TGViewer
Channel Public Channel
Sys-Admin InfoSec

Sys-Admin InfoSec

@sysadm_in_channel

News of cybersecurity / information security, information technology, data leaks / breaches, cve, hacks, tools, trainings
* Multilingual (En, Ru).
* Chat - @sysadm_in
* Job - @sysadm_in_job
* DNS - OpenBLD.net
* ? - @sysadminkz
Open in Telegram
Subscribers
12.9K
Photos
250
Videos
2
Links
4.6K

Showing posts older than #5459 · Back to latest

Older Posts 20 shown
Post #5455 3.55K
SecuritySnack - OpenAI Anti-Ads Malware

This report details the discovery of a malicious Chrome extension, named "ChatGPT Ad Blocker", found on the Google Chrome Web Store.

https://dti.domaintools.com/securitysnacks/securitysnack-openai-anti-ads-malware
Domaintools DomainTools Investigations | SecuritySnack - OpenAI Anti-Ads Malware Stay protected against the "ChatGPT Ad Blocker" malware. This investigation reveals how a malicious Chrome extension uses Discord webhooks to steal private ChatGPT conversations, prompts, and metadata.
Post #5451 3.4K

Forwarded from Sys-Admin Up (Yevgeniy Goncharov)

blacksanta-edr-killer-threat-report.pdf13.7 MB
BlackSanta EDR-Killer

A Silent Threat Targeting Recruitment Workflows. Aryaka Threat Labs has uncovered a sophisticated malware campaign:

The malware performs system reconnaissance and conducts environment checks to detect sandboxes, virtual machines, and debugging tools to evade analysis. A key component, BlackSanta, acts as an EDR-killer, disabling security solutions to ensure malicious payloads run undetected.

Once established, the malware communicates with command-and-control servers over encrypted HTTPS to exfiltrate sensitive data, demonstrating a persistent and highly sophisticated cyber threat..
Post #5449 3.19K

Forwarded from Sys-Admin Up (Yevgeniy Goncharov)

The Forgotten Bug: How a Node.js Core Design Flaw Enables HTTP Request Splitting

https://r3verii.github.io/cve/2026/02/27/nodejs-toctou.html
CyberSec Notes The Forgotten Bug: How a Node.js Core Design Flaw Enables HTTP Request Splitting Deep dive into a TOCTOU vulnerability in Node.js’s ClientRequest.path that bypasses CRLF validation and enables Header Injection and HTTP Request Splitting across 7+ major HTTP libraries totaling 160M+ weekly downloads.
Post #5445 3.16K
AI in the Middle: Turning Web-Based AI Services into C2 Proxies & The Future Of AI Driven Attacks

https://research.checkpoint.com/2026/ai-in-the-middle-turning-web-based-ai-services-into-c2-proxies-the-future-of-ai-driven-attacks/
Check Point Research AI in the Middle: Turning Web-Based AI Services into C2 Proxies & The Future Of AI Driven Attacks - Check Point Research Key Points Introduction AI is rapidly becoming embedded in day-to-day enterprise workflows, inside browsers, collaboration suites, and developer tooling. As a result, AI service domains increasingly blend into normal corporate traffic, often allowed by default…
Post #5444 3.37K
Old-School IRC, New Victims: Inside The Newly Discovered SSHStalker Linux Botnet

https://flare.io/learn/resources/blog/old-school-irc-new-victims-inside-the-newly-discovered-sshstalker-linux-botnet
Flare | Identity First Threat Intelligence | Unmatched Visibility into Cybercrime Old-School IRC, New Victims: Inside the Newly Discovered SSHStalker Linux Botnet Flare’s research team has uncovered a previously undocumented Linux botnet operation we’re calling SSHStalker. To the best of our knowledge, no other research team has reported on this threat actor. Our SSH honeypot captured multiple attacks over two months…
Post #5442 3.16K
Web Traffic Hijacking: When Your Nginx Configuration Turns Malicious

https://securitylabs.datadoghq.com/articles/web-traffic-hijacking-nginx-configuration-malicious/
Datadoghq Web Traffic Hijacking: When Your Nginx Configuration Turns Malicious Datadog Security Research has identified an active web traffic hijacking campaign that targets NGINX installations and management panels like Baota (BT). In this post, we provide our analysis of the techniques this campaign uses and share indicators of compromise…
Post #5441 2.77K
LookOut: Discovering RCE and Internal Access on Looker (Google Cloud & On-Prem)

https://www.tenable.com/blog/google-looker-vulnerabilities-rce-internal-access-lookout
Tenable® LookOut: Discovering RCE and Internal Access on Looker (Google Cloud & On-Prem) Tenable Research discovered two novel vulnerabilities in Google Looker that could allow an attacker to completely compromise a Looker instance. Google moved swiftly to patch these issues. Organizations running Looker on-prem should verify they have upgraded…
Post #5439 3.62K
PeckBirdy: A Versatile Script Framework for LOLBins Exploitation

https://www.trendmicro.com/en_us/research/26/a/peckbirdy-script-framework.html
Trend Micro PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups PeckBirdy is a sophisticated JScript-based C&C framework used by China-aligned APT groups to exploit LOLBins across multiple environments, delivering advanced backdoors to target gambling industries and Asian government entities.
Older posts →
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →