RRCfg Implant uses a DLL sideloading chain that hides its first stage in the certificate table of a genuine Microsoft-signed sllauncher.exe. The chain loads a modular beacon that profiles the host and executes PE plugins delivered by the operator.
Key points
First-stage payload embedded in the certificate table of Microsoft sllauncher.exe, signature remains intact.
Final implant connects to hard-coded C2 server awhfos.eu.cc:8083 over TCP using HP-Socket IOCP, ECDH P-256 and AES-GCM.
Sources
- Original post
- iocs/reports/rrcfgimplant at master - Linked page
XCPE Android botnet disrupted, 1.3M devices
Google and partners dismantled the XCPE botnet that infected over 1.3 million Android TV boxes and revoked Videostrong’s license to produce certified Android devices. The operation also took down C2 servers, cutting off access to at least 10 million additional compromised devices.
Key points
1.3 million Android TV streaming boxes were backdoored by Videostrong Technology Co.
Google terminated its relationship with Videostrong and banned the company from producing certified Android devices.
Sources
SpikeStrip adds reversible prompt decoys to web source
SpikeStrip is a work-in-progress tool that inserts reversible prompt decoys, fake vulnerability leads, and math traps into HTML and JavaScript source. It generates a random 12-character hex key for each insertion and supports an ARTEX-specific mode and raw comment export. The tool runs on Node.js 20+ and can inject a configurable number of decoys, e.g., 20 per run.
Key points
Random 12-character hex keys such as a7c94e2b610f are assigned to each inserted comment and checked for duplicates.
The default payload pool contains 28 entries, including 18 instruction decoys and false vulnerability leads.
Sources
- Original post
- SpikeStrip - Linked page
ARTEX attempts observed with AI pen-test framework
ARTEX intrusion attempts observed with AI pen-test framework. Multiple targets were hit using the openly published framework where an LLM agent selects each attack step.
Key points
Intrusion attempts against multiple targets using ARTEX
ARTEX is an openly published AI penetration-testing framework with an LLM agent choosing each step
Sources
- Original post
- bit.ly - Linked in the post
Tradecraft Tuesday Huntress SOC Event Nov 10
Tradecraft Tuesday hosted by Huntress SOC and detection engineers is scheduled for Nov 10 at 1 PM ET. The session will cover the lures, payloads, and infrastructure used in ClickFix campaigns that impersonate Amazon, ChatGPT, and Google Docs.
Key points
Date and time: Nov 10, 1 PM ET.
Topics: lures, payloads, and infrastructure behind ClickFix impersonation campaigns.
Sources
- Original post
- huntress.com - Linked in the post
LLM keys max_tokens=1 validation and resale $60/month
LLM keys are validated with max_tokens=1, using one token per call, then resold via an LLM mixer for $60/month. GTIG report on LLMJacking released today includes more details.
Key points
Validation uses max_tokens=1, one token per call, under every volume alert
Quota is resold through an “LLM mixer” for $60/month
Sources
Mac Monitor v3.0 release with 13 new features
Mac Monitor v3.0 is out with 13 new features, over 30 bug fixes and many quality of life updates. The release touches nearly every part of the app and is the fastest yet.
Key points
13 new features
over 30 bug fixes
Sources
- Original post
- github.com - Linked in the post