@ConfiantIntel

@WeAreConfiant Threat Intelligence feeds account, fighting malvertisers since 2013 ⚔️

blog.confiant.com
Joined December 2020
  • Tweets186
  • Following19
  • Followers1.2K
102Media
Our Security Researcher Michael Steele @crimewaretech delved deeply into ScamClub landing pages and the platforms with which ScamClub is affiliated! blog.confiant.com/scamclubs-…
1
369
Proud to have our Kaileigh M. as a BlackHat speaker this year !
Amy James@acurrydish10 Aug 2023
UP NEXT! @DarkReading is streaming LIVE from @MandalayBay #blackhatusa2023 Josh Grossman @BounceSecurity Kaileigh M. @ConfiantIntel John Shier @Sophos Abby Strong @cribl_io Chris Cesio @exabeam Dr. Renée Burton @Infoblox Kelly Shortridge @fastly shorturl.at/dxV19
1
501
🚨 Security Alert 🚨: DCCBoost Forced redirects Impacted SSPs: MediaGrid, AdYouLike, Minute Media, Smile, Wanted, YieldMo, IQZone Impacted DSPs: LoopMe, SmartyAds, Taipei Digital, BuckSense Targeted countries: US (87%), UK (9%), Canada (4%) More at: confiant.com/news/dccboost-i…

Threat Intelligence Red Button Security Alert: DCCBoost Attacks 05.09.2023

Confiant threat intelligence identified that threat actor DCCBoost has increased malicious ad activity through several sources in May 2023.

confiant.com
2,570
Fake "Monkey Drainer" leak on @github targets wannabe #Web3 Scammers with a Raccoon Stealer! github.com/Monkey-Drainer/Mo… c2: 193.37.213.23 As crypto-drainers gain popularity, we see more and more backdoored or malicious codebases targeting would-be thieves.
3
1
7
1,189
Malvertisers love to abuse low-impact browser bugs. They're often slow to get patched and make a significant impact on the efficacy of their malicious campaigns. blog.confiant.com/malvertise…
1
1
743
ConfiantIntel retweeted
Eliya Stein@eliyastein1 Feb 2023
In late September '22 we found a fun little browser bug impacting WebKit that was being abused by a malvertiser. Write up coming soon™️ on the @ConfiantIntel blog.
1
1
1
3
724
Warning 🚨: Google Search Ads delivering Malicious Chrome Extension 👾 Teamviewer search ads results pointing to a malicious domain: website-montppio24[.]buzz enabling drive-by downloads delivering an .MSI installer which in turn installs the extension 🧵
1
10
3
17
12,690
more replies
The extension monitors this list of domains in order to steal user credentials, sessions or hijack the transmitted data between the victims and the monitored domains. The extension exchanges the stolen data encrypted, with a C2 server -> mudg4rzhrmbjdcg0.ads798ad[.]top
1
1
351
This campaign was identified targeting Brazil. The .msi installer drops the following files inside %APPDATA% in a directory named “xxasd” that have the following structure. The extension is side loaded in it’s unpacked form below, into chrome via the --load-extension= switch.
1
321
ConfiantIntel retweeted
Confiant@WeAreConfiant26 Jan 2023
Here’s a great write-up by Billy Hurley in IT Brew on Daniel Fonseca Yarochewsky, Confiant security software engineer’s article uncovering how CashRewindo threat actors use aged domains to serve malicious ads. itbrew.com/stories/2023/01/2…

Scammers gain trust through ‘aged’ domains

Hackers are using older, trusted domains and accounts to provide cover for scams.

itbrew.com
3
5
264
[CONFIRMED] Warning 🚨: Brand Hijacking -> delivering malware 👾 Malwarebytes brand themed domain: malwarebytes-premium[.]com is enabling drive-by downloads delivering malware #Vidar #Stealer: Botnet: 645 DD: t.me/jetbim C2: 65.109.208.140:80 Originally found by
Artilllerie ☣@Artilllerie23 Jan 2023
This new domain: /MALWAREBYTES-PREMIUM[.]COM Creation Date: 2023-01-18T09:37:43Z 🧩Distributes a file: >zip with a ~800Mo exe >Fake cert ☣️Probably a stealer (#Vidar or #Mars) /65.109.208[.]140/pack[.]zip /116.203.30[.]135/qthw6l/rpilag[.]exe @malwrhunterteam @hasherezade
1
1
3
850
Adding IOC’s missing from the original tweet: SHA-256: 0a7c453531634b33a0dbe4d7c6aec8b60c70024616a096c360a016912b9ae481
1
1
181
This domain could be originating from multiple sources: Google search ads (highly likely since the malware delivery 100% overlaps with multiple malicious domains delivered via Google search ads), but could be also phishing or email etc.
1
166
Warning 🚨: Google Search Ads delivering malware 👾 Brave search ads results pointing to malicious domain: braven-go[.]site Windows binaries downloaded delivers malware #Vidar #Stealer Botnet: 651 DD: steamcommunity.com/profiles/… | t.me/tgdatapacks C2: 78.47.228.65
1
1
305
SHA-256: 39c54b5663f827d97686822873db1be415f491b4342365a886a11bb306dcb4a4 Downloaded via: https://www.dropbox[.]com/s/kjepjlrs874nxwu/Brave.br.zip?dl=1
221
Warning 🚨: Google Search Ads delivering malware 👾 7zip search ads results pointing to malicious domain: 7zip-app[.]org see attached screenshot. Windows binaries downloaded delivers malware #Vidar #Stealer Botnet: 841 C2: t.me/jetbim | 65.109.208.140:80
1
4
18
2,280
SHA-256: 524c945de64dc40d514cf4801c1ed9e41d892648023d26c4a9ac60f40d2852de
1
1
1
210
Tweeted again (as the previous Tweet was suspended/censored)
1
156
Load more