Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

LightSpy Malware Now Targets Facebook & Instagram Data

hunt.io | blog | #social-media | #surveillance | #spyware | #tls-certificates | #mobile-malware | #lightspy

Summary

A newly seen LightSpy server shows an expanded command list targeting Facebook and Instagram database files, as Hunt tracks eight active servers via TLS certificates.
Published
Collected

original ↗

Related coverage

blog · hunt.io
Tracking LightSpy: Certificates as Windows into Adversary Behavior
Hunt profiles LightSpy's infrastructure, tracking its servers mainly in China and Hong Kong via unique TLS certificates; it exfiltrates WeChat, Telegram and QQ data from mobile devices.
blog · hunt.io
Caught in the Act: Uncovering SpyNote in Unexpected Places
Hunt uncovered SpyNote Android spyware samples in open directories, disguised as Google Translate, Temp Mail and Deutsche Postbank apps, detailing how the leaked spyware steals user data.
blog · hunt.io
A Practical Guide to Uncovering Malicious Infrastructure With Hunt.io
A step-by-step infrastructure hunting walkthrough: from an AsyncRAT-linked IP, pivoting through ASN data, ports, services and TLS certificates to uncover a wider cluster of systems.
blog · hunt.io
Canis C2 Exposed: Previously Undocumented Cross-Platform Surveillance Framework Targeting Japan
An unauthenticated API on a Japanese phishing server exposed Canis C2, a previously undocumented cross-platform surveillance framework with agents for Android, iOS, Windows, Linux and macOS.
blog · hunt.io
Announcing Hunt 2.5
Hunt 2.5 adds a Pivots table tying IPs to certificate subjects, hashes, and TLS fingerprints, 50+ certificate fields in HuntSQL, an Add to Query button, and a downloadable phishing feed.
blog · hunt.io
Uncovering Joker’s C2 Network: How Hunt’s SSL History Exposed Its Infrastructure
Starting from a Joker-flagged 4K wallpaper APK, SSL certificate history pivots map the Android malware's C2 network across Alibaba Cloud servers and uncover related domains.
back