Looks like KmsdBot is now exploiting Tenda HG6 v3.3.0 - Remote Command Injection vulnerability. My guess is using weak login credentials via telnet/ssh isn't enough for them to build up the botnet so turning to exploits.
I wrote a quick patch to
@taviso PoC exploit for CVE-2023-20593 that redacts data read from memory so you're not reading secrets on multi-user systems when testing ->
https://vapid.dhs.org/misc/CVE-2023-20593.txtPhishing page for Citizens Bank
https://connect-citizens-account-secure01c.com/ses/?auth&apitoken=jvz7d9l53yaak43 only reachable using a mobile Browser user-agent string
Currently at a speakers dinner in Strasbourg France.
Look at this lame scam attempt.
What is this thing used for on my gas grill?
Middle block controls temp outer handle controls pressure. Took me a minute.
They don’t even try to hide the underlying is from you anymore.
