Source Byte

🐙 talks

Notes from the recent OnlyMalware event on "Sryxen Stealer" source code analysis are available on GitHub. We explore how they steal info for: - browser cookies, autofill, bookmarks, passwords, history - socials - games - VPNs, wallets, and more.

share here if you know @Sourc3_Byte_Chat

Any one know the threat actor?

WinPwnageUAC bypass, Elevate, Persistence methods

They share it

maybe now they understand they should spend more on security 👀 translation :

In the next 24 hours, we will publish the full information of 80 members of Parliament

Waiting Thread Hijacking: A Stealthier Version of Thread Execution Hijacking

Research by lovely hasherezade

Process Injection is one of the important techniques in the attackers’ toolkit. In the constant cat-and-mouse game, attackers try to invent its new implementations that bypass defenses, using creative methods and lesser-known APIs. Combining common building blocks in an atypical way, Check Point Research was able to create a much stealthier version of a known method, Thread Execution Hijacking.

hers is detals : 1. 300 MCI employees (Name and surname, father's name, gender, date of birth, place of birth, ID card, address, province, address, postal code, mobile, plan, email) 2. 300K client name & emails (customerBriefInfo_custName,indvBrief_email)

i check the breached data it is new :(

In April 2025, the threat actor group named Shadowbits claimed to have breached Hamrahe Avval (MCI), Iran's largest mobile operator, and to have gained access to its database. According to the threat actor, a substantial amount of data belonging to MCI's customers was taken, including full names, father names, place of birth, gender, national ID numbers, addresses, postal codes, birth dates, mobile numbers, and SIM card information. @aioooir | #hack