Security Review #280

In this article we will describe a technique to easily create a "Two-Face" Rust binary on Linux: an executable file that runs a harmless program most of the time, but will run a different, hidden code if deployed on a specific target host. We will also detail how to make the "hidden" binary more difficult to inspect in memory.

This post is about a data exfiltration attack chain, where an adversary (either the model or third-party attacker via indirect prompt injection) can exfiltrate data the user has access to. This will be performed by leveraging the built-in Anthropic Claude APIs.

In this article, I will demonstrate the technique of exploiting the Bind Filter driver (bindflt.sys) to redirect folders containing the executable files of EDRs to a location that I completely control. Here, we can block or inject code into the EDR at will. Everything will be executed in user mode without needing kernel privileges through the Bring Your Own Vulnerable Driver (BYOVD) attack.

We review techniques for exploiting confusion across various programming languages arising from differing syntaxes, refered to as 'syntax confusion'. We'll provide step-by-step guidance, supported by with practical examples, on crafting payloads to confuse syntaxes and parsers - enabling filter bypasses and real-world exploitation.

This article demonstrates how to systematically evade YARA rules and behavioral detection. We present a comprehensive case study of developing a Linux rootkit that successfully bypasses Elastic Security's detection mechanisms through string obfuscation, module fragmentation, XOR encoding, and ICMP reverse shell staging.

We discuss how to leverage Narator.exe to perform DLL Hijacking, persistence and lateral movement on Windows systems.

Thechnical analysis of a highly evasive malware loader that exploits legitimate, signed Greenshot software through DLL sideloading.

This post walks through the important modules of Wmiexec-Pro, a new WMI-native post-exploitation tool. We will review what those modules do, and the concrete telemetry you can hunt for.

CVE-2025-5350 and CVE-2025-5605 combined make a pre-auth server-side request forgery (SSRF) vulnerability in WSO2 API Manager, Identity Server, and other WSO2 products.

We stumbled upon an Azure Event Grid System Topic vulnerability allowing us to view Event Subscriptions data for all tenants that had an Event Subscription configured due to a flaw in the filtering mechanism Microsoft used for displaying data to their customers (CVE-2025-59273)

How n-day research for CVE-2025-59287 in Microsoft WSUS led to the discovery of a new 'SoapFormatter' vulnerability, leading to Remote Code Execution (RCE).

This post walks through an AD attack workflow - what happens in the first minutes, how techniques chain, and why it's so dangerous. We see how attackers quietly exploit AD through enumeration, Kerberoasting, and AS-REP roasting - and why most SIEM and EDR tools fail to catch it.

In this blog, we'll explore the essentials of detection engineering, dive into Sigma rules, and provide a practical example of detecting malware using this powerful framework.

We provide guidelines to manage the risk related to service accounts in Active Directory. We discuss inventory, owner assignment, and privilege triming. We also review the advantages of gMSA, how to block and monitor interactive logons, track authentication trails and AD changes.

In this blog post, I'll demonstrate how it is possible to execute shellcode from a PE section like .data without calling VirtualProtect() to change the memory protection from RW to RX. I will leverage a combination of three interesting Windows mechanisms: Hardware Breakpoints (HWBPs), Vectored Exception Handling (VEH), and Instruction Emulation.

I took an interesting challenge: reverse-engineer the new and shiny Friend pendant. The goal: retrieve the audio stream and the button state from the device. This article lays out my process, from how I approached the problem to how I figured out the inner workings of friend.

We uncovered a critical boundary-parsing bug, dubbed TARmageddon (CVE-2025-62518), in the popular async-tar Rust library and its deep lineage of forks, including the widely used tokio-tar. This vulnerability can lead to Remote Code Execution (RCE) through file overwriting attacks, such as replacing configuration files or hijacking build backends.

CVE-2025-9152, CVE-2025-10611, and CVE-2025-9804 are critical authentication bypass and privilege escalation vulnerabilities I discovered in WSO2 API Manager and WSO2 Identity Server.

We examine the latest version of the Vidar stealer, which features a full rewrite in C, a multithreaded architecture, and several enhancements that warrant attention.

In this post, we describe a novel method of OAuth consent attacks that leverage Copilot Studio agents. This method highlights current gaps in Microsoft's OAuth consent settings and served as a reminder not to trust low-code solutions on Microsoft domains as inherently non-malicious.

In this third part, we will investigate a web shell that does not have obvious indications as to which family it belongs to. We will try to determine that, as well as identifying its key features and specificities.

CVE-2023-40129 is an integer underflow in the GATT protocol implementation of Android's Bluetooth stack (Fluoride). When exploited, it can lead to remote execution without authentication or user interaction. In this blogpost, we detail how we exploited this vulnerability on both Android native allocators: Scudo and Jemalloc.

This post details my approach to the weaponization of CVE-2018-8617 against Microsoft Edge. Before writing the exploit we will first explain the vulnerability using ChakraCore (ch.exe) and WinDbg’s time travel debugging functionality. Then we will get a read/write primitive and escape the sandbox.

This post highlights the impact of lack of proper XPC client validation vulnerability, through CVE-2025-10016 (Kocal Privilege Escalation) and CVE-2025-10015 (TCC Bypass).

We detail how we found an Out Of Bounds vulnerability in the TTF virtual machine of a CANON ImageCLASS printer, letting us execute a shellcode through the IPP stack, a printing protocol implemented on top of a HTTP transport.

We delve into specific cases of Windows log analysis: when an attacker tries to erase them, or when malware crashes in the middle of doing something shady and leaves traces behind.

In this post, we will customize the LLVM compiler infrastructure to build a solution that enables self-masking capabilities for ordinary user-defined functions in a C++ source file. Self-masking means that a function remains in a masked (obfuscated or encrypted) state until it is invoked. Once execution enters the function, it is temporarily unmasked, and upon returning, it reverts back to its masked state.

Brash is a critical vulnerability in Blink, the rendering engine that powers Google's Chromium-based browsers. It allows any Chromium browser to collapse in 15-60 seconds by exploiting an architectural flaw in how certain DOM operations are managed.

A deep dive analysis of Warlock ransomware, deployed by exploiting the SharePoint vulnerabilities CVE-2025-53770 and CVE-2025-53771. It includes self-preservation tactics, defense evasion by stopping a list of services, volume shadow copies processing and encryption using a combination of the ChaCha20 algorithm and Curve25519.

From credential theft to data exfiltration, lateral movement, and even memory-only malware _ PowerShell can do it all. In this blog we will see how one can identify how PowerShell was used, and by who.

I detail CVE-2025-2905, a blind XXE vulnerability in WSO2 API Manager and other WSO2 products dependent on WSO2-Synapse. Exploitation of the vulnerability can lead to data exfiltration, Server-side request forgery (SSRF), or Denial of Service (DoS)

A new phishing attack is bypassing Secure Email Gateways (SEGs) and evading perimeter defences.We analyze the phishing script's mechanics, highlighting its unique features - random domain selection, UUID generation, and dynamic page replacement - and the threat actors' customized approach to credential phishing page design.

A refcount imbalance issue in the af_unix subsystem of Ubuntu’s kernel, leading to UAF of a struct sk_buff object allowing an attacker to escalate to root user.

In this article, we will explore how to extract access tokens from Office desktop applications, with a particular focus on Microsoft Teams. The main goal is to retrieve the access tokens stored on the disk.

HTTP request smuggling attacks can lead to cache poisoning (CPDoS), ACL bypasses and session hijacks, especially on stacks still 'speaking' the language of HTTP/1.1 or on edges that mishandle HTTP/2 to HTTP/1 downgrades. This guide shows you practical HTTP request smuggling techniques supported by in-depth explanations and examples.

We uncovered Herodotus, a new mobile malware that borrows techniques from usual banking trojans, and appears purpose-built to persist inside live sessions. A standout capability – the randomisation of time intervals between text inputs – likely aims to mimic human behaviour closely enough to bypass bot and automation detection, session heuristics, and some behavioural biometrics.

While exploring Docker Compose's support for OCI-based Compose artifacts, I discovered a high-severity path traversal vulnerability (CVE-2025-62725). The flaw allowed attackers to escape Compose's cache directory and write arbitrary files on the host system, simply by tricking a user into referencing a malicious remote artifact.

I detail a ClickFix / FileFix style phishing technique that merges FileFix and Cache Smuggling to avoid having its first stage loader make any web requests. Instead, the loader simply extracts the second-stage payload from the web browser's cache, where it was placed using Cache Smuggling. This evades many security controls which focus on restricting untrusted code's ability to access the internet.

We demonstrate that CSRF can still be exploitable through Client-Side Path Traversal, even with SameSite cookies and in applications that use header-based authentication.

We detail how OAuth applications can be used to gain persistent access to critical resources such as mailboxes and files within compromised environments. We demonstrate how such attacks can be automated through a PoC.

I stumbled across a vulnerability in FreeWifi_Secure: it turns out that the Free Mobile subscriber devices leak their IMSI in cleartext during EAP-SIM authentication. This means that anyone within Wi-Fi range could passively capture the IMSI of Free Mobile users.

The Microsoft Store provides a convenient mechanism to install software without needing administrator permissions. The feature is convenient for non-corporate and home users but is unlikely to be acceptable in corporate environments. This is because attackers and malicious employees can use the Microsoft Store to install software that might violate organizational policy.

In this blogpost, we'll see how the PsExec.exe binary works, and how we can use it as redteamers to improve remote command execution. We will write a python script that allows us acting as a legitimate PsExec.exe client, and review how to protect against it.

In this blog post, we will discuss attacking a self-hosted GitLab instance. We will discuss strategies for attacking a self-hosted GitLab instance, from hijacking runners to exploiting CI/CD vulnerabilities, and detail how attackers gain access, pivot within cloud environments, and steal sensitive data. Finally we will explore key defenses to secure your GitLab setup and prevent unauthorized access.

By chaining a weak domain check, a JSB misconfiguration, and a javascript:// trick, I was able to access local files and steal a user's session cookie with just a single link click.

SharePoint allows unique permissions at the list/library, folder, and item levels. When inheritance is broken, those unique ACLs trump the site's groups. A single "rogue" folder or file can become readable to people who have no access to the parent site.

Technical deep dive into bypassing a strict Web Application Firewall using HTTP Parameter Pollution, leveraging multi-parameter payload splitting to achieve JavaScript injection and evade detection.

Prompt injection is the highest profile vulnerability in AI-powered features and applications. The impact varies greatly depending on who will use the feature, what data is accessible, and what functionality is exposed to the LLM. This guide aims to assist developers in creating secure AI-powered applications and features by helping them understand the actual risks of prompt injection.