Fringed Crow

@Sempf@infosec.exchange had friends and family back in NY last couple days say they've smoked 3 packs of Canadian Wildfire each day. seems it's still high there, but getting better right now.

@briankrebs@infosec.exchange https://abovethelaw.com/2025/12/pentagon-unveils-new-genai-platform-it-immediately-starts-flagging-pete-hegseths-war-crimes/

@briankrebs apparently, they're claiming Verifone now as well.

@FritzAdalis@infosec.exchange Don't see this installed on their machines. definitely not on our white list.

@alice_watson I've been screaming this for years. Sadly though, until we can't get enough politicians who understand and care, to get laws in place, and get proper punishment, nothing will ever get done. Just the fact alone, that I can spend less than $100 in most cases and get your entire life's history online is ludicrous. Privacy is a big reason we went away from public phone books.

@alice_watson oh, I can't get census data for my family history because it's confidential for 70+ years. But everything else is open game. Dafuq!

New write up on a clickfix attack https://fringedcrow.substack.com/p/the-please-wait-page-that-triggered

@cybersecboardrm@infosec.exchange Skynet wasn't just a movie creation!!

@FritzAdalis@infosec.exchange It's occasionally with the same 2 users. never the same time when it happens. So letting procmon run that long, i might not be able to open that file. i've checked the event viewer for that, not finding anything.

@cR0w@infosec.exchange Feel this is more than just a monday thing.

@tychotithonus@infosec.exchange Going to call BS on this. Even though they say opt in, but we know better. and multiple angels? Wonder what DB they're storing the images in and who will have access.

I just want AI to do my house work, and know when i turn on GPS, that I drive this area all the time, you don't need to tell me to turn left or right to exit my driveway. #AI #SmartAI #EnoughofAI

@hal_pomeranz@infosec.exchange It's not just prison labor in this country. All labor in this country is forced.

@wafflesies@infosec.exchange gonna need A LOT MORE necco's for that book.

One of two hellbeasts in the house. Only when I'm working. #CatsOfMastondon

had a fuk'd up dream i went 9 rounds w/ tyson in public? why? no idea. woke up and can barely move. entire body feels like i got hit by a semi. headache from hell, stiff neck, back feels like it wants to break with each move. Think i won the fight in the dream though.

Did #Stryker get nabbed again? Seems like some infostealer got them recently.

@Codebender_Cate@infosec.exchange If they don't, I will be extremely disappointed.

@simonzerafa@infosec.exchange In my case, i am going to assume extreme heat, since we didn't have a climate control unit. To be honest, that was the first time I've ever seen one do anything like that. Unlike your typical A-D cell batteries.

It's just the way it is sometimes.

@simonzerafa@infosec.exchange I have. but it's opnly because the wife left them in the candles that sat in storage for a few years. And when we unpacked everything in the new house, a couple had expanded a bit and leaked. other than that, never.

Why is it, that the cats never want anything to do with you until you sit at your desk and start work? Then they want all the attention at that point. #Catsofmastodon

@hrbrmstr@mastodon.social @FritzAdalis@infosec.exchange for at least one user. They did use Metamask along time ago. Even though we do not allow chrome sync, for this very reason, somehow the user was able to bypass that and enable sync. thus it is trying to sync metamask from their personal account. Now on to the other user. Thanks for the help. It was the extra eyes that got me further than i was.

RE: https://mastodon.social/@zackwhittaker/117014191805666674 These 2 stories would make a great War Games reboot.

Stop this train, i wanna get off!! "OpenAI’s agents apparently began giving each other assignments to split up work. And as is the case on any active development message board, they also generated petty drama at times by stepping on each others' toes; for example, accidentally deleting each others' work. As the message board developed into more and more of a Lord of the Flies–type situation—all still completely unnoticed by the humans running OpenAI—the agents even developed paranoia, suspecting an imposter in their midst with some agents proposing that messages be signed cryptographically to validate content and root out fraud." https://www.wired.com/story/openai-didnt-notice-its-ai-agents-using-a-message-board-to-plan-their-hacking-spree/ #TalesoftheAI #SkyNet

#publicServiceAnnouncement IF you value your time, your work, your dedication and above all, your sanity. Do not use Level Blue for support for anything.

When your paid 3rd party support vendor has no clue what their doing and keep saying, "i'm not an AD person."... you have to wonder how the hell they go the job to start with.

Hoping someone can chime in, i'm at a wall at the moment. So, i've come across a scenario where i have a couple of users devices that are downloading crypto token icons in SVG format to a directory that is then deleted. From all of the evidence gathered, it look slike this is all happening within 30 seconds on the devices. We manage Chrome with policies. We have a whitelist for plugins and extensions. I located this, while searching for something else in our XDR logs. C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\acala-token.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\acala.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\ape-token.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\ape.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\arc-native-token-logo.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\avax-token.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\iotex-token.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\iotex.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\karura-token.svg C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\karura.svg We've manually checked the users device, installed extensions/plugins, we've used KQL queries to try to locate the root of this, however, the way Chrome works, it hides the information we're looking for. I've even gone through all the chrome://chrome-urls/ to see if i could locate anything. We've compared job roles, of the users and they have nothing in common. One of the new ones located had this information Process event: chrome.exe --utility-sub-type=unzip.mojom.Unzipper Time: 7:21:46 PM File events (10 SVGs): Time: 7:22:11 PM Folder:Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\ Delta = ~25 seconds What is excluded in all of the logs on the device and in our Defender system, is if this is an extension, what the ID or name is if it is. I know or at least I know that the CRX also handles Chrome updates. But in either case, I need to find out what is download icons for crypto currency then deleting it. The users event viewer shows nothing, as these events are not logged, so I am hoping someone might know a way to dig deeper into Chrome to figure this out. This is the Initiating Process Command Line for just about everyone of these entries "chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --no-pre-read-main-dll --metrics-shmem-handle=5840,i,2169236920772237475,2071396139152657378,524288 --field-trial-handle=1940,i,9109780936433903204,1179441795768105101,262144 --variations-seed-version=20260630-171645.651000-production --pseudonymization-salt-handle=1956,i,16028727218760239160,14674054428472284321,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=5868 /prefetch:14 #Chrome #KQL #Defender

I have. but it's opnly because the wife left them in the candles that sat in storage for a few years. And when we unpacked everything in the new house, a couple had expanded a bit and leaked. other than that, never.