unpack64

@SwitchToThread

Joined April 2013

34Posts 14KFollowers 5KFollowing

You might like

@ale_sp_brazil

@Arkbird_SOLG

@joe4security

@ViriBack

@zodiacon

@fr0s7_

@neonprimetime

@ntlmrelay

@avman1995

@JRoosen

@JAMESWT_WT

@r3c0nst

@Intel80x86

@Mesiagh

@ochsenmeier

unpack64

@SwitchToThread

11 h

BTMOB is one of the Android banking trojans responsible for significant financial losses to Brazil’s banking sector by enabling fraudulent PIX transactions.

SwitchToThread's tweet image. BTMOB is one of the Android banking trojans responsible for significant financial losses to Brazil’s banking sector by enabling fraudulent PIX transactions.

unpack64

@SwitchToThread

12 h

1/ Found an Android BroadcastReceiver (adapter.differentiator.decoder.alarme) that listens for a custom action and spawns a background thread to restart hidden services. Behavior: receives MY_CUSTOM_ACTION ➡️ spawns thread ➡️ conditionally starts two obfuscated services A…

SwitchToThread's tweet image. 1/ Found an Android BroadcastReceiver (adapter.differentiator.decoder.alarme) that listens for a custom action and spawns a background thread to restart hidden services. Behavior:

receives MY_CUSTOM_ACTION ➡️ spawns thread ➡️ conditionally starts two obfuscated services

A…

unpack64 reposted

Johnk3r

Oct 14

One analyzed C2 shows ~2,000 potential victims @dodo_sec @1ZRR4H @Merlax_

johnk3r's tweet image. One analyzed C2 shows ~2,000 potential victims

@dodo_sec @1ZRR4H @Merlax_

unpack64

@SwitchToThread

Oct 9

🇧🇷BTMOB custom module: sets up OkHttp WebSocket C2, pings/redirects C2, then executes JSON-driven ops: screen stream/control, mic capture, file search/move/upload (chunked b64 + ZIP), browser/notification/lock overlays, call-forwarding, local proxy, terminal shell, and injection…

SwitchToThread's tweet image. 🇧🇷BTMOB custom module: sets up OkHttp WebSocket C2, pings/redirects C2, then executes JSON-driven ops: screen stream/control, mic capture, file search/move/upload (chunked b64 + ZIP), browser/notification/lock overlays, call-forwarding, local proxy, terminal shell, and injection…

Merl

Oct 9

#Malware #Android - BTMOB 🧑‍🎄 Apuntando a Brasil 🇧🇷🎯 Site hxxps://191[.]101[.]131[.]165/magia-cristalina/ C2 hxxp://209[.]50[.]227.162/yaarsa/private/yarsap_80541.php 209[.]50[.]227[.]162:8080

Merlax_'s tweet image. #Malware #Android - BTMOB 🧑‍🎄

Apuntando a Brasil 🇧🇷🎯

Site
hxxps://191[.]101[.]131[.]165/magia-cristalina/

C2
hxxp://209[.]50[.]227.162/yaarsa/private/yarsap_80541.php
209[.]50[.]227[.]162:8080

Merlax_'s tweet image. #Malware #Android - BTMOB 🧑‍🎄

Apuntando a Brasil 🇧🇷🎯

Site
hxxps://191[.]101[.]131[.]165/magia-cristalina/

C2
hxxp://209[.]50[.]227.162/yaarsa/private/yarsap_80541.php
209[.]50[.]227[.]162:8080

Merlax_'s tweet image. #Malware #Android - BTMOB 🧑‍🎄

Apuntando a Brasil 🇧🇷🎯

Site
hxxps://191[.]101[.]131[.]165/magia-cristalina/

C2
hxxp://209[.]50[.]227.162/yaarsa/private/yarsap_80541.php
209[.]50[.]227[.]162:8080

Merlax_'s tweet image. #Malware #Android - BTMOB 🧑‍🎄

Apuntando a Brasil 🇧🇷🎯

Site
hxxps://191[.]101[.]131[.]165/magia-cristalina/

C2
hxxp://209[.]50[.]227.162/yaarsa/private/yarsap_80541.php
209[.]50[.]227[.]162:8080

unpack64 reposted

eremit4

Oct 8

Another Brazilian #Magecart observed: first GTM (dropper) spawns a second GTM (maps dataLayer: products, InitiateCheckout, Purchase) then a typo-squatted CDN loads a skimmer that hooks payment inputs for exfiltration. #CTI #LATAM

_eremit4's tweet image. Another Brazilian #Magecart observed: first GTM (dropper) spawns a second GTM (maps dataLayer: products, InitiateCheckout, Purchase) then a typo-squatted CDN loads a skimmer that hooks payment inputs for exfiltration. #CTI #LATAM

_eremit4's tweet image. Another Brazilian #Magecart observed: first GTM (dropper) spawns a second GTM (maps dataLayer: products, InitiateCheckout, Purchase) then a typo-squatted CDN loads a skimmer that hooks payment inputs for exfiltration. #CTI #LATAM

unpack64

@SwitchToThread

Oct 6

POST /api/event?event=pwaOpen HTTP/2 Host: nubanktrading[.]site Cookie: piuiding6cq=xxxxxxxxxxxxxxxx; pcpn4bdt0w=pwa; pwaid5n52de=xxxxxxxxx; splitidfnp8kv=-1; fpvdate1uehvj=2025-10-06; sdata6yo0lp=xxxxxxxxxxxxxxxx Origin: https://nubanktrading[.]site Referer:…

SwitchToThread's tweet image. POST /api/event?event=pwaOpen HTTP/2
Host: nubanktrading[.]site
Cookie: piuiding6cq=xxxxxxxxxxxxxxxx; pcpn4bdt0w=pwa; pwaid5n52de=xxxxxxxxx; splitidfnp8kv=-1; fpvdate1uehvj=2025-10-06; sdata6yo0lp=xxxxxxxxxxxxxxxx
Origin: https://nubanktrading[.]site
Referer:…

unpack64

@SwitchToThread

Oct 6

🇧🇷 #phishing Nubank atendimentonubank[.]site avalaianubank[.]site checkout-nubank[.]online comprovantenubank[.]online indeniza-nubank[.]site indenizacaonubank[.]site indenizacaonubankoficial[.]online indenizanubank[.]online indenizanubank[.]shop indenizanubank[.]site…

SwitchToThread's tweet image. 🇧🇷 #phishing Nubank

atendimentonubank[.]site
avalaianubank[.]site
checkout-nubank[.]online
comprovantenubank[.]online
indeniza-nubank[.]site
indenizacaonubank[.]site
indenizacaonubankoficial[.]online
indenizanubank[.]online
indenizanubank[.]shop
indenizanubank[.]site…

unpack64

@SwitchToThread

Oct 6

🇧🇷 #phishing Nubank atendimentonubank[.]site avalaianubank[.]site checkout-nubank[.]online comprovantenubank[.]online indeniza-nubank[.]site indenizacaonubank[.]site indenizacaonubankoficial[.]online indenizanubank[.]online indenizanubank[.]shop indenizanubank[.]site…

SwitchToThread's tweet image. 🇧🇷 #phishing Nubank

atendimentonubank[.]site
avalaianubank[.]site
checkout-nubank[.]online
comprovantenubank[.]online
indeniza-nubank[.]site
indenizacaonubank[.]site
indenizacaonubankoficial[.]online
indenizanubank[.]online
indenizanubank[.]shop
indenizanubank[.]site…

unpack64

@SwitchToThread

Oct 4

🇧🇷Scammers are impersonating Serasa and asking victims to make a PIX payment to “clear their name.” ▶️Destination { "type": "dynamic", "merchantCategoryCode": "0000", "transactionCurrency": 986, "countryCode": "BR", "merchantName": "AGILE LTDA", "merchantCity":…

SwitchToThread's tweet image. 🇧🇷Scammers are impersonating Serasa and asking victims to make a PIX payment to “clear their name.”

▶️Destination

{
"type": "dynamic",
"merchantCategoryCode": "0000",
"transactionCurrency": 986,
"countryCode": "BR",
"merchantName": "AGILE LTDA",
"merchantCity":…

SwitchToThread's tweet image. 🇧🇷Scammers are impersonating Serasa and asking victims to make a PIX payment to “clear their name.”

▶️Destination

{
"type": "dynamic",
"merchantCategoryCode": "0000",
"transactionCurrency": 986,
"countryCode": "BR",
"merchantName": "AGILE LTDA",
"merchantCity":…

SwitchToThread's tweet image. 🇧🇷Scammers are impersonating Serasa and asking victims to make a PIX payment to “clear their name.”

▶️Destination

{
"type": "dynamic",
"merchantCategoryCode": "0000",
"transactionCurrency": 986,
"countryCode": "BR",
"merchantName": "AGILE LTDA",
"merchantCity":…

unpack64

@SwitchToThread

Oct 3

🇧🇷 #phishing Uma nova e sofisticada campanha de phishing está circulando na internet, utilizando a marca e o prestígio de um marketplace famoso para enganar usuários com a promessa de um cartão de crédito nível “gold” com limite pré-aprovado de R$ 4.700,00 e zero anuidade. O…

SwitchToThread's tweet image. 🇧🇷 #phishing Uma nova e sofisticada campanha de phishing está circulando na internet, utilizando a marca e o prestígio de um marketplace famoso para enganar usuários com a promessa de um cartão de crédito nível “gold” com limite pré-aprovado de R$ 4.700,00 e zero anuidade. O…

SwitchToThread's tweet image. 🇧🇷 #phishing Uma nova e sofisticada campanha de phishing está circulando na internet, utilizando a marca e o prestígio de um marketplace famoso para enganar usuários com a promessa de um cartão de crédito nível “gold” com limite pré-aprovado de R$ 4.700,00 e zero anuidade. O…

SwitchToThread's tweet image. 🇧🇷 #phishing Uma nova e sofisticada campanha de phishing está circulando na internet, utilizando a marca e o prestígio de um marketplace famoso para enganar usuários com a promessa de um cartão de crédito nível “gold” com limite pré-aprovado de R$ 4.700,00 e zero anuidade. O…

unpack64

@SwitchToThread

Oct 2

🇧🇷 "Login - VR Benefícios" hxxps://acesso-portal-vr-empresa.site/login #phishing

SwitchToThread's tweet image. 🇧🇷 "Login - VR Benefícios"
hxxps://acesso-portal-vr-empresa.site/login
#phishing

Florian Roth ⚡️

@cyb3rops

chompie

@chompie1337

Grzegorz Tworek

@0gtweet

Thomas Roccia 🤘

@fr0gger_

Germán Fernández

@1ZRR4H

Michael Koczwara

@MichalKoczwara

blackorbird

@blackorbird

Justin Elze

@HackingLZ

ςεяβεяμs - мαℓωαяε яεsεαяςнεя

@c3rb3ru5d3d53c

Clandestine

@akaclandestine

Karsten Hahn

@struppigel

JAMESWT

@JAMESWT_WT

Ali Hadi | B!n@ry

@binaryz0ne

Max_Malyutin

@Max_Mal_

Will

@BushidoToken

James

@James_inthe_box

Pavel Yosifovich

@zodiacon

Josh Stroschein | The Cyber Yeti

@jstrosch

Matthew

@embee_research

abuse.ch

@abuse_ch

Issac Kertzmann

@IKertzmann47584

Mathew Ryan

@Matty_Ryans

Autodidac

@Autodidac178306

Eefroovaws

@Eefroovaws3161

toriiii

@Victoriawently

𝓔.

@_ernikaas

b_coke🫦

@b_cokeeea

sophia 🐢

@sophiaathena64

JEFÉ 💰

@DariussDavissx

xbe

@dsb718

Ingrid-Mari

@beloved_xza0258

christianbj87

@christianbj87

denemezen

@denemezen123

Charizard Metalúrgico

@metal_chariz

Paulo / Data Scientist

@Paulocsxs

Ycuiro

@Ycuiro5239758

fernando

@fergraz

jony blakk

@jonyblakk

nameless

@bbrroookenn2000

Daniel de Lima Rodrigues

@DanieldeLimaRo8

mr.renolc

@rogcompant

HAIDER

@UzairHaider502

Lucro Trampo

@LucroTrampo

a95m

@A95m0

Gabriel Antunes

@guesant_gabriel

Brandon Martins

@Brandon23828038

Lumi Flow - Dev

@lumiflow_dev

Sergey Makarov

@sergey_0x0

Everson Borges

@eversonb_net

john nunes

@johnnunesc

Mikhael

@MikhaelBitelo

Gango

@sydowDEV

Dieguito

@zer0eum

unknow000

@ouhboyg0d

marcos

@rfxct

Meca

@ddd021hehe

badalotti.dev

@mateusbadalotti

underrated

@sainttvn

str

@edgyzk

Jhemes Silva

@jhemesofc

Matheus Pereira

@mafhper

JV

@joaomaax

Vitor Duggen

@vlduggen

Attonic

@AntonioCleison

deus do aram

@eurangelzin

glock rajada

@cachorr0sfoda

yukii

@yukiigg

noia gata

@nsuzuki_

felipe ✠

@f_tomelin

Loyfus

@Loyfus

Florian Roth ⚡️

@cyb3rops

MalwareHunterTeam

@malwrhunterteam

Nicolas Krassas

@Dinosn

chompie

@chompie1337

Binni Shah

@binitamshah

0xor0ne

@0xor0ne

Florian Hansemann

@CyberWarship

Yarden Shafir

@yarden_shafir

Grzegorz Tworek

@0gtweet

Thomas Roccia 🤘

@fr0gger_

Jiří Vinopal

@vinopaljiri

Germán Fernández

@1ZRR4H

Michael Koczwara

@MichalKoczwara

blackorbird

@blackorbird

Justin Elze

@HackingLZ

inversecos

@inversecos

GuidedHacking

@GuidedHacking

ςεяβεяμs - мαℓωαяε яεsεαяςнεя

@c3rb3ru5d3d53c

Ptrace Security GmbH

@ptracesecurity

hasherezade

@hasherezade

Área Militar

@areamilitarof

Bernardo Quintero

@bquintero

sudox

@kmcnam1

Dynadot 🦾

@Dynadot

Modat

@modat_magnify

Watches of Espionage

@watchesofespion

Molfar

@molfar_agency

Socket

@SocketSecurity

matt godbolt is mostly on bsky these days

@mattgodbolt

Harshleen Chawla

@harshleenchawl2

$Mart07Alex's profile picture. Head of Research and partner @CFOP_ALPHA @cfop_btc\Bringing crypto to the masses$

Alex Mart

@Mart07Alex

Rani

@4484

International Cyber Digest

@IntCyberDigest

Yazidou

@xacone_

Gemini

@Gemini

Magicam

@magicam_ai

YungBinary

@YungBinary

FFmpeg

@FFmpeg

FS-ISAC

@FSISAC

The Vertex Project

@vtxproject

Fatos da Bolsa

@fatosdabolsa

Harborcoat

@Harborcoattech

MOR DAVID

@m0rd4vid

ThreatQuery

@threatquery

Michael Shellenberger

@shellenberger

Myron Aksakov | anonimnyy

@buffaoverflow

AmberWolf

@AmberWolfSec

Sander de Wit

@Sander_deWit

Tal Skverer

@TalSkverer

HackerRalf

@hacker_ralf

Globe Eye News

@GlobeEyeNews

SpiderLabs

@SpiderLabs

Natalia Ariede

@natyariede

APWG

@APWG

Helio Beltrão

@heliobeltrao

Kubernetes

@kubernetesio

CNCF

@CloudNativeFdn

Helm

@HelmPack

Nihad A. Hassan

@DarknessGate

Hackuten

@Hackutendotcom

U.S. Department of Justice

@TheJusticeDept

Winston Ighodaro

@Officialwhyte22

Kunai Project (@[email protected])

@kunai_project

Megatron

@Megatron_ron

Coffin

@coffinxp7

Josh Kamdjou

@jkamdjou

Iran Military Monitor

@IRIran_Military

Haeter, Lu

@haeter525

Amazon Web Services

@awscloud

AWS Support

@AWSSupport

United States Trends

1. #VSFashionShow 167K posts
2. quen 12.7K posts
3. #KaneAI N/A
4. madison 39K posts
5. jihyo 81.4K posts
6. #VictoriasSecretFashionShow 1,882 posts
7. Karol G 23.9K posts
8. tzuyu 73.1K posts
9. Nancy 109K posts
10. #youtubedown 1,276 posts
11. BELLA HADID 8,791 posts
12. Angel Reese 13.3K posts
13. #ARWINGS 3,719 posts
14. Birdman 2,298 posts
15. Argentina 462K posts
16. Supreme Court 142K posts
17. Anok 5,640 posts
18. Jasmine Tookes 4,517 posts
19. Waddle 6,004 posts
20. UTEP 2,535 posts

You might like

Something went wrong.

Something went wrong.