Joe Security's Blog
ToxNetV2: An AI-Assisted Botnet Controller
IntroductionToxNetV2 is an AArch64 Linux peer-to-peer botnet that integrates an LLM into the operational workflow of its controller. As uncovered in the Joe Reverser analysis, the controller collects host and botnet telemetry, sends that context to NVIDIA NIM, parses selected model responses into structured actions, and queues those actions for operator approval. The resulting workflow is straightforward: telemetry → LLM analysis → structured actions → operator approval → execution The system is not fully autonomous or self-modifying. The operator remains the final approval point for its higher-impact AI-generated actions.
Read more...
Google Phishing Kit: When Phishing Becomes a Real-Time Remote Browser
IntroductionMost of the phishing pages are mere static clones of the login form, whereas sophisticated phishing kits implement adversary-in-the-middle techniques that perform authentication in real-time. In particular, the design being analyzed below fits into the Browser-in-the-Middle (BitM) scheme where the victim-facing page becomes the client for the browser session running at the backend of the phishing operation.The captured network traffic and the extracted client-side artifacts demonstrate the functioning of the BitM session. The backend streams complete Google authentication views and subsequent DOM updates to the victim over Socket.
Read more...
Inside ScarfaceStealer's Sandbox-Aware Anti-Analysis System
IntroductionIn this blog post, we examine a multi-stage ScarfaceStealer infection chain delivered through an Electron-based application packaged with NSIS.The investigation began with a Joe Sandbox Cloud Basic analysis https://www.joesandbox.com/analysis/1915862/0/html that produced only limited behavioral indicators, suggesting that the sample did not fully expose its intended execution path.
Read more...
