WantonQuantum
Joined 6 years ago
Karma
1,113
Submissions
405
Member since
Dec 29
Joined 6 years ago
Edit to add: Previous HN discussions about PineBuds https://hn.algolia.com/?q=PineBuds
The excellent Arvin Ash has a very accessible video about it: https://www.youtube.com/watch?v=paQLJKtiAEE
BTW, this site is likely not set up to handle a HN hug of death of downloads so consider throttling your downloads if you can.
https://account.booking.xn--comdetailrestric-access-ge5vga.w...
More info here (the video refers to this page describing the attack): https://www.bleepingcomputer.com/news/security/bookingcom-ph...
Edit: HN presents the unicode characters in the domain in a way that makes it clear they're not slashes (well done HN!) so you'll need to look at the url when you hover over it.
The poetry is just a way of obfuscating the current IP address of the botnet control server stored in an otherwise vanilla fork of the nodejs.org website on github.
Despite the article saying that it uses "an AI jailbreak technique that turns harmful prompts into poems to trick LLMs into bypassing safety guardrails", I can't see anything that implies this is true.
I could be wrong - it's poorly written article.