I'm watching some folks reverse engineer the xz backdoor, sharing some *preliminary* analysis with permission.
The hooked RSA_public_decrypt verifies a signature on the server's host key by a fixed Ed448 key, and then passes a payload to system().
It's RCE, not auth bypass, and gated/unreplayable.
U.S. and French fake document generator
/spiceleads.cc
#scam #phishing @nytimes @washingtonpost.com @news-feed.bsky.social @infosec.skyfleet.blue
watch out, l is not i, info is not com, and
/twlitter.info is not
/twitter.com
#phishing
XSS #phishing
text.is/3KW7
watch out, fake @interpol.bsky.social #scam domain
/get-return.org
#scam #phishing
Public awareness is key to preventing
pig butchering #scam
www.youtube.com/watch?v=nDg2...
watch out, fake @interpol.bsky.social survey #scam domain
/internatinallhelp.org/form?p=413756227707060
#scam #phishing
hey what’s up, I’m illegalFawn and can help you in disrupting #phishing and #scam schemes, just tag me in your posts
