oh wow

technical information on the curseforge compromise https://hackmd.io/B46EYzKXSfWSF35DeCZz9A

apparently it's an actual virus in the original sense of the term, a JAR infector!

...and the code added to infected files hardcodes a C2 by IP address to get the next stage lol

they tried to hardcode a backup on cloudflare pages but fucked it up

imagine if they'd actually used a DGA or something lol

the final payload includes a stealer because of course it does

I've been thinking lately about how we teach folks about digital security and safety and how we don't really have a way to retire old advice

I know folks who heard they should never connect to a public or unfamiliar Wi-Fi network, never scan a QR code, never charge their phone at a public outlet - and they never got the stand down memo that those threats have been largely mitigated and as long as they're keeping their phones and browsers up to date, it's usually fine to do those things.

Your suffering matters.

Stop the mentality of “it’s ok because someone has it worse”

Tom Scott, in his newsletter today, described BlueSky as "the shiny Twitter-alike that will likely collapse into a ball of drama within a week".

As someone who doesn't need another social network right now, I'm kinda glad Mastodon is made up of several hundred separate balls of drama that can choose how they interact with each other.