Mpho Mathabathe-Mala

Mpho Mathabathe-Mala

@mphomala.bsky.social

Technology and Business for good 👩🏽‍💻💚: https://medium.com/@mphomathabathe

20 followers37 following157 posts

Mpho Mathabathe-Mala reposted

LaurieWired
@lauriewired.bsky.social

My CppCon Keynote, “The Address is Not The Place” is now up on YouTube! It’s not often that we get new tiers added to the memory hierarchy of computing, but it sure is fun! You can certainly get ahead of the curve by thinking about the programmatic challenges (and possibilities) this will cause.

Mpho Mathabathe-Mala
@mphomala.bsky.social

We are so back baby, 2.0! 🚀🥳 github.com/Green-Reliab...

github.comGitHub - Green-Reliable-Software-Budapest/Hack-for-Earth-Green-Fields-2026Contribute to Green-Reliable-Software-Budapest/Hack-for-Earth-Green-Fields-2026 development by creating an account on GitHub.
Mpho Mathabathe-Mala@mphomala.bsky.social

Several repeated visits to the mud pit enable the wasp to build its house - African Proverb. Happy Open source month hackers: github.com/Green-Reliab...

github.comGitHub - Green-Reliable-Software-Budapest/Hack-for-Earth-Green-AI-Hackathon-2025: Starter resources for Green Reliable Software. Hack for Earth Green AI Hackathon 2025: build green AI and use AI for g...Starter resources for Green Reliable Software. Hack for Earth Green AI Hackathon 2025: build green AI and use AI for green impact. - Green-Reliable-Software-Budapest/Hack-for-Earth-Green-AI-Hackath...
Mpho Mathabathe-Mala
@mphomala.bsky.social

Several repeated visits to the mud pit enable the wasp to build its house - African Proverb. Happy Open source month hackers: github.com/Green-Reliab...

github.comGitHub - Green-Reliable-Software-Budapest/Hack-for-Earth-Green-AI-Hackathon-2025: Starter resources for Green Reliable Software. Hack for Earth Green AI Hackathon 2025: build green AI and use AI for g...Starter resources for Green Reliable Software. Hack for Earth Green AI Hackathon 2025: build green AI and use AI for green impact. - Green-Reliable-Software-Budapest/Hack-for-Earth-Green-AI-Hackath...
Mpho Mathabathe-Mala
@mphomala.bsky.social

Sheesh! 🤕

InfoSec@infosec.skyfleet.blue

Hackers Turned Ethereum Into a Secret Messaging System for Malware

cybersecuritynews.comHackers Turned Ethereum Into a Secret Messaging System for MalwareA North Korea-linked malware campaign has found a way to keep infected computers connected to its operators. Instead of storing malware on Ethereum, the attackers hide the location of a control server inside cryptocurrency transfers. The campaign reaches developers through fake job offers, tainted code repositories and malicious software packages. Running the code can install a remote access tool and a credential stealer across Windows, macOS and Linux. Researchers from Ransom-ISAC identified the new Ethereum component in September 2026 samples of XCTDH. Ransom-ISAC said in a report shared with Cyber Security News (CSN) that the technique gives the malware another way to find its operator if other routes are disrupted. The operation was first documented in October 2025, but the researchers found its Ethereum signals began in June 2026. They counted 2,655 transactions over 90 days. The report does not establish how many computers were infected or how much data was stolen. Hackers Turned Ethereum Into a Secret Messaging System The method, called HashHiding by Ransom-ISAC, turns the recipient address of an Ethereum transfer into a tiny message. Its first four bytes represent the server’s internet address, and the next two represent its port. The remaining bytes contain a second endpoint and padding. That is different from placing full malware payloads in blockchain transaction data. These transfers carry no smart contract call or hidden script. Most move no cryptocurrency, while a few transfer a tiny amount to an address whose private key nobody is expected to control. The malware watches transactions sent from the operator’s signaling wallet. It scans recent Ethereum blocks through public access points, finds a matching transfer, decodes its recipient address and contacts the server it reveals. The server then supplies code that can rebuild the infection. Earlier reporting on malware servers hidden inside Ethereum transfers described a related method called NullReceiver. Kill Chain (Source – Ransom-ISAC) Ransom-ISAC credits that earlier public description, while tracing this separate campaign through its own on-chain collection. The distinction matters because a blockchain address here acts as a signpost, not a storage site for malware. The operator changed the encoded destination four separate times during the observed period. The first two signals pointed to the same internet address on different ports; later signals moved to another address range. One subsequent change altered only the final number of the server address, a shift that could escape blocklists. Multiple Paths Keep Malware Connected Ethereum is only one part of this operation. The initial loader checks transactions on TRON, with Aptos as a backup, to locate encrypted JavaScript stored in BNB Smart Chain transactions. That older route delivers code, while the Ethereum route supplies a fresh server location. The attack begins when a developer follows a fake recruitment prompt and runs a poisoned project or package. As JavaScript loaders hidden in repositories have shown, a project can carry code that contacts blockchain services after execution. Here, the hidden loader brings in later stages without an obvious malicious download link. The updated remote access tool can run commands, record keystrokes and watch the clipboard. A separate one-time stealer seeks browser information, password manager data, cloud storage credentials and cryptocurrency wallet material. Researchers counted 153 wallet targets and said stolen data leaves through a messaging bot interface. The Ethereum scanner starts alongside the remote access tool, not only after a connection fails. A hardcoded server location and the older cross-chain path also remain active. This parallel design means blocking one server or one blockchain access point may leave another route open. The broader risk resembles developer attacks using blockchain payloads , where a trusted-looking development task becomes the first step of compromise. Ransom-ISAC recommends watching for unexpected Ethereum block queries followed by unusual server connections and monitoring the signaling wallet for new destination changes. Teams investigating a suspected infection should also examine Node.js processes running evaluated code and review developer environments. Removing a known server alone is not enough if the malware can read a newer server address from public blockchain records and start the chain again. Indicators of compromise (IoCs):- Type Indicator Description C2 address 23[.]27[.]20[.]143:27017 Server and port listed for the October 2025 campaign. C2 endpoint 23[.]27[.]20[.]187:80 First observed Ethereum-encoded destination. C2 endpoint 23[.]27[.]20[.]187:443 Second observed Ethereum-encoded destination. C2 endpoint 181[.]214[.]149[.]147:443 Third observed Ethereum-encoded destination. C2 endpoint 181[.]214[.]149[.]148:443 Fourth observed Ethereum-encoded destination; the report also describes a port 80 dropper path on this IP. Encoded Ethereum recipient 0x171B14bB0050171b14Bb01BB398EAAB6441Fbd47 First observed destination, encoding the port 80 C2 endpoint. Encoded Ethereum recipient 0x171B14bb01bB171B14BB0050EB7f39C35C47E682 Second observed destination, encoding the port 443 C2 endpoint. Encoded Ethereum recipient 0xB5D6959301bbB5D69593005000FfABa8a5A2ADA2 Third observed destination. Encoded Ethereum recipient 0xB5D6959401bbb5D69594005000ff8C84e0b715b1 Fourth observed destination. Ethereum signaling wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 Sender of the observed beacon transactions. Wallet match pattern 33ff3edaf55a8e03dcbc7cb40d498a49 Partial sender address used by the scanner and detection rule. BSC sender 0x9bc1355344b54dedf3e44296916ed15653844509 Address reported as shared with the October 2025 campaign. BSC transaction hash 0x84e8cecd5b077eef530e7d69d546e2555199cb61759d1224d31cb31750788f62 Chain 1 payload leading to the RAT and Ethereum scanner. BSC transaction hash 0x610c9ec972545b8df6e3aaecc7a8ab5f2f2445cf0bfbd6ee026e618d07b29e22 Chain 2 payload leading to the dropper. TRON wallet TCqf6ZkaQD84vYsC2cuu1jRwB6JveTaRrF Chain 1 transaction pointer. TRON wallet TFMryB9m6d4kBMRjEVyFRbqKSV1cV2NcpH Chain 2 transaction pointer. TRON wallet TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP Example wallet cited for the earlier XCTDH flow. Aptos fallback 0x9d202c824402ca89e9aaccd2390b6f8b332ae743caa1469c695feb2781d56519 Chain 1 fallback identifier. Aptos fallback 0x3d2075f97b7b1e3234bd653779d21c605d7d8c6ec9c98d983880be5c7f4f9471 Chain 2 fallback identifier. XOR key 2\[gWfGj;<:-93Z^C Chain 1 BSC payload decryption key, shown exactly as extracted from the report. XOR key m6:tTh^D)cBz?NM] Chain 2 BSC payload decryption key. XOR key ThZG+0jfXE6VAGOJ Dropper-response decryption key. C2 path /init Port 443 endpoint returning the RAT and scanner. C2 path /$/boot Port 80 endpoint returning the encrypted dropper. C2 path /$/1 Port 80 endpoint returning OmniStealer. C2 path /boot Port 443 Ethereum recovery endpoint. Campaign marker global.i = '5-3-132' Marker in the initial code. Version marker /*RS260605*/ Ethereum scanner marker. Build marker B9=260924 OmniStealer build marker. User-Agent Python-urllib/3.13 User-Agent spoofed by the Node.js loader. HTTP header Sec-V Custom header on the dropper request. File name config.js Example poisoned repository file in the September chain. File name tailwind.config.js Example weaponized file in the earlier chain. File name boot.js Script returned during Ethereum-based recovery. RPC domain ethereum-rpc.publicnode.com Legitimate public Ethereum service named in the detection rule. RPC domain eth.drpc.org Legitimate public Ethereum service named in the detection rule. RPC domain blastapi.io Legitimate public Ethereum service named in the detection rule. RPC domain bsc-dataseed.binance.org Legitimate BSC service queried by the loader. Note:   IP addresses and domains are intentionally defanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC The post Hackers Turned Ethereum Into a Secret Messaging System for Malware appeared first on Cyber Security News .

Mpho Mathabathe-Mala reposted

InfoSec
@infosec.skyfleet.blue

Hackers Built a Botnet That Doesn’t Just Steal Data, It Burns AI Credits

cybersecuritynews.comHackers Built a Botnet That Doesn’t Just Steal Data, It Burns AI CreditsA Windows botnet called x47.c can spend victims’ paid AI credits, steal data, and flood websites. Its operator markets it as an attack toolkit for remote use, but the evidence describes advertised capabilities, not confirmed widespread infections or documented victims. The botnet gives operators control of infected Windows machines and can collect browser passwords, cookies, and Discord tokens. Researchers have not established how it first infects those machines. Its advertised attacks threaten online services and paid AI accounts. Analysts at Qrator Labs identified the offering during routine threat hunting. Qrator Labs said in a report shared with Cyber Security News (CSN) that seller WraithTools advertised 18 attack methods, including one meant to consume paid AI credits. An August 3, 2026 advertisement lists a $200 base package, a $150 DDoS add-on, and a $950 full package. Researchers reported no infection count, measured attack capacity, or verified losses. The risk is the combination of theft, service disruption, and billing abuse. Hackers Built a Botnet The AI drain feature requires a valid API key for the account being charged. This key lets software request services without a person signing in. The operator provides a model name, then bots send requests directly to an AI provider. The documented mode supports OpenAI, xAI, and compatible chat APIs, but it cannot bill an account without a valid key belonging to that account. x47.c platform overview and included components (Source – Qrator Labs) Accepted requests consume credits or generate charges. Researchers call this a denial of wallet risk: the website may stay online while its AI features fail if the provider stops requests at a balance or spending limit. Possible targets include chatbots, content management systems, trading bots, and scanners. Automatic top-ups could extend charges beyond a prepaid balance. Unlike website floods, these requests bypass the target website, so filtering its traffic cannot stop them. Although the seller advertises theft of wallets and AI-site tokens, the drain command still requires an operator-supplied account key. The report does not show the bot automatically converting stolen AI-site tokens into usable provider keys for this attack mode. That distinction matters: AI token jacking cases illustrate the danger of exposed keys, but do not establish how this botnet gets them. The wider financial risk is real. In a stolen Gemini API key case , unauthorized use generated more than $82,000 in two days. That separate incident does not establish losses from x47.c. Control, theft and defenses The panel also offers HTTP floods, slow connections, TCP and UDP floods, and other service disruption methods. The documented methods include TLS connection stress and reflection attacks that aim to overload network services. Each bot reportedly runs one attack at a time. Researchers found no tests supporting advertised protection bypasses. Bots remember a working command server and try alternatives if it fails. The panel shows six domains and eight IP addresses without publishing their values. This resembles fast flux infrastructure used to sustain malicious connections, although several names may point to one server. Attack methods (Source – Qrator Labs) An AI-assisted stealth module reportedly uses xAI Grok to assess a host and select preset maintenance actions. Startup entries and scheduled tasks support persistence; fallback actions work if the model call fails. AI does not choose attack targets; the operator remains responsible for selecting them. Other modules collect browser data and turn infected machines into SOCKS5 traffic relays. Operators can review stolen material, manage proxies, and update software on a compromised host. The relay sends traffic out through the victim’s network, potentially hiding where the operator actually sits. One infection therefore threatens both accounts and networks. Defenders should isolate infected systems, remove persistence, and investigate stolen passwords, cookies, and tokens. Revoke exposed credentials because cleanup cannot undo theft. Compare AI usage against bills, rotate compromised keys, and limit spending and automatic top-ups. Finally, prepare for application and network floods. The report documents attack options, not successful campaigns or proven performance. Its warning is that access to a paid AI account can become another resource attackers exhaust, even when a website remains available. Indicators of compromise (IoCs):- Type Indicator Description Seller username WraithTools Name used to advertise the botnet. Advertised product x47.c, Fast Flux Edition v4.1 Product identifier in the source material. Panel title x47 Fast Flux C2GUI v4.1 Title shown on the operator panel. Package directory x47.c_FF_v4.1 Documented package directory. Executable filename x47_bot.exe Documented EXE output. DLL filename x47_bot.dll Documented DLL output. Server script filename server_master.js Documented command-server script. Relay handshake prefix REVERSE_PROXY\| Documented reverse-proxy handshake prefix. Note:   IP addresses and domains are intentionally defanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC The post Hackers Built a Botnet That Doesn’t Just Steal Data, It Burns AI Credits appeared first on Cyber Security News .

Mpho Mathabathe-Mala reposted

LaurieWired
@lauriewired.bsky.social

Replying to @lauriewired.bsky.social

Here's the link to the library I created, I think it's a pretty neat implementation of reflection, performant too! Handily beats rttr and metapp. Tried to mirror the latest C++26 static reflection API so it's clean and easy to use! github.com/LaurieWired/...