Jérôme Segura

New: ShinyHunters says it’s fighting with cl0p and the threat researchers that follow these actors are *very* eager to see what’s next. With @ajvicens.bsky.social: www.reuters.com/legal/govern...

NEW: I spoke to cybersecurity legend Mikko Hyppönen about his decades-long fight against computers viruses first, and then malware — and how computers have gotten safer over time. Mikko also told me why he has decided to now turn his focus to fight another enemy: killer drones.

Bots are adding to the already obvious RAM scarcity problem. datadome.co/threat-resea...

mitmproxy 12 is out! 🚀 It’s now possible to modify the prettified representation of binary protocols. Editing Protobufs is now as easy as editing YAML, no .proto schema needed. 🙌 mitmproxy.org/posts/releas...

2025-04-22 (Tuesday): Always fun to find the fake CAPTCHA pages with the "ClickFix" style instructions trying to convince viewers to infect their computers with malware. Saw #StealC from an infection today. Indicators at github.com/malware-traf...

Crooks doing quality control the hard way 😂 console.log("!!!WORKING!!!") #skimming #ecommerce

“Attack techniques so stupid, they can’t possibly succeed… except they do!”, The Unwitting Accomplice textslashplain.com/2024/06/04/a...

Understanding (and debugging) SmartScreen/Network Protection textslashplain.com/2025/04/07/u...

Fake PuTTy, signed "Eptins Enterprises Llp" Sets scheduled task "Security Updater" and checks into IP address: 185.196.10.127 Triage: tria.ge/250401-wnbad... www.virustotal.com/gui/file/7ca... @jeromesegura.com

If you manage #wordpress sites using #managewp, watch out for this #phishing campaign via #googleads. -> menagewp[.]com (ad URL and redirect) -> orion[.]manaqewp[.]com (phishing page)

Malicious ads target Semrush users to steal Google account credentials 📖 Read more: www.helpnetsecurity.com/2025/03/21/m... #cybersecurity #cybersecuritynews #accountcredentials #SEO @malwarebytes.com @jeromesegura.com @semrushofficial.bsky.social

Scammers are happily abusing multiple platforms at once thanks to lack of controls. Who's going to protect users here? Google? Facebook?

PayPal’s “no-code checkout” abused by scammers www.malwarebytes.com/blog/scams/2... #malvertising #techsupportscams

SecTopRAT bundled in Chrome installer distributed via Google Ads 📖 www.malwarebytes.com/blog/news/20... ⚠️ sites[.]google[.]com/view/gfbtechd/ chrome[.]browser[.]com[.]de/GoogleChrome.exe #malvertising #SecTopRAT

If you are a developer and use #homebrew, beware of this fraudulent ad on Google. ⚠️ Fake site: brewsh[.]org Malicious curl command: hxxps[://]raw[.]brewsh[.]org/Homebrew/install/HEAD/install[.]sh Atomic Stealer (AMOS): www.virustotal.com/gui/file/389... ⚠️ #malvertising #atomicstealer

ClickFix vs. traditional download in new DarkGate campaign www.malwarebytes.com/blog/news/20... #ClickFix #malvertising

Microsoft advertisers phished via malicious Google ads www.malwarebytes.com/blog/news/20... #malvertising #googleads #microsoft #bing

Imagine for a moment that Google allowed a sponsored link to a phishing site for Google ads... www.malwarebytes.com/blog/news/20... #GoogleSearch #GoogleAds #malvertising #phishing

Malicious Google ad for Virtuals Protocol ⚠️ virtnals[.]com #malvertising

Malicious Google ad for Aerodrome Finance ⚠️ aeroclrome[.]finance #malvertising

Malicious Google ad for #Freecad ⚠️ freecad3dmodeling[.]com freecad3d-download[.]com hxxps[://]3d-digitals[.]org/downloads/guthub/FreeCAD_Setup_2[.]0[.]74_win_x64[.]zip #malvertising

‘Fix It’ social-engineering scheme impersonates several brands www.malwarebytes.com/blog/news/20...

Malicious Google ad for Netflix ⚠️ +1[-]877[-]906[-]4471 #malvertising

Malicious Google ad for onshape 3D ⚠️ onshapeservices[.]com #malvertising

Malicious Google ad for Freecad ⚠️ freecad3design[.]com #malvertising

Malicious Google ad for Rhino 3D ⚠️ rhino3ddev[.]net #malvertising

Malicious Google ad for m⁣y⁣N⁣Y⁣LG⁣B⁣S⁣⁣ ⚠️ bluehome[.]uk essnewyorkplatform[.]com #malvertising

Malicious Google ad for PayPal ⚠️ hxxps[:]//repairsexpert[.]online/services/ #malvertising

Malicious Google ad for Malwarebytes ⚠️ hxxps[://]sites[.]google[.]com/view/dexters-antivirus/home #malvertising

Malicious Google ad for New York Life ⚠️ alicehotels[.]com[.]ng eddutvolkinang[.]com/online/ #malvertising #phishing

A fraudulent Google ad meant to phish employees for their login credentials redirects them to a fake browser update page instead. #malvertising #phishing #SocGholish 🔗 www.malwarebytes.com/blog/news/20...

Malicious Google ad for Kaiser Permanente ⚠️ bellonasoftware[.]com #malvertising

Malicious Google ad for Grammarly ⚠️ grammarly[.]pc-download[.]live #malvertising

Malicious Google ad for Planner 5D ⚠️ planner5ddevelop[.]com #malvertising

Malicious Google ad for eBay ⚠️ fbdecors[.]online #malvertising

Malicious Google ad for PayPal ⚠️ https[:]//sites[.]google.com/view/pay-pal-helpcustomerservic/ #malvertising

Malicious Google ad for Microsoft ⚠️ hxxps[://]sites[.]google[.]com/view/micrlochus1011/home #malvertising

Malicious Google ad for HP ⚠️ vijtechnologies[.]store/result-page/

Malicious Google ad for HP ⚠️ Scammers' number: +1[-]844[-]954[-]54O4 #malvertising

Malicious Google ad for eBay ⚠️ Scammers' number: +1[-]888[-]747[-]9547 #malvertising

Malicious Google ad for PayPal ⚠️ hxxps[://]sites[.]google[.]com/view/womens-v-neck-cable/home #malvertising

Malicious Google ad for Onshape 3D ⚠️ onshape3d[.]org

Malicious Google ad for Freecad ⚠️ frecadsolution[.]net #malvertising

Malicious Google ad for Notion ⚠️ notion[.]downloads[.]com[.]pl/ notion[.]downloads[.]com[.]pl/Notion[.]exe #malvertising

Malicious Google ad for Rhino 3D ⚠️ rhino3dblog[.]net recad3dsolutions[.]org/setup/index[.]php calibrebook[.]org/downloads/Installer-8[.]39-win-x64[.]zip #malvertising

Malicious Google ad for Freecad ⚠️ frecad3dsolutions[.]org calibrebook[.]net/downloads/FreeCAD-Installer-4[.]5[.]089-win-x64[.]zip #malvertising

Malicious Google ads for Planner 5D ⚠️ planner5design[.]org planner5design[.]com calibrebook[.]net/downloads/Installer-8.39-win-x64.zip #malvertising

Malicious Google ad for Calibre ebook reader ⚠️ https[:]//calibrebook[.]com/downloads/Calibre-Installer-8.39-win-x64.zip #malvertising

Malicious Google ad for Planner 5D ⚠️ planner5design[.]net calibrebook[.]net/downloads/Installer-8.39-win-x64.zip #malvertising

Malicious Google ad for New York Life Landing page: urlscan.io/result/71763... #malvertising