tirreno

tirreno tirreno는 보안 프레임워크입니다. tirreno tir.ˈrɛ.no는 제품을 위협, 사기 및 남용으로부터 이해, 모니터링 및 보호하는 데 도움을 줍니다. 기존 사이버 보안이 인프라와 네트워크 경계에 초점을 맞추는 반면, 대부분의 침해는 손상된 계정과 방화벽, SIEM, WAF 및 기타 방어 체계를 우회하는 애플리케이션 로직 남용을 통해 발생합니다. tirreno는 위협이 실제로 발생하는 곳, 즉 제품 내부에서 감지합니다. tirreno는 수제로 작성되었으며 의존성이 적고 "로우테크"인 PHP/PostgreS...

fraud-bridge

소개 fraud-bridge 는 ICMP, NTP 또는 DNS IPv4 또는 IPv6를 통해 터널을 설정하여 직접 TCP 또는 UDP 연결을 차단하는 제한적인 검열 환경을 우회하는 데 도움을 줍니다. 자동으로 TCP MSS 옵션을 패치하여 비분할 패킷 스트림MSS-클램핑이라고 함을 달성해 브리지를 통한 웹 세션 사용 성능을 향상시킵니다. 터널을 악의적인 삽입 TCP 패킷으로부터 보호하기 위해 MD5HMAC-무결성 보호를 사용합니다. 프라이버시가 필요하다면 직접 암호화를 사용해야 합니다. 어차피 터널 위에 SSH를 사용할 것으로...

Gpt-Agreement-Payment

简体中文 | English Gpt-Agreement-Payment ChatGPT Plus / Team 구독 프로토콜의 종단간 재생 도구: 패킷 캡처로부터 Stripe Checkout → PayPal / GoPay / QRIS → ChatGPT manual-approval → Codex OAuth + PKCE 전체 체인을 역추적하여 실행 가능한 클라이언트로 구현했습니다. 완전히 새로 구현한 hCaptcha 시각적 솔버, PayPal 리스크 조기 종료 분기, 실제 운영 데이터를 수집한 사기 탐지 메커니즘의 실증 데이터 세트를...

tpotce

T-Pot - The All In One Multi Honeypot Platform T-Pot is the all in one, optionally distributed, multiarch amd64, arm64 honeypot plattform, supporting 20+ honeypots and countless visualization options using the Elastic Stack, animated live attack maps and lots of security tools to further improve...

public-research

공개 연구 위협 인텔리전스, 핑거프린팅, 사기 탐지에 관한 오픈소스 연구 및 발표 발표 10/25/2024 - Anti-Fraud W3 커뮤니티 그룹 - 리지덴셜 프록시의 경험적 분석 03/27/2025 - Anti-Fraud W3 커뮤니티 그룹 - 핑거프린트 사칭 완화 10/23/2025 - TLP:AMBER Anti-Fraud W3 커뮤니티 그룹 - 2025년 리지덴셜 프록시 환경 04/07/2026 - TLP:AMBER M3AAWG - 리지덴셜 프록시를 지원하는 봇넷 생태계 기사 09/09/2025 -...

CVE-2026-21010-VoIP-SIP-Digest-Authentication-Replay

CVE-2026-21010 – VoIP SIP ダイジェスト認証リプレイ プログラムコード（Python SIP シミュレータ） root@kitploit: sipserversim.py - SIP server that accepts replayed authenticated requests from flask import Flask, request app = Flaskname Simulated nonce storage: doesn't track used nonces usednonces = set @app.route'/call',...

CVE-2026-77999 Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6

Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - The PayPal IPN listener's signature check validateIPN accepted UNVERIFIED and any non-INVALID response as valid, made its verificati...

PT-2026-85010

Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - The PayPal IPN listener's signature check validateIPN accepted UNVERIFIED and any non-INVALID response as valid, made its verificati...

CVE-2026-77999: External Control of Assumed-Immutable Web Parameter

Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - The PayPal IPN listener's signature check validateIPN accepted UNVERIFIED and any non-INVALID response as valid, made its verificati...

North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales

Threat actors with ties to the Democratic People's Republic of Korea aka DPRK or North Korea have been observed seeking job opportunities beyond the information technology IT sector, with recent investigations identifying suspected workers employed in sales and marketing and the medical professio...

INTERPOL Operation Jackal IV Arrests 58, Identifies 263 in Global Cyber Fraud Crackdown

An eight-month INTERPOL operation targeting West African organized crime groups has led to arrests of 58 people and the identification of 263 suspects. "The operation, which brought together 22 countries from six continents, is a response to the escalating global threat posed by West African...

UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit

Cybersecurity researchers have disclosed details of a Chinese-speaking cybercrime group dubbed UAT-10147 that's targeting Windows and Linux web servers globally across the education, media, technology, and gaming sectors. The vast majority of the targets are located in Brazil, Bolivia, China,...

Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet

Cybersecurity researchers have flagged a new malware family that's specifically designed to infect Android-based vehicle head unit firmware developed by DoFun. Kaspersky, which discovered the threat in June 2026, said the end goal of the malware is to serve a multi-stage downloader to enable ad...

CVE-2026-16650

The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment...

The invisible passenger in your car

While monitoring Android threats in June 2026, we discovered a new piece of Android malware. What struck us as unusual was that it installed like an ordinary user app yet made no attempt to disguise itself as legitimate software: it had no user interface at all. This led us to suspect the app mig...

CVE-2026-16577

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against the vendor's actual outstanding balance when recording a reverse-withdrawal payment, allowing a vendor to credit their reverse-withdrawal...

Security Bulletin: IBM Cyber Fraud includes components with multiple known vulnerabilities

Summary IBM Cyber Fraud includes components with known vulnerabilities. These have been addressed in the update. Vulnerability Details CVEID:CVE-2026-66010 DESCRIPTION: DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via...

Your polite reply to that text is worth $2 on the dark web

Most wrong-number texts are harmless. Some are the first step in a carefully planned scam. By replying, you may be confirming that your number is active and that you're willing to engage with strangers, making you a more valuable target for future fraud. Here's why a polite response can be worth...

CVE-2026-74244

A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint without validating the Stripe-Signature header. Successful exploitation can lead to th...

China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud

The China-linked threat actor known as Jewelbug has been observed carrying out cyber espionage operations targeting governments and militaries, while simultaneously engaging in cryptocurrency fraud. "Both missions are administered from a single control panel, XG-Web , a browser-centric...