CodeTayo

QR code you can actually scan
Try it!

I love virus hunting, learn how they move, what they do.. it's a bit tricky before back in 2000 but thanks to AI, it's so much faster now.

See how AI using Antigravity and Gemini 3.1 Pro deobfuscated the malicious codes easily.

If ever you encountered these fake MrBeast online scam.

Ano ba ang mga nanakaw sayo?
1. Your entire browsing history on all of your Google Chrome and Microsoft Edge profile.
2. Your entire browsing session on all of your Google Chrome and Microsoft Edge profile.
3. Attacker can remotely operate your browser
4. Attacker can scan through your drives from A-Z
5. Attacker can see your downloaded files

What is "browsing session" (Session Hijacking) bakit pag bukas mo ng facebook naka login ka na agad? Bakit pag bukas mo ng gmail, nakikita mo na agad ang inbox? That's because you never log out and your current "session" is saved (in laymans term nalang) at eto ang hina hijack ng attacker, yung mga naka save na session sa browser mo, pinapadala nya eto sa kung saan sya located at ginagamit nya etong session mo at pwede sya mag pretend na ikaw yun bypassing all securities na nilagay mo sa facebook, gmail or kahit ano pa. Bypassing all 2FA, OTP, etc.. Kasi na hijack na yung session mo.

Ano ang recommendation ko:
0. Clean your browser extension, remove them all!

1. Logout ka sa lahat ng matatandaan mong site kung saan naka login ka na automatically. Facebook, Gmail, Shopee, Lazada. Anjan mo nga address at contact number mo diba?

2. Change Password - SA LAHAT NG MGA ACCOUNTS MO at gumamit ka ng ibang browser.

Wag Microsoft Edge, Brave, at iba pa kasi under the hood. Iisa lang sila at lahat, gumagamit ng "Chromonium" na galing sa Google din mismo. Para ka lang nag patakbo ng Google Chrome, pero iba ang pangalan.

I recommend, Mozilla Firefox dahil eto lang ang pinaka last na independent browser na hindi gumagamit ng chromonium. Meron din ba kayo alam na iba pa? Share mo na kung ano yon.

Lagay mo eto sa address bar "about:version" pag may nabasa ka Chromonium, pass ka na dyan.

The reason for bakit ibang browser, kasi kung gagamit ka din lang ng chrome at anjan pa yung malicious extension, makikita at makikita parin nya yung session mo, wala din silbi.

POSTING FOR AWARENESS, INFO AND SOLUTION

MrBeast online scam (not the true Mr.Beast)

Our accounts recently got hijacked using an chrome extension called "Saved to Google Drive" at first it looks safe because of the extension name it self.. But none of my family members will have an interest what this extension does and I do not remember installing one.

In our laptop, there are at least 10 separate google chrome profiles and I noticed all of them have the same extension. I already got a hunch that may be this is the reason.

last night, around 10pm, I started receiving emails regarding OTPs, make sure its me, and all that security notifications. I am a security j***y so I am pretty sure all my accounts have 2FA / OTP enabled and I am using secured passwords.

I checked the extension in AppData/Local and I noticed these folder names were a random characters. The parent folder name is also has random characters. I already had my suspicion. I checked the JS codes and they are heavily obfuscated and that made me decide that his extension is the suspect.

Code obfuscation is a way to sort of make your codes unreadable to the human eye.. It's as if encrypted but it's not. It's just the variables, function names, are "obfuscated" or named in non readable form. As a past virus hunter.. I do what they do and we do that to make it hard for some to trace the codes. The more the code is obfuscated, the more it's harder and almost impossible or it will take months to crack the codes or ... de-obfuscate. I'm not an security expert but I develop applications too in .net and code obfuscation is pretty standard these days because someone can just disassemble your applications written in .net.

Here comes AI and Antigravity IDE and using Gemini 3.1 Pro model.
I just asked to read the entire folder and tell me what it is and it quickly know that the codes were obfuscated, continued its work and minutes later, it reported back that the extension is a trojan / InfoStealer extension.

I can go deep as I want with this with the help of AI and trace back the true location of this actual author of this extension, send back pack of s**t and shove it down to its throat but I will let Cybercrime Investigation and Coordinating Center - CICC handle this.

This gave me an extreme headache but we are now safe.

Oh and the solution? Clean your chrome extension
Google Chrome and Edge

Where did it came from?
Someone clicked an online betting link, allowed it to install or someone downloaded a malware

Askal Mini Bot


Full video updat naten
https://youtu.be/sg3XKSn_pac

Weekend butingting
ESP32-S3 SUPERMINI breakout board na may 3A at 2A buck. This is for my AskalMiniBot.