OLVX Marketplace Offered More Than 1,500 Stolen Login Credentials

Telegram Group Allegedly Offered Cybercrime Tools

FBI Investigation Highlights Cross-Border Cybercrime Enforcement

Hunt.io traced BraZetsu ‘s infrastructure and found that hosting patterns and certificate data remained useful after published IOCs became outdated.

Group-IB researchers published a detailed writeup on BraZetsu back on August 31, naming it a Python framework compiled with Nuitka and tying it to a Brazilian actor called Exilware with high confidence. Hunt.io checked whether the published indicators still held up against its own certificate data. What they found is that the infrastructure had already moved on, quietly, months before anyone wrote about it.

BraZetsu is an initial access broker tool that breaks into Windows machines, checks them for ERP software, SCADA traces, EDR products, and certificate files, then packages the information for sale.

The group behind it, called Infected Marketplace, charges a deposit of about 5.80 Brazilian reais to let buyers browse the listings. The buyer who later deploys ransomware or steals money from a bank account doesn’t need to know how BraZetsu works. They simply buy a machine that has already been compromised.

Hunt.io’s approach was narrow on purpose. Instead of reversing the binary again, they took the hostnames and IP address Group-IB had already published and ran them against their own TLS certificate inventory.

“We didn’t reverse the binary again. We took the published indicators and checked what our certificate inventory still shows.” Hunt.io states. “The premise is narrow. An operator who keeps a panel and a command channel under the same apex, with Let’s Encrypt off port 443, leaves a more stable trail in the certificate inventory than the address of the month.”

Binaries can change all the time. A hostname linked to a valid TLS certificate is much harder to replace.

That approach worked quickly. The command server hostname mentioned in the August report, c2.installscenter.com, had already been using TLS on a second server since April 4, almost five months before the report was published. Researchers found it on the same IP address as the control panel hostname, painel.installscenter.com. Both were hosted by the same Swedish provider, Njalla.

The original seed IP, a Contabo server, tells its own story. From January through early February it served Contabo’s default factory hostname, boring and unremarkable. Then on February 11, right around when Group-IB dates the first BraZetsu version, the certificate switched to painel.seu-dominio.com, a Portuguese placeholder name literally meaning “your domain” lifted straight from hosting tutorials. That name showed up 17 separate times over five weeks, every two to four days, which is a strong signal of a panel someone actually kept running, not a page thrown up for one night.

When the operators eventually moved providers, they kept the exact same habits. The new host came alive on March 21, the very day the installscenter.com domain was registered, running the identical Hestia Control Panel setup with the same painel prefix. Different hosting company, same fingerprint.

“Passive DNS helps explain it. Our records show c2.installscenter[.]com resolving to 80.78.27[.]252 between 22 and 26 March, and to Cloudflare (104.21.78.246, 172.67.138.224) from 26 March on.” states the report. “The only A record we have for painel.installscenter[.]com is Cloudflare, from 21 March.”

The real lesson here isn’t about BraZetsu specifically, it’s about what actually survives a public takedown report. Hashes rotated across five different versions in just four months, useless as a long-term detection signal. What held steady from February through June was the naming convention and hosting pattern itself, a panel prefix on a nonstandard port, running on a VPS configured with Hestia Control Panel.

Hunt.io’s conclusion lands on a point worth remembering for anyone building detection rules off a threat intel report: don’t chase the IP of the month, chase the pattern. Before publishing, the researchers notified the relevant national CERTs and confirmed no victim data was recovered during the investigation, which is the responsible way to handle infrastructure still potentially active.

“The public reporting gave us three things to work from: the C2 hostname, the IP tied to it early in the year, and the shop both of them served. Our certificate inventory showed what happened to that hostname after the first VPS went quiet. It showed up on a new host in a different provider, with a control panel on the same apex.” concludes the report. “The TLS services on 80.78.27[.]252 went quiet after 20 June. The pattern is more stable: a painel. or c2. prefix on a port that isn’t 443, on a VPS running Hestia Control Panel. It held from February to June across two providers, and that’s what we’d build detection on, not the IP.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, BraZetsu)

Facebook users are reporting receiving a message with a fake Facebook Marketplace listing that has their name as the seller.

It works like this. You receive a message (in this case iMessage) asking “Is this still available for purchase?” Attached to the message is a fabricated Facebook Marketplace listing.

Tapping on the picture, you might notice that the seller’s name is the same as your name. This is known as a conversation lure, adding legitimacy to a message and giving you an additional reason to reply.

Interestingly in the example we received, even though the name of the seller matched the person who received the message, the profile picture did not. When I researched the profile picture, it turned out that it belongs to another Facebook user with the exact same name.

This likely means the attacker had a phone number associated with a name that they used to create the fake Marketplace listing. Receiving a message like that is very likely to provoke the natural corrective response: “That isn’t me.” Such a message will probably have a lot of receivers think that they are being impersonated by a scammer on Marketplace.

This method of approach may seem like a lot of work with a low chance of success, and this would have been true a few years ago. But with an AI agent and a list of matching names and phone numbers from a breach, this can be done relatively easy at scale. And that changes the return on time invested dramatically.

The name and phone number combination could come from any number of data breaches. On the dark web, cybercriminals buy and sell personal data for such purposes.

  “For less than the cost of a cup of coffee, a cybercriminal can buy enough information to devastate someone’s financial life.”

The personalized screenshot would work very well as a reply trigger. Its psychological function is well thought out and likely very effective: it combines curiosity, reputational concern, and the recipient’s impulse to correct an apparent mistake.

But when you reply to a phishing text you are telling a scammer that this is a live number. Your phone number then increases in value for the scammer and can be resold to other scammers. Or it can be used in other cybercrimes, to download malware, to begin a relationship that leads to fraud, to take over your Facebook account, or many other reasons.

How to stay safe

While the exact motive behind this text is hard to establish without engaging, there are a few things you can do:

• Limit what you share publicly on social media. Scammers can use information about you to increase the credibility of their attempts.
• Do not respond to unsolicited messages of any kind when they come from people you don’t know.
• If you do know the sender, but don’t trust the message, double check with them via a different channel that it was them who sent it.
• Don’t click a link, call a number supplied in the conversation, scan a QR code, or share a one-time code or screenshot of a security message.
• Open Facebook independently and inspect Marketplace activity, recent logins, messages, email addresses, phone numbers, and recovery settings. Use facebook.com/hacked if you find any signs of compromise.
• If you find a profile truly impersonating you, preserve its URL and report the profile. Facebook says impersonating profiles violate its standards and provides an impersonation-reporting process.
• If you’re unsure whether a message is a scam, use Malwarebytes Scam Guard. It will assist you in determining if it’s real or fake, and advise you on follow-up steps.

Meta’s Muse AI shared a Facebook Marketplace seller’s pickup address and arranged a deal that ended with a buyer showing up unexpectedly.

The post Meta AI Shares Seller’s Address: Facebook Marketplace Buyer Shows Up at His Home appeared first on TechRepublic.

A Facebook Marketplace buyer arrived at a seller’s apartment to collect a keyboard. The seller wasn’t home and didn’t know anyone was coming. Meta’s AI assistant Muse had handled the conversation, shared his address, and arranged the visit without telling him.

We often write about AI misalignment and how to use AI agents and browsers safely. That can sound theoretical, but this is an example of the real-world risk when an agent is allowed to act on someone’s behalf.

Muse is Meta’s semi-autonomous AI assistant, released in the US in September. Meta promotes it as a personal assistant that can help users automate tasks, including responding to Facebook Marketplace messages. Unlike a conventional chatbot, which waits for a prompt and produces an answer, an AI agent may be authorized to take actions within connected apps.

We’ve written about a separate weakness in Muse that researchers considered dangerous. Reportedly, Muse was downloaded 3 million times in its first week.

According to Business Insider, a Facebook Marketplace seller turned on Muse to help handle a keyboard listing. He entered his address as the pickup location and approved automatic replies. Muse then shared that address with a prospective buyer, negotiated over the item, and arranged a visit, the seller said. He says Muse did not ask permission to share his address or arrange the visit, and did not tell him it was happening. The buyer arrived at the seller’s apartment expecting to complete the purchase, but the seller wasn’t home. The sale didn’t happen.

The reported incident is more than a privacy failure. It illustrates a broader AI-agent risk: An agent may treat permission to reply automatically as permission to share sensitive information or commit you to an in-person meeting. Meta says it is looking into the report.

How to use AI agents safely

Before enabling an AI agent, treat its setup screen as a security review. Do not assume that an integration with a trusted platform means the agent will understand your intentions or apply sensible limits automatically.

Pay particular attention to:

• Connected accounts: Review every service the agent can access, such as email, messages, calendars, cloud storage, shopping accounts, or social media profiles.
• Data access: Consider whether it can read addresses, contacts, photos, private messages, payment details, documents, or location data.
• Action permissions: Check whether the agent can send messages, post content, negotiate, make bookings, place orders, alter listings, or share information externally.
• Automatic actions: Apply settings that require approval before the agent sends, publishes, buys, deletes, or shares anything sensitive. Check how it will notify you about the plans it makes on your behalf.
• Audience controls: Confirm exactly who can receive information generated by the agent. “Anyone who messages me” is very different from “people I approve.”

Give an AI agent the least access necessary for the task. If you only want help writing replies, do not enable automatic sending. If you want an AI agent to manage a listing, use a public meeting location or a separate pickup address rather than your home address.

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free →