killvxk

IOCs

Stealers observed in the DriveSurge campaign (Silent Push: ClickFix + fake update driveby attacks on thousands of compromised sites). Two stage macOS malware with dedicated arm64 (Apple Silicon) and x86_64 (Intel) builds, obfuscated bash loader → ~30MB Garble Obfuscated Go stealer. Steals 100+ crypto wallets, macOS Keychain, browser creds/cookies, SSH/GPG keys. Patches Atomic Wallet & Exodus Electron apps to intercept passwords. Shows fake Ledger Live / Trezor Suite "security update" dialogs to phish 24-word seed phrases. Persistence via LaunchAgent + ~/.persistenced.

C2 / Telemetry Servers (POST /api/t)

http://89.208.97.111:8133/api/t
http://45.155.71.15:8133/api/t
http://213.165.42.172:8133/api/t

This is for iOS 26+ only. Read mineek's secret.txt for more info.

I didn't plan to release this that early, but as iOS 27 has already nuked partial restore; and A12/A13 being jailbreakable (including A12 iPads EOL at 26) as soon as a new kernel exploit drops, there is not much to lose.

MissedRevoke

^{(the "secret.txt" for iOS 26)}

iOS has had a long time storing revocation details in separate plists, it was trivially bypassable by zeroing and chflags immutable on them. Since iOS 26.0b2, all of these files have been migrated to mis.db.

Certighost (CVE-2026-54121)

Authors: @h0j3n, @aniqfakhrul
Date: July 24, 2026

Certighost is an Active Directory Certificate Services (AD CS) vulnerability that allowed a low-privileged domain user to impersonate a Domain Controller and achieve domain compromise in the tested AD CS configuration. The issue was addressed in the July 2026 security updates.

The vulnerable path is an AD CS enrollment fallback known as a chase during directory-object resolution. By supplying request attributes such as cdc, an attacker could cause the Certification Authority (CA) to ask an attacker-controlled host for identity data belonging to a Domain Controller. The CA then used that data while issuing a certificate.

	[dynamic: ToInstance, Description(".NET Common Language Runtime"), Guid("{e13c0d23-ccbc-4e12-931b-d9cc2eee27e4}"), locale("MS\0x409")]
	class CLRTrace : EventTrace
	{
	};

	[dynamic: ToInstance, Description("CLR StrongNameVerification"), Guid("{15447A14-B523-46ae-B75B-023F900B4393}"), DisplayName("CLR StrongNameVerification"), locale("MS\0x409")]
	class CLRStrongNameVerification : CLRTrace
	{
	};

	[dynamic: ToInstance, Description("Windows Kernel Trace"), Guid("{9e814aad-3204-11d2-9a82-006008a86939}"), LOCALE("ms_409")]
	class MSNT_SystemTrace : EventTrace
	{
	[Description("Enable Flags"),
	ValueDescriptions{"Process creations/deletions", "Thread creations/deletions", "Image load", "Process counters", "Context switches", "Deferred procedure calls", "Interrupts", "System calls", "Disk IO", "File details", "Disk IO entry", "Dispatcher operations", "Page faults", "Hard page faults", "Virtual memory allocations", "Network TCP/IP", "Registry details", "ALPC", "Split IO", "Driver delays", "Sample based profiling", "File IO completion", "File IO"},
	DefineValues{"EVENT_TRACE_FLAG_PROCESS", "EVENT_TRACE_FLAG_THREAD", "EVENT_TRACE_FLAG_IMAGE_LOAD", "EVENT_TRACE_FLAG_PROCESS_COUNTERS", "EVENT_TRACE_FLAG_CSWITCH", "EVENT_TRACE_FLAG_DPC", "EVENT_TRACE_FLAG_INTERRUPT", "EVENT_TRACE_FLAG_SYSTEMCALL", "EVENT_TRACE_FLAG_DISK_IO", "EVENT_TRACE_FLAG_DISK_FILE_IO", "EVENT_TRACE_FLAG_DISK_IO_INIT", "EVENT_TRACE_FLAG_DISPA

	<?xml version="1.0" encoding="utf-8"?>
	<configuration>
	<system.diagnostics>
	<trace autoflush="true" />

	<sources>
	<source name="System.Net" switchValue="Verbose">
	<listeners>
	<add name="netlog" />
	</listeners>

	//
	// dotdot.m
	// dotdot
	//
	// Created by roooot on 03.08.26.
	// Copyright (C) 2026 roooot
	//
	// This program is free software: you can redistribute it and/or modify
	// it under the terms of the GNU Affero General Public License as published
	// by the Free Software Foundation, either version 3 of the License, or

	#!/usr/bin/env python3
	"""
	Scan and harden package-manager release-age gates.

	This script is intentionally self-contained: it uses only the Python standard
	library and writes only user-level config files. It covers the package-manager
	ecosystems inventoried by Perplexity Bumblebee plus additional common language
	package managers.

	Native age gates currently handled in harden mode:

	/*
	* gro_frag.c — LPE via GRO managed-frag UAF (io_uring SEND_ZC + veth)
	*
	* The bug: skb_gro_receive() copies frag descriptors from a ZC skb
	* (SKBFL_MANAGED_FRAG_REFS → no per-frag page refs) into a non-ZC
	* GRO accumulator. When the accumulator is freed, skb_release_data()
	* calls put_page() on each frag — including the stolen ones that never
	* had get_page() called. This gives us one extra put_page per merged
	* ZC frag: a refcount underflow.
	*

	#!/usr/bin/env python3
	"""Claude Code status line: API-rate cost estimate (session / today)."""
	import json
	import sys
	import glob
	import os
	import datetime as dt

	# USD per 1M tokens: (input, output, cache_write_5m, cache_read)
	# Source: platform.claude.com/docs/en/about-claude/pricing