iiinova — where your digital self keeps evolving

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 01/10/2026

A csv formatted list of #malspam campaigns that crossed my path in September to include subject, #malware type, c2, hash, and email efil addresses: gist.github.com/silence-is-best/8f9… #retohunt

000 0

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 30/09/2026

Fresh #unknown #stealer: app.any.run/tasks/c46c99a4-8b08-4b0… 1eb51e82267b2ea1d3216919dbac9d5297ca8565baf8e39ccfc07323136b1849 C:\Users\lakup\Documents\dev_tools\LARP HERE\Studio\client.pdb

000 0

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 28/09/2026

For those looking at the ps1 this should help.

000 0

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 28/09/2026

#remcos #powershell (albeit broken) #opendir at: https:// delphiaonline\\.top c2 dmsi\\.duckdns\\.org:14642 9d9f149a0052999587be2078375bb4530b351f3cda1b343c7f81a5d13b02ac45

100 1

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 24/09/2026

#asyncrat #darkcrystal #opendir at: https:// interactions-according-reports-syndication\\.trycloudflare.com https:// periods-genetic-stones-government\\.trycloudflare.com

000 0

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 22/09/2026

A new one on me.. (apparently) something called #hydra_kl #stealer #clipper #hvnc app.any.run/tasks/7dfd881f-dc86-41a… 2c530f2e10db77881730e7a9ec4e72244d59149fc8981a4f49c6e0fadc5fecee

000 0

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 16/09/2026

The usual suspects (only looked at the #dcrat one) at: https:// interactions-according-reports-syndication.trycloudflare\\.com https:// periods-genetic-stones-government.trycloudflare\\.com

000 0

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 09/09/2026

Couple #screenconnect droppers at: https:// doc. papperldoculess\\.top/edocument/

000 0

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 08/09/2026

If you're running into malicious #meshagent in #malspams, keep an eye on the .msh file for details:

100 1

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 06/09/2026

f you're using any of those Monster A19 wifi lightbulbs (monsterilluminessence . com) be aware your data appears to be going to @splunk cloud.

115 5

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 04/09/2026

While browser makers are edging out #ublockorigin , ublockorigin keeps getting better:

1416 16

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 02/09/2026

#originlogger payloads (encrypted) at: https:// munihuacho\\.gob\\.pe/documentos/

000 0

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 01/09/2026

A csv formatted list of #malspam campaigns that crossed my path in August to include subject, #malware type, c2, hash, and email exfil addresses: gist.github.com/silence-is-best/df9… #retrohunt

000 0

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 01/09/2026

If you're not blocking workers . dev at the proxy/perimeter, it's long overdue.

001 1

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 28/08/2026

#Clickfix initial payloads at: https:// github. com/snowplow-byte/ #stealer still unknown sadly exe hash: 70bf0a8c0ffe5d1aa51358aba0ae365a1fab15cc356a02c07a36de6427e3ca7f

100 1

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 28/08/2026

Yet another cheesy #RMM at: https:// github\\.com/Drealplug #heartbeatRM c2: controllers-us-west-2.heartbeatrm\\.com

000 0

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 05/08/2026

PSA: If you're seeing links that literally start with _wildcard_ in #malspam, these are dropping #screenconnect (usual relay c2) via #zoom update lure. 1f7ab5418d489fdd2fb392ada3accc77c13586f94f059ee8e5cc83c0974b614b

000 0

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 05/08/2026

An interesting development with #PureLogStealer ....seen this twice now where the Edge flag is invalid: app.any.run/tasks/992252ed-c867-4ad…

100 1

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 03/08/2026

A csv formatted list of #malspam campaigns that crossed my path in July to include #malware type, subjects, c2's, hashes, and email exfil addresses: gist.github.com/silence-is-best/48b… #retrohunt

000 0

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 01/08/2026

In light of recent LLM's breaking out of their guardrails and doing damage, I felt compelled to write this. gist.github.com/silence-is-best/e8f…

010 1

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 31/07/2026

Handful of IOC's for those .js #purelogs #stealer #malspams: app.any.run/tasks/43e561e4-707a-418… Exfil port is 4449 Calls hidden Edge Calls hidden Chrome

100 1

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 27/07/2026

#xloader 's (c6713b3c5ba4da5044d96463cae74227a6a898abb051a5f75ab7b508eb20f7e1) choice of which executable to inject into continues to fascinate me...

100 1

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 01/07/2026

A csv formatted list of #malspam campaigns that crossed my path in June to include #malware type, c2, hash, subject, and email exfil addresses: gist.github.com/silence-is-best/247… #retrohunt

000 0

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 17/06/2026

#remus #opendir at: http:// apexdataserver4\\.sbs/load/os1/ c2: carogra\\.biz:4219

100 1

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 01/06/2026

A csv formatted list of #malspam campaigns that crossed my path in May to include #malware, subjects, hashes, c2's, and email exfil addresses: gist.github.com/silence-is-best/9b7… #retrohunt

000 0

James_inthe_box @james-inthe-box.infosec.exchange.ap.brid.gy · 01/06/2026

A new one on me.. #overlord rat at: https:// localgolf\\.globalmerx\\.es/ssa/Windows/utility.php app.any.run/tasks/f0336476-584b-497…

100 1