Threat Intel.
United States
Joined April 2019
- Tweets244
- Following38
- Followers736
- Likes408
Luke Leal retweeted
[Tech blog] A cure for the obscure! PerimeterX researcher @ctrl__esc created a new open source #Javascript deobfuscator. Learn how it works. #infosec #supplychainattacks #magecart bit.ly/3v3hilm
Luke Leal retweeted
ℹ️ New blog: q-logger skimmer keeps Magecart attacks going
Based on previous research by @AffableKraut, @unmaskparasites and @rootprivilege
blog.malwarebytes.com/threat…
Luke Leal retweeted
Meet another Phishing Kit author targetting @Office365 customers.
Nick Name: Ex.Robotos
Name: Brahim El
From: Kenitra, Morocco
Birthday: 1987
YouTube: youtube.com/channel/UCzXFuDX…
Email: [email protected]
Facebook: facebook.com/Ex.Robotos
ICQ: 745771262
Luke Leal retweeted
1/n Version 0.1.4-d of the Angrybeaver Magento skimmer pastebin.com/raw/EPdSxtYw found in /js/prototype/jscript.min.js
by @_jamsec. Version 0.4.1.1 was described by @rootprivilege back in March xitter.gq/rootprivilege/status/1…
A new player joined the server...angrybeaver 🦫 is a #magecart #skimmer found ITW + still being actively developed
lukeleal.com/research/posts/…
#infosec #cybersecurity #malware #magento #ecommerce #carding #javascript
@AffableKraut @gwillem @sansecio @JCyberSec_ @500mk500
Luke Leal retweeted
🔥Threat actor sending Hermes #phishing via SMS is arrested!🚓
gmp.police.uk/news/greater-m…
🔍Note the actor was using a Hotel room to hide their geo-location
These actors are clever to hide their tracks, keep this in mind when dealing with them.
Luke Leal retweeted
enable dark mode for your chrome browser:
1. type chrome://flags in the address bar
2. type 'dark mode' in the search box
3. choose 'enabled'
4. the dark mode will take place after relaunch
#chrometips
Luke Leal retweeted
Quick and dirty JS deobfuscation example.
Say you see something like looks like this. Now this is just ugly and annoying. Let's make it suck less with a regex and some Javascript.
1/9
Luke Leal retweeted
I've been noticing some changes with the mr.Sniffa skimming/#magecart kit. It can now utilize whitespace encoded binary to mask code loading and data exfiltration. And the data exfiltration uses a dynamically generated image that is POSTed to further hide its activity.
1/14
Luke Leal retweeted
1/n Followed a lead on the «pub/static/static.js» path from this post xitter.gq/rootprivilege/status/1…
and found this infected site urlscan.io/search/#filename%…
A new player joined the server...angrybeaver 🦫 is a #magecart #skimmer found ITW + still being actively developed
lukeleal.com/research/posts/…
#infosec #cybersecurity #malware #magento #ecommerce #carding #javascript
@AffableKraut @gwillem @sansecio @JCyberSec_ @500mk500
Luke Leal retweeted
Sucuri's @rootprivilege explains how a compromised website could lead to business email compromise blog.sucuri.net/2021/03/troj…
Luke Leal retweeted
Sucuri researcher @rootprivilege writes about SQL triggers used as WordPress backdoors blog.sucuri.net/2021/02/sql-…
Luke Leal retweeted
#CyberAttacks: #Magento #PHP Injection Loads #JavaScript #Skimmer - bit.ly/39V43ry
@rootprivilege @sucurisecurity
𝞝
#Enterprises #Organizations
#CMS #OpenSource
#InfoSec #CyberSecurity
#WebSites #Vulnerabilities
#CodeInjection #CyberFrauds
#WebApplicationFirewall
Luke Leal retweeted
@rootprivilege @unmaskparasites just found a nifty JS Skimmer prettending to be @UserWayOrg loading this JS https://userway-api[.]com/static/userway.js - domain registered in the last 3 weeks.
Luke Leal retweeted
#Infosec Roundup is out!
infosecroundup.com/?edition_… #CyberSecurity stories via @rootprivilege @carlkotze @USCERT_gov
Luke Leal retweeted
New #InterCC Panel discovered📸
🌐hxxp://gaminpit.com/ (2606:4700:3037::681f:522a)
urlscan.io/result/d6cd089a-5… - @urlscanio
💰InterCC Panel is linked to #magecart as an exfil panel
Host @CloudflareAbuse
@jeromesegura @AffableKraut @ydklijnsma @rootprivilege @jknsCo @SteveD3
