iiinova — where your digital self keeps evolving

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 01/10/2026

A csv formatted list of #malspam campaigns that crossed my path in September to include subject, #malware type, c2, hash, and email efil addresses: gist.github.com/silence-is-best/8f9… #retohunt

000

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 30/09/2026

Fresh #unknown #stealer: app.any.run/tasks/c46c99a4-8b08-4b0… 1eb51e82267b2ea1d3216919dbac9d5297ca8565baf8e39ccfc07323136b1849 C:\Users\lakup\Documents\dev_tools\LARP HERE\Studio\client.pdb

000

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 28/09/2026

#remcos #powershell (albeit broken) #opendir at: https:// delphiaonline\\.top c2 dmsi\\.duckdns\\.org:14642 9d9f149a0052999587be2078375bb4530b351f3cda1b343c7f81a5d13b02ac45

100

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 24/09/2026

#asyncrat #darkcrystal #opendir at: https:// interactions-according-reports-syndication\\.trycloudflare.com https:// periods-genetic-stones-government\\.trycloudflare.com

000

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 22/09/2026

A new one on me.. (apparently) something called #hydra_kl #stealer #clipper #hvnc app.any.run/tasks/7dfd881f-dc86-41a… 2c530f2e10db77881730e7a9ec4e72244d59149fc8981a4f49c6e0fadc5fecee

000

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 17/09/2026

To the threat actor that has found my personal email address and has started sending malicious office documents: THANK YOU!!! IT'S LIKE CHRISTMAS UP IN HERE 🤗

000

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 16/09/2026

"All large-scale AI's eventually go insane." Dungeon Crawler Carl, The Gate of the Feral Gods Apt.

031

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 16/09/2026

The usual suspects (only looked at the #dcrat one) at: https:// interactions-according-reports-syndication.trycloudflare\\.com https:// periods-genetic-stones-government.trycloudflare\\.com

000

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 09/09/2026

Couple #screenconnect droppers at: https:// doc. papperldoculess\\.top/edocument/

000

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 08/09/2026

If you're running into malicious #meshagent in #malspams, keep an eye on the .msh file for details:

100

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 06/09/2026

f you're using any of those Monster A19 wifi lightbulbs (monsterilluminessence . com) be aware your data appears to be going to @splunk cloud.

115

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 04/09/2026

#purelogslealer at: https:// gaiadeqi\\.com/scrapbookpocketfordraf.exe Same tired old c2 of 2.27.62.123:4449

000

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 04/09/2026

While browser makers are edging out #ublockorigin , ublockorigin keeps getting better:

1415

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 02/09/2026

#originlogger payloads (encrypted) at: https:// munihuacho\\.gob\\.pe/documentos/

000

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 01/09/2026

A csv formatted list of #malspam campaigns that crossed my path in August to include subject, #malware type, c2, hash, and email exfil addresses: gist.github.com/silence-is-best/df9… #retrohunt

000

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 01/09/2026

If you're not blocking workers . dev at the proxy/perimeter, it's long overdue.

001

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 28/08/2026

#Clickfix initial payloads at: https:// github. com/snowplow-byte/ #stealer still unknown sadly exe hash: 70bf0a8c0ffe5d1aa51358aba0ae365a1fab15cc356a02c07a36de6427e3ca7f

100

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 28/08/2026

Yet another cheesy #RMM at: https:// github\\.com/Drealplug #heartbeatRM c2: controllers-us-west-2.heartbeatrm\\.com

000

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 21/08/2026

Since people trust LLM's known to hallucinate, does that mean I can drop acid at work?

000

Reposted by James_inthe_box

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 10/08/2026

I've published part one of a two-part blog series: Locking down Windows Part 1: Harden System Security Consider this the warm-up round. Part two will cover the way to truly lock down Windows: App Control (WDAC)

tharros.com

Locking down Windows Part 1: Harden System Security

225

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 07/08/2026

#faronics (yet another rmm by the look of it) at: https:// aerrixon .com/filee.html -> https:// mustafacorp .com/ref/2026Statement.exe

000

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 05/08/2026

PSA: If you're seeing links that literally start with _wildcard_ in #malspam, these are dropping #screenconnect (usual relay c2) via #zoom update lure. 1f7ab5418d489fdd2fb392ada3accc77c13586f94f059ee8e5cc83c0974b614b

000

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 05/08/2026

An interesting development with #PureLogStealer ....seen this twice now where the Edge flag is invalid: app.any.run/tasks/992252ed-c867-4ad…

100

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 03/08/2026

A csv formatted list of #malspam campaigns that crossed my path in July to include #malware type, subjects, c2's, hashes, and email exfil addresses: gist.github.com/silence-is-best/48b… #retrohunt

000

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 01/08/2026

In light of recent LLM's breaking out of their guardrails and doing damage, I felt compelled to write this. gist.github.com/silence-is-best/e8f…

010

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 31/07/2026

Handful of IOC's for those .js #purelogs #stealer #malspams: app.any.run/tasks/43e561e4-707a-418… Exfil port is 4449 Calls hidden Edge Calls hidden Chrome

100

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 27/07/2026

#xloader 's (c6713b3c5ba4da5044d96463cae74227a6a898abb051a5f75ab7b508eb20f7e1) choice of which executable to inject into continues to fascinate me...

100

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 01/07/2026

A csv formatted list of #malspam campaigns that crossed my path in June to include #malware type, c2, hash, subject, and email exfil addresses: gist.github.com/silence-is-best/247… #retrohunt

000

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 17/06/2026

Yet another shady #RMM; this time @Automox at: https:// ecdp.ronaldegesa\\.com/Automox_Installer-2.5.70.msi threat actor access key is c9af8abb-3be8-432d-b651-6da4df3e35a6

000