‼️ BREAKING: Anthropic has embedded hidden spyware-like code in Claude Code that covertly targets Chinese users. It then sends information regarding every user by injecting it into their prompt message. Claude Code is sending info like timezone, proxy and possible AI Lab connections into the system prompt in ways Chinese users can't notice. A coding agent with repo and command permissions should not silently hide routing metadata inside prompts. This is a serious breach of user trust.

‼️ Meet the scammer who drained a cancer patient's treatment fund, ruining many lives to drive sports cars and wear expensive watches. He is an Argentine immigrant in the US, and the OSINT nerds who found him have reported him to ICE.

‼️🇰🇵 Another North Korean hacker using AI to alter his face caught while trying to infiltrate Bitso. Meet "Sebastian," a software engineer from Colombia who can't speak Spanish. Strange, right?

🚨 vx-underground reverse-engineered the malware that stole $32k donated to Rastaland for his cancer fight. They uncovered the entire infrastructure, operations, the people that fell victim, and people behind it.

‼️ China's largest cybersecurity firm, Knownsec, was breached, exposing details of China's state cyber operations. The data includes cyberweapon documentation, internal hacking tool source code, and global target lists covering over 20 countries, including Japan, Vietnam, and India. A spreadsheet lists 80 hacked foreign organizations, plus evidence of 95 GB of stolen Indian immigration data and 3 TB of call records from South Korean mobile operator LG U Plus. One of the documents mention a malicious power bank, disguised as a charging device. Knownsec is key to China's cybersecurity, providing advanced defense and offensive capabilities, including espionage tools. A thread with their tools 🧵

🚨 Multiple cybercriminals were arrested during Operation SIMCARTEL. Europol and Latvian law enforcement dismantled five servers, seized 1,200 SIM box devices and 40,000 active SIM cards. The criminals were linked to over 1,700 cyber fraud cases in Austria and 1,500 in Latvia, causing losses of several million euros, including EUR 4.5 million in Austria and EUR 420,000 in Latvia.

‼️ Proton is cancelling journalists by blocking their mail accounts. This has huge consequences for their reputation and for all the people who thought they were safe by avoiding big tech.

🚨 The Discord breach is worse than expected! - 1.5 TB of data - Over 2 million government ID photos - Threat actor publishes some user data due to Discord's inaction Sample of a user showing her face, ID, and a written note:

‼️An Anduril engineer uploaded a hardcoded private key, hashed root passwords, and internal Anduril emails to a public repository. We sent a responsible disclosure to Anduril last year but received no reply. This company is currently operating autonomous killer drones above your head.

🚨 The friend pendant is not your friend Someone reverse-engineered the device, exposing lack of basic security: - Anyone can connect via Bluetooth and hear the microphone's recordings - Friend's audio is unencrypted. - Audio can be accessed on non onboarded devices as well

🚨 Discord Breach Update - Discord negotiated with the threat actor for two weeks, promising payment. - Discord then ceased communication. - The threat actor, now angry, is releasing files individually. Leaked tables will be posted next.

‼️ X preloads links without user clicks, raising serious cybersecurity and OPSEC concerns. Malicious code could load automatically, or your identity could be exposed to malicious actors.

❗️🐭 Your gaming mouse might be eavesdropping due to a critical vulnerability named Mic-E-Mouse.

❌ Vercel’s new head of security is off to a good start with all his personal information uploaded into a folder on his website.

‼️ North Korean hackers from the Chollima APT, part Lazarus, were caught. Meet Mateo and Alfredo, skilled engineers, allegedly from Mexico. But actually North Korean hackers.They were caught using AI to alter their faces and voices during a job interview. Their goal was to infiltrate Western companies, especially in crypto, Web3, and fintech, posing as software engineers for corporate espionage and financial theft.

🚨 Discord Breach Update Discord maintained a list of accounts that agents were instructed not to interact with, directing them to quietly close tickets without response. Source: NTTS

This is so true 😂

🚨 U.S. Secret Service dismantled a massive SIM network in NYC — 300+ servers & 100K SIM cards capable of crippling telecoms & launching anonymous attacks — neutralized just before world leaders arrived for the UN General Assembly.

Meet the women of Conti ransomware group. 💅

🚨🚨🚨 Google has issued a global security alert advising its 2.5 billion Gmail users to update their passwords following a data breach involving one of its Salesforce databases.

The entire cybersecurity community right now.

🚨🔓 @elonmusk won't like this one: @Tesla data has been leaked by @IntelBrokerBF. In an exclusive interview with International Cyber Digest IntelBroker told us "It was really bizarre how we found it". 🧵1/3

Ladies and gentlemen, we present to you Conti Ransomware group 💀

‼️ Meet Ryan Clifford Goldberg, a Digital Forensics and Incident Response manager at Sygnia, he is one of three insiders accused of cybercrimes. He allegedly conducted cyberattacks using ALPHV BlackCat ransomware. Goldberg and two other insiders ran ransomware operations since 2023 while employed at cybersecurity firms. After an FBI visit, Goldberg confessed. He now faces up to 50 years in prison.

‼️🚨 Red Hat breached: Crimson Collective stole 28k private repositories, including credentials, CI/CD secrets, pipeline configs, VPN profiles, and infrastructure blueprints. Our analysis of obtained data: 👇

‼️ Discord Breach Update vx-u discovered how the threat actor accessed Discord's Zendesk environment. "...the Threat Actors...began sending emails to Discord outsourced [Southeast Asia] employees offering them money [500 USD] in exchange for access to Discords internals."

🔑 Scattered LAPSUS$ hunters claim that the password of Mandiant's CEO was 'batman'.

‼️ Chinese hackers were caught and sentenced in Singapore. A police raid on their Mount Sinai bungalow uncovered malware, including RATs linked to PlugX and Shadow Brokers, and foreign government data. They were hired to hack and paid US$3 million in cryptocurrency.

🚨📧 This is how the npm attackers gained access to maintainer accounts and uploaded their malicious code. Can you spot what's wrong?

LOL. Diversity is practically what survival of the fittest is all about. More diversity equals a higher chance of survival.

Bro is scraping websites without consent and complaining that Hetzner is protecting its infrastructure and IP addresses from blacklisting. It's surprising he hasn't been banned yet. @Hetzner_Online Lea, did you see this?

‼️ After posting their goodbye note on BreachForums, Scattered Lapsus$ Hunters provided proof of access to FBI NICS (background check) and Google LERS (Law Enforcement Request System).

cc @Steam stop hosting malware.

🚨 Breach alert: Attackers claim live access to AT&T infrastructure. Alleged impact: enables SIM-swapping, reading SMS 2FA codes, and accessing a database with ~24M AT&T customer records.

Happy beginnings. Sad endings. Don't do cybercrime, kids.

🚨Two 17-year-old Dutch teenagers were arrested for performing Russian espionage. They used a Wi-Fi sniffer near Europol, Eurojust, and the Canadian Embassy. Recruited via Telegram by a pro-Russian hacker, one is now detained for 14 days, the other is placed under house arrest with an ankle monitor. The father of one, shocked, described his son as a computer-savvy gamer with no worldly interests. The arrests followed a tip from Dutch intelligence (AIVD), this is the first known case of minors recruited by a foreign power in the Netherlands.

‼️The guy who reverse-engineered friend just deleted the thread explaining all the vulnerabilities. Possibly he’s being pressured. Anyway, we've documented them for you.

❗️ The threat actor quotes Discord's official statement on government-ID image numbers, then taunts and reveals the actual figures.

🚨 BREAKING: Here's a statement from Valentin, identified by OSINT nerds as the scammer allegedly draining cancer treatment funds. Do you think he's telling the truth?

🚨 Very concerning 0-click zero-day vulnerability for sale: allows unauthenticated attackers to execute arbitrary code with SYSTEM-level privileges on fully patched Windows 10/11 and Windows Server 2022 systems. The exploit is “reliable, low-resource, and bypasses the latest security mitigations.” Price: 25k POC:

‼️ Discord was breached two weeks ago. Attackers accessed government ID photos, contact details, payment info, and more. We noticed Discord is sending different emails; we found two versions.

❗ The developer of the @NeoFreeBird app, which reverses X's Twitter branding and unlocks premium features for free, was invited by an X engineer to join X. Unbeknownst to the engineer, the developer, whose app removes X's branding and who displays a rainbow flag in his bio, would clearly never work for Musk.

🚨‼️ Israeli defense contractor breached Cyber Toufan, allegedly an Iranian state actor, just released security cam footage of defense contractor Maya. The cameras seem located in a meeting room (!) and a workshop. There are hours of footage of confidential conversations in the meeting room. We can see them working on weapons prototypes/mockups of: - drones - missiles - tracking and launching systems

Is this true, @discord? Why would you keep information like this stored after confirmation of age?

‼️ Unremovable Israeli Spyware Found on Samsung Devices Samsung faces backlash over AppCloud, an Israeli-developed app pre-installed on budget Galaxy A and M series devices. Investigations reveal the app is embedded in the operating system, preventing full removal. Even when disabled, AppCloud remains on the device, reappears after updates, and can covertly install additional software.

Let's not forget when @ProtonPrivacy shared the IP address of a French activist with authorities. The company has widely claimed that it doesn't log users' IP addresses. Weird, huh?

🚨 We've confirmed in a VM that this PoC suspends EDR, we've tested it on Defender. EDR-Freeze: A tool that puts EDRs and antivirus into a coma state.

ICE ICE BABY.

UPDATE: About those 12,000 files that allegedly leaked from the security firm Knownsec (知道创宇) onto GitHub: Here's what we know so far from public reporting, company statements, and translated Chinese forum posts. No independent sources confirm the quantity posted in many articles we came across. On 31-10-2025, a user created a thread on a known illegal marketplace for an "exclusive sale of KNOWNSEC Chinese infosec company data." This thread had the same screenshots attached that were circulating on several social media platforms three days later. The thread owner updated the post on 02 Nov 2025 12:51 GMT, adding more samples by linking to the image-sharing host ibb[.]co. The metadata of images uploaded to this host reveal that the user uploaded a total of 63 images between Sun, 02 Nov 2025 12:35:00 and 12:35:48 GMT. Some of the images first publicly surfaced the day after in a blog post authored by a user who goes by "netaskari." On 05-11-2025, several security-focused WeChat accounts reported a Knownsec (知道创宇) leak, suggesting that an insider was involved. We've seen claims that accounts on WeChat had specific data altered or removed. On 07-11-2025, another update on the illegal market followed, in which the thread owner stated that they had sold the data and that it would no longer be for sale. According to Security419 (据安全419), the underlying intrusion occurred in 2023 via a 0-day vulnerability within the infrastructure of a "third-party cloud desktop provider," affecting a limited number of employee cloud desktops. Knownsec further mentions that its honeypot detected the activity in 2023, and their IR team contained, cleaned, and traced it. We found no evidence that supports a more recent breach. Reported scope (per Knownsec): "employee contact lists, internal training materials, a subset of customer names, and dark-web monitoring/early-warning data." Knownsec also reported that its business systems are stable, that the 2023 incident has been closed, and that it has been in contact with the relevant regulators. Besides several mentions that the company's data had leaked onto GitHub, thorough OSINT does not reveal any such repository has been reported on. Given the timeline of events, we firmly believe this to be false. As the first post in the GitHub leak got published by an outlet that describes itself as an Artificial Intelligence-Driven Media Outlet, we believe the event was confused with another Chinese leak, the "I-Soon" leak, which actually occurred on GitHub and received a TOS takedown shortly after.

❗️ More photos from the raid.

‼️ The $1M zero-click WhatsApp RCE demo planned for Pwn2Own Ireland 2025 was canceled. "they did not feel their research was ready to publicly demonstrate" 👀 What is really going on here?

Context:

❗️We spotted another case of Proton disabling mails. This time they pulled the plug on a paying customer with premium account.

🛠️ PoC CVE-2025-32463 LPE→Root Local Privilege Escalation to Root via Sudo chroot in Linux github.com/kh4sh3i/CVE-2025-…

🚨 Meet Sevy aka Darya, a member of Scattered LAPSUS$ Shiny Hunters and an admin of their Telegram group. She is a Russian national living in Turkey and a drug addict who commits crimes to support her addiction.

🚨 Hacking the Airport X-Ray Machine: 11 Vulnerabilities in a Popular Scanner Security researcher Felix Zuber shares his findings from penetration testing the populair Smiths Detection HI-SCAN 6040i X-ray machine. The process includes analysis, threat modeling, attack vector mapping, exploitation, and a list of discovered vulnerabilities. This is reportedly the first public pentest of an airport X-ray scanner.

@vxunderground notes that this was not only his effort: Here are the cool and badass people I worked with: - @zachxbt - @John5725424446 - @andreee_eeeeee - @escrow_ - @C4L38 - @downsin - "J" - Random nerds who provided "tips" to us

Some photo's of Zhdanova and Beketova from Conti ransomware group 💋💅

When not scamming people, he enjoys making brainless TikTok videos with his girlfriend.

‼️ An AI gun detection system, @Omnilert, flagged a teen holding a bag of chips as a gunman. "I was holding a Doritos bag with two hands and one finger out, and they thought it was a gun." "Eight cop cars pulled up. They approached me with guns, shouting, 'Get on the ground,' and I was confused." "They searched me and found nothing."

✅ Vercel's new head of security deleted the file with his personal information after our post. Glad we could teach him about OpSec.

🛠️ KeyloggerScreenshot Tool for comprehensive surveillance: record keystrokes, screenshots, mouse clicks & audio. Try: github.com/Kill0geR/Keylogge…

☠ Lenovo CVE-2025-8061 Exploit PoC and write-up for shell popping against LnvMSRIO.sys (3.1.0.36) driver. Try: github.com/symeonp/Lenovo-CV…

Conti ransomware group lives extravagantly in Dubai, enjoying the yacht lifestyle.

❗️JUST IN: CL0P ransomware group allegedly leaked Oracle source code online.

‼️ Iranian nation-state APT CharmingKitten exposed on GitHub. Exposure includes: - Official APT internal network documents - Employee photos - Attack reports - Translation documents - Internal chat files

The threat actor told us about Discord that "they do not purge the tickets after resolution btw"

🛠️ HikvisionExploiter HikvisionExploiter is a powerful and automated exploitation toolkit targeting unauthenticated endpoints on Hikvision IP cameras, particularly those running firmware version 3.1.3.150324. github.com/HexBuddy/Hikvisio…

vx-underground found a .bat file in the game files that searches for browser credentials and crypto wallets.

❗️ Bloomberg interviewed Scattered Spider member Noah Urban. He justified his actions because he “just wanted financial freedom”. He was a millionaire before 18 and sentenced to 10 years at 20.

‼️ The Iranian state actor is releasing more footage We can see they’re developing parts for what seems to be weapon systems. We can also see they expanded their operation this year by adding multiple Bambu Lab X1C printers to their arsenal.

💭 The one on the left lost everything, harmed no one, and shows kindness. The one on the right has everything—a dream jawline, a pretty face, a nice girlfriend—but still chose to steal from the one on the left. What a world we live in... Take care of each other.

‼️ It's absurd how Proton bashes other companies when they themselves mingle with government entities and process batch scripts from them that deactivate journalists' accounts without asking a single word.

❗️I remember Anonymous back in the day — it used to be a community of highly intellectual individuals who came together to share knowledge and help each other. They actually stood on moral high ground. Now they’ve become a joke. When did they turn into n00bs?

Lastly, @vxunderground identified the campaign's orchestrator, who is already celebrating their victims and splurging on champagne and parties!

📚 Zero-Day in TP-Link AX10 Router (CVE-2025-9961) Exploiting a zero-day vulnerability in the TP-Link AX10 router. Read: blog.byteray.co.uk/8745f9af9…

‼️ Iranian nation-state APT CharmingKitten exposed on GitHub: Episode 3! - BellaCiao malware samples - Google Drive phishing guides - Malware usage guides - Malware specification sheets & MORE!

The threat actor writes: "its funny how discord tried to phrase this as a "third party vendor" incident when a majority of the blame falls directly on them"

The Drainer malware spread through Steam via a game called Block Blasters.

‼️ Meet the Chinese man who has sold over 6,500 counterfeit licenses to Americans and Canadians, making over $750k. He used more than 83 domains and multiple social media accounts to promote his services.

🚨BREAKING: Trump’s Treasury Secretary just leaked a warning text from Ag Sec Brooke Rollins: “Argentina sold soy to China… this gives China more leverage over us.” What iPhone is he using—and which version of iOS?

❗ Microsoft disables File Explorer previews Microsoft announced that File Explorer (formerly Windows Explorer) will now automatically block file previews for items downloaded from the Internet. The change is designed to prevent credential theft attacks delivered through malicious documents.

‼️🇰🇵 And another North Korean state-sponsored hacker caught trying to get that sweet Western money for the great, yet petty, Kim Jong-un. Meet “Jesús Sebastián” from Barranquilla, Colombia. Does he speak Spanish? I don’t think so.

vx-underground retrieved logs and infrastructure data of the criminals, including details on 970 victims.

He found their Telegram credentials hardcoded in the drainer and used them to investigate their operation.

“Yep, that’s me. You’re probably wondering how I got into this situation …”

🛠️ BreachForums Database Search OSINT Tool Search a BreachForums username to view linked data: profile details, emails, historical IPs, and posts. Perfect for attribution and threat research. Try: bf.based.re

I thought they married us because of our LEGO collection.

🚨 The Iranian nation-state actor claims to have had access to defense companies Elbit and Rafael, and more, allegedly through an FTP server. They're now sharing blueprints of what seem to be rocket castings from Rafael. This is really painful to watch.

Living the fast life... until some nerds catch up to you.

🚨 F5 breached by nation-state threat actor; attackers stole BIG-IP source code and vulnerability data. Read the official statement: my.f5.com/manage/s/article/K…

🤐 We are reposting the article that got Phrack zine banned from Proton, because @ProtonPrivacy is trying to silence them. This is not only their story. This is also our story. We will not be silenced.

🛠️ RealBlindingEDR Kernel-level AV/EDR removal for red teams. Advanced evasion methods in one toolkit. Try: github.com/myzxcg/RealBlindi…

🛠️ Al-Khaser A PoC "malware" application with good intentions that aims to stress your anti-malware system. It performs a bunch of common malware tricks with the goal of seeing if you stay under the radar. Try: github.com/ayoubfaouzi/al-kh…

🚨 Vulnerabilities were discovered in Microsoft’s Defender for Endpoint's Cloud Communication Microsoft says no biggie and didn’t fix. Impact = authentication bypass, data/command spoofing, information disclosure, and the ability to upload malicious files to investigation packages destined for security analysts.

📚 AD Domain-Join Owning PoC Compromising the Active Directory through domain-join account attacks in 2025. Read: shelltrail.com/research/acti…

❌ Block .SVG attachments on your mail server. Thank us later.

🚨 Discord breach data is allegedly being used in an email scam campaign. Reddit users report receiving unsolicited Zendesk support tickets sent from official email addresses belonging to Tinder, Zendesk, Kahoot, and other major brands. A Zendesk vulnerability being exploited?

🍿 We just received a screenshot of a chat allegedly showing @phantom's head of security picking a fight with Scattered Lapsus$ ShinyHunters saying "We also operate in Russia"... implying they'll be caught soon.