A new Android RAT turning infected devices into potential residential proxy nodes

Mirax is a newly identified Android Remote Access Trojan operating as Malware-as-a-Service, actively targeting European users, particularly in Spanish-speaking regions. Distributed through Meta advertisements and GitHub-hosted droppers, the malware has reached over 200,000 accounts. It employs sophisticated techniques including dynamically fetched HTML overlays, comprehensive keylogging, and remote device control capabilities. A distinctive feature is its integration of SOCKS5-based residential proxy functionality, transforming infected devices into proxy nodes that enable attackers to route traffic through legitimate residential IP addresses. This capability allows operators to bypass geolocation restrictions and evade fraud detection systems while conducting account takeovers and transaction fraud. The malware uses commercial-grade obfuscation through Golden Encryption and establishes persistence through Accessibility Service abuse.

Pulse ID: 69dcfd5f0b3e3ab70a58831d
Pulse Link: https://otx.alienvault.com/pulse/69dcfd5f0b3e3ab70a58831d
Pulse Author: AlienVault
Created: 2026-04-13 14:27:43

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Android #CyberSecurity #Encryption #Europe #GitHub #HTML #InfoSec #Malware #MalwareAsAService #OTX #OpenThreatExchange #Proxy #RAT #RemoteAccessTrojan #Trojan #bot #AlienVault

Tracking the Pangolin Memory Leak Upstream: A Next.js Gzip Bug

https://rant.mvh.dev/tracking-the-pangolin-memory-leak-upstream-a-next-js-gzip-bug/

#selfhosted #homelab #proxy #pangolin #docker

Complete Guide to Setting Up an #Apache Reverse #Proxy for an #Ecommerce Website

This article provides a complete guide to setting up an Apache reverse proxy for an ecommerce website. We will provide a start-to-finish guide for installing all required software, configuring your reverse proxy and installing the SSL certificate ...
Continued 👉 https://blog.radwebhosting.com/complete-guide-to-setting-up-an-apache-reverse-proxy-for-an-ecommerce-website/?utm_source=mastodon&utm_medium=social&utm_campaign=mastodon.raddemo.host #shoppingcart #oraclelinux #debian #rockylinux #reverseproxy #loadbalancing #proxyserver #loadbalancer #letsencrypt #almalinux

Complete Guide to Setting Up an #Apache Reverse #Proxy for an #Ecommerce Website

This article provides a complete guide to setting up an Apache reverse proxy for an ecommerce website. We will provide a start-to-finish guide for installing all required software, configuring your reverse proxy and installing the SSL certificate ...
Continued 👉 https://blog.radwebhosting.com/complete-guide-to-setting-up-an-apache-reverse-proxy-for-an-ecommerce-website/?utm_source=mastodon&utm_medium=social&utm_campaign=mastodon.social #almalinux #reverseproxy #oraclelinux #shoppingcart #rockylinux #loadbalancer #debian #loadbalancing #proxyserver #letsencrypt

Worked out a handy way to deploy software to a PocketBeagle SBC today.

The USB port enumerates a CDC-ACM serial interface (console) and a CDC-Ethernet port, however by default, there's no route to the Internet. To connect it to the Internet, you must set your machine up as a router, and make it use your host as a default route.

Alternatively, you direct things to use a HTTP proxy. Like this:

https://proxypy.readthedocs.io/en/latest/

```
log.info("Sending deployment script")
os.system(
"scp deploy.sh [email protected]:/tmp"
)

# Send the deployment script over via SSH
with proxy.Proxy(port=0) as p:
log.info("Running deployment script")
os.system(
"ssh -R 8080:localhost:%d [email protected] bash -ex /tmp/deploy.sh" % p.flags.port
)
```

In the top of `deploy.sh`:

```
# Never sure whether things use upper or lower case here
export HTTP_PROXY="http://localhost:8080/"
export http_proxy="http://localhost:8080/"
export HTTPS_PROXY="http://localhost:8080/"
export https_proxy="http://localhost:8080/"
```

(Some applications use upper case, others use lower case.)

Now `apt-get`, `git` and friends, can pull files over HTTP/HTTPS via your proxy.

The same technique would work with the Raspberry Pi Zero family.

#Python #Proxy #BeagleBoard #RaspberryPi

→ Meat-based LLM proxies
https://not-an-llm.bearblog.dev/meat-based-llm-proxies/

“I am noticing one thing becoming more prominent over time; meat-based LLM proxies.

They'll talk to you as if they're human, except all of their words are written by an LLM. Anything you tell them, they feed to the same LLM and send you the response.

Effectively, you end up talking to the LLM via a meat proxy.”

#LLM #meat #human #proxy

O que é um servidor? Saiba como funciona e os tipos mais comuns na web

https://fed.brid.gy/r/https://tecnoblog.net/responde/o-que-e-um-servidor-saiba-como-funciona-e-os-tipos-mais-comuns-na-web/

Telegram починил прокси на iOS: как работает и почему он ломался

Telegram выкатил обновление для iOS — MTProto-прокси снова работают. Обновил, подключил, медиа грузятся. Разбираю, почему прокси ломались именно на iOS, как Fake TLS маскирует MTProto-трафик под обычный HTTPS, и почему прокси на российском VPS работает лучше зарубежного.

https://habr.com/ru/articles/1021668/

#telegram #mtproto #proxy #ios #dpi #тспу

The long road to your crypto: ClipBanker and its marathon infection chain

Proxifiers are speciaized software designed to tunnel traffic for programs that do not natively support proxy servers. They are a go-to for making sure these apps are functional within secured development environments. By coincidence, Proxifier is also a name for a proprietary proxifier developed by VentoByte, which is distributed under a paid license. If you search for Proxifier (or a proxifier), one of the top results in popular search engines is a link to a GitHub repository. That’s exactly where the source of the primary infection lives.

Pulse ID: 69d77818426ba84dc9eb0371
Pulse Link: https://otx.alienvault.com/pulse/69d77818426ba84dc9eb0371
Pulse Author: AlienVault
Created: 2026-04-09 09:57:44

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Bank #CyberSecurity #GitHub #InfoSec #OTX #OpenThreatExchange #Proxy #RAT #RCE #bot #AlienVault

Из-за критической уязвимости VLESS клиентов скоро все ваши VPN будут заблокированы / Хабр

https://habr.com/ru/articles/1020080/

> Критическая уязвимость позволяет обходить per-app split tunneling и приватные пространства (Knox/Shelter/Island/etc) и гарантированно обнаруживать выходной ip прокси, который вы используете.

android private space (Knox, Shelter, Island, etc) хотя и изолирует VpnService, но не изолирует loopback интерфейс.

#infosec #proxy #vulnerability #android #privateSpace