Nad

Nad

@nadsec.online

Hacker (the good kind[mostly]). Breaking things, fixing them, then breaking them again. AI, robotics, honeypots, and whatever else keeps me up at night https://github.com/Rat5ak https://medium.com/@Nadsec https://x.com/Nadsec11

71 followers121 following191 posts

Pinned

Nad
@nadsec.online

Kernel Analysis now available for Coruna malware Blog post and full technical analysis of the whole chain also updated significantly. -Corrections made www.nadsec.online/blog/coruna www.nadsec.online/blog/coruna-... github.com/Rat5ak/CORUN... www.nadsec.online/blog/coruna-...

nadsec.onlineInside Coruna: Reverse Engineering a Nation-State iOS Exploit Kit | NadSecDeep-dive into Coruna - a nation-state iOS exploit kit reverse-engineered from obfuscated JavaScript. WebKit RCE, PAC bypass, JIT cage escape.
Nad
@nadsec.online

FYI; Anthropic/OAI gives some open-source fixers extra access beyond standard CVP. My account shows Defender access plus work-specific tweaks. If you only publish exploits, don't expect the same. Start with obliterated models, use frontier models to patch, then request adjustments backed by PRs.

Nad
@nadsec.online

What a joke. 1000 dollars in credits doesn’t even come close. I gave y’all 700 dollars and y’all delivered 300 dollars worth of usage. 1000 in credits must only equate to about 1/4 of the usage I have lost.. if that. You guys are scamming people on a colossal scale.

Nad
@nadsec.online

Which ever country made this junk malware.. Ya'll should be ashamed. 4/10 only cause it does actually work and somehow evades EDR.. Whichever EDR vendor this was, just don't. Don't anymore. www.nadsec.online/blog/majlis-...

nadsec.onlineMajlis 2026 Invitation RAT: OTP 123456 and a Snowy Village | NadSecRobert pulls apart the Majlis 2026 invitation RAT: a WebDAV and FTP delivery chain, two command channels, nine tested commands, a screenshot bug, and one deeply unhelpful holiday photo.
Nad
@nadsec.online

Rascals

Catalin Cimpanu@campuscodi.risky.biz

The Bitget hackers "exploited a zero-day in a third-party security product to obtain valid admin credentials, then deleted traces after injecting fraudulent withdrawal commands into wallet backend systems." www.theblock.co/news/regulat...

theblock.coBitget attacker tested risk controls with small transfers before $388 million theft, CEO saysBitget's user protection fund will absorb the $388 million loss and be replenished to at least $300 million within a week, CEO Gracy Chen says.
Nad
@nadsec.online

There it is.. one day ppl gonna listen to me 🤣🤣🤣🤣

Nad@nadsec.online

New Cisco zero day finna drop in the next month. Gonna start being used for in the wild exploitation in 2 weeks and will be publically disclosed within 2-3 weeks following. Good luck out there.

Nad
@nadsec.online

Found dupe glitch in an gringo currency type web3 type bs thing. The robot out here printing it's own money.

Nad
@nadsec.online

New Cisco zero day finna drop in the next month. Gonna start being used for in the wild exploitation in 2 weeks and will be publically disclosed within 2-3 weeks following. Good luck out there.

Nad
@nadsec.online

If Claude was a person, he’d be riding a Surron electric motorcycle through a school zone at 150kmph at 3PM on a weekday.

Nad
@nadsec.online

Watching botnets smack my honeypot infra is pure art. Unfiltered, aggressive, unrelenting yet beautifully creative. The chaos of human intent encapsulated in automated fighting robots. A digital terrarium of nerds wading through a sea of shit nobody asked for, simply because they can.

Nad
@nadsec.online

CVE-2026-66804 - Windows Cross Device Service LPE - Writeup & PoC Found another cool one! www.nadsec.online/blog/cve-202... Not sure who found it first, but shoutout to them. Despite not being FTF, my mom thinks this one is cool, which is the only important metric 😎

nadsec.onlineCVE-2026-66804: Cross Device Virtual Camera to SYSTEM | NadSecA missing ProgramData COM path lets a standard user plant the Cross Device virtual-camera DLL, reach LOCAL SERVICE, and obtain SYSTEM.

Nad reposted

Catalin Cimpanu
@campuscodi.risky.biz

Also this: www.artsprofessional.co.uk/news/breakin... And this: www.cse.org.uk/news/beacon-...

maxsec.bsky.social@maxsec.bsky.social

Massive CRM used by many UK charities hacked . @campuscodi.risky.biz @grahamcluley.com BBC News - English National Ballet suffers customer data hack www.bbc.co.uk/news/article...

bbc.co.ukEnglish National Ballet suffers customer data hackENB said it was "so sorry" and is warning customers to be cautious of unexpected emails.
Nad
@nadsec.online

CVE-2026-50343 - InstallService Windows local privilege Escelation - Writeup and POC Found another cool one! www.nadsec.online/blog/cve-202... Not sure who first to find was, but shoutout to them. Despite not being FTF, my mom thinks it's cool and that's all that matters 😎

nadsec.onlineCVE-2026-50343: InstallService StaticPluginMap to SYSTEM | NadSecA standard user controls plugin state consumed by Microsoft InstallService, then uses a public WinRT trigger to reach SYSTEM DLL loading.
Nad
@nadsec.online

I’m so 30 that I’ve started drinking oat milk in my coffee. I didn’t sign up for this.

Nad
@nadsec.online

Linus Torvalds is the original vibe coder. That guy's been vibe coding for atleast a decade. Legit, he been prompting humans this whole time. Barely writes any code himself. Crazy

Nad
@nadsec.online

The irony of using a non-deterministic robot with system level privileges, an internet connection and a track record of flying off the rails to find software vulnerabilities in the name of security… I was promised hoverboards. That’s all I have to say.

Nad
@nadsec.online

I just realised old school C2s in the command line are about to come back. AI ain’t all bad.

Nad
@nadsec.online

If ya didn’t want me to order parts for an F18 to my house yall shouldn’t have put the damn portal on the internet. No idea where I’m gonna store all these ejector seats!