8erg

8erg at Taplink

taplink.cc/8erg

How are you doing?

On my end, took some time off , to clear my mind

I spent the last 2 weeks doing these:

➡️Boxing (I'm always boxing)
➡️Running…walking
➡️Fasting (what can i say, I'm kind of a masochist😂)

Back next week to face the love of my life…

I just released a blog post about performing a DLL Proxying via OneDriveServiceUpdater.exe.

Why did I chose this one...just because I wanted to🤗.

But you can perform this with any other executable the process is still the same

🔗Link: 8erg.github.io/posts/2025-0...

screenshot

Who can tell me the problem here...?🫠

The zero-day that could've compromised every Cursor and Windsurf user Learn how one overlooked flaw in OpenVSX discovered by Koi Secureity could've let attackers hijack millions of dev machines via an extension supply chain attack. The zero-day threat's been patched—but...

Every vibe coder🙀

The zero-day that could've compromised every Cursor and Windsurf user

(Side note) But even editors like VS Code are prone to having malicious extensions too

www.bleepingcomputer.com/news/securit...

I would say hands down that reverse engineering, it's the most important skill, in cybersecurity or any other fields (try to change my mind)

who's going to defcon this year?

Here are some tools that I've discovered recently to test/verify AV evasion without burning my signatures:

🔗https://github.com/rasta-mouse/ThreatCheck
🔗https://github.com/BlackSnufkin/LitterBox
🔗https://github.com/CYB3RMX/Qu1cksc0pe

P-S : Qu1cksc0pe, is my favorite for now🤩

Useful resources:
🔗 Official docs: sliver.sh/docs?name=Ge...
🔗 Other open source C2s: howto.thec2matrix.com
🔗 Installation guide I used:

Key features for those who want the specs:
✅ Multi-platform support (Windows, Linux, macOS)
✅ Multiple transports (HTTP, HTTPS, mTLS, DNS, WireGuard)
✅ Feature extensions via "Armory"
✅ Much more (honestly, I haven't finished experimenting myself 😂)

👉 Sliver uses msfvenom (linked to Metasploit) for shellcode generation (I didn't really divorce, keeping my options open... 😂)
👉 By default, implants will be detected by AV - disable Windows Defender for testing
👉 Requires MSF 6.2+

I think Sliver is an excellent starting point (experts welcome to suggest others!), especially because it doesn't make you leave your terminal (if you don't like your terminal, you need to quit tech😂).

I usually use Metasploit as my command & control in labs. It's effective for beginners, but since I want to learn more sophisticated attacks, the ideal is to use a C2 specifically designed for Red Team operations.

I just got divorced...💔 Metasploit, I'm leaving you for SliverC2😂
Jokes aside, I recently experimented with Sliver C2 and wanted to share my experience.
#RedTeam #CyberSecurity #PenetrationTesting

Katz Stealer Threat Analysis - Nextron Systems In-depth analysis of Katz Stealer malware: infection chain, data theft methods, and detection rules with YARA and Sigma examples.

www.nextron-systems.com/2025/05/23/k...

FluBot Android Malware Technical Analysis - ThreatMon Blog The FluBot it’s an Android malware that targets Android devices and spreads to victims via phishing SMS messages that contain a malicious link to download the FluBot app. Victims click on this li...

FluBot Android Malware Technical Analysis

threatmon.io/flubot-andro...

300 Malicious 'Vapor' Apps Hosted on Google Play Had 60 Million Downloads 300 malicious applications displaying intrusive full-screen interstitial video ads amassed more than 60 million downloads on Google Play.

300 Malicious ‘Vapor’ Apps Hosted on Google Play Had 60 Million Downloads

The life of an android user...😱

www.securityweek.com/300-maliciou...

Android trojan TgToxic updates its capabilities Intel 471 mobile malware researchers recently discovered a campaign leveraging an updated version of TgToxic, an Android banking trojan. Here's an…

Android trojan TgToxic updates its capabilities

intel471.com/blog/android...

BTMOB RAT Newly Discovered Android Malware Cyble analyzes BTMOB RAT, advanced Android malware actively spreading via phishing sites, leveraging Accessibility Services to steal credentials, control devices remotely, and execute various maliciou...

BTMOB RAT: Newly Discovered Android Malware Spreading via Phishing Sites

cyble.com/blog/btmob-r...

Detecting Banker Malware Installed on Android Devices | DevSec Blog Presenting Java detection mechanisms of Android malicious applications (Trojan bankers) that abuse AccessibilityService.

Detecting Banker Malware Installed on Android Devices

devsec-blog.com/2024/03/dete...

Hundreds of Malicious Google Play-Hosted Apps Bypassed Android 13 Security With Ease Bitdefender's security researchers have found a huge ad fraud campaign with hundreds of malicious apps in the Google Play Store

Hundreds of Malicious Google Play-Hosted Apps Bypassed Android 13 Security With Ease

P.S : Just learned recently that we can use native code inside an android app😱 (I know I'm late...)

www.bitdefender.com/en-us/blog/l...

OctoV2 Android Banking Trojan Masquerades as Deepseek AI in Phishing Attack Uncover the threat of OctoV2, an Android banking Trojan that deceives users through fake AI chatbot applications.

OctoV2 Android Banking Trojan Masquerades as Deepseek AI in Phishing Attack

securityonline.info/octov2-andro...

An Analysis of Security System for Intrusion in Smartphone Environment There are many malware applications in Smartphone. Smartphone's users may become unaware if their data has been recorded and stolen by intruders via malware. Smartphone—whether for business or persona...

An Analysis of Security System for Intrusion in Smartphone Environment

pmc.ncbi.nlm.nih.gov/articles/PMC...

Android Malware Detection & Protection Malware can target Android devices. Learn how to check for malware on Android & how to protect Android devices from malware.

How to detect and avoid malware on Android devices

www.kaspersky.com/resource-cen...

Banking data theft attacks on smartphones triple in 2024, Kaspersky reports

www.kaspersky.com/about/press-...

Android apps laced with North Korean spyware found in Google Play Google’s Firebase platform also hosted configuration settings used by the apps.

Android apps laced with North Korean spyware found in Google Play

arstechnica.com/security/202...

Google, Apple, and Microsoft Rush to Patch Actively Exploited Zero-Day Vulnerability Learn how the Google Zero-Day Vulnerability is actively exploited, prompting critical updates from Google, Apple, and Microsoft.

Google, Apple, and Microsoft Rush to Patch Actively Exploited Zero-Day Vulnerability

securityonline.info/google-apple...

GitHub - sensepost/objection: 📱 objection - runtime mobile exploration 📱 objection - runtime mobile exploration. Contribute to sensepost/objection development by creating an account on GitHub.

objection is a runtime mobile exploration toolkit, powered by Frida, built to help you assess the security posture of your mobile applications, without needing a jailbreak.

github.com/sensepost/ob...

Any recommendation for it to be less painful?

xdaforum is your bestfriend, you'll probably find the steps required for your mobile phone...good luck!