yooo we just hit 600 already damn
thank you y'all 🥰💪

@AfroSec

check out this man he is arc stud
and design enthusiast

@AfroSec

tweaking ctf and in the mean time hearing this legends's masterpiece 👌👌
feels epic sunday ngl its been long time since i feel Sunday like this

@AfroSec

#redteam_yap

Have you heard about MOTW (Mark of the Web)?
aight let’s cook

MOTW is basically a trust badge Windows slaps on files that come from the internet.
Think of it as Windows saying:

> “yoo hold up bro, you’re a guest here ”

What’s really happening?

* MOTW is implemented using NTFS Alternate Data Streams (ADS)
* When a file is downloaded from the internet, Windows attaches metadata like:

- ZoneId
- Source URL
- Referrer info
- Most common case: ZoneId = 3 (Internet Zone)
there are 5 zones

ZoneId, Meaning
0 Local computer
1 Local intranet
2 Trusted sites
3 Internet (most common for downloads)
4 Restricted sites

Once that tag exists, Windows components start acting paranoid:

- 🛑 Microsoft SmartScreen
- 🛑 Microsoft Office (Protected View)
- 🛑 Other security-aware apps

Result?
Pop-ups like:

> “Are you _sure_ you want to open this file?”
> “This file came from an untrusted source.”

From an attacker’s perspective… yeah, that’s annoying 😏

😈 Attacker mindset: Okay, how do we blend in?

Since MOTW depends on ADS, the game becomes:
> Deliver the payload without inheriting ADS

Especially useful for multi-stage payloads, loaders, or initial access files.

and yup there are well-known, still-used ways to do this :)

1. MOTW Evasion Techniques (Still Wildly Relevant) Container / Disk Image Formats

Examples:
- .iso
- .vhd
- .vhdx
- .img

Why this works:
- When mounted via Windows Explorer, files inside the virtual disk do NOT inherit MOTW

- Payload comes out looking “local” 👌
> Still abused heavily in real-world campaigns btw.

2. Physical Transfer / Internal Copy

- USB devices
- Copying from another internal machine

No browser → no ADS → no MOTW
Old-school, but effective.

3. Internal Email Attachments

- Payload archived (ZIP/RAR)
- Password-protected archive
- Sent from a compromised internal mailbox

> Even in modern Microsoft 365 environments (as of 2026):
> Internal emails do NOT apply MOTW by default
> Unless orgs explicitly enforce custom policies

This is gold for lateral movement and internal phishing 🎯

Real Threat Actors Using These Techniques
Groups known to abuse MOTW bypass paths:

- TA505
- APT38
- APT29

@AfroSec

“Comparison is the thief of joy” is advice for people already in motion … not for those who haven’t started

@selfmadecoder

yellow fam 🙃

jst found cozzy coffe house while heading home 👌

@AfroSec

late night grind loading 😅

@AfroSec

Anthropic's Claude Code Security Wipes Billions Off Cybersecurity Stocks in a Single Afternoon | Awesome Agents
https://awesomeagents.ai/news/claude-code-security-cybersecurity-stocks-crash/

i wonder why attackers love chrome tho 😅 all the time chrome exploit mtsm

@AfroSec

am in luv with this edit frrr

@AfroSec

Machine Learning Augmented Attacks

Recent threat reporting shows malicious actors are actively using AI as a force multiplier for offensive operations.

The interesting part isn’t that AI can generate code(i mean we already knew that)
The real shift is:
-Polymorphic Malware: rapid generation of variants to evade signature-based detection.
-Linguistic Smoothing: low skill actors are now bypassing "broken English" red flags in phishing.
-Condensed Attack Cycles: Reconnaissance and profiling that took days now take minutes.

🔴For Security & Red Teams
Focus less on what is generated,and more on how fast and how often:-
1.Content Velocity: abnormal speeds in phishing deployment.
2. LLM Wrappers: malicious use of open-source models in botnets.
3. Linguistic Patterns: Fluency ≠ legitimacy
4.Adaptive Payload Mutation: watch for rapid iteration patterns rather than static signatures.

AI is now part of both the exploit chain and the defense stack,the advantage won’t belong to whoever “uses AI”,it will belong to whoever understands how it changes execution speed.