#GSocket
LightNews LightNews
josehelps.bsky.social
Tunnels: revsocks, pysoxy and GSocket (gs-netcat in /dev/shm/.gs-10085/ as [kcached]). GSocket is on LOTTunnels, revsocks and pysoxy are not yet.
November 3, 2026 at 4:59 PM
threadlinqs.bsky.social
A stolen CDN key let attackers push a root-level cPGuard update straight to hosting servers. https://intel.threadlinqs.com/threat/TL-2026-5229?utm_source=bluesky #ThreatIntel #gsocket #OpsShield #cPGuard
November 4, 2026 at 11:24 AM
handle.invalid
Python bots exploit Moodle LMS via GSocket, installing PHP redirects to Indonesian gambling sites (pktoto[.]cc). Millions of requests linked to this campaign, leveraging existing webshells for persistence.#MoodlePythonBotAttack
January 17, 2025 at 1:51 PM
ahmandonk.bsky.social
📰 ClickLock, Malware macOS Baru yang Paksa Pengguna Membocorkan Password Login

👉 Baca artikel lengkap di sini: https://ahmandonk.com/2026/07/17/clicklock-macos-malware-paksa-password-login/

#backd#backdoork#clickfixk#clicklockk#clicklockStealert#cryptoWalletr#cybersecurityp#groupsock#gsocket#info
July 17, 2026 at 10:12 AM
tom-doerr.bsky.social
https://github.com/hackerschoice/gsocket
February 16, 2026 at 8:18 AM
cyberveille-ch.bsky.social
📢 Backdoor GSocket déployé via un script Bash avec techniques anti-forensiques avancées
📝 ## 🔍 Contexte

Analyse publiée le 20 mars 2026 par Xavier M…
https://cyberveille.ch/posts/2026-03-24-backdoor-gsocket-deploye-via-un-script-bash-avec-techniques-anti-forensiques-avancees/ #_bboscat #Cyberveille
March 24, 2026 at 6:00 PM
hacker.at.thenote.app
GSocket Backdoor Delivered Through Bash Script, (Fri, Mar 20th)

Yesterday, I discovered a malicious Bash script that installs a GSocket backdoor on the victim's computer. I don't know the source of the script not how it is delivered to the victim.
#hackernews #news
GSocket Backdoor Delivered Through Bash Script, (Fri, Mar 20th)
Yesterday, I discovered a malicious Bash script that installs a GSocket backdoor on the victim's computer. I don't know the source of the script not how it is delivered to the victim.
isc.sans.edu
March 21, 2026 at 6:04 AM
hacker.at.thenote.app
GSocket Gambling Scavenger – How Hackers Use PHP Backdoors and GSocket to Facilitate Illegal Gambling in Indonesia

Since 1974, gambling has been officially illegal in Indonesia. However, the digital revolution of the 2000s introduced a new challenge: the rapid growth of online g…

#hackernews #news
GSocket Gambling Scavenger – How Hackers Use PHP Backdoors and GSocket to Facilitate Illegal Gambling in Indonesia
Since 1974, gambling has been officially illegal in Indonesia. However, the digital revolution of the 2000s introduced a new challenge: the rapid growth of online gambling platforms. This technological shift has created enforcement gaps, compelling the Indonesian government to intensify its efforts to combat illegal online gambling. Recent government crackdowns have sought to disrupt the […]
securityboulevard.com
January 16, 2025 at 11:08 PM
sans.ec
Found "defunct.dat" or "qfile" on your site? They contain access keys for hidden GSocket backdoors. Mass scans for these files launched since Mar 31st. Dozens of sites affected.

sansec.io/research/gso...
April 3, 2025 at 2:33 PM
malmoeb.bsky.social
gs-netcat -s <secret_from_the_dat_file> -i, which gave me shell access under the user who started gsocket in the first place.
June 1, 2026 at 3:22 PM
malmoeb.bsky.social
On a recent Linux-based Incident Response case, we found a dropped GSocket binary as a persistence mechanism [1]. The threat actor planted the dropped binaries under user-space directories to blend in, masquerading as legitimate system processes:

./.config/dbus/php-fpm
./.config/htop/defunct
June 1, 2026 at 3:22 PM
oversecurity.net.web.brid.gy
ClickLock Stealer: Paste Once, Lose Everything
Analysis of ClickLock, a modular macOS stealer delivered via ClickFix that uses fake dialogs, kill loops, and a GSocket backdoor to steal passwords, browser data, and crypto wallets.
www.group-ib.com
July 16, 2026 at 8:32 AM
mariusavram.bsky.social
GSocket Gambling Scavenger – How Hackers Use PHP Backdoors and GSocket to Facilitate Illegal Gambling in Indonesia www.imperva.com/blog/how-hac...
January 17, 2025 at 4:51 PM
technology-news.bsky.social
Analysis of ClickLock, a modular macOS stealer delivered via ClickFix that uses fake dialogs, kill loops, and a GSocket backdoor to steal passwords, browser data, and crypto wallets.
ClickLock Stealer: Paste Once, Lose Everything
www.group-ib.com
July 17, 2026 at 7:55 AM
patrickcmiller.bsky.social
Python-Based Bots Exploiting PHP Servers Fuel Gambling Platform Proliferation
Python-Based Bots Exploiting PHP Servers Fuel Gambling Platform Proliferation
Millions of PHP servers compromised by Python bots using GSocket to target Indonesian users with gambling redirects.
buff.ly
January 22, 2025 at 4:42 PM
sansisc.bsky.social
SANS Stormcast Monday, March 23rd, 2026: GSocket Backdoor in Bash; Oracle Security Alert; Rockwell Attacks
https://isc.sans.edu/podcastdetail/9860
image of sans internet stormcenter logo with stormcast flair
March 23, 2026 at 7:12 AM
sansisc.bsky.social
GSocket Backdoor Delivered Through Bash Script https://isc.sans.edu/diary/32816
ISC Logo
March 20, 2026 at 8:41 AM
samilaiho.com
ClickLock Stealer: Paste Once, Lose Everything
www.group-ib.com/blog/clicklo...
ClickLock Stealer: Paste Once, Lose Everything
Analysis of ClickLock, a modular macOS stealer delivered via ClickFix that uses fake dialogs, kill loops, and a GSocket backdoor to steal passwords, browser data, and crypto wallets.
www.group-ib.com
July 18, 2026 at 11:55 AM
niiqo.eurosky.social
ShadowHS : ce malware Linux « sans fichier » échappe à tous les antivirus (et il est déjà sur vos serveurs)

goodtech.info/shadowhs-mal...

Un article signé GOODTECH.info

Des chercheurs en cybersécurité ont révélé un nouveau framework de post-exploitation Linux qui fonctio…
🚨 Ce malware Linux fonctionne en mémoire (vos antivirus ne le verront jamais)
ShadowHS : framework post-exploitation Linux sans fichier. Chiffrement AES-256, exfiltration via GSocket, détection CrowdStrike/Sophos. Une étude de Cyble Research traduite en français.
goodtech.info
February 3, 2026 at 11:40 AM
kitafox.bsky.social
見えない侵入者：「ShadowHS」マルウェアがLinux上でハックシェルを武器化

Invisible Intruder: “ShadowHS” Malware Weaponizes Hackshell on Linux #DailyCyberSecurity (Feb 4)

securityonline.info/invisible-in...
Invisible Intruder: "ShadowHS" Malware Weaponizes Hackshell on Linux
Cyble uncovers "ShadowHS," a fileless Linux malware weaponizing hackshell. It uses GSocket tunneling to evade firewalls and kill rival bots.
securityonline.info
February 6, 2026 at 1:30 AM
amitav63.bsky.social
Python-Based Bots Exploiting PHP Servers Fuel Gambling Platform Proliferation!

thehackernews.com/2025/01/pyth...

#php #Gambling #php #PYTHON #vulnerability #2fa #RCE #ZeroTrust #ZeroDay #cybercrime #hacker #privacy #APT #bot #CISO #DDoS #hacking #phishing #CyberAttack #cybersecurity #Security
Python-Based Bots Exploiting PHP Servers Fuel Gambling Platform Proliferation
Millions of PHP servers compromised by Python bots using GSocket to target Indonesian users with gambling redirects.
thehackernews.com
January 19, 2025 at 2:10 AM
dinosn.bsky.social
GSocket Gambling Scavenger – How Hackers Use PHP Backdoors and GSocket to Facilitate Illegal Gambling in Indonesia www.imperva.com/blog/how-hac...
GSocket Gambling Scavenger – How Hackers Use PHP Backdoors and GSocket to Facilitate Illegal Gambling in Indonesia | Imperva
How Hackers Use PHP Backdoors and GSocket to Facilitate Illegal Gambling in Indonesia
www.imperva.com
January 16, 2025 at 6:10 AM
fluid.sublimer.me
hackerschoice/gsocket: Connect like there is no firewall. Securely.
hackerschoice/gsocket: Connect like there is no firewall. Securely.
https://github.com/hackerschoice/gsocket
github.com
April 13, 2024 at 1:10 AM
cyfar.ca
Stood up an Ivanti Sentry honeypot for 5 days post-CISA-KEV (CVE-2026-10520). They bombarded the snot out of it...

one ran a toolkit, another hand-ran 362 commands and hashed their own SSH implant to confirm it stuck, another gsocket...

cyfar.ca/engagements/...
Ten Operators, One Ivanti Sentry Command-Injection Endpoint
Within five days of exposing an Ivanti Sentry management surface to the internet, a controlled sensor recorded ten distinct operators attempting to exploit CVE-2026-10520, the CVSS 10.0...
cyfar.ca
June 22, 2026 at 3:19 PM
threadlinqs.bsky.social
This macOS stealer freezes your Mac with a kill-loop until you type your real password - then loots it all. https://intel.threadlinqs.com/threat/TL-2026-1440 #ThreatIntel #ClickLock #goyim #GSocket
ClickLock Stealer: macOS ClickFix Infostealer Uses 210ms Process-Kill Loops and Fake Authentication Dialogs to Coerce Credentials
July 17, 2026 at 9:55 AM