↓ Skip to main content
Andrew Healey

"I'm smart enough not to get hacked"

·1 min
LinkedIn Security

Oftentimes your high-ego, “I’m smart enough not to get hacked” techies are more dangerous than Randall over in Sales. They see a shiny new “PoC exploit” for a spicy CVE on GitHub and think, “I got this. I’ll just test it real quick on my machine.

Well, that’s exactly how the WebRAT malware is spreading right now. Threat actors are spinning up convincing GitHub repos that mimic proof-of-concept exploits for recently disclosed vulnerabilities (high CVSS stuff like Windows RasMan flaws). The repos look legit: AI-generated descriptions, mitigation details, code snippets, etc.

But the “exploit” ZIP? Well, it’s a dropper that disables Defender, escalates privileges, and installs WebRAT, a full-featured backdoor and infostealer that grabs:

  • Credentials from Steam, Discord, Telegram
  • Crypto wallets
  • Screenshots
  • Webcam access

Kaspersky spotted 15 of these repos (all taken down now, for now). This campaign specifically targets infosec pros and enthusiasts who can’t resist poking at fresh CVEs.

Lesson: Ego + haste = compromise.

Always: ➙ Verify the repo owner, activity, and stars ➙ Download and test only in an isolated VM or sandbox ➙ Never run untrusted code on your daily driver

What’s your go-to when you stumble across a GitHub “PoC”? Local VM? Sandboxed lab? Vendor solution (which one)?

More details: https://www.bleepingcomputer.com/news/security/webrat-malware-spread-via-fake-vulnerability-exploits-on-github/

Related

🎧 Down the Security Rabbithole Podcast - the identity crisis we've been facing

·1 min
LinkedIn Security Podcast
🎧 A must-listen to episode of the Down the Security Rabbithole Podcast that nails the identity crisis we’ve been facing for years. Rafal Los and his guests unpack the risks of the many idp problem, weak observability, and fragmented controls across identity providers. As usual, a great blend of technical and administrative insights. https://dtsr.buzzsprout.com/2153215/episodes/17018052-dtsr-episode-650-executing-a-human-focused-security-approach*

62 malicious Chrome extensions

·1 min
LinkedIn Security
62 malicious Chrome extensions have found ways around Google’s ban on remote code execution. They’re linked to Phoenix Invicta, Technosense Media, and notably, Sweet VPN. These extensions inject ads and could compromise user data. Phoenix Invicta, once known as Funteq Inc., has a convoluted corporate setup, with ties to the US, Hong Kong, and operations in Ukraine. They use techniques like manipulating the declarativeNetRequest API to execute remote code, despite Google’s restrictions.

Unused Domain? Add These DNS Records

·7 mins
Business Technology Dns Security
Why would an unused domain even need any resources records? # It’s common for domains to go unused. Sometimes they’re purchased for a potential idea or project. Other times, it’s to protect a name or trademark, or maybe they’re meant for use internally on a protected and private network. But the internet does weird stuff and sometimes there are steps that should be taken even if these domains aren’t being used.