Hunt.io

@Huntio

http://hunt.io is a service that provides threat intelligence data about observed network scanning and cyber attacks.

United States

Joined June 2023

911Following

3KFollowers

Pinned

Hunt.io@Huntio · May 14

🔥 Our new eBook is out: Modern Threat Hunting - 10 Practical Steps to Outsmart Adversaries hunt.io/learning/moder… IOC pivots, SSH key tracking, ASN abuse, C2 clustering, all backed by real examples and HuntSQL™ queries. Grab your free copy 👇 #ThreatHunting #CyberSecurity…

Huntio's tweet card. Download our free eBook and learn how to uncover adversary infrastructure at scale in 10 practical, repeatable steps.

5.0K

Pinned

Hunt.io@Huntio · Jul 26

☁️ Threat Hunting in the Cloud: Uncovering What Traditional Alerts Miss hunt.io/glossary/threa… Cloud infrastructure expands your capabilities, but also your attack surface. Traditional detection methods often fall short in dynamic, distributed environments. That’s why…

Huntio's tweet card. Cloud threat hunting helps you detect and respond to threats in real-time. Discover tools and best practices to keep your cloud environment secure.

3.0K

Hunt.io@Huntio · 34 m

Actors reuse and rotate infrastructure fast. C2 Detection lets you follow that evolution over time, automatically. → Monitor the shifts. Find the overlap. Hunt the campaign. hunt.io/features/c2-de…

Huntio's tweet card. Discover Hunt.io's C2 detection capabilities. Validate, scan, and monitor malicious infrastructures with our threat hunting tools. Book your demo now

118

Hunt.io@Huntio · 2 h

⚠️ SharePoint Zero‑Day “ToolShell” Used to Deploy Ransomware on 400+ Organizations cybersecuritynews.com/sharepoint-0-d… Chinese-state aligned group Storm‑2603 has exploited CVE‑2025‑53770/53771 to breach on‑prem SharePoint servers, bypass MFA, and deploy Warlock ransomware. The campaign has…

Huntio's tweet card. Microsoft has issued urgent warnings about active exploitation of critical SharePoint vulnerabilities CVE-2025-53770 and CVE-2025-53771 by multiple threat actors, including the China-based group...

420

Hunt.io@Huntio · 5 h

🔍 A closer look at how we exposed hidden attacker infrastructure. hunt.io/blog/rust-beac… Through careful analysis and research, we uncovered a campaign targeting South Korean organizations using a Rust‑compiled loader to deploy Cobalt Strike ‘Cat.’ Further analysis…

Huntio's tweet card. Discover how threat actors used a Rust loader to deploy Cobalt Strike ‘Cat’ against South Korean targets. Learn more.

1.0K

Hunt.io@Huntio · 7 h

🚩 Scattered Spider APT Hijacks VMware ESXi to Deploy Ransomware at Scale thehackernews.com/2025/07/scatte… Threat actors tracked as Scattered Spider (UNC3944, 0ktapus) are now targeting VMware ESXi environments in U.S. retail, airline, transportation, and insurance sectors using a fast…

Huntio's tweet card. Scattered Spider targets VMware ESXi in fast, stealthy ransomware attacks across U.S. retail and airline sectors.

518

Hunt.io@Huntio · Jul 26

🚩 Malicious Code Injected into 6 Popular npm Packages After Phishing Attack thehackernews.com/2025/07/malwar… A threat actor hijacked a developer's npm account via phishing and inserted post‑install scripts into widely used packages. These script included eslint‑config‑prettier,…

Huntio's tweet card. npm packages hit by phishing-based supply chain attack, exposing developers to malware and remote access threats.

965

Hunt.io@Huntio · Jul 25

📖 What do fake CAPTCHA pages and login spoofers have in common? hunt.io/learning/moder… They show up again and again in phishing campaigns, often before reports catch them. In our ebook, you’ll learn how to detect landing pages with “Robot or Human?” prompts, mshta…

366

Hunt.io@Huntio · Jul 25

🚩 Threat Actors Use GitHub Repositories to Host Amadey & Loader Payloads thehackernews.com/2025/07/hacker… A recent campaign leverages fake GitHub accounts to host Emmenthal loader and Amadey malware, along with other payloads like AsyncRAT, Lumma, RedLine, PuTTY, and more, to bypass…

Huntio's tweet card. Malicious GitHub repositories used by threat actors to host Amadey payloads and steal data, impacting targeted entities.

371

Hunt.io@Huntio · Jul 25

⚠️ Critical SQL Injection RCE in Fortinet FortiWeb (CVE‑2025‑25257) Exploited Hours After PoC Release securityaffairs.com/180118/hacking… A severe flaw was found in FortiWeb's Fabric Connector API, enabling unauthenticated attackers to execute SQL and achieve root-level remote code…

Huntio's tweet card. Hackers exploited a Fortinet FortiWeb flaw the same day a PoC was published, compromising dozens of systems.

606

Hunt.io@Huntio · Jul 24

Forget static feeds. hunt.io/features/c2-de… Hunt’s C2 Detection is dynamic, actor-aware, and built on 150+ detection techniques. → Map C2 infrastructure the smart way.

485

Hunt.io@Huntio · Jul 24

🚩 Trojanized Telegram APK Targets Chinese Android Users darkreading.com/cyberattacks-d… Malware disguised as Telegram is being distributed via QR‑code links on over 600 Chinese-language domains. Exploiting the 2017 Janus flaw, the malicious app (QR-delivered link) slips past…

667

Hunt.io@Huntio · Jul 24

🚩 New Konfety Android Malware Variant Evades Detection Using APK Tricks thehackernews.com/2025/07/new-ko… Researchers at zLabs have uncovered a sophisticated Konfety variant that tampers APK ZIP metadata to break analysis tools. By falsely marking files as encrypted or using uncommon…

Huntio's tweet card. Researchers uncover sophisticated Konfety Android malware using evil twin apps and complex evasion methods to conduct ad fraud.

476

Hunt.io@Huntio · Jul 23

🔍 Find and Investigate Exposed Directories with AttackCapture™ hunt.io/features/attac… Attackers often leave behind exposed directories packed with malware, scripts, or stolen data. AttackCapture™ helps you uncover and analyze these overlooked assets before they’re used…

Huntio's tweet card. Uncover and mitigate cyber threats in exposed open directories with Hunt.io's Open Directory feature. Identify misconfigured open directories and access critical security data. Book your demo today.

384

Hunt.io@Huntio · Jul 23

💡 Another threat unraveled through hunting. hunt.io/blog/backdoore… We discovered a campaign targeting Chinese-speaking users with backdoored installers masquerading as Signal, Line, and Gmail. Our infrastructure analysis linked the campaign to servers hosted on Alibaba…

Huntio's tweet card. Read how attackers distribute backdoored Signal, Line, and Gmail installers through fraudulent download pages and how to defend against this campaign.

552

Hunt.io@Huntio · Jul 23

⚠️ Golden dMSA Attack in Windows Server 2025 Enables Forest-Wide Compromise thehackernews.com/2025/07/critic… Researchers from Semperis reveal a design flaw in delegated Managed Service Accounts (dMSAs) that allows generation of any dMSA/gMSA password across your AD forest, after…

Huntio's tweet card. Researchers expose critical flaw in Windows Server 2025’s dMSA, enabling enterprise-wide access and lateral movement across domains.

511

Hunt.io@Huntio · Jul 22

🔍 Monitor Active Malware Infrastructure with C2 Feed API hunt.io/products/cyber… Our C2 Feed API provides real-time intelligence on active C2 servers used by malware. The feed is continuously updated and delivered in newline-delimited JSON, making it easy to ingest into…

Huntio's tweet card. Enhance your cyber intelligence with Hunt.io's Cyber Threat Enrichment API. Access high-confidence C2 feeds and streamline your threat intelligence today

408

Hunt.io@Huntio · Jul 22

⚠️New Research: Clickfix on macOS - AppleScript Stealer via Terminal Prompts A new phishing campaign is using Clickfix to bypass downloads and trick users into running base64 -d | bash in Terminal. The AppleScript payload grabs browser data, crypto wallets, and cookies, then…

Huntio's tweet image. ⚠️New Research: Clickfix on macOS - AppleScript Stealer via Terminal Prompts

A new phishing campaign is using Clickfix to bypass downloads and trick users into running base64 -d | bash in Terminal.

The AppleScript payload grabs browser data, crypto wallets, and cookies, then…

9.0K

Hunt.io@Huntio · Jul 21

Have your own investigation path? HuntSQL™ gives you raw access to everything: HTTP logs, C2s, phishing kits, certs, honeypots, and more. → Query deeper. Hunt smarter. hunt.io/features/hunt-…

Huntio's tweet card. Query Hunt's database using SQL to track C2 servers, phishing sites, malware, and more. Ideal for researchers, analysts, and threat hunters. Book your demo now.

755

Hunt.io@Huntio · Jul 21

💡 From signal to full infrastructure map, here’s what we learned. hunt.io/blog/lightspy-… Our investigation into LightSpy malware reveals significant expansion in its capabilities, now targeting Facebook and Instagram data. Previously documented for exfiltrating data from…

Huntio's tweet card. A new LightSpy server expands its attack scope, targeting Facebook and Instagram database files. Explore its evolving capabilities and infrastructure.

826

Hunt.io@Huntio · Jul 21

🚨 630K+ Brazilian gov .br subdomains hijacked in a blackhat SEO campaign. hunt.io/blog/gov-br-su… Using Hunt’s AttackCapture™, researchers uncovered a Flask-based server automating the creation of fake, SEO-optimized government-style pages. Techniques included cloaking,…

Huntio's tweet card. Over 630K hijacked gov.br subdomains were exploited in a black hat SEO campaign using cloaking, keyword stuffing, and redirect techniques. Learn more.

726