Loading video...

Video Failed to Load

There was a problem loading this video. This could be due to a temporary network issue or the video might be unavailable.

🚨 Very concerning 0-click zero-day vulnerability for sale: allows unauthenticated attackers to execute arbitrary code with SYSTEM-level privileges on fully patched Windows 10/11 and Windows Server 2022 systems. The exploit is “reliable, low-resource, and bypasses the latest security mitigations.” Price: 25k POC:

International Cyber Digest

33,422 subscribers

77,014 views • 10 months ago •via X (Twitter)

Science & Technology News & Politics Education

Anya Rossi• Live Now

Private livecam show

0 Comments

No comments available

Comments from the original post will appear here

Related Videos

Microsoft denies rewriting Windows 11 using AI after an employee’s “one engineer, one month, one million lines of code” post on LinkedIn causes outrage. "Windows is *NOT* being rewritten in Rust with AI" -- Microsoft. Since this has Microsoft's attention, it's the right time to remind everyone about the lack of "native" code for UI-level features in Windows 11, as everything is moving to WebView2. For example, in recent Windows 11 builds, Notification Center's Agenda view is built using WebView2, and you'll notice spike in web resources (Edge-related processes) when you open Notification Center.

Microsoft denies rewriting Windows 11 using AI after an employee’s “one engineer, one month, one million lines of code” post on LinkedIn causes outrage. "Windows is NOT being rewritten in Rust with AI" -- Microsoft. Since this has Microsoft's attention, it's the right time to remind everyone about the lack of "native" code for UI-level features in Windows 11, as everything is moving to WebView2. For example, in recent Windows 11 builds, Notification Center's Agenda view is built using WebView2, and you'll notice spike in web resources (Edge-related processes) when you open Notification Center.

Windows Latest

564,454 views • 6 months ago

So here is new local privilege escalation zero-day I discovered, not patched yet too :). In simple terms, if you have a service like RDP that exposes an RPC server, there many system services running as SYSTEM connect to it as RPC clients. If that service is turned off (RDP is off by default), it seems that any other process in Windows can expose the same RPC server using the same endpoint. Now all the RPC calls from that SYSTEM processes will come to this fake server and If the process that deployed the server has SeImpersonatePrivilege, it can escalate to SYSTEM by impersonate the RPC client. In the white paper below, I describe five exploit paths you can abuse. However it's architecture problem and maybe there are more. It's Not A Potato

So here is new local privilege escalation zero-day I discovered, not patched yet too :). In simple terms, if you have a service like RDP that exposes an RPC server, there many system services running as SYSTEM connect to it as RPC clients. If that service is turned off (RDP is off by default), it seems that any other process in Windows can expose the same RPC server using the same endpoint. Now all the RPC calls from that SYSTEM processes will come to this fake server and If the process that deployed the server has SeImpersonatePrivilege, it can escalate to SYSTEM by impersonate the RPC client. In the white paper below, I describe five exploit paths you can abuse. However it's architecture problem and maybe there are more. It's Not A Potato

Haidar

51,137 views • 2 months ago

Exploit write-ups for our 🚨latest 0-day🚨and the tragedy that swept the red black tree family dropping soon 👀 Here is a tiktok style video for those of you with no attention span thanks to slop and social media. Turn on the audio!!!

Exploit write-ups for our 🚨latest 0-day🚨and the tragedy that swept the red black tree family dropping soon 👀 Here is a tiktok style video for those of you with no attention span thanks to slop and social media. Turn on the audio!!!

Crusaders of Rust

56,065 views • 1 year ago

$TESTED: Windows 11's upcoming "Low Latency Profile" mode brings genuine performance improvements to the OS, speeding up flyout and app launches significantly. We've benchmarked opening some apps on video with the Low Latency Profile enabled and disabled, and you can see differences in how quickly things appear. For some things, it's a fraction of a second faster, for others, it's a significant increase in speed. In our testing, this new Low Latency Profile is a major improvement in overall responsiveness when it comes to opening apps and flyouts. Our tests were conducted on a clean install of the latest Windows 11 preview build on the same hardware.$

TESTED: Windows 11's upcoming "Low Latency Profile" mode brings genuine performance improvements to the OS, speeding up flyout and app launches significantly. We've benchmarked opening some apps on video with the Low Latency Profile enabled and disabled, and you can see differences in how quickly things appear. For some things, it's a fraction of a second faster, for others, it's a significant increase in speed. In our testing, this new Low Latency Profile is a major improvement in overall responsiveness when it comes to opening apps and flyouts. Our tests were conducted on a clean install of the latest Windows 11 preview build on the same hardware.

Windows Central

1,158,963 views • 2 months ago

Windows 11’s hidden CPU boost is now available in the May optional update! I installed KB5089573 (Build 26200.8524) and tested the Low Latency Profile again. For now, this feature does not make your apps launch faster, as that particular change is not included in today's update. However, the Low Latency Profile currently makes OS flyouts load faster. This means the Start menu opens with less lag, and Action Center feels smoother. Plus, right-click menus show less of that annoying rendering delay. On slower PCs, this should matter even more because Windows briefly pushes the CPU harder during shell interactions, then lets it drop back to idle. Some people call this a lazy band-aid, but that misses the point. macOS and Linux already have similar tricks. This is how modern systems make interactions feel instant. The real win comes when Microsoft combines this with native WinUI 3 work and less WebView2 bloat. Windows 11 finally feels like it’s being tuned for responsiveness again.

Windows Latest

218,973 views • 1 month ago

This is big... Anthropic just announced a model so powerful they won't release it to the public out of fear over the damage it will cause 😨 Claude Mythos Preview found thousands of zero-day exploits in every major operating system and web browser... The numbers are hard to believe: > $50 to find a 27-year-old bug in OpenBSD, one of the most security-hardened operating systems ever built > Under $1,000 to find AND build a fully working remote code execution exploit on FreeBSD that grants unauthenticated root access from anywhere on the internet > Under $2,000 to chain together multiple Linux kernel vulnerabilities into a complete privilege escalation exploit For context: these are the kinds of findings that previously required elite security researchers working for weeks. Anthropic engineers with no formal security training asked Mythos to find exploits overnight. They woke up to working code the next morning. The results were so impressive Anthropic assembled Apple, Google, Microsoft, Amazon, NVIDIA, and seven other organizations into Project Glasswing: A $100M defensive coalition. They're not releasing this model publicly. Instead, they're racing to patch the world's infrastructure before models like this proliferate.

This is big... Anthropic just announced a model so powerful they won't release it to the public out of fear over the damage it will cause 😨 Claude Mythos Preview found thousands of zero-day exploits in every major operating system and web browser... The numbers are hard to believe: > $50 to find a 27-year-old bug in OpenBSD, one of the most security-hardened operating systems ever built > Under $1,000 to find AND build a fully working remote code execution exploit on FreeBSD that grants unauthenticated root access from anywhere on the internet > Under $2,000 to chain together multiple Linux kernel vulnerabilities into a complete privilege escalation exploit For context: these are the kinds of findings that previously required elite security researchers working for weeks. Anthropic engineers with no formal security training asked Mythos to find exploits overnight. They woke up to working code the next morning. The results were so impressive Anthropic assembled Apple, Google, Microsoft, Amazon, NVIDIA, and seven other organizations into Project Glasswing: A $100M defensive coalition. They're not releasing this model publicly. Instead, they're racing to patch the world's infrastructure before models like this proliferate.

Josh Kale

4,061,798 views • 3 months ago

someone built an AI RED TEAM that maps your entire attack surface as a knowledge graph, finds every vulnerability, then EXPLOITS them to root access AUTONOMOUSLY its called RedAmon, 9,000 templates. 17 node types, actual Metasploit shells, not reports, no pentesters needed 6 phases of autonomous recon: subdomain discovery, port scanning, http probing, resource enumeration, vulnerability scanning, MITRE mapping every finding stored in a Neo4j graph with 17 node types and 20+ relationship types. the AI reasons about the graph, finds attack paths, and runs actual Metasploit exploits, actual shells stress-tested with zero vulnerability data, zero exploit modules, one instruction find a CVE and exploit it, it went from empty database to root-level RCE in 20 steps, researched the exploit on the web, crafted a custom deserialization payload, debugged itself when the first attempt failed next try, the server responded with root access, the highest privilege level on any Linux system. full control over everything the target was running node-serialize 0.0.4, a package with a critical deserialization flaw (CVE-2017-5941, CVSS 9.8), the server takes your cookie, decodes it, and passes it straight into unserialize() which executes any code inside it, the AI figured this out on its own with no hints built on LangGraph + MCP tool servers for naabu, nuclei, curl, metasploit. hunts leaked secrets across GitHub repos, 40+ regex patterns for AWS keys, Stripe tokens, database creds

someone built an AI RED TEAM that maps your entire attack surface as a knowledge graph, finds every vulnerability, then EXPLOITS them to root access AUTONOMOUSLY its called RedAmon, 9,000 templates. 17 node types, actual Metasploit shells, not reports, no pentesters needed 6 phases of autonomous recon: subdomain discovery, port scanning, http probing, resource enumeration, vulnerability scanning, MITRE mapping every finding stored in a Neo4j graph with 17 node types and 20+ relationship types. the AI reasons about the graph, finds attack paths, and runs actual Metasploit exploits, actual shells stress-tested with zero vulnerability data, zero exploit modules, one instruction find a CVE and exploit it, it went from empty database to root-level RCE in 20 steps, researched the exploit on the web, crafted a custom deserialization payload, debugged itself when the first attempt failed next try, the server responded with root access, the highest privilege level on any Linux system. full control over everything the target was running node-serialize 0.0.4, a package with a critical deserialization flaw (CVE-2017-5941, CVSS 9.8), the server takes your cookie, decodes it, and passes it straight into unserialize() which executes any code inside it, the AI figured this out on its own with no hints built on LangGraph + MCP tool servers for naabu, nuclei, curl, metasploit. hunts leaked secrets across GitHub repos, 40+ regex patterns for AWS keys, Stripe tokens, database creds

chiefofautism

70,129 views • 4 months ago

MUST WATCH:🚨 Watch this crucial 20-minute video featuring prominent Democrats, computer science professors, and election security experts discussing the vulnerabilities in America's election system. They warn that the system is online, easily hackable, and often operates on outdated Windows 7 or older systems. Key Points: Easily Hackable Voting Equipment: All electronic voting equipment can be hacked as they must receive programming before each election from memory cards prepared on election management systems. These systems are often connected to the internet and run outdated Windows versions. Spread of Malware: If a county election management system is infected with malware, it can spread to USB drives, which then transfer it to voting machines, scanners, and ballot-marking devices throughout the county. Programming Practices: Most U.S. election systems are programmed by local county officials or third-party vendors. They use previously used USB drives on internet-connected computers before plugging them into scanners, tabulators, and voting machines. Outdated Systems: In 2019, the Associated Press reported that most of the 10,000 election jurisdictions, including swing states, were still using Windows 7 or older systems for ballot production, vote programming, counting, and reporting. End of Windows 7 Support: Windows 7 reached its end of life on January 14, 2020, with Microsoft stopping technical support and security updates. Remote Access and Modems: Voting machine manufacturers have installed remote-access software and wireless modems, connecting voting machines directly to the internet. NBC News reported in 2020 that ES&S, the largest U.S. election machine vendor, had installed at least 14,000 modems. Dominion Voting Systems: The second-largest vendor, Dominion, has publicly acknowledged using modems in their machines and running remote-access software during the 2020 election. For example, in Georgia, election worker Susan Voyles testified that Dominion employees operated remotely on ballot-marking devices and poll pads. Findings from Wisconsin and Michigan: Investigations found Dominion and ES&S machines online and connected to the internet. In Michigan, a modem chip was discovered in an ES&S voting machine, potentially allowing hackers to intercept and manipulate election results. Conclusion: Hackers can potentially infiltrate elections through vulnerable USB cards, election management systems, and voting machines themselves. This underscores the urgent need for securing America's election infrastructure.

MUST WATCH:🚨 Watch this crucial 20-minute video featuring prominent Democrats, computer science professors, and election security experts discussing the vulnerabilities in America's election system. They warn that the system is online, easily hackable, and often operates on outdated Windows 7 or older systems. Key Points: Easily Hackable Voting Equipment: All electronic voting equipment can be hacked as they must receive programming before each election from memory cards prepared on election management systems. These systems are often connected to the internet and run outdated Windows versions. Spread of Malware: If a county election management system is infected with malware, it can spread to USB drives, which then transfer it to voting machines, scanners, and ballot-marking devices throughout the county. Programming Practices: Most U.S. election systems are programmed by local county officials or third-party vendors. They use previously used USB drives on internet-connected computers before plugging them into scanners, tabulators, and voting machines. Outdated Systems: In 2019, the Associated Press reported that most of the 10,000 election jurisdictions, including swing states, were still using Windows 7 or older systems for ballot production, vote programming, counting, and reporting. End of Windows 7 Support: Windows 7 reached its end of life on January 14, 2020, with Microsoft stopping technical support and security updates. Remote Access and Modems: Voting machine manufacturers have installed remote-access software and wireless modems, connecting voting machines directly to the internet. NBC News reported in 2020 that ES&S, the largest U.S. election machine vendor, had installed at least 14,000 modems. Dominion Voting Systems: The second-largest vendor, Dominion, has publicly acknowledged using modems in their machines and running remote-access software during the 2020 election. For example, in Georgia, election worker Susan Voyles testified that Dominion employees operated remotely on ballot-marking devices and poll pads. Findings from Wisconsin and Michigan: Investigations found Dominion and ES&S machines online and connected to the internet. In Michigan, a modem chip was discovered in an ES&S voting machine, potentially allowing hackers to intercept and manipulate election results. Conclusion: Hackers can potentially infiltrate elections through vulnerable USB cards, election management systems, and voting machines themselves. This underscores the urgent need for securing America's election infrastructure.

KanekoaTheGreat

1,146,565 views • 2 years ago

A Threat Actor has announced, through text and video in a Telegram group, the launch of BLACKNET-00 — the world’s most advanced and accessible ransomware builder platform. Featuring a professional dark-themed graphical interface, intuitive tabs, and real-time configuration preview, anyone — even with ZERO programming knowledge — can generate fully functional ransomware with just one click. High-risk features of the BLACKNET-00 tool include: • AES-256, RSA, and ChaCha20 encryption • Complete disablement of Windows Defender, Task Manager, and critical system controls • Advanced persistence + network/USB self-propagation • C2 server with Tor + DGA support • Anti-detection (VM, sandbox, delayed execution) • Exfiltration of passwords, crypto wallets, screenshots, and webcam footage Announced price: US$ 500. This platform democratizes ransomware, completely eliminating the technical barrier and dramatically increasing the risk of mass attacks by low-level actors. Cybersecurity professionals and organizations: immediately raise your alert level and reinforce defenses. Share to spread awareness. #CyberSecurity #Ransomware #BLACKNET00 #ThreatIntelligence #InfoSec #Malware #RansomwareAsAService #CyberThreat #ThreatActor

A Threat Actor has announced, through text and video in a Telegram group, the launch of BLACKNET-00 — the world’s most advanced and accessible ransomware builder platform. Featuring a professional dark-themed graphical interface, intuitive tabs, and real-time configuration preview, anyone — even with ZERO programming knowledge — can generate fully functional ransomware with just one click. High-risk features of the BLACKNET-00 tool include: • AES-256, RSA, and ChaCha20 encryption • Complete disablement of Windows Defender, Task Manager, and critical system controls • Advanced persistence + network/USB self-propagation • C2 server with Tor + DGA support • Anti-detection (VM, sandbox, delayed execution) • Exfiltration of passwords, crypto wallets, screenshots, and webcam footage Announced price: US$ 500. This platform democratizes ransomware, completely eliminating the technical barrier and dramatically increasing the risk of mass attacks by low-level actors. Cybersecurity professionals and organizations: immediately raise your alert level and reinforce defenses. Share to spread awareness. #CyberSecurity #Ransomware #BLACKNET00 #ThreatIntelligence #InfoSec #Malware #RansomwareAsAService #CyberThreat #ThreatActor

Clandestine

88,218 views • 3 months ago

XBOX Gen-10 details: • Microsoft's next-generation Xbox (Gen-10) is the company's most ambitious and risky gaming platform, built as a Windows 11 gaming PC with a TV-optimized, console-like interface. • It supports full backward compatibility for all Xbox One, Series X|S, and legacy games, plus any Windows 11 PC titles. • Users can exit the Xbox interface to full Windows for tasks like streaming, coding, or music production, akin to Steam Deck's Linux mode. • Core hardware features an AMD semi-custom SoC codenamed “Magnus.” • AMD CEO Lisa Su: “Development of Microsoft's next-gen Xbox featuring an AMD semi-custom SoC is progressing well to support a launch in 2027.” • 2027 launch is a "best-case scenario"; Microsoft insiders are surprised by Su's timeline, pending Windows 11 polish. • Xbox President Sarah Bond confirmed a multi-year Xbox-AMD partnership for hardware and backward compatibility. • Xbox and Windows teams collaborate for a seamless, console-like OS experience atop Windows 11. • Supports multiple storefronts: Xbox Store, Steam, and Epic Games Store, with ports to PS and Switch 2. • The "Xbox Everywhere" strategy offers hardware choices via OEM partners like ASUS (Xbox Ally preview). • OEMs (ASUS, Lenovo, and Razer) to offer a range of Xbox-branded devices at different price/performance points. • Microsoft plans its own first-party Xbox handheld in the future. • NPU-powered features like auto-generated gameplay highlight clips, testing on Xbox Ally X, and rollout in March 2026. • Emphasizes cross-play, cross-saves, and cross-purchasing via Xbox Play Anywhere to grow the industry. • First-party games ported to Steam, PlayStation, and Nintendo Switch 2. • Easier developer publishing tools; major updates at GDC 2026. • Polished software experience is critical; current Ally handhelds highlight Windows issues to fix. • Epic Games Store and Steam are expected to be part of the next Xbox’s multi-store openness, alongside Xbox’s own store. • Price is uncertain (due to tariffs and costs; OEMs for affordability), but the next Xbox may skew more premium (~$1,000)—while lower-end options may persist via partners. Also, Series S support will be extended. • Echoes the original Xbox vision of Windows in the living room; Surface-like premium ecosystem strategy. via: Windows Central Jez

XBOX Gen-10 details: • Microsoft's next-generation Xbox (Gen-10) is the company's most ambitious and risky gaming platform, built as a Windows 11 gaming PC with a TV-optimized, console-like interface. • It supports full backward compatibility for all Xbox One, Series X|S, and legacy games, plus any Windows 11 PC titles. • Users can exit the Xbox interface to full Windows for tasks like streaming, coding, or music production, akin to Steam Deck's Linux mode. • Core hardware features an AMD semi-custom SoC codenamed “Magnus.” • AMD CEO Lisa Su: “Development of Microsoft's next-gen Xbox featuring an AMD semi-custom SoC is progressing well to support a launch in 2027.” • 2027 launch is a "best-case scenario"; Microsoft insiders are surprised by Su's timeline, pending Windows 11 polish. • Xbox President Sarah Bond confirmed a multi-year Xbox-AMD partnership for hardware and backward compatibility. • Xbox and Windows teams collaborate for a seamless, console-like OS experience atop Windows 11. • Supports multiple storefronts: Xbox Store, Steam, and Epic Games Store, with ports to PS and Switch 2. • The "Xbox Everywhere" strategy offers hardware choices via OEM partners like ASUS (Xbox Ally preview). • OEMs (ASUS, Lenovo, and Razer) to offer a range of Xbox-branded devices at different price/performance points. • Microsoft plans its own first-party Xbox handheld in the future. • NPU-powered features like auto-generated gameplay highlight clips, testing on Xbox Ally X, and rollout in March 2026. • Emphasizes cross-play, cross-saves, and cross-purchasing via Xbox Play Anywhere to grow the industry. • First-party games ported to Steam, PlayStation, and Nintendo Switch 2. • Easier developer publishing tools; major updates at GDC 2026. • Polished software experience is critical; current Ally handhelds highlight Windows issues to fix. • Epic Games Store and Steam are expected to be part of the next Xbox’s multi-store openness, alongside Xbox’s own store. • Price is uncertain (due to tariffs and costs; OEMs for affordability), but the next Xbox may skew more premium (~$1,000)—while lower-end options may persist via partners. Also, Series S support will be extended. • Echoes the original Xbox vision of Windows in the living room; Surface-like premium ecosystem strategy. via: Windows Central Jez

Idle Sloth

69,919 views • 5 months ago

OKKKK Ive fully automated Codex + Claude Code it take any app idea and runs a fleet of parallel agents in iterative loops nonstop for 24hr+ it can research, design, plan and execute for DAYS zero back and forth it also costs $0 because it’s powered by AI subs we all already pay for so I could have 100s of complex, polished iOS apps built in 30 days if i really wanted to - for the SAME price as anyone else on the same subscription this is CLONK

OKKKK Ive fully automated Codex + Claude Code it take any app idea and runs a fleet of parallel agents in iterative loops nonstop for 24hr+ it can research, design, plan and execute for DAYS zero back and forth it also costs $0 because it’s powered by AI subs we all already pay for so I could have 100s of complex, polished iOS apps built in 30 days if i really wanted to - for the SAME price as anyone else on the same subscription this is CLONK

Paulius 🏴‍☠️

44,371 views • 28 days ago

Write 100x better code using AI (for free!) Install the Codacy extension (VSCode, Cursor, WindSurf). This will install an MCP Server locally on your computer. Your coding copilot will use this server with the Codacy CLI to check every line of code it generates. The way this works is pretty awesome (assuming you are using Cursor): 1. You ask Cursor to generate some code 2. Cursor writes the code 3. Cursor then calls Codacy's MCP Server to check it 4. The MCP Server will use the Codacy CLI to find any issues 5. Cursor will fix the issues and call the MCP server again 6. When the code passes all checks, you are done Level of effort on your side: literally zero! Code quality and security because of this: 100x better! Codacy has been doing this for a long, long time, and their Guardrails MCP Server checks for a lot of potential issues: • Security issues • Quality standards • Pattern violations • Linting issues You can see more information about the extension here: I recorded a quick video to show you how it works. Thanks to the Codacy team for helping me set up everything, answering my 1,000 questions, and collaborating with me on this post.

Write 100x better code using AI (for free!) Install the Codacy extension (VSCode, Cursor, WindSurf). This will install an MCP Server locally on your computer. Your coding copilot will use this server with the Codacy CLI to check every line of code it generates. The way this works is pretty awesome (assuming you are using Cursor): 1. You ask Cursor to generate some code 2. Cursor writes the code 3. Cursor then calls Codacy's MCP Server to check it 4. The MCP Server will use the Codacy CLI to find any issues 5. Cursor will fix the issues and call the MCP server again 6. When the code passes all checks, you are done Level of effort on your side: literally zero! Code quality and security because of this: 100x better! Codacy has been doing this for a long, long time, and their Guardrails MCP Server checks for a lot of potential issues: • Security issues • Quality standards • Pattern violations • Linting issues You can see more information about the extension here: I recorded a quick video to show you how it works. Thanks to the Codacy team for helping me set up everything, answering my 1,000 questions, and collaborating with me on this post.

Santiago

63,262 views • 1 year ago

⚠️ A defense evasion tool called ExEngine is being sold as a service, marketed as an AV/EDR killer that disables mainstream consumer security software including Windows Defender, Malwarebytes, Bitdefender, and Avast. The tool combines AV termination with a Ring-3 rootkit, UAC bypass, and decoy payload delivery to support stealthy initial access operations. ⠀ ‣ Threat Actor: ryewx1 ‣ Category: Defense Evasion Tool / Killer ‣ Offering: ExEngine AV/EDR Killer ‣ Industry: Malware Tooling ⠀ The seller claims ExEngine actively terminates security software rather than only obfuscating payloads, granting attackers a longer window of undetected operation. The tool supports Windows 10 and 11 builds and is sold per-build at $150 to $250. ⠀ Advertised capabilities: ⠀ ▪️ AV/EDR termination with primary and fallback techniques ▪️ UAC bypass with automatic privilege escalation ▪️ Ring-3 rootkit functionality to hide files, processes, registry keys, and network connections ▪️ Discord webhook logging for victim machine info and execution status ▪️ Secondary decoy payload (game/document/installer) to keep targets unaware ▪️ Persistence across reboots and logouts ▪️ Anti-VM and anti-debug detection with fake error message exit ▪️ Universal Windows 10/11 support, all payload types ⠀ Risk to defenders: ⠀ ▪️ Active termination of consumer AV products including Windows Defender means traditional endpoint protections cannot be relied on once ExEngine executes successfully ▪️ Decoy payload pattern is designed to delay user-driven incident reporting, lengthening attacker dwell time ▪️ Ring-3 rootkit hiding of files, processes, and network connections complicates incident response triage on compromised hosts ▪️ Discord webhook telemetry indicates the operator is targeting consumer and SMB victims at scale rather than running individual targeted campaigns ▪️ Sold per-build at low cost ($150 to $250), making it accessible to low-skill operators who can pair it with commodity stealers, RATs, or loaders

⚠️ A defense evasion tool called ExEngine is being sold as a service, marketed as an AV/EDR killer that disables mainstream consumer security software including Windows Defender, Malwarebytes, Bitdefender, and Avast. The tool combines AV termination with a Ring-3 rootkit, UAC bypass, and decoy payload delivery to support stealthy initial access operations. ⠀ ‣ Threat Actor: ryewx1 ‣ Category: Defense Evasion Tool / Killer ‣ Offering: ExEngine AV/EDR Killer ‣ Industry: Malware Tooling ⠀ The seller claims ExEngine actively terminates security software rather than only obfuscating payloads, granting attackers a longer window of undetected operation. The tool supports Windows 10 and 11 builds and is sold per-build at $150 to $250. ⠀ Advertised capabilities: ⠀ ▪️ AV/EDR termination with primary and fallback techniques ▪️ UAC bypass with automatic privilege escalation ▪️ Ring-3 rootkit functionality to hide files, processes, registry keys, and network connections ▪️ Discord webhook logging for victim machine info and execution status ▪️ Secondary decoy payload (game/document/installer) to keep targets unaware ▪️ Persistence across reboots and logouts ▪️ Anti-VM and anti-debug detection with fake error message exit ▪️ Universal Windows 10/11 support, all payload types ⠀ Risk to defenders: ⠀ ▪️ Active termination of consumer AV products including Windows Defender means traditional endpoint protections cannot be relied on once ExEngine executes successfully ▪️ Decoy payload pattern is designed to delay user-driven incident reporting, lengthening attacker dwell time ▪️ Ring-3 rootkit hiding of files, processes, and network connections complicates incident response triage on compromised hosts ▪️ Discord webhook telemetry indicates the operator is targeting consumer and SMB victims at scale rather than running individual targeted campaigns ▪️ Sold per-build at low cost ($150 to $250), making it accessible to low-skill operators who can pair it with commodity stealers, RATs, or loaders

Dark Web Informer

23,210 views • 2 months ago

🚨 FLOCK 2.0 IS HERE — THEY'RE PUTTING AI CAMERAS ON GARBAGE TRUCKS TO SPY ON EVERY HOME They're taking surveillance to the next level. They're now deploying AI cameras on garbage trucks that will drive through every street, scanning homes, roofs, windows, and more. No more fixed poles you can tear down. These cameras move with the trucks with eyes on every block, every house, every day. They’re already testing software that can detect “bad roofs,” broken windows, construction materials, and more… all while claiming it’s for “public safety.” And when people push back against mass surveillance systems like Flock? Flock sends cease and desist letters threatening legal action. How much more of our privacy are we going to surrender before we finally push back against this surveillance grid?

🚨 FLOCK 2.0 IS HERE — THEY'RE PUTTING AI CAMERAS ON GARBAGE TRUCKS TO SPY ON EVERY HOME They're taking surveillance to the next level. They're now deploying AI cameras on garbage trucks that will drive through every street, scanning homes, roofs, windows, and more. No more fixed poles you can tear down. These cameras move with the trucks with eyes on every block, every house, every day. They’re already testing software that can detect “bad roofs,” broken windows, construction materials, and more… all while claiming it’s for “public safety.” And when people push back against mass surveillance systems like Flock? Flock sends cease and desist letters threatening legal action. How much more of our privacy are we going to surrender before we finally push back against this surveillance grid?

HustleBitch

25,498 views • 4 days ago

‼️A malware binder tool branded "Universal File Binder 2026" is being sold on a popular cybercrime forum, advertised as fully undetectable and designed to disguise executable payloads as common file types including documents, images, and videos. ⠀ ‣ Threat Actor: Davina Keenan ‣ Category: Malware Tool Sale / Payload Binder ‣ Product: Universal File Binder 2026 ‣ Industry Impact: Phishing, Social Engineering, Initial Access ⠀ The tool is marketed as a payload binder, a category of malware used to attach executable code to a legitimate looking file so that opening the file triggers both the decoy document and the hidden payload. A video demo is attached to the listing and this post. ⠀ Advertised features: ⠀ ▪️ Claimed "100% FUD" (Fully Undetectable) against major antivirus engines including Windows Defender, Avast, and Kaspersky, at both scantime and runtime ▪️ Bind payloads to .jpg, .png, .pdf, .docx, .pptx, .mp4, and .mp3 files ▪️ Icon and extension spoofing, including double extension tricks ▪️ Lightweight stub with small footprint ▪️ Stated compatibility with Windows 10 and Windows 11 ⠀ Pricing: ⠀ ▪️ Single build: $100 ▪️ Lifetime access with updates: $1,000 ⠀ Binders of this type are a common component of commodity phishing kits, used primarily to deliver RATs, stealers, and ransomware via email attachments or messaging platforms. "FUD" claims on public forums are typically short lived and degrade within days or weeks of release as antivirus vendors collect samples.

‼️A malware binder tool branded "Universal File Binder 2026" is being sold on a popular cybercrime forum, advertised as fully undetectable and designed to disguise executable payloads as common file types including documents, images, and videos. ⠀ ‣ Threat Actor: Davina Keenan ‣ Category: Malware Tool Sale / Payload Binder ‣ Product: Universal File Binder 2026 ‣ Industry Impact: Phishing, Social Engineering, Initial Access ⠀ The tool is marketed as a payload binder, a category of malware used to attach executable code to a legitimate looking file so that opening the file triggers both the decoy document and the hidden payload. A video demo is attached to the listing and this post. ⠀ Advertised features: ⠀ ▪️ Claimed "100% FUD" (Fully Undetectable) against major antivirus engines including Windows Defender, Avast, and Kaspersky, at both scantime and runtime ▪️ Bind payloads to .jpg, .png, .pdf, .docx, .pptx, .mp4, and .mp3 files ▪️ Icon and extension spoofing, including double extension tricks ▪️ Lightweight stub with small footprint ▪️ Stated compatibility with Windows 10 and Windows 11 ⠀ Pricing: ⠀ ▪️ Single build: $100 ▪️ Lifetime access with updates: $1,000 ⠀ Binders of this type are a common component of commodity phishing kits, used primarily to deliver RATs, stealers, and ransomware via email attachments or messaging platforms. "FUD" claims on public forums are typically short lived and degrade within days or weeks of release as antivirus vendors collect samples.

Dark Web Informer

25,017 views • 2 months ago

Hot topic in vogue is what happens to systems of record in an era of 1000x more agents than humans. Aaron Levie has been the CEO of Box for 20 years and believes that systems of record become more important, not less, with agents: “Systems of record were built for a TAM of human employees. And that was sort of where the value maxed out at. And now maybe we'll have a hundred times more agents than people or a thousand times more agents than people. So I think on a relative basis, the agent layer will seize growth from zero to a trillion. But the system of record layer now has a thousand times more users on it that need to access data and need to execute a workflow and need to move things through various events. And importantly, you need as an enterprise to care about data integrity and security and the controls in your workflow and traffic copying the agents. So basically, this is where I am very diametrically opposed to the view that the system of record gets is squeezed into a database interaction layer because you actually need all of the core system of record properties for the agents to operate on.”

Hot topic in vogue is what happens to systems of record in an era of 1000x more agents than humans. Aaron Levie has been the CEO of Box for 20 years and believes that systems of record become more important, not less, with agents: “Systems of record were built for a TAM of human employees. And that was sort of where the value maxed out at. And now maybe we'll have a hundred times more agents than people or a thousand times more agents than people. So I think on a relative basis, the agent layer will seize growth from zero to a trillion. But the system of record layer now has a thousand times more users on it that need to access data and need to execute a workflow and need to move things through various events. And importantly, you need as an enterprise to care about data integrity and security and the controls in your workflow and traffic copying the agents. So basically, this is where I am very diametrically opposed to the view that the system of record gets is squeezed into a database interaction layer because you actually need all of the core system of record properties for the agents to operate on.”

Corinne Marie Riley

119,410 views • 7 months ago

Holy CRAP! jnmartin gave me access to his private Sonic R decompilation repo, which will serve as the basis for the Sega Dreamcast port. I was able to build Sonic R NATIVELY for my x86_64 desktop, running Ubuntu 24.04, and immediately begin playing after just typing "make" and then passing the binary the location of my ripped (yet legally purchased) PC assets. ...but while he's at it, jnmartin has decided to make the base decompilation codebase platform-independent, so this should theoretically work on any platform that supports SDL2 and very basic OpenGL--no shaders required--with very low system requirements. jnmartin already has it running fine on the latest MacOS version on Apple silicon, and now we can confirm it works fine on Debian Linux distros, no problem. Next up we'll test for Windows. Oh, and by the way, to everyone freaking out over the fact that the decomp is starting from the PC version and not the Saturn version, lamenting the less vibrant coloring... Your voices have been heard! CHECK IT OUT NOW!!! ...just imagine 4p netplay between Windows, Mac, Linux, and the Sega Dreamcast! 🤯

Holy CRAP! jnmartin gave me access to his private Sonic R decompilation repo, which will serve as the basis for the Sega Dreamcast port. I was able to build Sonic R NATIVELY for my x86_64 desktop, running Ubuntu 24.04, and immediately begin playing after just typing "make" and then passing the binary the location of my ripped (yet legally purchased) PC assets. ...but while he's at it, jnmartin has decided to make the base decompilation codebase platform-independent, so this should theoretically work on any platform that supports SDL2 and very basic OpenGL--no shaders required--with very low system requirements. jnmartin already has it running fine on the latest MacOS version on Apple silicon, and now we can confirm it works fine on Debian Linux distros, no problem. Next up we'll test for Windows. Oh, and by the way, to everyone freaking out over the fact that the decomp is starting from the PC version and not the Saturn version, lamenting the less vibrant coloring... Your voices have been heard! CHECK IT OUT NOW!!! ...just imagine 4p netplay between Windows, Mac, Linux, and the Sega Dreamcast! 🤯

Falco Girgis

71,356 views • 2 months ago

You see this SSRF attack yeah? Big companies with strong engineering teams like Capital One, GitHub, Microsoft, Alibaba, and others, have all suffered from it in the past. Once an attacker successfully exploits SSRF, they can pivot from the application into the underlying infrastructure, using credentials (keys, tokens, metadata secrets, etc.) that the server is tricked into returning. From there, cloud-level access becomes possible, depending on the permissions of the exposed credentials. If your environment is poorly isolated, this can escalate into full infrastructure compromise. This is how real incidents happen, and in worst-case scenarios, companies end up dealing with ransom demands or catastrophic data and infra loss, like what happened to Code Spaces. I gave a talk on this vulnerability about 2 months ago at APIsec|CON (I’ll attach the video in the replies), & I’ve also decided to show how attackers exploit SSRF in this video for anyone willing to learn. You can see how I tricked the server into making a request to its internal resource, saving the response in a static folder and serving me these cloud config data.

You see this SSRF attack yeah? Big companies with strong engineering teams like Capital One, GitHub, Microsoft, Alibaba, and others, have all suffered from it in the past. Once an attacker successfully exploits SSRF, they can pivot from the application into the underlying infrastructure, using credentials (keys, tokens, metadata secrets, etc.) that the server is tricked into returning. From there, cloud-level access becomes possible, depending on the permissions of the exposed credentials. If your environment is poorly isolated, this can escalate into full infrastructure compromise. This is how real incidents happen, and in worst-case scenarios, companies end up dealing with ransom demands or catastrophic data and infra loss, like what happened to Code Spaces. I gave a talk on this vulnerability about 2 months ago at APIsec|CON (I’ll attach the video in the replies), & I’ve also decided to show how attackers exploit SSRF in this video for anyone willing to learn. You can see how I tricked the server into making a request to its internal resource, saving the response in a static folder and serving me these cloud config data.

Ghost St Badmus

91,265 views • 7 months ago

This is a standard practice for almost all Tier-1 banking applications in Nigeria, and for some fintech applications I’ve previously performed pentests on. Client-side encryption isn’t a total waste, or a waste of compute, as some people have claimed, but rather a measure to protect against API tampering or API request/response manipulation between the client and the server when implemented properly. Even with HTTPS, attackers can capture a decrypted version of web or mobile API data in transit because the browser and the server establish a level of trust during the TLS handshake. Attackers can leverage this trust to capture & proxy already-decrypted traffic, tamper with it, and then forward it to the server. This allows them to override what the user interface or client is originally supposed to send and replace it with data of their choosing. That is why validation needs to be performed on both the client and the server side. To wrap up, encrypting API requests and responses makes it significantly harder for attackers to tamper with data, even if they capture the traffic, unless they have access to the encryption details (algorithm, encryption mode, key size, secret key, and initialization vector), assuming asymmetric encryption is used. In the demo below, you can see how I discovered additional parameters (balance, is_admin) in the API response, captured the registration API request, despite it being sent over HTTPS from the interface, added the discovered parameters, and successfully inflated my balance to 50 billion and also escalated my privileges to admin, and ultimately deleted the accounts of two live users/customers. In the second slide, I captured an API traffic of a bank app, and you can see how difficult the payloads are to read.

This is a standard practice for almost all Tier-1 banking applications in Nigeria, and for some fintech applications I’ve previously performed pentests on. Client-side encryption isn’t a total waste, or a waste of compute, as some people have claimed, but rather a measure to protect against API tampering or API request/response manipulation between the client and the server when implemented properly. Even with HTTPS, attackers can capture a decrypted version of web or mobile API data in transit because the browser and the server establish a level of trust during the TLS handshake. Attackers can leverage this trust to capture & proxy already-decrypted traffic, tamper with it, and then forward it to the server. This allows them to override what the user interface or client is originally supposed to send and replace it with data of their choosing. That is why validation needs to be performed on both the client and the server side. To wrap up, encrypting API requests and responses makes it significantly harder for attackers to tamper with data, even if they capture the traffic, unless they have access to the encryption details (algorithm, encryption mode, key size, secret key, and initialization vector), assuming asymmetric encryption is used. In the demo below, you can see how I discovered additional parameters (balance, is_admin) in the API response, captured the registration API request, despite it being sent over HTTPS from the interface, added the discovered parameters, and successfully inflated my balance to 50 billion and also escalated my privileges to admin, and ultimately deleted the accounts of two live users/customers. In the second slide, I captured an API traffic of a bank app, and you can see how difficult the payloads are to read.

Ghost St Badmus

217,252 views • 7 months ago

George Kurtz: An iPhone is safer than a regular computer — but if a nation state wants to get in bad enough, they’re gonna get in. There’s a whole black and gray market for zero-day vulnerabilities. One unknown flaw in iOS can be worth millions — and sometimes all it takes is opening a browser. There are zero days in all software. If you have one for Apple iOS, that’s super valuable. Nation states don’t need phishing emails or fake links. In some cases, just receiving a message is enough to run code and implant malware. If there is a software vulnerability that hasn’t been found and patched, they can exploit that and run code. No click. No warning. Just an SMS that silently installs an implant on your phone. This is what modern cyber warfare actually looks like People think phones are safe by default — but there were vulnerabilities where they could just send you an SMS. You wouldn’t even know it happened. The message processes, the exploit runs, and suddenly your phone isn’t yours anymore. If they want to get in bad enough, they’re gonna get in. That’s the reality of zero-days, nation states, and why ‘secure’ doesn’t mean untouchable in modern software.

George Kurtz: An iPhone is safer than a regular computer — but if a nation state wants to get in bad enough, they’re gonna get in. There’s a whole black and gray market for zero-day vulnerabilities. One unknown flaw in iOS can be worth millions — and sometimes all it takes is opening a browser. There are zero days in all software. If you have one for Apple iOS, that’s super valuable. Nation states don’t need phishing emails or fake links. In some cases, just receiving a message is enough to run code and implant malware. If there is a software vulnerability that hasn’t been found and patched, they can exploit that and run code. No click. No warning. Just an SMS that silently installs an implant on your phone. This is what modern cyber warfare actually looks like People think phones are safe by default — but there were vulnerabilities where they could just send you an SMS. You wouldn’t even know it happened. The message processes, the exploit runs, and suddenly your phone isn’t yours anymore. If they want to get in bad enough, they’re gonna get in. That’s the reality of zero-days, nation states, and why ‘secure’ doesn’t mean untouchable in modern software.

Ian Miles Cheong

20,065 views • 5 months ago