Brayan Angulo @Briamcode

🚨 Android 0-Day Vulnerability Exploited in Attacks to Gain Complete Device Control Source: cybersecuritynews.com/android-0-day-… A critical Android zero-day vulnerability is being actively exploited in targeted attacks, allowing threat actors to gain near-complete control over affected devices without any user interaction. The flaw, tracked as CVE-2025-48595, was highlighted in the June 2026 Android Security Bulletin, where Google confirmed limited real-world exploitation. The vulnerability resides in the Android Framework component and is a high-severity elevation-of-privilege (EoP) issue. Under certain conditions, attackers can exploit the flaw remotely to escalate privileges without requiring additional execution permissions. #cybersecuritynews #Vulnerability #Android

🚨 🇨🇴 CYBER INTELLIGENCE ALERT: HACKTIVIST ACTIVITY IN COLOMBIA STATUS: HACKTIVIST MOBILIZATION Recent activity has been detected by the collective "Anonymous Colombia" regarding possible hacktivist actions in the country. 👥 Entity/Collective: Anonymous Colombia (#OpColombia) and ColHackers. 📊 Scope of Activity: Possible Reactivation: The collective has stated that, in the event of a right-wing government, "OpColombia" would be reactivated by ColHackers. Declared Intentions: They have disseminated hashtags such as #OpFalsaIndependencia, #OpColombia, and #AnonymousColombia, warning that their upcoming actions "will not be like before." Mobilization Message: The rhetoric used suggests a direct confrontational stance and possible planning of future digital operations. 🛡️ Recommendations and Mitigation Infrastructure Monitoring: IT teams in government entities and strategic sectors in Colombia are advised to strengthen the monitoring of their digital perimeters against potential defacement attempts or distributed denial-of-service (DDoS) attacks associated with this mobilization. Vulnerability Management: It is prudent to review web security protocols and critical infrastructure patches to minimize common attack vectors used in hacktivist campaigns. #CyberSecurity #Colombia #Hacktivism #Anonymous #OpColombia #ThreatIntelligence #CyberAlert #VECERT #BreachAlert

🐉 Katoolin — Install Hundreds of Kali Linux Tools on Any Linux System Katoolin is a lightweight utility that allows Ubuntu users to add Kali repositories and install popular Kali Linux tools without switching operating systems. Key Features: • Add or remove Kali Linux repositories • Install hundreds of Kali Linux tools from one interface • Simple Python-based utility • Useful for learning and testing security tools on Ubuntu Important Note: Mixing Kali repositories with Ubuntu can break package dependencies and create system stability issues. If you use Katoolin, always review repository changes carefully and remove Kali repositories before major system updates. A useful project for cybersecurity learners who want access to Kali tools while staying on Ubuntu. 🔗 github.com/LionSec/katool… #CyberSecurity #Linux #KaliLinux #Ubuntu #Pentesting #EthicalHacking #OpenSource

🧵 THREAD OSINT | 1/6 🚨 ACTIVE THREAT ALERT – HIGH SEVERITY A complete Malware-as-a-Service (MaaS) Android infrastructure The domain btmob-rat.com/yaarsa/user/tr… is the official trial portal for BTMOB RAT v4.1/4.2 — an advanced evolution of SpySolr, CraxsRAT, and CypherRAT. Registered only 32 days ago (March 18, 2026), the panel is already delivering full remote control via Accessibility Service abuse, banking credential theft (Pix, Alipay, etc.), keylogging, screen mirroring, and real-time data exfiltration. 2/6 EXECUTIVE SUMMARY
• Active operator panel at /yaarsa/user/trial.php (automatic 2-day trial)
• Primary C2: server.yaarsa.com/con + multiple European IPs
• Geographic focus: LATAM (Pix-heavy), Morocco, and Asia
• Lifetime pricing: up to US$2,273 + monthly support
• Full source code already leaked on dark web forums Criticality: HIGH — Mass phishing campaigns are active now. 3/6 KEY IOCs (Technical OSINT) •Domain: btmob-rat.com (NameCheap, full privacy protection) •Critical paths: /yaarsa/user/trial.php | /yaarsa/private/yarsap_*.php •WebSocket C2: server.yaarsa.com/con •Technologies: PHP backend + real-time JSON WebSocket •Advanced evasion: Play Protect bypass + heavy Accessibility Service abuse 4/6 Link Analysis
The ecosystem is compact and mature:
Phishing (fake APKs mimicking WhatsApp, Chrome, Roku, Starlink, and banking apps) → Dropper → yaarsa C2 → Operator panel on btmob-rat.com → Monetization via Telegram (@BTMOB1). Clear lineage from the SpySolr family. Associated threat actor: EVLF. 5/6 Real-World Risk
• Large-scale banking theft targeting Pix and financial apps
• Full device access: camera, microphone, location, files
• Production-grade evasion already deployed
• Source code leak significantly raises risk of forks and new campaigns Any organization with Android users in LATAM is currently exposed. 6/6 IMMEDIATE RECOMMENDATIONS 1Block btmob-rat.com and all /yaarsa/* paths 2Monitor Telegram t.me/BTMOB1 for fresh IOCs 3Deploy YARA/SIGMA rules for “BTMOB” payloads and yaarsa WebSocket traffic 4Review internal logs for trial.php access or /yaarsa/private patterns 
#CyberThreat #AndroidRAT #OSINT #BTMOBRAT #MaaS

A hacking tool called BTMOB lets criminals build custom fake Android apps — disguised as streaming services, crypto platforms, or even government portals — that steal banking details, intercept financial transactions, and hand attackers full remote control of your phone. Once installed, it silently grants itself deep system access using Android's Accessibility Services (a feature designed to help people with disabilities, but here abused to take over your device without asking again). It is sold openly online for $700 a month, meaning any criminal can buy a ready-made version tailored to their scam. Open your Android Settings, go to Apps → Special App Access → Accessibility, and remove access for anything you don't recognise — then go to Google Play, open the menu, tap Play Protect → Scan, and delete any app that fails. 🚨 #CyberNewsLive bleepingcomputer.com/news/security/…

📱 Massive Collection of Mobile Pentesting & Reverse Engineering Tools ⚔️ Curated resources for: 🤖 Android Security Testing 🍎 iOS Reverse Engineering 🔍 APK & IPA Analysis 🧠 Frida Instrumentation 🛡️ SSL Pinning Bypass 📡 NFC & Bluetooth Research 🔥 Runtime Analysis 🕵️ Mobile Malware Research Includes tools like: ⚡ MobSF ⚡ Frida ⚡ Objection ⚡ Drozer ⚡ Apktool ⚡ JADX ⚡ Ghidra ⚡ Burp Suite Most security researchers focus only on web applications. Mobile apps expose completely different attack surfaces — insecure storage, hardcoded secrets, deep links, SSL pinning flaws, API abuse, and runtime vulnerabilities. This repo is a strong resource for anyone learning mobile application security and pentesting. 🔗 github.com/hahwul/MobileH… #CyberSecurity #MobileSecurity #Android #iOS #ReverseEngineering #BugBounty #Pentesting

Turns Android phones into local AI agents github.com/sepivip/Seeker…

⚠️ New BTMOB Malware Lets Attackers Remotely Control Android Devices Source: cybersecuritynews.com/btmob-malware-… New Android malware dubbed BTMOB is arming even low-skilled attackers with full remote control over infected phones by combining a powerful RAT engine with a no-code campaign builder toolkit. Unlike classic banking trojans focused only on financial data, BTMOB is designed for full device surveillance and control. The malware can exfiltrate a wide range of sensitive data, capture screenshots, record on-device activity, and give operators persistent remote access to the compromised phone. #cybersecuritynews

🚨 New 0-Click WhatsApp Account Takeover Attack Targeting iOS 16 Users Source: cybersecuritynews.com/0-click-whatsa… A new 0-Click WhatsApp Account Takeover Attack Targeting iOS 16 Users is raising serious concerns after multiple iPhone users reported their accounts being hijacked without any interaction, warnings, or visible linked devices. The attackers are exploiting a zero-click attack chain that allows them to silently access WhatsApp accounts, even while the legitimate user remains logged in. Unlike traditional WhatsApp hijacking techniques such as QR code phishing or GhostPairing campaigns, this attack does not require user action, making it significantly more dangerous and difficult to detect. #cybersecuitynews #whatsapp #iOS

🔥اختراق ويندوز 11 والحفاظ على الاتصال إذا قام الضحية بإعادة تشغيل الجهاز (Restart) من دورة CEH v13

HackShell Hackers can do a lot of things in a stealthy way on Linux with hackshell. It mainly helps evade detection during lateral movement, persistence and data exfiltration. But it’s limited to this only. We covered its capabilities in our article and showed you how to detect it. hackers-arise.com/linux-hackshel… @three_cube @_aircorridor #apt #redteam

⚠️Motorola Phones Preinstalled App Found Hijacking Amazon App to Inject Affiliate Codes Source: cybersecuritynews.com/motorola-phone… A hidden system application bundled with Motorola smartphones has been caught intercepting user-initiated Amazon app launches and silently redirecting them through affiliate tracking URLs, raising serious concerns about supply chain integrity, user consent, and undisclosed revenue practices on premium Android devices. The behavior was first reported by a Motorola Razr 60 Ultra user on Reddit, who noticed that tapping the Amazon app icon no longer opened the app directly. Instead, the device launched a browser session pointing to an unfamiliar URL, which subsequently redirected to Amazon[.]com with an embedded affiliate code. #cybersecuritynews #motorolaphones #Affiliatelinks

Memory Forensics Using Volatility Framework 📲 Telegram: t.me/hackinarticles Discover how investigators analyze RAM memory dumps to uncover hidden processes, credentials, and malicious activity during forensic investigations. 🕵️‍♂️💻 💡 Key Takeaways: 🧠 Memory Acquisition Basics 📦 Supported Memory Dump Formats 🔍 Image Profile Identification ⚙️ Volatility Plugins & Commands 🧾 Process & Network Artifact Analysis 🔐 Credential & Registry Extraction 📖 Full Guide: hackingarticles.in/memory-forensi… #Volatility #MemoryForensics #DFIR #DigitalForensics #CyberSecurity #HackingArticles #Infosec

keyboard_arrow_left Previous keyboard_arrow_right Next

💻 How a Discarded Device Exposed WiFi Credentials and Web Admin Credentials (CVE-2026-4346) Blog: securityspace2.wordpress.com/2026/04/06/how… Author: Cyber coyote

keyboard_arrow_left Previous keyboard_arrow_right Next

¡Microsoft acaba de hacer de código abierto Webright! Una skill para agentes de IA para controlar navegadores. El truco es que por debajo usa Playwright, escribe el código al vuelo y el rendimiento es brutal. github.com/microsoft/Webw…

a 28-year-old in Berlin runs a 7-agent software factory off a remote server she approves checkpoints from her phone at midnight; her workspace has no desk, no city, no fixed machine - any screen is just a terminal she quoted $28,000 for a scope a local agency priced at $74,000 and told the client 'minimum 6 weeks.' the agents shipped a validated PR in 19 hours the agency was still revising their proposal i've been running a version of this for the past few months. the setup sounds absurd until the first time it works, and then you can't go back the factory lives on a remote VPS - always on, eight tmux panes, already mid-session. ssh in from whatever screen is nearby: laptop at home, phone on a train, tablet at a café at 1am. the environment never moves. you're just a terminal window connecting to something that was already running agencies price the way they do because their overhead is structural. a $74,000 quote on a 6-week scope is real math: account managers, a senior dev who gets rotated to a bigger client by week three, revision cycles that exist because context lives in fourteen slack threads instead of one file the factory collapses all of that into a CLAUDE.md → a 100-line markdown file at the repo root loads the entire project into every new agent session - stack, architectural rules, banned patterns - so no session starts blind and no context drifts between runs → agent one is read-only: maps the existing codebase, documents patterns, flags risks before any agent touches the code → agent two writes the user story and acceptance criteria, locking the exact definition of done before engineering starts → agent three produces the technical brief: data model changes, API shapes, a precise list of every file that will move - this locks before any builder runs → backend and frontend build in parallel but in isolation, each scoped to its own directories, so they can't reach across and corrupt each other's work → agent six writes acceptance tests against the original user story criteria before the implementation is considered complete → agent seven runs a final read-only audit: missing auth, tenant isolation gaps, any deviation from the brief gets flagged back into the loop before the pr is cut → three checkpoints pause the entire chain for human approval - story, spec, pre-merge - each one a 30-second phone tap when the upstream work was done right the 19 hours is the output. what compressed was everything underneath: the pm relaying a question to an engineer who responds two days later, the architectural mistake that only surfaces after code is written, the context drift between sessions because the memory layer is a human brain instead of a file that loads before anything runs the loop closes itself. validator flags a gap, builder fixes it, verifier confirms, pr is clean by morning the agency sent their revised proposal at 9am. the pr had been merged for 14 hours she approved the final checkpoint at midnight, 30 seconds on her phone. the agents were already done the desk, the office, the fixed machine - she left them out

Rahul @sairahul1

2 weeks ago

x.com/i/article/2058…

35 208 2K 2.9M 7K

This is how a Coruna iOS RAT infected device looks like💀

🚨 Hackers Can Weaponize Lenovo Driver to Terminate EDR Processes Source: cybersecuritynews.com/lenovo-driver-… Hackers can weaponize a legitimately signed Lenovo driver to terminate security processes, highlighting a dangerous Bring Your Own Vulnerable Driver (BYOVD) attack vector that can bypass endpoint protection controls. A Lenovo driver, BootRepair.sys, originally associated with the Lenovo PC Manager utility, was discovered to be able to kill arbitrary processes at the kernel level. As the driver is legitimately signed and initially undetected, it can evade traditional security controls that rely on signature trust. #cybersecuritynews

🚨 Bu 10 GitHub reposu o kadar güçlü ki ücretsiz olmaları neredeyse yasadışı gibi duruyor. KAYDET ve PAYLAŞ 1. **AutoHedge** Python ile geliştirilmiş tam otonom bir hedge fund sistemi. Dört ayrı AI ajanı birlikte çalışıyor: Director yatırım tezleri üretiyor, Quant bunları doğruluyor, Risk Manager pozisyon büyüklüğünü hesaplıyor, Execution Agent ise emirleri piyasaya iletiyor. Solana blokzincirinde canlı işlem yapıyor. Tek komutla (`pip install -U autohedge`) kurulup hemen ticarete başlanabiliyor. Repo → github.com/The-Swarm-Corp… 2. **Vibe-Trading** Directed Acyclic Graph (DAG) mimarisiyle çalışan ileri seviye trading sistemi. 64 finansal beceri ve 29 uzman ajan swarm’ı içeriyor. Ichimoku, Elliott Wave, SMC, Black-Scholes, Greeks ve risk parity gibi profesyonel analiz yöntemlerini destekliyor. Kripto masasında likidasyon haritaları ve token unlock takibi gibi özellikler var. Ajanların stratejileri gerçek zamanlı tartışmasını izleyebiliyorsun. Repo → github.com/HKUDS/Vibe-Tra… 3. **Fincept Terminal** Bloomberg Terminal’in dizüstü bilgisayarda çalışan ücretsiz alternatifi. CFA seviye 1-2-3 analizleri, Buffett, Dalio, Soros gibi 20’den fazla ünlü yatırımcı ajanı ve 100’den fazla veri konektörü (Polygon, World Bank, IMF vb.) içeriyor. Bloomberg’in yıllık 24.000 dolarlık ücretine karşılık tamamen ücretsiz. Repo → github.com/Fincept-Corpor… 4. **LibreChat** ChatGPT’nin tüm modellerini, Claude, Gemini, DeepSeek ve 20’den fazla başka modeli tek arayüzde sunan self-hosted sohbet uygulaması. Veriler, geçmiş konuşmalar ve altyapı tamamen senin kontrolünde. OpenAI’nin aylık 20 dolarlık ChatGPT Plus’ına karşılık sıfır maliyetle kendi modellerini kullanabiliyorsun. Repo → librechat.ai 5. **Open Higgsfield AI** Kendi bilgisayarında çalışan tam teşekküllü bir AI sinema stüdyosu. Flux, Midjourney, Sora, Kling, Veo, GPT-4o gibi 200’den fazla modeli tek arayüzde birleştiriyor. Text-to-image, image-to-video, profesyonel kamera kontrolleri ve cinema modu mevcut. Abonelik yok, tüm veriler yerel kalıyor. Repo → github.com/Anil-matcha/Op… 6. **Open-LLM-VTuber** Offline çalışan, ekranını gören, sesini duyan ve hiçbir şeyi unutmayan Live2D AI companion. Düşünce süreci ayrı bir katmanda gösteriliyor. Pet modu ile masaüstünde serbestçe dolaşabiliyor. LLM’i tek satırda değiştirebiliyorsun. Repo → github.com/Open-LLM-VTube… 7. **Claude Ads** Claude Code için geliştirilmiş güçlü bir reklam optimizasyon skill’i. Google, Meta, YouTube, LinkedIn, TikTok ve Microsoft Ads’te 190 farklı denetim yapıyor. 6 paralel sub-agent aynı anda çalışıyor ve sonuçları gelir etkisine göre sıralıyor. Ajansların aylık 4.000 dolar aldığı işi ücretsiz yapıyor. Repo → github.com/AgriciDaniel/c… 8. **Agentic Inbox** Cloudflare’in açık kaynaklı AI ajanlı e-posta istemcisi. AI ajan inbox’ını okuyor, cevap taslakları hazırlıyor. Her mailbox kendi Durable Object’inde çalışıyor. E-postaların asla Cloudflare hesabından dışarı çıkmıyor. Tek tıkla deploy edilebiliyor. Repo → github.com/cloudflare/age… 9. **Camofox Browser** AI ajanlarını bot tespit sistemlerinden gizleyen, C++ seviyesinde spoofing yapan açık kaynak headless browser. Navigator, WebGL, AudioContext ve WebRTC gibi tüm izleri profesyonelce gizliyor. Erişilebilirlik ağacı çıktısıyla token maliyetini %90’a kadar düşürebiliyor. Repo → github.com/jo-inc/camofox… 10. **Hyperframes** HeyGen’in açık kaynak video framework’ü. Remotion’un yaptığı her şeyi React ve JSX olmadan yapıyor. AI ajan HTML yazıyor, framework MP4 render ediyor. GSAP, Lottie ve Three.js tam destekli. Aynı HTML her zaman aynı videoyu üretiyor. Repo → github.com/heygen-com/hyp… Bunlar oyuncak değil. Her biri hâlâ para ödediğin bir kurumsal ürünü doğrudan hedef alıyor. Birini seç. Kur. İş akışına entegre et. %100 ücretsiz. %100 açık kaynak.

keyboard_arrow_left Previous keyboard_arrow_right Next

⚠️ Critical Chrome Vulnerabilities Enable Remote Code Execution Attacks – Patch Now! Source: cybersecuritynews.com/critical-chrom… Google has released an urgent security update for Chrome, addressing 16 vulnerabilities, including two rated Critical, that could allow attackers to execute arbitrary code on affected systems. The Stable channel has been updated to 148.0.7778.178/179 for Windows and Mac, and 148.0.7778.178 for Linux, with the rollout expected to complete over the coming days. Use-after-free bugs are particularly dangerous because they allow threat actors to manipulate freed memory regions, often leading to full system compromise when successfully chained with other exploits. #cybersecuritynews #Chrome