josehelps Add us as a preferred source on Google

Mastodon @josehelps@infosec.exchange

⚔ Compare ☆ Follow Own this channel?

🔄 Data last refreshed 1 day ago

🤝

Make a deal with josehelps

🔒 Paid proposals held safely in escrow — released only when the work's approved.

Followers

Account age

3 yrs

🎁 Free analysisfor josehelps

🕵️Fake Followers CheckReal-audience % & bot risk→ 📊Engagement rateBenchmarked vs. peers→ 💰What they chargeFair sponsored-post price→

📊 Activity & format

Posting cadence

74.6 / week

A very active account — posts many times a day.

Content mix

Mostly text

Recent: 12 text · 0 image · 0 video.

Follower / following

0.3×

Follows 28 back. A more reciprocal / networked account.

Recent posts

View on Mastodon ↗

As of this morning the stager URL is still live: agent.x90[.]dev/data/copilot[.]txt (Cloudflare, ~8.5MB PE). Censys shows *.x90[.]dev certs in the wild and dns.x90[.]dev on Oracle BMC; Active DNS had no A/AAAA bound for agent.x90[.]dev in … This is living-off-the-AI. C2Agent is an MCP client (defaulting to Firecrawl's public MCP), pulls skill playbooks from C2 as markdown, can save new skills, and from v2.3 can hand tasks to AI coding CLIs already on the victim host. That is … The operator sends a plain-language goal. The implant builds a system prompt, asks the model for one JSON tool call, runs it, feeds the result back, and loops. Tools cover command exec, LOLBin templates (cred dump, shadow copies, free-spac… Unit 42 just published timely intel on C2Agent: Windows malware where an LLM runs the host. Jingwen Shi, Gaurav C G, Mark Lim, Tyler Halfpop, and Ashutosh Chitwadgi tracked 32 samples across ~a month of active development. https://github.c… If AnyDesk isn't your remote tool, prevent it from running with app control, free with https://MagicSword.io: https://magicsword.io file_transfer_trace.txt is a plaintext log of every file-manager transfer. In the lab, a 231 MiB https://documents.zip left 5 min after a Passwd login. AnyDesk also tries direct TCP 7070 before the relay. Blocked attempts show as Connectio… AnyDesk is in 32 ransomware groups' toolsets in the Ransomware Tool Matrix, more than any other RMM. It's signed and legit, so the alert reads "probably IT" and gets closed. Ayush Anand ran it in a lab the way crews do and wrote up how to … Hunt on the hash or the TechPowerUp LLC signer. Per the CVE-2025-7771 PoC, the device name comes from the service name, so that's not reliable either. hlpdrv.sys now has the DFIR Report ref and %TEMP% path: https://www.loldrivers.io/driver… It's the same signed ThrottleStop.sys we've had on LOLDrivers since May 2025 from Kaspersky GERT's AV-killer research. I added rwdrv.sys as a tag plus the Akira context. https://www.loldrivers.io/drivers/6e0786f5-2168-40a8-a068-e261c4eb10e… Akira affiliates drop a signed ThrottleStop.sys renamed to rwdrv.sys in %TEMP% (service mgdsrv), next to a malicious hlpdrv.sys (service KMHLPSVC), to shut off Defender. Hunt on that filename and you'll mostly hit RWEverything's RwDrv.sys.… Other coverage: hlpdrv.sys and rwdrv.sys from the Swisscom BYOVD step are already on LOLDrivers. The consent.exe → msimg32.dll Bumblebee sideload isn't on HijackLibs yet, I have a PR open: https://github.com/wietze/HijackLibs/pull/203 Not … Both LOLRMM entries were stubs, so I filled them in from the RustDesk and cloudflared source plus the case: service names, --service / --tray / --cm, config and token paths, ports (RustDesk 21115-21119, cloudflared 7844). https://github.co…

🐘 Community & instance

Home server

infosec.exchange

A cybersecurity & infosec server — its members and audience skew toward that niche, so expect a community-aligned, engaged following.

On Mastodon since

Nov 2022

Joined in the Twitter-exodus wave of late 2022 — part of the migration that made Mastodon a real destination.

💡 Facts

🗓️Joined Mastodon in 2022 — 3 years ago.

📤Posts about 74.6× per week.

🕵️ Fake follower check

Estimated

55/100

Fair Credibility score

~80%

Real Real audience

Low Fake-follower risk

Low Data confidence

Est. 80% real, active audience · Low fake-follower risk.
Limited engagement data — score uses the signals available.
Established account (3+ years old).

Low confidence — few signals are public for this listing, so treat it as a rough screen. Heuristic estimate from engagement, follower ratios, account age & growth — a screening signal, not a guarantee.

About

🛡️ Prevention @MagicSword ex Director of Research Director @Splunk 🔧 Maintainer of #AtomicRedTeam, #LOLDRIVERS & #LOLRMM

🔀 Audience overlap

Estimated

Estimated shared audience with similar creators — useful for avoiding overlap (or doubling down) when planning a campaign.

Mnt news bharat 16%

kokuto_milk 13%

ライリー 🏳️‍⚧️ 12%

STIC (stic13jp) 12%

紅梅アヤ 10%

ハイ液 10%

More like this

Find more →

Mastodon ＋

Mnt news bharat

@mntnewsbharat@mastodon.social

@kokuto_milk@mstdn.jp

8 Followers

Frequently asked questions

How much does josehelps charge for a sponsorship?

josehelps hasn't published fixed prices yet. Send a proposal through SocialDB and agree terms directly — your payment is held in escrow until the work is approved.

How do I contact josehelps for a brand deal or collaboration?

Send a paid deal or collab request right here on SocialDB — we notify josehelps, and once they accept, your payment is held safely in escrow and released when the work is approved. You don't need to track down an email.

How many followers does josehelps have?

josehelps has 8 followers on Mastodon.

Auto-generated from Mastodon's public data — no affiliation with or endorsement by SocialDB. Is this you? Claim it · Remove

josehelps Add us as a preferred source on Google

Make a deal with josehelps

📊 Activity & format

Recent posts

🐘 Community & instance

💡 Facts

🕵️ Fake follower check

About

🔀 Audience overlap

More like this

Frequently asked questions

✉ Message josehelps

🎤 Event / appearance with josehelps