Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Noodlophile Stealer, first detailed in our previous analysis (New Noodlophile Stealer Distributes Via Fake AI Video Generation Platforms), has evolved into a highly targeted threat exploiting enterprises with significant Facebook footprints.

The Noodlophile Stealer is a malware strain that has evolved from its initial distribution via fake AI video generation platforms to a more targeted and sophisticated threat. It now specifically targets enterprises with significant social media footprints, particularly on Facebook. The attack vector involves copyright phishing campaigns designed to lure victims into executing malicious payloads. The malware leverages DLL sideloading techniques (T1073) to evade detection and gain persistence on infected systems. It also employs process injection (T1055) and command execution (T1059) tactics to maintain stealth and execute arbitrary code. The use of spear phishing (T1566) indicates a high degree of targeting and social engineering sophistication. The malware is written in Python, which may facilitate rapid development and obfuscation. The threat actors behind Noodlophile use Telegram as a command and control or communication channel, suggesting a preference for encrypted and less-monitored platforms. The malware’s persistence mechanisms (T1503) ensure it remains active on compromised hosts, increasing the risk of data exfiltration and lateral movement within enterprise networks. The focus on enterprises with Facebook footprints implies that attackers perform reconnaissance on social media to identify valuable targets, increasing the likelihood of successful phishing attempts. This evolution marks a shift from opportunistic to targeted attacks, increasing the threat’s potential impact on organizations with a strong social media presence.

MD5 of d0b0551e8988a9f81b80933ec68efabb47cd12acaeffa79c42564863424a376e

SHA1 of d0b0551e8988a9f81b80933ec68efabb47cd12acaeffa79c42564863424a376e

Detailed information about Noodlophile Stealer Evolves: Targeted Copyright Phishing Hits Enterprises with Social Media Footprints. Get real-time updates, techni

Noodlophile Stealer Evolves: Targeted Copyright Phishing Hits Enterprises with Social Media Footprints - Live Threat Intelligence - Threat Radar | OffSeq.com

Noodlophile Stealer Evolves: Targeted Copyright Phishing Hits Enterprises with Social Media Footprints

Threats Tagged 'select'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'select'

Lead Pen Test Professional