-
Polish “Powiadomienie” JS Campaign — Credential Theft via FTP Exfiltration
A 3.6 MB JavaScript file, hardened with `javascript-obfuscator` — rotated string arrays, index decoders, 53 dead dispatcher functions, a catastrophic backtracking regex trap — ends with a plaintext FTP upload of your saved browser passwords. The entire malicious activity: 3 seconds. Join…
-
The 1.7 MB CAPTCHA — How a Fake Human Verification Check Delivered Two RATs
A fake CAPTCHA — 1.7 MB of React 19 served from a .top domain — tricks a visitor into pressing Win+Rand pasting PowerShell. No browser sandbox escape needed. No exploit. Just social engineering. What follows is a 6-stage infection chain: The full…
-
Hunting Lazy OPSEC: Spotting Default C2 Certificates with DuckDB and Zeek
Threat actors love to reuse tools, and sometimes, they get lazy. Case in point: AsyncRAT and its notorious fork, DcRAT. These remote access trojans often ship with default, self-signed certificates. If the operators don’t bother to swap them out before deploying their…
-
Beyond the Grep: Hunting Malware with Zeek and DuckDB SQL
Hunting through raw Zeek logs just got a massive upgrade. If you’ve spent years in the SOC, you’ve likely built up a library of complex awk chains and grep commands to parse Zeek data. It works, but it’s brittle and hard to…
-
How I Used Gemini To Fix My Terrible Zeek Documentation
I built a Zeek-based Amadey malware detector… and then absolutely did NOT document it. https://github.com/keithjjones/zeek-amadey-detector So instead of fixing my own mess, I made Gemini do it. In this video: If your docs look like ancient hieroglyphics carved during a power outage,…
-
Fix NoMachine’s CAPS LOCK Reversal Bug
I was recently trying to connect to a remote NoMachine host, and the sense of caps lock was reversed compared to my local machine. This happens if your caps was on when you connected to a NoMachine host where the caps was…
-
Keith Jones’ Journey As Expert Digital Forensics Expert To AI Malware Researcher
Had a great time as a guest on the Security Unfiltered Podcast, talking about work-life balance in cybersecurity—especially for parents. We covered how remote work has shifted expectations, the challenge of growing your career while raising a family, and how AI is…
-
Manually Download MacOS Sequoia
Apple’s macOS updates are typically seamless through the App Store, but sometimes, a bug can throw a wrench in the process. I recently encountered this firsthand when updating one of my Macs to macOS Sequoia. No matter what I did, the App…
-
Drone Flight @ BWI Airport Sept 8, 2024
Enjoy some runway 33L activity at the Baltimore Washington International Airport in Maryland. The FAA authorized me to fly and photograph airport activity with my part 107 commercial drone license.
-
Detect STRRAT Malware With Zeek And Suricata
Join me in learning how to detect the STRRAT malware family with Zeek and Suricata. Corelight Blog: https://corelight.com/blog/newsroom/news/strrat-malware Source Code: https://github.com/corelight/zeek-strrat-detector 00:00:10:18 – 00:00:37:17Dr. Keith JonesHey, welcome. We’re going to talk about how to detect STRRAT, which is a malware family. This…