Security Review #314

Wwe discuss some benchmarks that measure how to evaluate if a model can find and exploit security vulnerabilities, how we know when agents become useful for defenders, and when they cross the threshold into uplifting attackers.

A technical overview of how to load malicious code into .NET assemblies. We will look for a trusted executable that tries to load a (non-existent) DLL, and we will place our DLL at the expected path with our loader in it. Although EDRs do see that a specific function was executed from within the DLL, they tend to care less about it, especially if the execution originates from a high-reputation EXE.

I've noticed that the security side of AI memory systems is completely overlooked, despite holding more information than most password managers. The memory system itself is secure, the real question is what happens when you pair it with an agent that can browse the web.

We analyze sa relay technique that involves NTLM authentication coercion outbound to the internet, catching that traffic with a cloud host, and forwarding that traffic back to our red team infrastructure where it will be proxied back into the target environment to a service which will allow identity or computer takeover.

This article presents a callstack spoofing technique that combines three primitives: Windows Thread Pool execution, enum callback trampolining and indirect syscalls. We get a call stack where every frame is backed by a signed Windows module at the moment the syscall executes, and therefore unlikely to be flagged by EDR.

A Redis 8.6 stream PEL ownership bug, a malformed RESTORE payload, and a jemalloc size class collision that turns a shared NACK into code execution.

We introduce reverse prompt injection as a honeypot detection mechanism and analyze a full offensive session from an autonomous LLM-based agent, exhibiting multi-tool switching, semantic credential extraction from HTML comments, contextual payload generation, and a characteristic "sawtooth" timing signature.

Static teardown of a ClickFix chain on new-blog.artlist[.]io, from Polygon EtherHiding and PowerShell delivery to a manually mapped native Windows RAT.

We detail a sophisticated ClickFix campaign operating on a subdomain belonging to the popular digital asset platform, Artlist. The attackers had successfully compromised new-blog.artlist[.]io, injecting malicious code designed to trick visitors into installing a Remote Access Trojan (RAT) disguised as a human verification CAPTCHA.

ServiceNow provides not only its own system of tables and ACLs but also its own query API, known as the GlideRecord system. Investigations led to us finding a completely unauthenticated RCE, which allowed full compromise of the ServiceNow instance as well as all connected proxy servers.

Dell stores its BIOS administrator and user passwords as XOR-encrypted plaintext in the DVAR (Dell Variable) region of the SPI flash chip, not as a one-way hash. An attacker who can read the SPI flash, which is possible with a clip and a cheap programmer or by booting an operating system they control, can recover the password and gain full BIOS access

We analyze two phishing toolkits, "Jalisco" and "OmegaLord". Jalisco provisions fresh OAuth codes in real time; OmegaLord grabs phone numbers with passwords to intercept MFA.

We show that the long‑standing default allowedToCreateApps setting lets any ordinary user register a malicious Azure Entra application, configure attacker‑controlled redirects and implicit‑grant settings, and request high‑privilege Graph scopes; once a victim clicks a consent link the attacker gains a persistent token and back‑door into the tenant.

In this second part, I will show how exposing device registers to non-privileged users can lead to access to physical memory. We solely focuse on the DMA vulnerability because its PoC is quite complex.

We analyze CrashStealer, a macOS infostealer in native C++ that steals browser data, crypto wallets and keychain secrets using AES-GCM encryption.

Analyis of TuxBot v3 Evolution cross-compiled binaries, an IoT botnet framework built with LLMs. We review the C2 architecture and uncover some interesting bug.

Static analysis of a .NET RAT that ships browser credential theft, Discord token harvesting, cryptocurrency wallet draining, and a Jigsaw-inspired ransomware module in a single 2.5 MB executable.

Full reverse engineering analysis of ModHeader browser extension silently exfiltrates browsing history to api.stanfordstudies.com using AES-GCM encrypted IndexedDB.

Having examined Unicode handling in other databases, we will see that its implementation in SQL Server proves to be particularly complex. We will discover how the burden of backwards compatibility has given rise to new features which, in reality, have serious shortcomings.

Microsoft permits third-party applications to register AMSI providers with the operating system in order to communicate with the interface. Threat actors with elevated permissions on the asset could abuse this behaviour and register a fake AMSI provider to establish persistence.

We detail how the LLM ability to generate escape code can be leveraged to exploit AI tools relying on the macOS Terminal app. The exploit leaks data through specially crafted DNS requests triggered by specific ANSI escape codes.

Two bugs in the Google's implementation of the device authorization grant (RFC 8628) make it possible to create a link, when opened by a victim who has ever used "Sign in with Google" anywhere, silently hands over an access token for an arbitrary Google-registered client

In this second part, we present a technique that produces an out-of-band, high-fidelity trigger. We plant a leaked AWS credential that is deliberately corrupted. We back the credential with a real AWS canary token, so the trigger fires only when the attacker genuinely pivots to AWS, and the alert arrives with whatever client and network telemetry they bring to that call.

In this first part, we detail a technique to replace container images in Azure container services. We embed IMDS token theft and secret exfiltration directly into a Dockerfile's entrypoint, eliminating the need for a persistent reverse shell connection.

Technical analysis and IOC for TELEPUZ, a full-featured and lightweight MaaS malware spreading via CLICKFIX-VIDAR attacks and using WebSockets for communications.

We found CVE-2026-9082, a Highly critical SQL injection in Drupal core. The issue is reachable by fully anonymous users on any deployment that backs Drupal with PostgreSQL. We walk through the patch, explain why an unauthenticated JSON object survives into the SQL placeholder name on the case-insensitive IN path, and include two working proofs of concept.

DoublePulsar is a UDRL that adds multiple layers of concealment: it hides the implant inside a legitimate system module’s memory, encrypts it while idle, fakes its call history to look like normal system activity, and isolates its memory allocations from the rest of the process. This post provides detection strategies, YARA rules, and a MITRE ATT&CK mapping to help security teams identify this class of threat.

The built-in "MareBackup" scheduled task is susceptible to a trivial executable search order hijacking, which can be abused by a low-privileged user to gain SYSTEM privileges whenever a vulnerable folder is prepended to the system's PATH environment variable (instead of being appended).

This article aims to provide the reader with a comprehensive guide to the technical details and the underlying design decisions of process cloning on Windows and how they affect its usability. We will explore why most techniques for code injection via cloning will almost inevitably struggle with evading security products, yet other attack vectors like credential dumping might find their niche.

We revisit some of the offensive AD CS attacks once Microsoft released the KB5014754 patch, detail how the patch has affected some of the existing escalations and two new escalations titled ESC9 and ESC10.