Got some surprise love from the @malbeacon team for beta testing a new product. Thanks a lot for this gift! Hope more people soon get to try your amazing work. TAs will fear you 😈 Cheers ❤️

In 2024 I reported several critical vulnerabilities in the aviation sector to @AviationISAC . This week (after several global shipping attempts) I was honored to recieve 2 challenge coins (+ some stickers) from them 🔥 Thank you! #BeAware #Report #MakeAChange

Had an amazing time #FirstCon last week. Met a bunch of awesome folks from all over the industry. Around 3 hours of sleep per night and 17 hours of social interactions ^^ Was so done but also super happy on friday :) Cheers to all the awesome folks in our industry <3

Hunting bottlenecks in my infra. For months I thought it was the MySQL server. Now that I have some stats, this does not seem to be the case. Time to check the other servers...

At the beginning of this month i bought myself a #Steamdeck. Must admit I am very pleasently surprised by it. Nice handling, great screen resolution, good performance. Better and more versatile than a Nintendo Switch. Nice product @valvesoftware #ThankGaben #gaming

New Blogpost: #HuluCaptcha - An example of a FakeCaptcha framework. Started investigating this after a friend was compromised by it. Some interesting/unique techniques shown, plus analysis of the compromised server. Hope you enjoy the read! :) medium.com/@gi7w0rm/hul...

New #Blogpost scheduled for release tomorrow 8 a.m. (UTC+2). Analyzing a new #FakeCaptcha framework I call #HuluCaptcha. Besides codeanalysis, I also analyze 2 new #wordpress #backdoors and server logs. Hope you ll enjoy 😊

Jo @LidlUS @lidl @LidlGB, didn't knew you now also host fake versions of the New-York Times: hxxps[:]//baustandards-qs[.]lidl[.]com Seems a solid subdomain takeover? Pointing to AWS: 72.144.31[.]24 #subdomaintakeover #itw

So this just happend to me: gamerhorizon.com/2015/01/28/p... 800 Gigs of Data gone. Years of work. Because the installer for @Bethesda @Elderscrolls Online decided to wipe the complete disk upon uninstall.

The website of the "Deutsche Vereinigung für internationales Recht" (dvir[.]de) is currently compromised and spreading #Lumma #Stealer via #FakeCaptcha attack. Compromised webfile is: hxxp[://]www[.]dvir[.]de/wp-content/themes/Dummy/assets/js/main[.]min[.]js?ver=1[.]0

On December 31,2024 @sourcedefense released an article about a #webskimming threat, using extensive google redirects. securityboulevard.com/2024/12/crit... I entered a @ThinkstCanary CC token. April 09, 2025 morning I woke up to 6 payment attempts from Australia! Attempts to pay @eBay and @Uber.

Message of the day: Not every North Korean Cyber Threat is #Lazarus or related to Lazarus. Please get this into your heads...

"Studio Ghibli" - Gi7w0rm #AIArt #StudioGhibli #Gi7w0rm

Homeoffice starting in 4 days, so after roughly 10+ years I upgraded my office desk. Now the proud owner of an hight-adjustable desk. Looking pretty neat! Hope my back will thank me in some years...

Small Bugfix in gi7w0rm.github.io/ArrayThisClo... The name field can now be empty. Previous coding prevented the user from deleting the complete input field content. Using this as a short reminder that this tool is still out there for if you ever need to convert multi-line content to an array.

Have just been notified that I am featured in: www.darkreading.com/cyberattacks... Thank you for the honor @DarkReading ❤️

Happy to share that I have signed a work contract at a CTI company. Also, today was my last work day at my old employer, since I took the remaining vacation days. Looking forward to 2 weeks of rest to prepare for whats to come. Cheers all ❤️

Seems someone just tried to pay an Uber with my @ThinkstCanary token CreditCard which I entered into a #webskimmer. I bet it didn't go well ^^

Please excuse the lack of content in the last weeks. I am overhelmed by current political developments and additionally working on some topics that I can't publicly disclose. No capacity for free research :/ Hope this will get better in some months. Cheers to all my friends and followers.❤️

Looking good on the #jobhunt. Hope to sign a contract by the end of next week. Currently decluttering my workdesk to be prepared for a fresh start. Highly motivated for whats to come 😊 💪

Happy to have received recognition for being a #TopContributor to the abuse_ch project in #2024. Currently ranking place 4 in the leaderboard of global #IoC sharing via #Threatfox. Definetly planning to keep up that rank in the next years. Cheers to the Team @abuse_ch and @spamhaus.bsky.social!

Damn, what an awesome feeling to improve the speed of your code. From 1k documents to 16k per second using some simple coding techniques and #CursorAI. Amazing 🔥

New #challengecoin unlocked. Images as soon as received 🔥

Released my new blogpost: "A beginner(s) guide to hunting web-based credit card skimmers" My experience on how to detect and analyze skimming campaigns using free tools like Validin, URLscan and FoFa. Includes WebSocket analysis and new IOCs! https://gi7w0rm.medium.com/a-beginner-s-guide-to-huntin…

Blogpost release scheduled 6 pm CET today. Topic: How to hunt for CreditCard skimmers using free tools. (Only none free tool I use is ClaudeAI and you could use Llama or similar). Hope you ll enjoy!

Had a productive evening yesterday :) #skimming #magecart #hunting

I have seen so much compromise, if someone sends me a list of 200 backdoored Wordpress sites I am actually starting to contemplate if it is worth to act. What does this say about the state of our cybersecurity? At least its a job with a future ^^

Update pushed to Teletoken.info 1. Added about page - Added About section - Added HowTo section - Added advanced features list - Added disclaimer/ToS - Added Contact details 2. Added security.txt

Here is a list of 698 ACTIVE #KeitaroTDS domains identified via @ValidinLLC. While not inherently harmful, these domains are often used for advertising, misinformation (DoppelGaenger), and harmful activities. Blocking them could be a wise precaution.

Hey, we even have a #Bugbounty Program, we are so secure! The Bugbounty program:

#Magecart #Skimmer just triggered my #Canarytoken. 2 different shops, one was a 1 dollar transaction attempt, likely to test if the card works. The second was a transaction of 1604 canadian dollars in an attempt to buy something from Viwoods Aipaper. Actor = Canadian? @thinkstcanary.canary.tools

5 days into Social Media Botting. First valid accounts. Estimating 2,50$ per Bot. I do not know how this can be profitable without illegal methods. #experiment #socialmedia #botnet

Please suggest your favorite #cybersecurity related tv series (not Mr Robot). Alternatively anything related to organized crime or espionage. #Netflix or Amazon #Prime preferred. #infosec

Trying to setup a social media botnet. Think it could make a good blogpost and cool research. Turns out for full automation you need cryptocurrency for EVERYTHING. 1. Captcha Solvers 2. Virtual SIMs Plus: Static residential proxies are expensive #TheWorldIsAboutMoney -.-

Sometimes it feels like every click I do online leads to another interesting technical rabbithole to get lost in. #infosec #interesting

Trying to move away from X/ Elno. Please suggest #cybersecurity accounts I should follow on here! Need to find the #CTI crowd in particular. #infosec

Professional goals for 2025: - Find a cool job - Develop new systems and automation - collaborate with awesome people in #infosec - Get legal setup to sell CTI data - Gradually move main activities to Bluesky Best wishes to all, may we stand strong during these turbulent times❤️

Updating old projects to prepare for 2025 🙂 IoCSharing to #ThreatFox and my Github has been very low in recent months. Blame my bachelor thesis. But I hope to get that going on a way more frequent basis with the new system :) Cheers @abuse_ch for your awesome platforms 💪

Woke up to the news that I passed my bachelor thesis with 95%. Best grade possible. After 7 years of stress, unhappiness and mediocre grades I finished with a banger. Very happy and reliefed. 🎉 #gratefull #didit #bachelorofscience #bachelor2024

I decided that it might not hurt to publish the Usernames of the affected developers from #GitLab and #Github in a temporary Pastebin entry. For @github : pastebin.com/RGEgXGb5 For @gitlab : pastebin.com/y25PFNyF If your username is in this list please reach out.

.git leaks with #Github and #Gitlab tokens, some stats: 1439 valid tokens collected over 30 days allow access to 108.707 code repositories. Besides lone developers, access is also possible to 2117 Organizations/Groups. Top Tokens by num repos 18,534 1,615 1,142 1,035 1,035

New Update pushed to teletoken.info 1. 40k new chat to token relations added 2. Added Token to Source feature to advanced section - 2k malware relations added - 7k phishing relations added Say hi to some of the identified #threatactors below ;)

I wish all my abuse reports were that simple. 1. Enter website 2. Click Chat 3. Get a nice responsive human on the other end 4. Report abuse in chat without any secondary contact channels 5. Solve abuse and give feedback on actions taken Nice work @ipregistryco !

#Phishing against #Twitch observed. twitch-community-guidelines[.]web[.]app Asks for user details Asks for user password (actually twice with automatic fail on first submit) Asks for user 2FA Redirects to safety.twitch.tv

For several years I have been using the ArrayThis website by populu[.]com Sadly it has been compromised by #ApateWeb malware (for months) and the owner does not react to my reports. So I decided to fire up #AI to create my own #opensource clone. https://gi7w0rm.github.io/ArrayThisClone/

91 additional domains identified, because this idiot tried to target me: gist.githubusercontent.com/Gi7w0rm/f55b...

Damn, they really use "3D Security" for this website where I just won the iPhone 16 Pro ^^ Just need to give them my creditcard for this free, totally legitimate gift. So cooooool 😱

Upcoming feature for teletoken.info (andvanced info page): Get all sources I observed related to a Telegram bot token. See images below. This will allow you to pivot from one malicious page or sample to additional ones using the same Telegram bot token, tying the threat actor to additional attacks.

Just handed in my bachelor thesis. One more presentation and I am done with my degree.

Exploring the cross-posting capabilities between X, Bluesky, and Mastodon. Thrilled to have you all here, my dear followers!