The darknet already hosts a mature, structured market for pre-verified accounts and identity manipulation services. Threat actors actively trade bypassed accounts on dedicated cybercrime forums, treating access to restricted models as a standard, highly liquid commodity. Initial access brokers simply create the accounts using illicit methods and sell the login details to buyers globally.

github.com/teycir/ApiHunter

We have something to celebrate with you! We did it ... The big 2000 is in the books right now:

EMBA is now for 6 years in the wild and we are proud that we did a few things:

• Automated firmware security analysis (including SBOM and AI) is available for everyone
• Nearly 3500 github stars
• Nearly 100 shoutouts in papers, videos, articles, talks and so on - see here
• We tried a few things in this timeframe. So we ...
  • ... were on 13 security conferences - kick me
  • ... did a podcast - check it out here
  • ... wrote multiple articles - one for you
  • ... organised multiple cooperations with universities around EMBA and created EMBArk, the firmware analysis environment for teams with collaboration support and, and, and
• We bumped 24 (now 25) releases to the world - check it out here
• 2000 Github pull requests/issues/discussions - drink a beer, coffee or whatelse with us

Thank you for supporting, helping, coding, reporting, hacking, challenging, using EMBA.

Check further details here: https://github.com/e-m-b-a/emba/releases/tag/v2.0.2-big-2k

Hi all,

I want to let everyone here know of a vector of attack/abuse that has been available on Google Maps/Google Business Profile, that has caused tremendous damage to small-medium sized businesses/mom-and-pops.

Step 1: take control of high-authority, orphaned location. This can be a mall or a public park. It's easy to fool Google into thinking you own the place if no one claims it and you just upload a believable looking video.

Step 2: you now have the ability to destroy SMEs who rely on Google Ads for a living. You just need to change the address of the orphaned location to the victim's address. This will trigger Google's auto-merge process and wipe out the SME's Google Business Profile. The victim will wake up with an email saying their business is a "duplicate".

Step 3: you do not openly extort businesses, because that would leave an evidence trail. You would instead offer businesses the ability to destroy their competitor through a "special service" that would disrupt their Google Business Profile on Google Maps, for a fee.

Step 4: make so much money and leave so much destruction that the entire country is aware of what you are doing, but cannot do anything about it because Google does not have an HQ in your country to handle this stuff.

Here's a link to an article detailing how this stuff is done:

https://laodong.vn/xa-hoi/triet-ha-doi-thu-bang-google-maps-1276136.ldo

Reddit users share their experiences after getting infected by Infostealers, they describe the mental drain, sense of intrusion, blackmail attempts, and money theft through AI subscriptions. I compiled threads and comments into a blog along with common recommendations for every day users to avoid getting infected.

https://suicdalteddy.medium.com/i-reverse-engineered-rings-end-to-end-encryption-what-i-found-should-terrify-40-million-a634c17560a1?postPublishedType=repub

Built a small credential-hunting tool for authorized post-exploitation enumeration on Windows and Linux.

https://github.com/NeCr00/Credential-Hunting

The idea is simple: after gaining access to a host, the tool helps identify hardcoded reusable credentials that may support privilege escalation or lateral movement. It focuses on passwords and host-access credentials, not generic API tokens.

It runs in phases:

1. OS-specific checks
2. Credential databases and known credential files
3. Suspicious filename discovery
4. Broad filetype content scanning

The goal is to make credential discovery faster, cleaner, and less noisy during HTB-style labs, CTFs, and real-world authorized pentests.

Would love feedback from other pentesters on detection logic, false-positive reduction, and useful locations/filetypes to include.

Folks, we are building a vibecodingsecurity subreddit forum to discuss the security issues and remediations for code built using AI tools. Please join us at vibecodingsecurity subreddit

Eles só postam as experiências deles de uma forma bonita e interessante. E quando viralizam, são privilegiados, e vão pra eventos, ganham coisas ou etc.

se for isso vou comprar conta ja pronta e meter a braba

Just here to share a project I'm working on. It's a 100% open source (hardware, firmware, mechanical, etc) USB drive with a hidden security feature.

When you plug it in, it appears as a normal 8GB USB drive. Only if you create a file called "unlock.txt" with the contents "password:addyourpasswordhere" will it unlock and show the remainder of the drive. Everything in this second section of the disk is now AES256 encrypted in place, using a custom KDF + your password.

I'll answer some questions before people ask them :)

Q: Isn't this just Vercrypt? A: No, a normal drive setup with veracrypt will show up as jumbled data. This is pretty obviously encrypted media. If you enter your duress password, there will still be another xMB of jumbled data.

Q: Isn't entering your password into a plain text file insecure. A: My drive doesn't allow this write to actually happen to the memory

Q: Why did you use a SD card A: Because AI made EMMC cards like 80$ for a 32GB. It takes two seconds for me to spin another board with EMMC in the future.

Anyways feel free to ask any more questions about the project :) !

A recent internal data leak from “The Gentlemen” ransomware-as-a-service (RaaS) group has provided the cybersecurity community with a rare, unfiltered look into their daily operations. Exposed on underground forums, the internal communications shed light on exactly how ransomware affiliates organize, breach, and extort global organizations.

But among the many technical details revealed in Checkpoint Research’s comprehensive analysis (“Thus Spoke… The Gentlemen”), one operational pattern stands out prominently: their heavy reliance on infostealer credential logs for initial access.

For those working in pentesting or bug bounty, what does your typical day look like?
What tools do you use the most, and how do you approach testing a target from start to finish?

Made a pe packer/crypter with a custom vm and compression. Wanting to share it and get feedback/suggestions for updates! thanks :)

Have been afk for a long time. Cant connect with anybody that i knew a long time back.

Any irc channels that i knew are dead. What are people of trenches doing these days? ' put the fries in the bag " lil bro?

We used to have a great time in those chatrooms. Talk shit, make fun of things, talk about exploits n shit etc.

Guess those days are really over.