Archive

Security research by R3dpars3c documenting a Universal XSS vulnerability in Google Translate.

Multiple critical vulnerabilities at Plausible Analytics: pre-auth Storybook RCE, registration bypass with cross-tenant IDORs and stored XSS, and SSO verification SSRF to PostgreSQL RCE.

We found PavinLoader being used across ClickFix, fake software, and RenPy campaigns to deliver Amatera Stealer and other malware.

a collaborative hunt: finding access tokens, Copilot chat logs, and other private information inside Microsoft employee diagnostic data

Vulnerability intelligence that predicts avenues of attack with speed and accuracy.

Losing access to VirusTotal Intelligence at the start of the year was surprisingly productive. Unable to hunt for interesting new malware, I stopped adding to my “TODO” pile and finally worked through my backlog from last year. That led to a detailed examination of BeheMOF as well as the discovery of this malware. Upon closer inspection, a sample that did not seem too noteworthy at first turned out to have a distinctive design once I looked under the hood: a passive backdoor that opens no obvious listening port and carries no payload inside itself. It waits in memory doing nothing at all until one specifically crafted network packet reaches the machine, which is why I am calling it SLEEPWALKER.

AmberWolf Security Research Blog

A single static Go binary that decrypts and unpacks FortiOS firmware end to end, plus the FortiOS 7.4 config-secret key nobody had published before this.

New Loader Hiding Shellcode in Plain English Words

How I registered a Linux machine with Apple's private services, received an existing Find My People key over IDS, and decrypted the live location without a Mac.

I remember watching Simon Scannell's REcon 2023 talk, You Have Become the Very Thing You Swore to Destroy, and being deeply impressed by how he turned ClamAV's own detection logic into an oracle for exploiting a service with no direct output channel. I remember hoping that, someday, I might have the

Introduction Running Tailscale as a network layer for C2 traffic is not a new idea. What makes this implementation different is that the entire Tailscale daemon runs inside the implant process with no driver, no service, no disk state, and no child processes. Traffic relays over standard WebSockets that are indistinguishable at the edge from […]

Abstract We all know AI can find bugs. After a decade of research, I asked a harder question: can an autonomous system invent new attack techniques, and use them to hack live websites at scale? Buildi

Hunting Exchange Server 0day like a detective It has been a while since my last blog post, not because I didn’t do anything (or I?), I just don’t have any time/ any motivation to start new blog …

HiveMQ Platform 4.54.0 Data Hub custom module upload extracts ZIP entries with path.resolve() and no containment checks. Using the shipped default…

Learn how Chromium browser extensions can be silently sideloaded to establish persistent C2 access and how to detect it with Sysmon.

The first open source Mythic C2 agent with a full in-memory BOF loader for macOS and Linux, including Apple Silicon. No fork and runs, no baked in capabilities.

Unlocking _everything_ on the CPU with DRAM scrambling - xoreaxeaxeax/skitter-creek-bath-salts

Real-world backup infrastructure attacks revealing how misconfigured Veeam servers and unencrypted backups enable domain compromise

Intro Something different this time. This post is based on a speech I’m giving on June 24th at Ya!vaConf in Poland. So, we will analyze WebGoat application which is written in Java to discover some vulnerabilities in the source code and then write an exploit using Python.

Swarmer enables stealthy Windows registry persistence by exploiting mandatory user profiles and the Offline Registry API to bypass EDR detection. Learn how this technique leverages NTUSER.MAN files to modify the registry without triggering standard API monitoring.

Gareth Heyes - [email protected] - @garethheyes It's quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization. In this

Kaspersky experts have discovered malicious TrueConf software installers. The Head Mare APT group uses them to deliver the PhantomCore and PhantomGraph backdoors to target systems by exploiting vulnerabilities in an unpatched TrueConf server.

How a small code mistake allowed hijacking the Microsoft accounts of everyone in a Teams meeting.

Guillaume Técher — Personal website

Autonomous multi-LLM vulnerability research: full root-cause analyses and reproducible PoCs for 0-day RCE chains across enterprise, ICS/SCADA, ERP, and NMS products.