Sign in

crep1x

@crep1x.bsky.social
88 followers 41 following 30 posts

Lead cybercrime analyst, tracking adversaries activities & infrastructure, at @sekoia.io

PostsRepliesMedia
crep1x @crep1x.bsky.social · 16/06/2026
We published an in-depth analysis on the #ErrTraffic framework, detailing two specific clusters ("Beer" and "Analytics"), campaigns compromising WordPress sites to deploy this malicious #ClickFix framework, as well as others impersonating AI platforms ⬇️ x.com/sekoia_io/st...
x.com
Sekoia.io (@sekoia_io) on X
#TDR analysts published a new report detailing #ErrTraffic, a widespread #ClickFix malware distribution framework. ErrTraffic injects malicious JavaScript into compromised WordPress and malicious sit...
100
Reposted by crep1x
Sekoia @sekoia.com · 16/06/2026
Our forensic analysis of compromised WordPress servers helped us to cluster ErrTraffic and map affiliates' TTPs and backdoors. We notably identified two distinct clusters: "Analytics" operated by a single threat actor, and "Beer" likely operated by LenAI for affiliates.
111
Reposted by crep1x
Sekoia @sekoia.com · 16/06/2026
#TDR analysts published a new report detailing #ErrTraffic, a widespread #ClickFix malware distribution framework. ErrTraffic injects malicious JavaScript into compromised WordPress and malicious sites to serve ClickFix lures. blog.sekoia.io/unveiling-er...
243
crep1x @crep1x.bsky.social · 08/04/2026
Part 2 of our #EvilTokens in-depth analysis is out! This blog post details the AI-augmented features significantly facilitating #BEC fraud. I believe that this AI-augmented post-compromise tooling represent a genuine breakthrough in the #PhaaS ecosystem. blog.sekoia.io/eviltokens-a...
010
crep1x @crep1x.bsky.social · 30/03/2026
In early March 2026, we uncovered #EvilTokens, a new #PhaaS offering device code phishing pages and AI-driven features to automate and scale BEC workflows. Part 1 of our analysis provides a technical analysis of the EvilTokens kit ⬇️ blog.sekoia.io/new-widespre...
blog.sekoia.io
New widespread EvilTokens kit: device code phishing as-a-service - Part 1
Uncover the new sophisticated EvilTokens device code phishing as-a-service, with AI-augmented features facilitating BEC fraud
110
crep1x @crep1x.bsky.social · 29/01/2026
Our latest TDR report on the #IClickFix framework: 📊 3,800+ WordPress sites compromised worldwide ⚙️ Multi-stage JavaScript loader 🚦 Abusing YOURLS as TDS 🖱️ Fake Cloudflare CAPTCHA and #ClickFix lure 🦠 #NetSupport RAT payload bsky.app/profile/seko...
131
crep1x @crep1x.bsky.social · 01/12/2025
Open directory at 104.168.81.]229/BJ/ containing phishing pages for Zimbra, Outlook, Adobe, and various Chinese services 104.168.81.]229 microsoftstorage.duckdns[.]org outllook.duckdns[.]org outlookspace.duckdns[.]org patnerrshipp.duckdns[.]org ⬇️
100
Reposted by crep1x
Sekoia @sekoia.com · 06/11/2025
#TDR analysts dig into a modus operandi targeting the hospitality industry and the related cybercrime ecosystem that facilitates #phishing and #fraud campaigns. blog.sekoia.io/phishing-cam...
153
Reposted by crep1x
Sekoia @sekoia.com · 11/06/2025
📝 Our latest #TDR report delivers an in-depth analysis of Adversary-in-the-Middle (#AitM) #phishing threats - targeting Microsoft 365 and Google accounts - and their ecosystem. This report shares actionable intelligence to help analysts detect and investigate AitM phishing.
1107
crep1x @crep1x.bsky.social · 16/04/2025
Check out our new blog post by the TDR team, presenting the latest TTPs used by the #Interlock ransomware group! It includes their use of the ClickFix tactic, PyInstaller, Node.js, Cloudflare Tunnels, and new PowerShell loader/backdoor ⬇️ bsky.app/profile/seko... ✍️ @kseznec.bsky.social
infosec.exchange
Sekoia.io (@sekoia_io@infosec.exchange)
Attached: 1 image Since the apparition of the #Interlock ransomware, the Sekoia #TDR team observed its operators evolving, improving their toolset (#LummaStealer and #BerserkStealer), and leveraging ...
120
Reposted by crep1x
Sekoia @sekoia.com · 16/04/2025
Since the apparition of the #Interlock ransomware, the Sekoia #TDR team observed its operators evolving, improving their toolset (#LummaStealer and #BerserkStealer), and leveraging new techniques such as #ClickFix to deploy the ransomware payload. blog.sekoia.io/interlock-ra...
025
crep1x @crep1x.bsky.social · 24/03/2025
Tycoon 2FA (a prominent AitM phishing kit), targeting Microsoft and Google accounts, uses a new CAPTCHA page instead of the custom Cloudflare Turnstile page e.g. hxxps://ymi.bvyunz.]ru/3v4jfQ-cUo/ hxxps://xau.kolivax.]ru/ckYHFJN/ hxxps://ffqt.lzirleg.]es/VajlR/ ⬇️
121
crep1x @crep1x.bsky.social · 20/03/2025
Here is our in-depth analysis of the latest #ClearFake variant using the Binance Smart Chain and two new ClickFix lures. ClearFake is injected into thousands of compromised sites to distribute the #Emmental Loader, #Lumma, #Rhadamanthys, and #Vidar. ⬇️ bsky.app/profile/seko...
141
Reposted by crep1x
Sekoia @sekoia.com · 19/03/2025
TDR analysts published an analysis of the new #ClearFake variant that relies on compromised websites injected with the malicious JavaScript framework, the #EtherHiding technique, and the #ClickFix social engineering tactic. buff.ly/vbiVbsN
blog.sekoia.io
ClearFake’s New Widespread Variant: Increased Web3 Exploitation for Malware Delivery
ClearFake spreads malware via compromised websites, using fake CAPTCHAs, JavaScript injections, and drive-by downloads.
153
crep1x @crep1x.bsky.social · 06/03/2025
#ClearFake variant is now spreading #Rhadamanthys Stealer via #Emmenhtal Loader. cc @plebourhis.bsky.social @sekoia.io 1. ClearFake framework is injected on compromised WordPress and relies on EtherHiding 2. The #ClickFix lure uses a fake Cloudflare Turnstile with unusual web traffic ⬇️
232
crep1x @crep1x.bsky.social · 22/01/2025
For those who did not monitor the supply chain attack against Chrome extensions in December 2024, our article provides an overview of: - the targeted phishing attack against extension developers - malicious code - the adversary's infrastructure ⬇️ bsky.app/profile/seko...
033
Reposted by crep1x
Sekoia @sekoia.com · 22/01/2025
TDR analysts analysed the supply chain attack targeting Chrome browser extensions, which potentially affected hundreds of thousands of end users in December 2024. buff.ly/4auQ0HN
184
crep1x @crep1x.bsky.social · 20/01/2025
Around 1,000 malicious domains are hosting webpages impersonating Reddit and WeTransfer, redirecting users to download password-protected archives These archives contain an AutoIT dropper, we internally named #SelfAU3 Dropper at @sekoia.io, which executes #Lumma Stealer IoCs ⬇️
296
crep1x @crep1x.bsky.social · 16/01/2025
Our last article exposes the new AiTM phishing kit Sneaky 2FA, sold by the cybercrime service "Sneaky Log"! We provide an in-depth analysis of the phishing pages, the associated service, detection opportunities and multiple IoCs. ⬇️ bsky.app/profile/seko...
161
crep1x @crep1x.bsky.social · 08/01/2025
Recent update in #Vidar C2 servers configuration: HTTP Location header set to "hxxps://t.]me", instead of "hxxps://google.]com" Heuristic to track C2 IPs and domains on Censys: search.censys.io/search?resou... Dead Drop Resolvers (DDR) of the week: hxxps://t.]me/no111p ⬇️
130
Reposted by crep1x
Nicolas Caproni @caproni.fr · 04/12/2024
🦝 The new episode of @intel471.bsky.social "Cybercrime Exposed" podcast produced by @jkirk.bsky.social tells the story of #Raccoon Stealer and, more broadly, reveals how the #infostealer ecosystem operates. Featuring @crep1x.bsky.social from @sekoia.io! intel471.com/resources/po...
intel471.com
Cybercrime Exposed Podcast: Raccoon Stealer
Intel 471 empowers cybersecurity teams worldwide to be proactive with its TITAN platform and comprehensive coverage into the criminal underground.
042