Currently maintaining PMA.
Joined December 2009
- Tweets1K
- Following309
- Followers450
- Likes3.7K
Got my first Chrome CVE!
This was surfaced by my agentic pipeline, though the PoC was put together with a bit of manual work, AI, and a lot of digging through similar older reports and commits, since it was my first time and I honestly did not understand much of the codebase or how a PoC was supposed to be done for this case initially.
Iβve also had a few other CVEs surfaced by my pipeline over the past few months, and I might write about those some other time
π½πΊππ retweeted
Had too many AI tokens, so I vibe-coded a Malaysia Web Defacement Observatory.
It visualizes scraped Malaysian web defacement data, with the entire pipeline running on GitHub:
- GitHub Actions -> data processing
- JSON metrics generation
- GitHub Pages -> dashboard
Check it out:
observatory.kampung.digital/β¦
π½πΊππ retweeted
Dissecting a GenesisStealer Campaign Hiding Behind Indie Game Branding
badrulmunir.com/posts/analysβ¦
π½πΊππ retweeted
Noticed a qr phishing trend on threads aimed towards local Malaysians and did a quick analysis on the situation :
notion.so/3ch0/Analysis-of-tβ¦
Thank you carisurau @farhanhelmycode
Looking forward to v2!
Salam, baju carisurau dah selamat dipos kepada semua contributor, terima kasih kepada semua! InsyaAllah carisurau V2 akan disambung develop ramadhan.
Boleh tengok design upcoming for V2 dekat sini:
figma.com/design/o283jBzytkiβ¦
Carisurau codebase
github.com/farhan-helmy/cariβ¦
π½πΊππ retweeted
The prize pool we have collected so far is MYR600. If anyone wants to add to it or sponsor by adding their logo, please let me know. The CTF starts tomorrow at 9PM GMT+8.
We have ~140 players going to compete (solo/duo)
π Girls in CTF 2025 is back! π»π
π
13β14 Sept (24h)
π Reg closes: 11 Sept
π Sign up: forms.gle/ASoWQ2RdqNQirUb4A
π Info: girls-in-ctf.online/
Jeopardy CTF
π Prize pool TBA
π Sponsors welcome: [email protected]
#GCTF2025
cc: @reun10n_
π½πΊππ retweeted
Parallel Pulse @nanosec_asia is excited to π welcome Jason Phang and Robbin Ooi to our panel of speakers, presenting "Following the Breadcrumbs: MacOS Unified Logs & FSEvents."
Read abstract here: linkedin.com/feed/update/urnβ¦
Watch this space for registration - opening soon!
π½πΊππ retweeted
btw be careful, me and my colleague identified a malicious SEO poisoned GitHub Desktop download website where it has AMOS stealer in it.
This commit (github.com/desktop/desktop/cβ¦) shows the threat actor modifying the README file to include his own download URL.
#AMOS #Phishing
π½πΊππ retweeted
Girls in CTF is back. We are doing it this year.
girls-in-ctf.online/
Open for students and professionals in π²πΎ
More details soon.
π½πΊππ retweeted
I'm sharing my note, containing little tips and checklist on how we can attribute a piece of malware or a campaign to certain threat groups. Although it does not cover all methodologies but I think it's good for beginners to learn this topic. ππ»
fareedfauzi.github.io/cheatsβ¦
π½πΊππ retweeted
Soft-launch overview of upcoming training service, delivered directly by the developer.
Topic: Malware Development for Red Team Operator
Course syllabus (PDF): vx-engineering.org/docs/MDRTβ¦
π½πΊππ retweeted
I did an analysis of TPwSav.sys driver and write a proof of concept exploiting the arbitrary physical memory read and write primitive for fun :)
You can find the quick writeup here, zeifan.my/TPwSav-Driver-Arbiβ¦
Blackpoint analysis: blackpointcyber.com/blog/qilβ¦
Found a simple command injection vuln in CodeIgniter 4 ImageMagick handler with the help of LLM agent. Nothing too complex or mindblowing, but it's fun to tap into AI agents again at this time :)
Detailed blog post about the vuln:
vicevirus.github.io/posts/cvβ¦
π½πΊππ retweeted
"Audio, I barely know her" - 0x251e
It's all fun and games laughing at Linux memes until it happen to me
So, here is a blog explaining why there is no audio after I installed Arch
0x251e.github.io/posts/how-iβ¦
π½πΊππ retweeted
CVE-2024-45955 - SQL Injection Vulnerability Discovered in Rocket Zena
congrat @7imbitz for first CVE π₯³
notes.netbytesec.com/2025/07β¦
π½πΊππ retweeted
Did you know Malaysia has its own socmed platform called daun.me, developed by @amanz?
In this blog post, I share several vulnerabilities I reported in March 2025. The team responded quickly, fixed the issues, and even offered a bounty!
rz.my/2025/07/multiple-vulneβ¦