Device code phishing is scaling fast. We investigated real BEC cases to show how attackers abuse Microsoft’s login flow, why forensics get tricky, and how defenders can detect, block, and investigate these attacks in Entra ID, Sentinel, Conditional Access…

My blog, mostly about programming

Claude Desktop launches its AI subprocess with --allow-dangerously-skip-permissions. We found the command line, reverse-engineered the architecture, and threat-modeled what an attacker could actually do inside that sandbox, including a prompt injection chain…

AI can tell you what your software does. It cannot tell you what your software must never do. So you should not rely on it
If I wrote my own financial audit report and handed it to you, would you give me a loan?
Most people would not. A self-certified audit…

During our security research we keep encountering the same iDEAL abuse pattern: criminals generate a real iDEAL payment link for their own purchases and trick victims into paying it. Here is how it works, why it is hard to prevent, and an open question for…

Abusing an unauthenticated Bluetooth protocol to turn a PC speaker into a Rubber Ducky.

Claroty Team82 researchers used Anthropic’s Claude Opus 4.6 AI model to uncover vulnerabilities in a popular video intercom platform manufactured by Zenitel. Team82 had already manually researched and disclosed five vulnerabilities in the TCIV-3+ model, a…

Expose how compiling Sliver into WebAssembly beats EDR: WasmForge produces opsec-safe binaries with zero changes to the tool source.

Posted by albinowax - 8 votes and 3 comments

A two-byte gRPC request crashed AWS's Kubernetes KMS plugin. Coordinated disclosure with AWS VDP; fix merged as aws-encryption-provider#169.

Mythos found a 17-year-old FreeBSD RCE; AISLE reproduced it with gpt-5.4-nano via their nano-analyzer pipeline. I ran the pipeline on two local open-weight models, gpt-oss-20b and gemma-4-31b-it. The misses recovered on re-run. The real problem was the false…

Because we can!

Unified threat intelligence platform combining dark web monitoring, stealer log analysis, and attack surface recon.

There's no silver bullet, but if we put some "lead" bullets in the right
places, we have a good shot at keeping sensitive data out of logs.

a simple, no-frills, command-line driven
pastebin service powered by the Rocket web framework.

EDRChoker redteam tool uses Policy-based QoS - pacer.sys to set throttling on EDR agents, causing them to always time out, effectively blocking them

This research documents my development of payloads for the CVE-2026-46640. - CVE-2026-46640 writeup.md

Posted by Turbulent-Tap6723 - 1 vote and 1 comment