@megabeets_

Animal liberation activist 🌟 Forbes 30 Under 30 • Sr. Principal Researcher @ Unit 42 • Maintainer of Cutter and Rizin I don't eat animals.

 California, USA
megabeets.net/
Joined September 2016
  • Tweets1.4K
  • Following538
  • Followers5.6K
163Media
I am incredibly honored and grateful to have been selected to the Forbes 30 Under 30 list for 2023! 🎉 This recognition is deeply important to me. I’ll continue pursuing my biggest goal — making the world a safer and more just place for all of us, humans & animals.❤️ #30under30
29
9
2
188
40,419
Itay Cohen 🌱 retweeted
Unit 42@Unit42_IntelOct 19
We've noted a group of domains associated with #Coruna-like and #DarkSword iOS exploit kit activity. In this example, one of the pages instructs viewers to open the content using Safari on their iPhone. More info at bit.ly/4BfC29F
4
13
1
82
7,037
Itay Cohen 🌱 retweeted
Check Point Research
@_CPResearch_Aug 11
0-Day Used by Lazarus in #DreamJob Campaign Against Defense Sector: 💥LPE vulnerability in Microsoft’s Afd.sys driver (CVE-2026-68820) 🧰New tools, including #Troy backdoor 🌍Compromised Roundcube servers (CVE-2025-49113) as infrastructure Read More : research.checkpoint.com/2026…
2
82
4
309
36,384
Itay Cohen 🌱 retweeted
hasherezade
@hasherezadeAug 6
Slides from my today's talk at #BlackHatUSA2026 : "Breaking the Seal: Static Deobfuscation of Compiled #V8 JavaScript Bytecode #Malware" : speakerdeck.com/hshrzd/break… // #BHUSA #BlackHat2026

Breaking the Seal: Static Deobfuscation of Compiled V8 JavaScript Bytecode Malware

Presented at Black Hat USA 2026: https://blackhat.com/us-26/briefings/schedule/index.html#breaking-the-seal-static-deobfuscation-of-compiled-v8-javascri…

speakerdeck.com
12
48
3
205
17,019
Super excited to speak at Virus Bulletin!
Virus Bulletin@virusbtnJun 9
Join @megabeets_ (Itay Cohen) at #VB2026 for a deep dive into LANDFALL, a previously unknown commercial-grade Android spyware framework exploiting a zero-day in Samsung’s image processing library to achieve zero-click compromise of Galaxy devices. 👉tinyurl.com/5axvjrck
2
2
38
3,502
Itay Cohen 🌱 retweeted
Donncha Ó Cearbhaill@DonnchaCMay 8
In January, a phishing message arrived on my Signal account, supposedly from "Signal Support." The unwise attack attempt, gave me a unique opportunity to peek inside this wide-scale phishing campaign targeting journalists and politicians. I was target #13,730 in their database.
9
119
7
501
62,181
Itay Cohen 🌱 retweeted
Boris Larin@oct0xorMar 26
We analyzed the Coruna exploit kit and found intriguing code overlaps with Operation Triangulation. Full analysis on our blog: link below.
4
86
2
420
39,231
Trojanized Red Alert rocket-alert app being pushed via SMS pretending to be from the Israeli Home Front Command ("Oref") asking to update the app to the latest version ASAP. Sample: virustotal.com/gui/file/0cba… C2: https://api[.]ra-backup[.]com/analytics/submit.php >>
4
12
2
49
5,163
more replies
The loader spoofs the original app's signing cert at runtime via IPackageManager hook and redirects DEX loading to an embedded payload in `assets/umgdn`. Every string in the APK is XOR+Base64 obfuscated with unique per-string keys, which is why the code is so bloated.
1
3
11
781
Name: RedAlert.apk Sample: virustotal.com/gui/file/8365… Asset: virustotal.com/gui/file/0cba… C2: virustotal.com/gui/domain/ap…
2
6
404
Itay Cohen 🌱 retweeted
Seongsu Park
@unpackerFeb 27
Excited to share my latest research on APT37 (aka ScarCruft) and their evolving campaign targeting so-called "isolated" networks through a carefully orchestrated multi-stage infection chain. Key findings: ▶️Ruby-based loader: APT37 is deploying full Ruby runtimes with trojanized script to blend execution within legitimate environments. ▶️USB dead-drop technique: A refined removable media workflow bridges air-gapped segments, leveraging hidden directories to stage tasking and exfiltrate data. ▶️Cloud C2 evolution: The group has expanded its cloud abuse playbook, incorporating Zoho WorkDrive as an operational command-and-control channel. In this research, I detail the full intrusion lifecycle from the initial LNK lure to the deployment of the surveillance backdoors with technical breakdowns. Blog: zscaler.com/blogs/security-r…
2
33
133
9,633
Itay Cohen 🌱 retweeted
Check Point Research
@_CPResearch_Feb 4
In 2025, Amaranth-Dragon APT weaponized the popular WinRAR CVE-2025-8088 for targeted espionage across Southeast Asia. Custom loader, Telegram RAT, geofenced C2, and event-themed lures. research.checkpoint.com/2026…

Amaranth-Dragon: Weaponizing CVE-2025-8088 for Targeted Espionage in the Southeast Asia - Check...

Key Points Introduction Check Point Research has identified several campaigns targeting multiple countries in the Southeast Asian region. These related activities have been collectively categorized...

research.checkpoint.com
1
38
6
121
17,870
Itay Cohen 🌱 retweeted
ESET Research
@ESETresearchJan 23
#BREAKNG #ESETresearch identified the wiper #DynoWiper used in an attempted disruptive cyberattack against the 🇵🇱 Polish energy sector on Dec 29, 2025. At this point, no successful disruption is known, but the malware’s design clearly indicates destructive intent. 1/5
61
109
12
243
50,567
Itay Cohen 🌱 retweeted
Project Zero Bugs@ProjectZeroBugsJan 1
Samsung: libimagecodec.quram.so buffer overflow in WINKJ_YcbcrWriteOutput1to1_YUV422_H1V2_toRGBA8888 during JPEG decoding project-zero.issues.chromium…
20
68
13,510
IDA has a plugin manager now! I hope this makes it so much easier for you to try new extensions, like after the Plugin Contest. hex-rays.com/blog/introducin…

Introducing the IDA Plugin Manager

Meet the new IDA Plugin Manager - a modern, self-service ecosystem that makes extending IDA as simple as inputting a few key commands.

hex-rays.com
1
20
2
74
11,699
DNG vulnerabilities are everywhere recently. From itw 0-days in iOS and Android (as exploited by LANDFALL) to the many proactively found by Google Project Zero. This excellent talk by @DarkNavyOrg dissecting DNG vulns and a recent WhatsApp 0-click chain. media.ccc.de/v/39c3-dngerous…

DNGerousLINK

The spyware attack targeting WhatsApp, disclosed in August as an in-the-wild exploit, garnered significant attention. By simply knowing a...

media.ccc.de
35
1
128
21,483
Samsung: QuramDng FixBadPixelList opcode out-of-bounds read/write project-zero.issues.chromium…
1
9
32
6,317
Samsung: QuramDng opcodes ignore PixelType, leading to out-of-bounds read/writes project-zero.issues.chromium…
15
62
8,997
Itay Cohen 🌱 retweeted
ESET Research
@ESETresearch18 Dec 2025
#ESETresearch has discovered a new 🇨🇳-aligned APT group, #LongNosedGoblin. This group focuses on cyberespionage and targets mainly governmental entities in Southeast Asia and 🇯🇵. welivesecurity.com/en/eset-r… 1/7

LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan

ESET researchers discovered a China-aligned APT group, LongNosedGoblin, which uses Group Policy to deploy cyberespionage tools across networks of governmental institutions.

welivesecurity.com
2
36
4
120
17,917
An analysis of a recent 0-click exploit targeting Samsung devices: googleprojectzero.blogspot.c…
4
145
7
440
66,311
Load more