0x6rss's banner

0x6rss

@0x6rss • 17,341 subscribers

OSINT & malware enthusiast, CTI analyst https://t.co/bktDzzYyfz

Videos

Anya Rossi

sweetdream.ai

SweetDream.ai•Sponsored•Livecam

Watch Anya Live

Anya is streaming live right now! Join her private show and enjoy exclusive content.

Exclusive private shows

1.2k viewers online

Private Show

Join now for exclusive access

Free preview available • Premium content

Dear threat hunters and malware analysts! new web version of #matkap is back online. You can now easily hunt malicious telegram bots via . And it’s completely free 😃 Merry Christmas and happy hunting!

Dear threat hunters and malware analysts! new web version of #matkap is back online. You can now easily hunt malicious telegram bots via . And it’s completely free 😃 Merry Christmas and happy hunting!

146,608 Aufrufe • vor 5 Monaten

new Zoom lure observed in the wild. (I think this is a method associated with an APT or Lazarus ) You click a meeting link. A woman's voice plays: "Hello? Hello? Can you hear me?" You assume it's an audio issue. Then this appears on screen 👇

new Zoom lure observed in the wild. (I think this is a method associated with an APT or Lazarus ) You click a meeting link. A woman's voice plays: "Hello? Hello? Can you hear me?" You assume it's an audio issue. Then this appears on screen 👇

56,507 Aufrufe • vor 2 Monaten

I searched for my username in underground telegram channels😀

I searched for my username in underground telegram channels😀

115,530 Aufrufe • vor 5 Monaten

hi threat hunters and malware analysts! I want to introduce you to my newly developed tool called "Matkap". with this tool, you can infiltrate telegram bots(malbots) associated with malware, gain access to their messages, and extract all their logs! ➡️

hi threat hunters and malware analysts! I want to introduce you to my newly developed tool called "Matkap". with this tool, you can infiltrate telegram bots(malbots) associated with malware, gain access to their messages, and extract all their logs! ➡️

191,751 Aufrufe • vor 1 Jahr

meet track2pulse enables you to monitor, via an interactive map, OSINT-driven intelligence streams aggregated from country-specific telegram channels, covering topics such as geopolitics, information warfare, domestic developments, and strategic shifts. you can track: -APT group activities targeting specific countries -Terror-related fatality data and organizational intelligence -Critical infrastructure across relevant geographic regions -The Interpol wanted persons list -War-related flights and aircraft movements (flight tracking) -International arms trade flows between countries -National intelligence insights and satellite imagery-based data -cybersecurity incidents, including ransomware campaigns and threat reports You can create a personalized profile and follow only the developments that align with your operational interests , all in real time, directly on the map interface.

54,878 Aufrufe • vor 3 Monaten

Recently, I discovered a campaign spreading via Telegram Mini Apps. In fact, a threat actor attempted to phish me using this tactic.👇 The technique is highly convincing because it involves a trust boundary violation in Telegram’s MiniApp SDK (affecting Android, Desktop, iOS, and Web versions). Telegram allows third-party code to use its trusted native UI through showPopup(), but it does so without clearly indicating the source to the user or providing safeguards against abuse. This constitutes a design weakness, as the triggered pop-up belongs to Telegram and can be used in an arbitrary manner. -The attacker misleads the user by leveraging Telegram’s own native UI component. -The popup is rendered outside the MiniApp iframe, within Telegram’s own UI layer. -The user perceives it as a legitimate warning from Telegram itself. -By placing a single button, the attacker can redirect the user to a phishing page. -Since the phishing page opens inside the Mini App, the phishing URL is not visibly exposed. After conducting detailed research, I simulated this attack and demonstrated it in the video below. Be cautious when opening Mini Apps in bots.

Recently, I discovered a campaign spreading via Telegram Mini Apps. In fact, a threat actor attempted to phish me using this tactic.👇 The technique is highly convincing because it involves a trust boundary violation in Telegram’s MiniApp SDK (affecting Android, Desktop, iOS, and Web versions). Telegram allows third-party code to use its trusted native UI through showPopup(), but it does so without clearly indicating the source to the user or providing safeguards against abuse. This constitutes a design weakness, as the triggered pop-up belongs to Telegram and can be used in an arbitrary manner. -The attacker misleads the user by leveraging Telegram’s own native UI component. -The popup is rendered outside the MiniApp iframe, within Telegram’s own UI layer. -The user perceives it as a legitimate warning from Telegram itself. -By placing a single button, the attacker can redirect the user to a phishing page. -Since the phishing page opens inside the Mini App, the phishing URL is not visibly exposed. After conducting detailed research, I simulated this attack and demonstrated it in the video below. Be cautious when opening Mini Apps in bots.

48,891 Aufrufe • vor 3 Monaten

Android malware (.apk) can be spread through a fake video by manipulating the Telegram file extension. I showed how it is done in the video below.

Android malware (.apk) can be spread through a fake video by manipulating the Telegram file extension. I showed how it is done in the video below.

176,524 Aufrufe • vor 1 Jahr

Sometimes you build a tool just to streamline your own work. Here is the demo of "Televector" Telegram OSINT platform, not available to the public, developed purely for my own use :) -Live monitoring with API -Hash database -Matkap module -Threat analysis with ai

Sometimes you build a tool just to streamline your own work. Here is the demo of "Televector" Telegram OSINT platform, not available to the public, developed purely for my own use :) -Live monitoring with API -Hash database -Matkap module -Threat analysis with ai

83,683 Aufrufe • vor 11 Monaten

APT35/charmingkitten IRGC biriminin Türkiye özelinde yeni faaliyetleri ifşa olmuş. İran’ın sızdırılan Kashef ismindeki istihbarat sisteminde Türkiye’ye özel kritik unsurlar: Tahran’daki Türkiye Büyükelçiliğine giren-çıkan herkes plaka, saat, kimlik ve istihbarat notlarıyla takip ediliyor. Ayrıca İran’dan Türkiye’ye seyahat eden tüm vatandaşlar dini mezhep, aile bağı, iletişim ve hareket geçmişi ile profilleniyor. IRGC’nin siber birimi(APT35) ise bu verileri hedefleme, takip ve operasyon planlamasında kullanıyormuş. videoda Kashef istihbarat izleme sisteminde büyükelçilikler özelinde nasıl çalıştığı görülebiliyor

APT35/charmingkitten IRGC biriminin Türkiye özelinde yeni faaliyetleri ifşa olmuş. İran’ın sızdırılan Kashef ismindeki istihbarat sisteminde Türkiye’ye özel kritik unsurlar: Tahran’daki Türkiye Büyükelçiliğine giren-çıkan herkes plaka, saat, kimlik ve istihbarat notlarıyla takip ediliyor. Ayrıca İran’dan Türkiye’ye seyahat eden tüm vatandaşlar dini mezhep, aile bağı, iletişim ve hareket geçmişi ile profilleniyor. IRGC’nin siber birimi(APT35) ise bu verileri hedefleme, takip ve operasyon planlamasında kullanıyormuş. videoda Kashef istihbarat izleme sisteminde büyükelçilikler özelinde nasıl çalıştığı görülebiliyor

43,391 Aufrufe • vor 5 Monaten

Hunting tips 🔴 Using "matkap" tool, you can search for the parameter body=" on fofa to infiltrate the malicious Telegram bots to which fake/phishing pages send logs! Happy Hunting!

Hunting tips 🔴 Using "matkap" tool, you can search for the parameter body=" on fofa to infiltrate the malicious Telegram bots to which fake/phishing pages send logs! Happy Hunting!

90,307 Aufrufe • vor 1 Jahr

Telegram channel belonging to DarkForums (The Jacuzzi) has been banned. It was a channel I had been following, but what made it distinctive was its cycle of ownership transfers. Initially, it was associated with BreachForums (BaphChat), then it was taken over by the FBI. Afterwards, it was put up for sale by an actor named “weep,” and finally it was used by DarkForums under the name “The Jacuzzi.” Although this lifecycle raises questions, it has left behind an archive consisting of thousands of messages.

Telegram channel belonging to DarkForums (The Jacuzzi) has been banned. It was a channel I had been following, but what made it distinctive was its cycle of ownership transfers. Initially, it was associated with BreachForums (BaphChat), then it was taken over by the FBI. Afterwards, it was put up for sale by an actor named “weep,” and finally it was used by DarkForums under the name “The Jacuzzi.” Although this lifecycle raises questions, it has left behind an archive consisting of thousands of messages.

36,908 Aufrufe • vor 5 Monaten

Hey threat hunters and malware analysts! The web version of Matkap is now live! You can now hunt malicious Telegram bots via Happy hunting!

Hey threat hunters and malware analysts! The web version of Matkap is now live! You can now hunt malicious Telegram bots via Happy hunting!

62,598 Aufrufe • vor 1 Jahr

My first blog post: Creating a PDF Dropper by Injecting Malicious JavaScript into a PDF with a Cobalt Strike Payload For the source code and PoC, check out my blog post:👇

My first blog post: Creating a PDF Dropper by Injecting Malicious JavaScript into a PDF with a Cobalt Strike Payload For the source code and PoC, check out my blog post:👇

76,989 Aufrufe • vor 1 Jahr

WhatsApp messages that seem to come from someone even though they never sent anything? No clicks, no permissions. Just a few technical steps! I demonstrated a manipulation technique for digital forensics experts. Blog post: PoC:

WhatsApp messages that seem to come from someone even though they never sent anything? No clicks, no permissions. Just a few technical steps! I demonstrated a manipulation technique for digital forensics experts. Blog post: PoC:

35,824 Aufrufe • vor 10 Monaten

CVE-2025-24071: Microsoft Windows File Explorer Spoofing Vulnerability Check out the new security vulnerability I discovered in Windows, which I believe is potentially being sold in the wild. (fixed patch tuesday) Blog post: PoC:

CVE-2025-24071: Microsoft Windows File Explorer Spoofing Vulnerability Check out the new security vulnerability I discovered in Windows, which I believe is potentially being sold in the wild. (fixed patch tuesday) Blog post: PoC:

45,616 Aufrufe • vor 1 Jahr

gelelim caller id spoof olayına.. aşağıdaki videoda gösterdiğim gibi herhangi bir numara taklit edilebiliyor. öncelikle, bu tür aramalar maalesef türkiye’deki operatörler tarafından tespit edilemiyor. tespiti için ya komple altyapıyı değiştirmeleri gerek, ya da STIR/SHAKEN (Secure Telephone Identity Revisited/Signature-based Handling of Asserted information using toKENs) teknolojisini sistemlerine entegre etmeleri gerekiyor. Şu an bu sistem bazı ülkelerde aktif olarak uygulanıyor. ancak yaptığımız çalışmalar sonucunda CİS tespitini manuel bir şekilde sağladık, yakında kamuoyuyla paylaşılır.

gelelim caller id spoof olayına.. aşağıdaki videoda gösterdiğim gibi herhangi bir numara taklit edilebiliyor. öncelikle, bu tür aramalar maalesef türkiye’deki operatörler tarafından tespit edilemiyor. tespiti için ya komple altyapıyı değiştirmeleri gerek, ya da STIR/SHAKEN (Secure Telephone Identity Revisited/Signature-based Handling of Asserted information using toKENs) teknolojisini sistemlerine entegre etmeleri gerekiyor. Şu an bu sistem bazı ülkelerde aktif olarak uygulanıyor. ancak yaptığımız çalışmalar sonucunda CİS tespitini manuel bir şekilde sağladık, yakında kamuoyuyla paylaşılır.

48,018 Aufrufe • vor 1 Jahr

update: I have added the VNC feature. This way, the phone screen can be viewed through parental panel (screen tracker).

update: I have added the VNC feature. This way, the phone screen can be viewed through parental panel (screen tracker).

34,825 Aufrufe • vor 1 Jahr

update: I added an application-specific keylogger feature. this way, keystrokes on social media applications can be tracked on the parental panel.

update: I added an application-specific keylogger feature. this way, keystrokes on social media applications can be tracked on the parental panel.

28,547 Aufrufe • vor 1 Jahr

hi threat hunters and malware analysts! I’ve shared my new C2 hunting, reporting, and visualization tool, "Keklick," on github! It helps you discover and manage potential domains/IPs related to C2 infrastructure. Happy hunting! keklick:

hi threat hunters and malware analysts! I’ve shared my new C2 hunting, reporting, and visualization tool, "Keklick," on github! It helps you discover and manage potential domains/IPs related to C2 infrastructure. Happy hunting! keklick:

20,568 Aufrufe • vor 10 Monaten

Dear threat hunters and malware analysts, Threat.Zone | Holistic Malware Analysis Platform , a Holistic Malware Analysis Platform, allows you to capture the Telegram C2 network requests of the XWORM malware and hunt the logs using Matkap! ➡️

Dear threat hunters and malware analysts, Threat.Zone | Holistic Malware Analysis Platform , a Holistic Malware Analysis Platform, allows you to capture the Telegram C2 network requests of the XWORM malware and hunt the logs using Matkap! ➡️

21,090 Aufrufe • vor 1 Jahr