Filter
Exclude
Time range
-
Near
TonyD²
@On4r4p
Jun 6
RT @MarceloRivero: Fake LumaNotch macOS app = #NovaStealer (#MioLab) 🧐 🎭 site = near 1:1 clone of dynamichorizon[.]app 🧾 #ClickFix shows a…
11
Securityblog retweeted
Yogesh Londhe@suyog41
Jun 5
NovaStealer luma04 933d70ccf35b0784ae4e997417dfd03a itw 31[.]76[.]93[.]69 #NovaStealer #MioLab #MAC #IOC
Marcelo Rivero
@MarceloRivero
Jun 3
Fake LumaNotch macOS app = #NovaStealer (#MioLab) 🧐 🎭 site = near 1:1 clone of dynamichorizon[.]app 🧾 #ClickFix shows apps[.]apple[.]com, hides the curl|bash 📣 propped up by X/TikTok AI review bait 💀 "killall Terminal" on launch (hides the drop) 🧹 xattr -c → strips quarantine, skips Gatekeeper 🧱 same lineage → build_info_t _g_serialized_build_info 🆕 but config now PBKDF2-HMAC-SHA1 3DES-CBC ↪️ older Nova/MioLab stealer used inline XOR/stream 🌐 open dir → 31.76.93[.]69 🏷️ self-tags "macos-stealer-v2"
Fake LumaNotch macOS app = NovaStealer (MioLab) - site = near 1:1 clone of dynamichorizon[.]app

ALT Fake LumaNotch macOS app = NovaStealer (MioLab) - site = near 1:1 clone of dynamichorizon[.]app

ClickFix shows apps.apple.com, hides the curl|bash

ALT ClickFix shows apps.apple.com, hides the curl|bash

now PBKDF2-HMAC-SHA1 3DES-CBC - older Nova/MioLab stealer used inline XOR/stream

ALT now PBKDF2-HMAC-SHA1 3DES-CBC - older Nova/MioLab stealer used inline XOR/stream
3
10
1,148
𝕯issolution@Diss0lution
Jun 5
RT @MarceloRivero: Fake LumaNotch macOS app = #NovaStealer (#MioLab) 🧐 🎭 site = near 1:1 clone of dynamichorizon[.]app 🧾 #ClickFix shows a…
11
Leigh@0x1337Leigh
Jun 4
RT @MarceloRivero: Fake LumaNotch macOS app = #NovaStealer (#MioLab) 🧐 🎭 site = near 1:1 clone of dynamichorizon[.]app 🧾 #ClickFix shows a…
11
raw-data@_raw_data_
Jun 4
Replying to @suyog41
#MioLab
1
44
Bruce Ketta@bruce_k3tta
Jun 4
RT @MarceloRivero: Fake LumaNotch macOS app = #NovaStealer (#MioLab) 🧐 🎭 site = near 1:1 clone of dynamichorizon[.]app 🧾 #ClickFix shows a…
11
Alex Kleber a.k.a Privacy 1st
@privacyis1st
Jun 4
RT @MarceloRivero: Fake LumaNotch macOS app = #NovaStealer (#MioLab) 🧐 🎭 site = near 1:1 clone of dynamichorizon[.]app 🧾 #ClickFix shows a…
11
Patrick Wardle
@patrickwardle
Jun 4
RT @MarceloRivero: Fake LumaNotch macOS app = #NovaStealer (#MioLab) 🧐 🎭 site = near 1:1 clone of dynamichorizon[.]app 🧾 #ClickFix shows a…
11
ܛܔܔܔܛܔܛܔܛ
@skocherhan
Jun 4
RT @MarceloRivero: Fake LumaNotch macOS app = #NovaStealer (#MioLab) 🧐 🎭 site = near 1:1 clone of dynamichorizon[.]app 🧾 #ClickFix shows a…
11
Dodge This Security
@shotgunner101
Jun 4
RT @MarceloRivero: Fake LumaNotch macOS app = #NovaStealer (#MioLab) 🧐 🎭 site = near 1:1 clone of dynamichorizon[.]app 🧾 #ClickFix shows a…
11
Asmani@Asmani_
Jun 4
RT @MarceloRivero: Fake LumaNotch macOS app = #NovaStealer (#MioLab) 🧐 🎭 site = near 1:1 clone of dynamichorizon[.]app 🧾 #ClickFix shows a…
11
Andre Gironda@AndreGironda
Jun 4
RT @MarceloRivero: Fake LumaNotch macOS app = #NovaStealer (#MioLab) 🧐 🎭 site = near 1:1 clone of dynamichorizon[.]app 🧾 #ClickFix shows a…
11
xiu
@osint_barbie
Jun 3
RT @MarceloRivero: Fake LumaNotch macOS app = #NovaStealer (#MioLab) 🧐 🎭 site = near 1:1 clone of dynamichorizon[.]app 🧾 #ClickFix shows a…
11
Marcelo Rivero
@MarceloRivero
Jun 3
Fake LumaNotch macOS app = #NovaStealer (#MioLab) 🧐 🎭 site = near 1:1 clone of dynamichorizon[.]app 🧾 #ClickFix shows apps[.]apple[.]com, hides the curl|bash 📣 propped up by X/TikTok AI review bait 💀 "killall Terminal" on launch (hides the drop) 🧹 xattr -c → strips quarantine, skips Gatekeeper 🧱 same lineage → build_info_t _g_serialized_build_info 🆕 but config now PBKDF2-HMAC-SHA1 3DES-CBC ↪️ older Nova/MioLab stealer used inline XOR/stream 🌐 open dir → 31.76.93[.]69 🏷️ self-tags "macos-stealer-v2"
Fake LumaNotch macOS app = NovaStealer (MioLab) - site = near 1:1 clone of dynamichorizon[.]app

ALT Fake LumaNotch macOS app = NovaStealer (MioLab) - site = near 1:1 clone of dynamichorizon[.]app

ClickFix shows apps.apple.com, hides the curl|bash

ALT ClickFix shows apps.apple.com, hides the curl|bash

now PBKDF2-HMAC-SHA1 3DES-CBC - older Nova/MioLab stealer used inline XOR/stream

ALT now PBKDF2-HMAC-SHA1 3DES-CBC - older Nova/MioLab stealer used inline XOR/stream
11
45
5,734
bbsz
@blackbigswan
Jun 3
Replying to @MarceloRivero
MioLab probably
40
raw-data@_raw_data_
Jun 3
Replying to @txhaflaire @MarceloRivero
yup, 1 for #MioLab
1
30
raw-data@_raw_data_
May 21
Replying to @suyog41
#MioLab
20
Load more