
ytjobspartner[.]com
ytjobsnow[.]com
ytjobsdesk[.]com
ytjobsmember[.]com
ytjobsrecruiting[.]com
ytjobsemployment[.]com
ytjobscollab[.]com
@500mk500
teapawt.net/MalasadaTech808/status…
More PoisonSeed domains. These ones are Aquent-themed.
EXFIL: hxxps://bxcback2025xxx23vnvn.onrender[.]com/api/login
aquent-recruitment[.]com
aquent-career[.]com
aquent-scheduling[.]com
aquent-staffing[.]com
aquent-hiring[.]com
aquent-professionals[.]com
aquent-recruiting[.]com
aquent-updates[.]com
@500mk500
Security Chat retweeted
NEW THREAT REPORT 🚨 We're tracking the spread of a new malware loader we have named “CountLoader,” that is strongly associated with Russian ransomware gangs. 🇷🇺
Read: hubs.ly/Q03JNJMJ0
#countloader #threat #russia #ukraine #cybersecurity #ransomware
Security Chat retweeted
Remember: teapawt.net/malwrhunterteam/status…
Security Chat retweeted
Replying to @banthisguy9349 @silentpush
searching on keywords that are often used by threatactors can bring you to juicy open directories!
hxxp://84.247.147.214:8080/
uhoh, the worst ransomware I have seen.
Security Chat retweeted
Pivoting on a file named google-privacy-policy-Cb0CGVRT.svg was used in a ClickFix campaign.
hash: 51da32d8582706c6229f9a548da21b9845cb51ee55736a252addcdf2b1df5848
@silentpush
@banthisguy9349
@RacWatchin8872
@SquiblydooBlog
@skocherhan
@500mk500
@volrant136
@smica83
Security Chat retweeted
#NetSupportRat #C2
5[.]181[.]159[.]204
94[.]158[.]244[.]161
AS39798 MivoCloud SRL 🇺🇸
@Huntio @abuse_ch @JAMESWT_WT @500mk500 @anyrun_app @silentpush @MivoCloud
Security Chat retweeted
Our team @silentpush just dropped a definitive look at SocGholish (operated by TA569) and the initial access broker ecosystem they are facilitating. Big thanks to past researchers who have worked on SocGholish! We've got details about our visibility @ silentpush.com/blog/socgholi… 🖖🏻
Security Chat retweeted
We're seeing lots of similar #phishing domains to those reported by @_JohnHammond 🚨
The actors are using consistent naming schemes and web hosting software that we can capture with a search query.
The actors have also made two other woopsies that we'll show down below👇
Digging into a Twitter/X based phishing email I received -- exploring the source code (very similar to the one that hit Linus Tech Tips), finding the hacker's API keys, pulling message logs... and a little extra spice to try to call and confront them 🙃 youtu.be/CFjATtMAm8A
Security Chat retweeted
In this type of field its important to never rely on one tooling. Nothing is the holy grail in my opinion. So combine the bunch to that overview going.
I just learned that you can use several datasources @silentpush
Lets see what I can find with open-dir datasource.
Security Chat retweeted
Fake Google Chrome download site: https://google.[tw].cn/
The SSL cert for this domain has been given by "Google Trust Services". Not think I have to say anything about it...
🤷♂️
Security Chat retweeted
Definite threat alert: https://d[.]goldmansachserfd[.]top/?jp=1 found on app.silentpush.com/shared/eb… via @silentpush @GoldmanSachs
Security Chat retweeted
Nice and Simple Scattered Spider Pivots - Thanks to Initial Intel and previous posts from @TLP_R3D
1⃣ Regex Pattern And Server Header
2⃣ Regex, Server Header and ASN
3⃣ Regex, Dates, ASN and Name Server
Utilising Domain Search and Web Scanner from @silentpush
🔥After a Long Break - New #ScatteredSpider
Domain: revolut-okta[.]com
IP Address: 80.78.27.6
AS Owner: ABSTRACT, FI
404media.co/a-network-of-ai-…
Very interesting watering hole attack by Fin7- going for the AI nude audience #ThreatIntelligence #cybersecuritytips initial investigation by @silentpush
139
Incredible what security teams can access for free these days. silentpush.com/blog/silent-p… #informationsecurity #threatintelligence #freecybertools
36






















































