Yesterday two different people contacted me about two different projects on GitHub.

"Tito" DMd me about someone making a comment on GitHub claiming to have a patch for "synara" (Image 1)

"Robert Z" emailed about something similar on a different GitHub project (image 2).

Interesting.

Upon further investigation it turns out this exact file has been discovered online named:
- hb_patch_v1112
- registry_patch_v0.1.7
- rep_fix_v1.zip
- sodium_fix_v1
- log_fix_patch
blah blah blah (image 3)

Basically, someone is creating accounts on GitHub, going to open issues, and leaving a comment saying they've found a patch (it's likely automated, but whatever). The patch is malware.

It appears this campaign began around July 7th (yesterday) and is making its rounds pretty quickly.

When you look inside (hehe silly reference) it's a program written in Go. When the binary detonates it queries a remote host which resolves to ... Telegram. The Telegram channel description specifies a website. The website in the Telegram description is where the payload exfiltrates code too.

They're doing it this way because they can quickly change the Telegram channel description if the website they specify is taken down. It's basically a bootleg DNS resolver (image 4).

Anyway, this is StealC (based on YARA identifiers). This is (probably) a new malware campaign by someone using StealC. I like it. Very cool usage of GitHub spam combined with a bootleg ass DNS resolver on Telegram. It probably helps because I doubt Telegram is quick to take action with takedown requests.

[Hoyo][Wuwa]
All hoyo's game and wuwa official account are now limited to "Only followers who follow at least 7-days can comment" on Bilibili, as wuwa & hoyo players attacking eachother extremely started from yesterday.

Poco mold fix please

Nothing 4b Announced Globally

Nothing 4b is the cancelled CMF 3 Pro. The 'b' here stands for a bullshit product & here's why:

• 480Hz PWM dimming 💩
• 8-bit display 💩
• Snapdragon 6 Gen 4 SoC 💩
• LPDDR4X RAM 💩
• UFS 2.2 storage 💩
• 50MP main (JN1, 1/2.76", OIS) 💩
• 8MP Ultrawide 💩
• 33W charging 💩
• eSIM (Only Japan) 💩
• NFC (Except India) 💩
• Plastic frame 💩

The new Glyph Bar interface features a grid of 45 mini-LEDs distributed across 5 squares (4 white + 1 red color).

• 6.7" (1080x2344 px) AMOLED Display
• 120Hz refresh rate
• 1200nits outdoor brightness
• Dragontail Pro Glass protection
• 4400 mm² VC Chamber
• 16MP Front camera
• In-display fingerprint
• IP64 rated; Essential Key
• 5200mAh battery (India: 6000mAh)
• Dual Stereo Speakers
Runs NothingOS 4.1 based on Android 16
3yrs Android OS + 6yrs Security Patch

Pricing:
• 8GB+128GB= €330/£300/₹35,000
• 8GB+256GB= ₹39,000 (India only)

There is also the Nothing Phone (4b) RCB Edition which has already been sold out on 7th July.

Follow @TechLeaksZone