Sign in

Gi7w0rm

@gi7w0rm.bsky.social
560 followers 41 following 73 posts

Just me, worming through the interwebs. Threat Intelligence and #URINT Analyst Other places: linktr.ee/gi7w0rm Support me: ko-fi.com/gi7w0rm

PostsRepliesMedia
Gi7w0rm @gi7w0rm.bsky.social · 18/06/2026
New season of #OperationEndgame just dropped. This time, they targeted #SocGholish. 106 servers and domains taken down, 14.971 websites remediated. Of course, they released a movie like video for it again. Press release: www.politie.nl/en/news/2026... #OpEndgame #SocGholish
010
Gi7w0rm @gi7w0rm.bsky.social · 18/05/2026
On January 13th 2026, SilentPush released an article about a #MageCart campaign. Curious, I submitted a @ThinkstCanary CreditCard Token. 4 days ago, it triggered for the first time. Dwelltime: 4 months! Carddata Testing done via @amazon prime and a US based charity. #magecart #ccfraud #webskimming
020
Gi7w0rm @gi7w0rm.bsky.social · 30/03/2026
New tool for all those #Stealer #malware analysts out there: crxray[.]info Translate #Chrome #Extension IDs to their Names and Descriptions in Bulk. Currently 174,534 Extensions in database. More related tools to come.
040
Gi7w0rm @gi7w0rm.bsky.social · 02/03/2026
New Blogpost "Amos Stealer "malext" variant spread in global malvertising campaign using free text-sharing websites" is now live. medium.com/@gi7w0rm/amo... Hope you will enjoy 🙂
medium.com
Amos Stealer “malext” variant spread in a global malvertising campaign using free text-sharing…
Hello and welcome back to another blog post. It has been a minute and I am happy I am finally finding the time to write down something for…
021
Gi7w0rm @gi7w0rm.bsky.social · 04/02/2026
When you finally reverse the loader for that malware sample #VirusTotal flagged as "APT XYZ". and it turns out to be just a #Vidar #Stealer dropper. 4 Stages including Steganography for nothing 😕
030
Gi7w0rm @gi7w0rm.bsky.social · 05/11/2025
Got some surprise love from the @malbeacon team for beta testing a new product. Thanks a lot for this gift! Hope more people soon get to try your amazing work. TAs will fear you 😈 Cheers ❤️
050
Gi7w0rm @gi7w0rm.bsky.social · 03/10/2025
In 2024 I reported several critical vulnerabilities in the aviation sector to @AviationISAC . This week (after several global shipping attempts) I was honored to recieve 2 challenge coins (+ some stickers) from them 🔥 Thank you! #BeAware #Report #MakeAChange
010
Gi7w0rm @gi7w0rm.bsky.social · 02/07/2025
Had an amazing time #FirstCon last week. Met a bunch of awesome folks from all over the industry. Around 3 hours of sleep per night and 17 hours of social interactions ^^ Was so done but also super happy on friday :) Cheers to all the awesome folks in our industry <3
020
Gi7w0rm @gi7w0rm.bsky.social · 20/06/2025
Hunting bottlenecks in my infra. For months I thought it was the MySQL server. Now that I have some stats, this does not seem to be the case. Time to check the other servers...
110
Gi7w0rm @gi7w0rm.bsky.social · 19/06/2025
At the beginning of this month i bought myself a #Steamdeck. Must admit I am very pleasently surprised by it. Nice handling, great screen resolution, good performance. Better and more versatile than a Nintendo Switch. Nice product @valvesoftware #ThankGaben #gaming
001
Gi7w0rm @gi7w0rm.bsky.social · 02/06/2025
New Blogpost: #HuluCaptcha - An example of a FakeCaptcha framework. Started investigating this after a friend was compromised by it. Some interesting/unique techniques shown, plus analysis of the compromised server. Hope you enjoy the read! :) medium.com/@gi7w0rm/hul...
medium.com
HuluCaptcha — An example of a FakeCaptcha framework
Hello and welcome back to another blog post. After some time of absence due to a lot of changes in my personal life ( finished university…
030
Gi7w0rm @gi7w0rm.bsky.social · 01/06/2025
New #Blogpost scheduled for release tomorrow 8 a.m. (UTC+2). Analyzing a new #FakeCaptcha framework I call #HuluCaptcha. Besides codeanalysis, I also analyze 2 new #wordpress #backdoors and server logs. Hope you ll enjoy 😊
050
Gi7w0rm @gi7w0rm.bsky.social · 06/05/2025
Jo @LidlUS @lidl @LidlGB, didn't knew you now also host fake versions of the New-York Times: hxxps[:]//baustandards-qs[.]lidl[.]com Seems a solid subdomain takeover? Pointing to AWS: 72.144.31[.]24 #subdomaintakeover #itw
051
Gi7w0rm @gi7w0rm.bsky.social · 22/04/2025
So this just happend to me: gamerhorizon.com/2015/01/28/p... 800 Gigs of Data gone. Years of work. Because the installer for @Bethesda @Elderscrolls Online decided to wipe the complete disk upon uninstall.
gamerhorizon.com
PSA: Don’t let The Elder Scrolls Online delete your files and folders!
The installer included with the on-disc version of The Elder Scrolls Online contains a bug that can potentially wipe out everything on your hard drive.
000
Gi7w0rm @gi7w0rm.bsky.social · 14/04/2025
The website of the "Deutsche Vereinigung für internationales Recht" (dvir[.]de) is currently compromised and spreading #Lumma #Stealer via #FakeCaptcha attack. Compromised webfile is: hxxp[://]www[.]dvir[.]de/wp-content/themes/Dummy/assets/js/main[.]min[.]js?ver=1[.]0
010
Gi7w0rm @gi7w0rm.bsky.social · 09/04/2025
On December 31,2024 @sourcedefense released an article about a #webskimming threat, using extensive google redirects. securityboulevard.com/2024/12/crit... I entered a @ThinkstCanary CC token. April 09, 2025 morning I woke up to 6 payment attempts from Australia! Attempts to pay @eBay and @Uber.
010
Gi7w0rm @gi7w0rm.bsky.social · 06/04/2025
Message of the day: Not every North Korean Cyber Threat is #Lazarus or related to Lazarus. Please get this into your heads...
030
Gi7w0rm @gi7w0rm.bsky.social · 28/03/2025
"Studio Ghibli" - Gi7w0rm #AIArt #StudioGhibli #Gi7w0rm
010
Gi7w0rm @gi7w0rm.bsky.social · 27/03/2025
Homeoffice starting in 4 days, so after roughly 10+ years I upgraded my office desk. Now the proud owner of an hight-adjustable desk. Looking pretty neat! Hope my back will thank me in some years...
010
Gi7w0rm @gi7w0rm.bsky.social · 23/03/2025
Small Bugfix in gi7w0rm.github.io/ArrayThisClo... The name field can now be empty. Previous coding prevented the user from deleting the complete input field content. Using this as a short reminder that this tool is still out there for if you ever need to convert multi-line content to an array.
gi7w0rm.github.io
ArrayThisClone
000
Gi7w0rm @gi7w0rm.bsky.social · 21/03/2025
Have just been notified that I am featured in: www.darkreading.com/cyberattacks... Thank you for the honor @DarkReading ❤️
darkreading.com
Why It's So Hard to Stop Rising Malicious TDS Traffic
Cybersecurity vendors say threat actors' abuse of traffic distribution systems (TDS) is becoming more complex and sophisticated — and much harder to detect and block.
020
Gi7w0rm @gi7w0rm.bsky.social · 14/03/2025
Happy to share that I have signed a work contract at a CTI company. Also, today was my last work day at my old employer, since I took the remaining vacation days. Looking forward to 2 weeks of rest to prepare for whats to come. Cheers all ❤️
140
Gi7w0rm @gi7w0rm.bsky.social · 24/02/2025
Seems someone just tried to pay an Uber with my @ThinkstCanary token CreditCard which I entered into a #webskimmer. I bet it didn't go well ^^
020
Gi7w0rm @gi7w0rm.bsky.social · 22/02/2025
Please excuse the lack of content in the last weeks. I am overhelmed by current political developments and additionally working on some topics that I can't publicly disclose. No capacity for free research :/ Hope this will get better in some months. Cheers to all my friends and followers.❤️
040
Gi7w0rm @gi7w0rm.bsky.social · 22/02/2025
Looking good on the #jobhunt. Hope to sign a contract by the end of next week. Currently decluttering my workdesk to be prepared for a fresh start. Highly motivated for whats to come 😊 💪
020
Gi7w0rm @gi7w0rm.bsky.social · 12/02/2025
Happy to have received recognition for being a #TopContributor to the abuse_ch project in #2024. Currently ranking place 4 in the leaderboard of global #IoC sharing via #Threatfox. Definetly planning to keep up that rank in the next years. Cheers to the Team @abuse_ch and @spamhaus.bsky.social!
140
Gi7w0rm @gi7w0rm.bsky.social · 30/01/2025
Damn, what an awesome feeling to improve the speed of your code. From 1k documents to 16k per second using some simple coding techniques and #CursorAI. Amazing 🔥
040
Gi7w0rm @gi7w0rm.bsky.social · 29/01/2025
New #challengecoin unlocked. Images as soon as received 🔥
media.tenor.com
a white cat is standing on its hind legs on a wooden floor .
ALT: a white cat is standing on its hind legs on a wooden floor .
010
Gi7w0rm @gi7w0rm.bsky.social · 23/01/2025
Released my new blogpost: "A beginner(s) guide to hunting web-based credit card skimmers" My experience on how to detect and analyze skimming campaigns using free tools like Validin, URLscan and FoFa. Includes WebSocket analysis and new IOCs! gi7w0rm.medium.com/a-beginner-s-gui……
gi7w0rm.medium.com
A beginner(s) guide to hunting web-based credit card skimmers
Hello everyone, and welcome back to another blog post. Today, I will show you my approaches to hunting credit card skimmers. This blog is…
2104
Gi7w0rm @gi7w0rm.bsky.social · 23/01/2025
Blogpost release scheduled 6 pm CET today. Topic: How to hunt for CreditCard skimmers using free tools. (Only none free tool I use is ClaudeAI and you could use Llama or similar). Hope you ll enjoy!
media.tenor.com
a sign that says coming soon is lit up with lights .
ALT: a sign that says coming soon is lit up with lights .
030
Gi7w0rm @gi7w0rm.bsky.social · 20/01/2025
Had a productive evening yesterday :) #skimming #magecart #hunting
000
Gi7w0rm @gi7w0rm.bsky.social · 14/01/2025
I have seen so much compromise, if someone sends me a list of 200 backdoored Wordpress sites I am actually starting to contemplate if it is worth to act. What does this say about the state of our cybersecurity? At least its a job with a future ^^
020
Gi7w0rm @gi7w0rm.bsky.social · 10/01/2025
Update pushed to Teletoken.info 1. Added about page - Added About section - Added HowTo section - Added advanced features list - Added disclaimer/ToS - Added Contact details 2. Added security.txt
020
Gi7w0rm @gi7w0rm.bsky.social · 09/01/2025
Here is a list of 698 ACTIVE #KeitaroTDS domains identified via @ValidinLLC. While not inherently harmful, these domains are often used for advertising, misinformation (DoppelGaenger), and harmful activities. Blocking them could be a wise precaution.
github.com
MalwareConfigLists/Suspicious/KeitaroTDS.txt at main · Gi7w0rm/MalwareConfigLists
Just some lists of Malware Configs. Contribute to Gi7w0rm/MalwareConfigLists development by creating an account on GitHub.
000
Gi7w0rm @gi7w0rm.bsky.social · 07/01/2025
Hey, we even have a #Bugbounty Program, we are so secure! The Bugbounty program:
000
Gi7w0rm @gi7w0rm.bsky.social · 07/01/2025
#Magecart #Skimmer just triggered my #Canarytoken. 2 different shops, one was a 1 dollar transaction attempt, likely to test if the card works. The second was a transaction of 1604 canadian dollars in an attempt to buy something from Viwoods Aipaper. Actor = Canadian? @thinkstcanary.canary.tools
062
Gi7w0rm @gi7w0rm.bsky.social · 06/01/2025
5 days into Social Media Botting. First valid accounts. Estimating 2,50$ per Bot. I do not know how this can be profitable without illegal methods. #experiment #socialmedia #botnet
220
Gi7w0rm @gi7w0rm.bsky.social · 05/01/2025
Please suggest your favorite #cybersecurity related tv series (not Mr Robot). Alternatively anything related to organized crime or espionage. #Netflix or Amazon #Prime preferred. #infosec
000
Gi7w0rm @gi7w0rm.bsky.social · 04/01/2025
Trying to setup a social media botnet. Think it could make a good blogpost and cool research. Turns out for full automation you need cryptocurrency for EVERYTHING. 1. Captcha Solvers 2. Virtual SIMs Plus: Static residential proxies are expensive #TheWorldIsAboutMoney -.-
000
Gi7w0rm @gi7w0rm.bsky.social · 04/01/2025
Sometimes it feels like every click I do online leads to another interesting technical rabbithole to get lost in. #infosec #interesting
020
Gi7w0rm @gi7w0rm.bsky.social · 02/01/2025
Trying to move away from X/ Elno. Please suggest #cybersecurity accounts I should follow on here! Need to find the #CTI crowd in particular. #infosec
media.tenor.com
a cartoon of a hamster with the words hello anyone there
ALT: a cartoon of a hamster with the words hello anyone there
140
Gi7w0rm @gi7w0rm.bsky.social · 02/01/2025
Professional goals for 2025: - Find a cool job - Develop new systems and automation - collaborate with awesome people in #infosec - Get legal setup to sell CTI data - Gradually move main activities to Bluesky Best wishes to all, may we stand strong during these turbulent times❤️
media.tenor.com
a black background with fireworks and the words happy new year 2025
ALT: a black background with fireworks and the words happy new year 2025
060
Gi7w0rm @gi7w0rm.bsky.social · 22/12/2024
Updating old projects to prepare for 2025 🙂 IoCSharing to #ThreatFox and my Github has been very low in recent months. Blame my bachelor thesis. But I hope to get that going on a way more frequent basis with the new system :) Cheers @abuse_ch for your awesome platforms 💪
040
Gi7w0rm @gi7w0rm.bsky.social · 16/12/2024
Woke up to the news that I passed my bachelor thesis with 95%. Best grade possible. After 7 years of stress, unhappiness and mediocre grades I finished with a banger. Very happy and reliefed. 🎉 #gratefull #didit #bachelorofscience #bachelor2024
2130
Gi7w0rm @gi7w0rm.bsky.social · 04/12/2024
I decided that it might not hurt to publish the Usernames of the affected developers from #GitLab and #Github in a temporary Pastebin entry. For @github : pastebin.com/RGEgXGb5 For @gitlab : pastebin.com/y25PFNyF If your username is in this list please reach out.
pastebin.com
GitLab Users exposing API Keys via 3rd party host - Pastebin.com
Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.
011
Gi7w0rm @gi7w0rm.bsky.social · 04/12/2024
.git leaks with #Github and #Gitlab tokens, some stats: 1439 valid tokens collected over 30 days allow access to 108.707 code repositories. Besides lone developers, access is also possible to 2117 Organizations/Groups. Top Tokens by num repos 18,534 1,615 1,142 1,035 1,035
000
Gi7w0rm @gi7w0rm.bsky.social · 20/11/2024
New Update pushed to teletoken.info 1. 40k new chat to token relations added 2. Added Token to Source feature to advanced section - 2k malware relations added - 7k phishing relations added Say hi to some of the identified #threatactors below ;)
031
Gi7w0rm @gi7w0rm.bsky.social · 17/11/2024
I wish all my abuse reports were that simple. 1. Enter website 2. Click Chat 3. Get a nice responsive human on the other end 4. Report abuse in chat without any secondary contact channels 5. Solve abuse and give feedback on actions taken Nice work @ipregistryco !
030
Gi7w0rm @gi7w0rm.bsky.social · 17/11/2024
#Phishing against #Twitch observed. twitch-community-guidelines[.]web[.]app Asks for user details Asks for user password (actually twice with automatic fail on first submit) Asks for user 2FA Redirects to safety.twitch.tv
031
Gi7w0rm @gi7w0rm.bsky.social · 16/11/2024
For several years I have been using the ArrayThis website by populu[.]com Sadly it has been compromised by #ApateWeb malware (for months) and the owner does not react to my reports. So I decided to fire up #AI to create my own #opensource clone. gi7w0rm.github.io/ArrayThisClone
github.com
GitHub - Gi7w0rm/ArrayThisClone: A copy of one of my favorite convenience tool. Sadly, the original page is currently compromised.
A copy of one of my favorite convenience tool. Sadly, the original page is currently compromised. - Gi7w0rm/ArrayThisClone
020