0x6rss's banner

0x6rss

@0x6rss • 18,280 subscribers

OSINT & malware enthusiast, CTI analyst https://t.co/bktDzzYyfz

Shorts

⚠️Telegram 0-Click Crash Exploit Telegram Messenger This vulnerability can make Telegram unusable regardless of the version or platform. Sending just a single malicious sticker to the target chat is enough. The vulnerability was confirmed and reported to Telegram along with a PoC.

⚠️Telegram 0-Click Crash Exploit Telegram Messenger This vulnerability can make Telegram unusable regardless of the version or platform. Sending just a single malicious sticker to the target chat is enough. The vulnerability was confirmed and reported to Telegram along with a PoC.

110,088 views

Videos

Anya Rossi

sweetdream.ai

SweetDream.ai•Sponsored•Livecam

Watch Anya Live

Anya is streaming live right now! Join her private show and enjoy exclusive content.

Exclusive private shows

1.2k viewers online

Private Show

Join now for exclusive access

Free preview available • Premium content

🔥Hi OSINTers, Identify the followers and followed accounts that a private Instagram profile interacts with. I built Instagram Private Graph powered by my own algorithm to uncover a large portion of the followers and followed accounts linked to private Instagram profiles. ➡️GitHub:

93,623 views • 5 days ago

whatsapp üzerinden karşı taraftan gelen bir tehdit, tehlike veya benzer bir durumda işe yarayacak ufak bir hook scripti yazdım: -karşı tarafın ip adresine dayalı konumu (p2p açıksa)+port -karşı tarafın whatsapp hesabına kaç cihaz bağlı olduğu -karşı tarafın mobilde mi wifi ağında mı olduğu -karşı tarafın işletim sistemine dair info (iphone-android-web vb) gibi bilgileri tek bir çağrıyla (çağrının cevaplanması şartı ile) alabilirsiniz. repo linki👇

whatsapp üzerinden karşı taraftan gelen bir tehdit, tehlike veya benzer bir durumda işe yarayacak ufak bir hook scripti yazdım: -karşı tarafın ip adresine dayalı konumu (p2p açıksa)+port -karşı tarafın whatsapp hesabına kaç cihaz bağlı olduğu -karşı tarafın mobilde mi wifi ağında mı olduğu -karşı tarafın işletim sistemine dair info (iphone-android-web vb) gibi bilgileri tek bir çağrıyla (çağrının cevaplanması şartı ile) alabilirsiniz. repo linki👇

70,527 views • 17 days ago

this is probably a caller ID spoofing call (yes, in most cases, calls can be made from the requested number.)

this is probably a caller ID spoofing call (yes, in most cases, calls can be made from the requested number.)

112,503 views • 1 month ago

❤️‍🔥❤️‍🔥❤️‍🔥Hi threat hunters and malware analysts! The weaponized web version of Matkap is now open source! Level up your hunt for malicious Telegram bots! -View reports and tweets about Telegram bots being used as C2 infrastructure directly in the panel, and extract IOCs. -Use JADX MCP to extract Telegram bot tokens and chat IDs from Android malware. -Scrape bot tokens from web addresses indexed by urlscan, ThreatFox, and ZoomEye. -Pull malware samples that use Telegram bots directly from MalwareBazaar. All in one panel. Happy hunting!

❤️‍🔥❤️‍🔥❤️‍🔥Hi threat hunters and malware analysts! The weaponized web version of Matkap is now open source! Level up your hunt for malicious Telegram bots! -View reports and tweets about Telegram bots being used as C2 infrastructure directly in the panel, and extract IOCs. -Use JADX MCP to extract Telegram bot tokens and chat IDs from Android malware. -Scrape bot tokens from web addresses indexed by urlscan, ThreatFox, and ZoomEye. -Pull malware samples that use Telegram bots directly from MalwareBazaar. All in one panel. Happy hunting!

22,383 views • 14 days ago

Dear threat hunters and malware analysts! new web version of #matkap is back online. You can now easily hunt malicious telegram bots via . And it’s completely free 😃 Merry Christmas and happy hunting!

Dear threat hunters and malware analysts! new web version of #matkap is back online. You can now easily hunt malicious telegram bots via . And it’s completely free 😃 Merry Christmas and happy hunting!

157,664 views • 8 months ago

I searched for my username in underground telegram channels😀

I searched for my username in underground telegram channels😀

115,530 views • 8 months ago

hi threat hunters and malware analysts! I want to introduce you to my newly developed tool called "Matkap". with this tool, you can infiltrate telegram bots(malbots) associated with malware, gain access to their messages, and extract all their logs! ➡️

hi threat hunters and malware analysts! I want to introduce you to my newly developed tool called "Matkap". with this tool, you can infiltrate telegram bots(malbots) associated with malware, gain access to their messages, and extract all their logs! ➡️

192,192 views • 1 year ago

new Zoom lure observed in the wild. (I think this is a method associated with an APT or Lazarus ) You click a meeting link. A woman's voice plays: "Hello? Hello? Can you hear me?" You assume it's an audio issue. Then this appears on screen 👇

new Zoom lure observed in the wild. (I think this is a method associated with an APT or Lazarus ) You click a meeting link. A woman's voice plays: "Hello? Hello? Can you hear me?" You assume it's an audio issue. Then this appears on screen 👇

57,614 views • 5 months ago

Android malware (.apk) can be spread through a fake video by manipulating the Telegram file extension. I showed how it is done in the video below.

Android malware (.apk) can be spread through a fake video by manipulating the Telegram file extension. I showed how it is done in the video below.

180,816 views • 2 years ago

meet track2pulse enables you to monitor, via an interactive map, OSINT-driven intelligence streams aggregated from country-specific telegram channels, covering topics such as geopolitics, information warfare, domestic developments, and strategic shifts. you can track: -APT group activities targeting specific countries -Terror-related fatality data and organizational intelligence -Critical infrastructure across relevant geographic regions -The Interpol wanted persons list -War-related flights and aircraft movements (flight tracking) -International arms trade flows between countries -National intelligence insights and satellite imagery-based data -cybersecurity incidents, including ransomware campaigns and threat reports You can create a personalized profile and follow only the developments that align with your operational interests , all in real time, directly on the map interface.

56,319 views • 6 months ago

Recently, I discovered a campaign spreading via Telegram Mini Apps. In fact, a threat actor attempted to phish me using this tactic.👇 The technique is highly convincing because it involves a trust boundary violation in Telegram’s MiniApp SDK (affecting Android, Desktop, iOS, and Web versions). Telegram allows third-party code to use its trusted native UI through showPopup(), but it does so without clearly indicating the source to the user or providing safeguards against abuse. This constitutes a design weakness, as the triggered pop-up belongs to Telegram and can be used in an arbitrary manner. -The attacker misleads the user by leveraging Telegram’s own native UI component. -The popup is rendered outside the MiniApp iframe, within Telegram’s own UI layer. -The user perceives it as a legitimate warning from Telegram itself. -By placing a single button, the attacker can redirect the user to a phishing page. -Since the phishing page opens inside the Mini App, the phishing URL is not visibly exposed. After conducting detailed research, I simulated this attack and demonstrated it in the video below. Be cautious when opening Mini Apps in bots.

Recently, I discovered a campaign spreading via Telegram Mini Apps. In fact, a threat actor attempted to phish me using this tactic.👇 The technique is highly convincing because it involves a trust boundary violation in Telegram’s MiniApp SDK (affecting Android, Desktop, iOS, and Web versions). Telegram allows third-party code to use its trusted native UI through showPopup(), but it does so without clearly indicating the source to the user or providing safeguards against abuse. This constitutes a design weakness, as the triggered pop-up belongs to Telegram and can be used in an arbitrary manner. -The attacker misleads the user by leveraging Telegram’s own native UI component. -The popup is rendered outside the MiniApp iframe, within Telegram’s own UI layer. -The user perceives it as a legitimate warning from Telegram itself. -By placing a single button, the attacker can redirect the user to a phishing page. -Since the phishing page opens inside the Mini App, the phishing URL is not visibly exposed. After conducting detailed research, I simulated this attack and demonstrated it in the video below. Be cautious when opening Mini Apps in bots.

49,167 views • 6 months ago

Hunting tips 🔴 Using "matkap" tool, you can search for the parameter body=" on fofa to infiltrate the malicious Telegram bots to which fake/phishing pages send logs! Happy Hunting!

Hunting tips 🔴 Using "matkap" tool, you can search for the parameter body=" on fofa to infiltrate the malicious Telegram bots to which fake/phishing pages send logs! Happy Hunting!

90,510 views • 1 year ago

APT35/charmingkitten IRGC biriminin Türkiye özelinde yeni faaliyetleri ifşa olmuş. İran’ın sızdırılan Kashef ismindeki istihbarat sisteminde Türkiye’ye özel kritik unsurlar: Tahran’daki Türkiye Büyükelçiliğine giren-çıkan herkes plaka, saat, kimlik ve istihbarat notlarıyla takip ediliyor. Ayrıca İran’dan Türkiye’ye seyahat eden tüm vatandaşlar dini mezhep, aile bağı, iletişim ve hareket geçmişi ile profilleniyor. IRGC’nin siber birimi(APT35) ise bu verileri hedefleme, takip ve operasyon planlamasında kullanıyormuş. videoda Kashef istihbarat izleme sisteminde büyükelçilikler özelinde nasıl çalıştığı görülebiliyor

APT35/charmingkitten IRGC biriminin Türkiye özelinde yeni faaliyetleri ifşa olmuş. İran’ın sızdırılan Kashef ismindeki istihbarat sisteminde Türkiye’ye özel kritik unsurlar: Tahran’daki Türkiye Büyükelçiliğine giren-çıkan herkes plaka, saat, kimlik ve istihbarat notlarıyla takip ediliyor. Ayrıca İran’dan Türkiye’ye seyahat eden tüm vatandaşlar dini mezhep, aile bağı, iletişim ve hareket geçmişi ile profilleniyor. IRGC’nin siber birimi(APT35) ise bu verileri hedefleme, takip ve operasyon planlamasında kullanıyormuş. videoda Kashef istihbarat izleme sisteminde büyükelçilikler özelinde nasıl çalıştığı görülebiliyor

44,892 views • 9 months ago

Telegram channel belonging to DarkForums (The Jacuzzi) has been banned. It was a channel I had been following, but what made it distinctive was its cycle of ownership transfers. Initially, it was associated with BreachForums (BaphChat), then it was taken over by the FBI. Afterwards, it was put up for sale by an actor named “weep,” and finally it was used by DarkForums under the name “The Jacuzzi.” Although this lifecycle raises questions, it has left behind an archive consisting of thousands of messages.

Telegram channel belonging to DarkForums (The Jacuzzi) has been banned. It was a channel I had been following, but what made it distinctive was its cycle of ownership transfers. Initially, it was associated with BreachForums (BaphChat), then it was taken over by the FBI. Afterwards, it was put up for sale by an actor named “weep,” and finally it was used by DarkForums under the name “The Jacuzzi.” Although this lifecycle raises questions, it has left behind an archive consisting of thousands of messages.

37,800 views • 8 months ago

Hey threat hunters and malware analysts! The web version of Matkap is now live! You can now hunt malicious Telegram bots via Happy hunting!

Hey threat hunters and malware analysts! The web version of Matkap is now live! You can now hunt malicious Telegram bots via Happy hunting!

63,685 views • 1 year ago

My first blog post: Creating a PDF Dropper by Injecting Malicious JavaScript into a PDF with a Cobalt Strike Payload For the source code and PoC, check out my blog post:👇

My first blog post: Creating a PDF Dropper by Injecting Malicious JavaScript into a PDF with a Cobalt Strike Payload For the source code and PoC, check out my blog post:👇

76,989 views • 2 years ago

WhatsApp messages that seem to come from someone even though they never sent anything? No clicks, no permissions. Just a few technical steps! I demonstrated a manipulation technique for digital forensics experts. Blog post: PoC:

WhatsApp messages that seem to come from someone even though they never sent anything? No clicks, no permissions. Just a few technical steps! I demonstrated a manipulation technique for digital forensics experts. Blog post: PoC:

37,667 views • 1 year ago

CVE-2025-24071: Microsoft Windows File Explorer Spoofing Vulnerability Check out the new security vulnerability I discovered in Windows, which I believe is potentially being sold in the wild. (fixed patch tuesday) Blog post: PoC:

CVE-2025-24071: Microsoft Windows File Explorer Spoofing Vulnerability Check out the new security vulnerability I discovered in Windows, which I believe is potentially being sold in the wild. (fixed patch tuesday) Blog post: PoC:

45,855 views • 1 year ago

gelelim caller id spoof olayına.. aşağıdaki videoda gösterdiğim gibi herhangi bir numara taklit edilebiliyor. öncelikle, bu tür aramalar maalesef türkiye’deki operatörler tarafından tespit edilemiyor. tespiti için ya komple altyapıyı değiştirmeleri gerek, ya da STIR/SHAKEN (Secure Telephone Identity Revisited/Signature-based Handling of Asserted information using toKENs) teknolojisini sistemlerine entegre etmeleri gerekiyor. Şu an bu sistem bazı ülkelerde aktif olarak uygulanıyor. ancak yaptığımız çalışmalar sonucunda CİS tespitini manuel bir şekilde sağladık, yakında kamuoyuyla paylaşılır.

gelelim caller id spoof olayına.. aşağıdaki videoda gösterdiğim gibi herhangi bir numara taklit edilebiliyor. öncelikle, bu tür aramalar maalesef türkiye’deki operatörler tarafından tespit edilemiyor. tespiti için ya komple altyapıyı değiştirmeleri gerek, ya da STIR/SHAKEN (Secure Telephone Identity Revisited/Signature-based Handling of Asserted information using toKENs) teknolojisini sistemlerine entegre etmeleri gerekiyor. Şu an bu sistem bazı ülkelerde aktif olarak uygulanıyor. ancak yaptığımız çalışmalar sonucunda CİS tespitini manuel bir şekilde sağladık, yakında kamuoyuyla paylaşılır.

48,444 views • 1 year ago