你可能會喜歡
BTMOB is one of the Android banking trojans responsible for significant financial losses to Brazil’s banking sector by enabling fraudulent PIX transactions.
1/ Found an Android BroadcastReceiver (adapter.differentiator.decoder.alarme) that listens for a custom action and spawns a background thread to restart hidden services. Behavior: receives MY_CUSTOM_ACTION ➡️ spawns thread ➡️ conditionally starts two obfuscated services A…
🇧🇷BTMOB custom module: sets up OkHttp WebSocket C2, pings/redirects C2, then executes JSON-driven ops: screen stream/control, mic capture, file search/move/upload (chunked b64 + ZIP), browser/notification/lock overlays, call-forwarding, local proxy, terminal shell, and injection…
![Merlax_'s tweet image. #Malware #Android - BTMOB 🧑🎄
Apuntando a Brasil 🇧🇷🎯
Site
hxxps://191[.]101[.]131[.]165/magia-cristalina/
C2
hxxp://209[.]50[.]227.162/yaarsa/private/yarsap_80541.php
209[.]50[.]227[.]162:8080](https://pbs.twimg.com/media/G202U27WsAAw9L0.png)
![Merlax_'s tweet image. #Malware #Android - BTMOB 🧑🎄
Apuntando a Brasil 🇧🇷🎯
Site
hxxps://191[.]101[.]131[.]165/magia-cristalina/
C2
hxxp://209[.]50[.]227.162/yaarsa/private/yarsap_80541.php
209[.]50[.]227[.]162:8080](https://pbs.twimg.com/media/G202YdTWMAAaKS2.png)
![Merlax_'s tweet image. #Malware #Android - BTMOB 🧑🎄
Apuntando a Brasil 🇧🇷🎯
Site
hxxps://191[.]101[.]131[.]165/magia-cristalina/
C2
hxxp://209[.]50[.]227.162/yaarsa/private/yarsap_80541.php
209[.]50[.]227[.]162:8080](https://pbs.twimg.com/media/G204vGWWkAAMTi5.png)
![Merlax_'s tweet image. #Malware #Android - BTMOB 🧑🎄
Apuntando a Brasil 🇧🇷🎯
Site
hxxps://191[.]101[.]131[.]165/magia-cristalina/
C2
hxxp://209[.]50[.]227.162/yaarsa/private/yarsap_80541.php
209[.]50[.]227[.]162:8080](https://pbs.twimg.com/media/G204zFJXMAArMDc.png)
Another Brazilian #Magecart observed: first GTM (dropper) spawns a second GTM (maps dataLayer: products, InitiateCheckout, Purchase) then a typo-squatted CDN loads a skimmer that hooks payment inputs for exfiltration. #CTI #LATAM
POST /api/event?event=pwaOpen HTTP/2 Host: nubanktrading[.]site Cookie: piuiding6cq=xxxxxxxxxxxxxxxx; pcpn4bdt0w=pwa; pwaid5n52de=xxxxxxxxx; splitidfnp8kv=-1; fpvdate1uehvj=2025-10-06; sdata6yo0lp=xxxxxxxxxxxxxxxx Origin: https://nubanktrading[.]site Referer:…
![SwitchToThread's tweet image. POST /api/event?event=pwaOpen HTTP/2
Host: nubanktrading[.]site
Cookie: piuiding6cq=xxxxxxxxxxxxxxxx; pcpn4bdt0w=pwa; pwaid5n52de=xxxxxxxxx; splitidfnp8kv=-1; fpvdate1uehvj=2025-10-06; sdata6yo0lp=xxxxxxxxxxxxxxxx
Origin: https://nubanktrading[.]site
Referer:…](https://pbs.twimg.com/media/G2nPCqTWIAAjoae.jpg)
🇧🇷 #phishing Nubank atendimentonubank[.]site avalaianubank[.]site checkout-nubank[.]online comprovantenubank[.]online indeniza-nubank[.]site indenizacaonubank[.]site indenizacaonubankoficial[.]online indenizanubank[.]online indenizanubank[.]shop indenizanubank[.]site…
![SwitchToThread's tweet image. 🇧🇷 #phishing Nubank
atendimentonubank[.]site
avalaianubank[.]site
checkout-nubank[.]online
comprovantenubank[.]online
indeniza-nubank[.]site
indenizacaonubank[.]site
indenizacaonubankoficial[.]online
indenizanubank[.]online
indenizanubank[.]shop
indenizanubank[.]site…](https://pbs.twimg.com/media/G2nIZhjWsAAI6fj.jpg)
🇧🇷 #phishing Nubank atendimentonubank[.]site avalaianubank[.]site checkout-nubank[.]online comprovantenubank[.]online indeniza-nubank[.]site indenizacaonubank[.]site indenizacaonubankoficial[.]online indenizanubank[.]online indenizanubank[.]shop indenizanubank[.]site…
🇧🇷Scammers are impersonating Serasa and asking victims to make a PIX payment to “clear their name.” ▶️Destination { "type": "dynamic", "merchantCategoryCode": "0000", "transactionCurrency": 986, "countryCode": "BR", "merchantName": "AGILE LTDA", "merchantCity":…
🇧🇷 #phishing Uma nova e sofisticada campanha de phishing está circulando na internet, utilizando a marca e o prestígio de um marketplace famoso para enganar usuários com a promessa de um cartão de crédito nível “gold” com limite pré-aprovado de R$ 4.700,00 e zero anuidade. O…
United States 趨勢
- 1. Deport Harry Sisson 9,959 posts
- 2. DuPont 1,915 posts
- 3. #PokemonZA 2,093 posts
- 4. Deloitte 7,534 posts
- 5. #EliraGotCake2025 8,873 posts
- 6. #PokemonLegendZA 1,809 posts
- 7. Gabe Vincent 4,200 posts
- 8. Angel Reese 54.3K posts
- 9. Lakers 18.4K posts
- 10. tzuyu 259K posts
- 11. #ENHYPEN 108K posts
- 12. Domain For Sale 19.6K posts
- 13. #Blackhawks 2,195 posts
- 14. Mad Max 4,049 posts
- 15. Mavs 5,742 posts
- 16. Everest 3,538 posts
- 17. Blues 20.4K posts
- 18. Birdman 5,585 posts
- 19. Britney 22.9K posts
- 20. Fast Times 1,618 posts
你可能會喜歡
-
Alexandre Borges
@ale_sp_brazil -
Arkbird
@Arkbird_SOLG -
Joe Security
@joe4security -
Dee
@ViriBack -
Pavel Yosifovich
@zodiacon -
Frost
@fr0s7_ -
neonprimetime
@neonprimetime -
Ring3API 🇺🇦
@ntlmrelay -
avman
@avman1995 -
Joe Roosen
@JRoosen -
JAMESWT
@JAMESWT_WT -
Frank Boldewin
@r3c0nst -
Sinaei
@Intel80x86 -
Artsiom Holub
@Mesiagh -
marc ochsenmeier
@ochsenmeier
Something went wrong.
Something went wrong.