<rss xmlns:atom="http://www.w3.org/2005/Atom" version="2.0">
<channel>
<title><![CDATA[ ParaCyberBellum Security Review ]]></title>
<description><![CDATA[ Cybersecurity technical stuff on the fly ]]></description>
<link>https://library.paracyberbellum.io/rss</link>
<atom:link href="https://library.paracyberbellum.io/rss" rel="self" type="application/rss+xml"/>
<language>en</language>
<pubDate>Tue, 19 May 2026 04:24:37 +0000</pubDate>
<item>
<title><![CDATA[ [ARTICLE] Hack the Elephant One Bite at a Time: JPEG-Related Memory-Safety Bugs in PHP ]]></title>
<link>https://swarm.ptsecurity.com/hack-the-elephant-one-bite-at-a-time-jpeg-related-memory-safety-bugs-in-php/</link>
<guid>https://swarm.ptsecurity.com/hack-the-elephant-one-bite-at-a-time-jpeg-related-memory-safety-bugs-in-php/</guid>
<pubDate>Mon, 18 May 2026 06:54:09 +0000</pubDate>
<description><![CDATA[ [ Exploits & Payloads ] We uncovered two serious memory‑corruption bugs PHP’s ext/standard module: a heap‑memory disclosure in getimagesize (CVE‑2025‑14177) caused by improper chunk concatenation when reading multi‑chunk JPEG APP segments, and a heap‑buffer overflow in iptcembed where a buffer sized from fstat is overrun while copying stream data. ]]></description>
<author><![CDATA[ Nikita Sveshnikov ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] The Good, the bad, and the ugly of Microsoft Edge's autofill databases ]]></title>
<link>https://www.reliancecyber.com/blog/the-good-the-bad-and-the-ugly-of-edges-autofill-databases/</link>
<guid>https://www.reliancecyber.com/blog/the-good-the-bad-and-the-ugly-of-edges-autofill-databases/</guid>
<pubDate>Mon, 18 May 2026 06:45:17 +0000</pubDate>
<description><![CDATA[ [ Browser Security ] We  discovered that Microsoft Edge, by default, automatically retained a range of sensitive data outside of its secure storage locations. In this article, we explain how sensitive data can end up in autofill tables and how they can be retrieved. ]]></description>
</item>
<item>
<title><![CDATA[ [ARTICLE] The AI Middleware Risks in Claude Desktop ]]></title>
<link>https://cyberdom.blog/the-ai-middleware-risks-in-claude-desktop/</link>
<guid>https://cyberdom.blog/the-ai-middleware-risks-in-claude-desktop/</guid>
<pubDate>Mon, 18 May 2026 06:40:43 +0000</pubDate>
<description><![CDATA[ [ Post-Exploitation & Lateral Movement ] The article focuses on post-exploitation amplification and demonstrates that once attackers gain execution within the same user context, AI desktop middleware enables credential theft, token decryption, cloud pivoting, MCP abuse, and autonomous operations without requiring administrator privileges or kernel-level escalation. ]]></description>
<author><![CDATA[ Elli Shlomo ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] Behind the Code: The Layered Defense-Evasion of VIP Keylogger ]]></title>
<link>https://www.splunk.com/en_us/blog/security/behind-the-code-layered-defense-evasion-vip-keylogger.html</link>
<guid>https://www.splunk.com/en_us/blog/security/behind-the-code-layered-defense-evasion-vip-keylogger.html</guid>
<pubDate>Mon, 18 May 2026 06:36:56 +0000</pubDate>
<description><![CDATA[ [ Keyloggers, Backdoors & Rootkits - Malware Analysis ] In this post, we provide a comprehensive analysis of the VIP Keylogger malware family, alongside a deep dive into its script loader’s use of obfuscation and steganography. ]]></description>
</item>
<item>
<title><![CDATA[ [ARTICLE] Investigating server compromises with cgroups: A Linux DFIR primer ]]></title>
<link>https://redcanary.com/blog/threat-detection/linux-cgroups/</link>
<guid>https://redcanary.com/blog/threat-detection/linux-cgroups/</guid>
<pubDate>Mon, 18 May 2026 06:34:28 +0000</pubDate>
<description><![CDATA[ [ Incident Response & Forensics ] This blog post introduces a new type of Linux telemetry by repurposing chroups, a kernel feature designed to limit system resources, into an effective form of process enrichment. We will see how we unlock valuable telemetry for investigating malicious processes on Linux. ]]></description>
<author><![CDATA[ Thomas Gardner ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] CVE-2025-69443: Archon OS Vulnerable To Web-To-Client Attack ]]></title>
<link>https://www.ox.security/blog/cve-2025-69443-archon-os-vulnerable-to-unauthenticated-web-to-client-attack/</link>
<guid>https://www.ox.security/blog/cve-2025-69443-archon-os-vulnerable-to-unauthenticated-web-to-client-attack/</guid>
<pubDate>Mon, 18 May 2026 06:31:45 +0000</pubDate>
<description><![CDATA[ [ Exploits & Payloads ] We discovered CVE-2025-69443, a critical vulnerability in Archon OS that allows a malicious web page to cross web-to-client boundaries via an unauthenticated network request. Exploitation enables extraction of sensitive environment variables and arbitrary command execution on the server UI, allowing an attacker to act fully on the user's behalf. ]]></description>
<author><![CDATA[ Moshe Siman Tov Bustan, Nir Zadok ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] CVE-2025-65719: Critical RCE in Kubectl MCP Server ]]></title>
<link>https://www.ox.security/blog/cve-2025-65719-critical-rce-in-kubectl-mcp-server/</link>
<guid>https://www.ox.security/blog/cve-2025-65719-critical-rce-in-kubectl-mcp-server/</guid>
<pubDate>Mon, 18 May 2026 06:30:09 +0000</pubDate>
<description><![CDATA[ [ Exploits & Payloads ] We discovered CVE-2025-65719, a critical RCE in Kubectl MCP Server.If exploited a single webpage visit can compromise clusters. ]]></description>
<author><![CDATA[ Moshe Siman Tov Bustan, Nir Zadok ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] How malware abuses npm lifecycle scripts and VS Code tasks ]]></title>
<link>https://opensourcemalware.com/blog/malware-abuses-vscode-lifecycle-scripts</link>
<guid>https://opensourcemalware.com/blog/malware-abuses-vscode-lifecycle-scripts</guid>
<pubDate>Mon, 18 May 2026 06:28:47 +0000</pubDate>
<description><![CDATA[ [ DevOps - Malware Analysis ] We review how npm lifecycle scripts and VS Code's tasks.json, are being weaponized by threat actors who embed malicious code that runs automatically during package installation, and how such threat can be mitigated. ]]></description>
<author><![CDATA[ Jenn ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] AI Artifacts: A New Layer of Endpoint Activity to Hunt ]]></title>
<link>https://nebulock.io/blog/ai-artifacts-a-new-layer-of-endpoint-activity-to-hunt</link>
<guid>https://nebulock.io/blog/ai-artifacts-a-new-layer-of-endpoint-activity-to-hunt</guid>
<pubDate>Mon, 18 May 2026 06:25:16 +0000</pubDate>
<description><![CDATA[ [ Incident Response & Forensics - Machine Learning & AI ] In this article, we'll explore how AI assistants behave from a Digital Forensics and Incident Response (DFIR) perspective and examine the artifacts they generate on endpoint systems: conversation and prompt history, file system and workspace artifacts, plugin, extension, and MCP server usage. ]]></description>
<author><![CDATA[ Jarrett Polcari ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] How to respond to an incident in Kubernetes ]]></title>
<link>https://www.invictus-ir.com/news/incident-response-in-kubernetes-eks</link>
<guid>https://www.invictus-ir.com/news/incident-response-in-kubernetes-eks</guid>
<pubDate>Mon, 18 May 2026 06:21:25 +0000</pubDate>
<description><![CDATA[ [ DevOps - Incident Response & Forensics - Public Cloud ] We review the prerequisites for an efficient reaction to intrusion in an EKS environment, the investigations steps to be taken, and mistakes that should be avoided. ]]></description>
</item>
<item>
<title><![CDATA[ [ARTICLE] Malicious Coding Agent Skills and the Risk of Dynamic Context ]]></title>
<link>https://securitylabs.datadoghq.com/articles/malicious-skills-supply-chain-risks-in-coding-agents-with-dynamic-context/</link>
<guid>https://securitylabs.datadoghq.com/articles/malicious-skills-supply-chain-risks-in-coding-agents-with-dynamic-context/</guid>
<pubDate>Mon, 18 May 2026 06:15:24 +0000</pubDate>
<description><![CDATA[ [ Machine Learning & AI ] In this post, we look at that risk through Claude Code skills. The important detail is not only that a malicious skill can ask an agent to do something dangerous. It is that dynamic context commands run before the model sees the skill at all. When that happens, model-level prompt injection defenses never get a chance to intervene. ]]></description>
<author><![CDATA[ Nick Frichette, Ryan Simon ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] We Have Packet Capture at Home ]]></title>
<link>https://blog.axelarator.net/we-have-packet-capture-at-home/</link>
<guid>https://blog.axelarator.net/we-have-packet-capture-at-home/</guid>
<pubDate>Mon, 18 May 2026 06:11:49 +0000</pubDate>
<description><![CDATA[ [ Intrusion Detection - Network & WiFi ] We demonstrate how Zeek (for structured logs) and Arkime (for full PCAPs) packet‑capture - combined with community IDs and JA4+ fingerprints - helps quickly correlate and enrich events such as Nmap scans, SMB access, reverse‑shell downloads, and Sliver C2 activity. ]]></description>
<author><![CDATA[ Axelarator ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] Shai Hulud and Looking Into the Deep End of Supply Chain Mayhem ]]></title>
<link>https://www.abdulmhsblog.com/posts/shaihulud-analysis-leak/</link>
<guid>https://www.abdulmhsblog.com/posts/shaihulud-analysis-leak/</guid>
<pubDate>Mon, 18 May 2026 06:07:12 +0000</pubDate>
<description><![CDATA[ [ Malware Analysis ] The goal of this blogpost is to understand, through static and a little bit of synamic analysis, how Shai Hulid works, where it hurts, and what defenders can actually do about it. ]]></description>
<author><![CDATA[ Abdul Mhanni ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] APFS Snapshots Mac Forensics Guide Explained : SUMURI ]]></title>
<link>https://sumuri.com/why-apfs-snapshots-change-everything-in-mac-forensics/</link>
<guid>https://sumuri.com/why-apfs-snapshots-change-everything-in-mac-forensics/</guid>
<pubDate>Mon, 18 May 2026 06:04:55 +0000</pubDate>
<description><![CDATA[ [ Incident Response & Forensics ] We detail APFS snapshots, one of the most powerful and often misunderstood sources of evidence on a Mac. We will see how they impact what data is available, when it was available, and how that data should be collected. ]]></description>
<author><![CDATA[ Steve Whalen ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] Windows Prefetch Forensics: Execution Evidence and Its Limits ]]></title>
<link>https://sethenoka.com/prefetch-execution-evidence-and-its-limits/</link>
<guid>https://sethenoka.com/prefetch-execution-evidence-and-its-limits/</guid>
<pubDate>Mon, 18 May 2026 06:02:46 +0000</pubDate>
<description><![CDATA[ [ Incident Response & Forensics ] A DFIR guide to Windows Prefetch forensics, what Prefetch can support as execution evidence, what it can't prove, and how to corroborate findings. ]]></description>
<author><![CDATA[ Seth Enoka ]]></author>
</item>
<item>
<title><![CDATA[ [TOOL] Magnetar ]]></title>
<link>https://github.com/0xjrx/magnetar</link>
<guid>https://github.com/0xjrx/magnetar</guid>
<pubDate>Mon, 18 May 2026 05:59:28 +0000</pubDate>
<description><![CDATA[ [ Malwares - Obfuscation, Evasion & LoL ] A EDR bypassing shellcode loader framework for Windows 10 64bit, featuring ETW/AMSI patching, Tartarus Gate, process protection and more ]]></description>
<author><![CDATA[ Moritz M. (0xjrx) ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools ]]></title>
<link>https://origin-unit42.paloaltonetworks.com/active-directory-certificate-services-exploitation/</link>
<guid>https://origin-unit42.paloaltonetworks.com/active-directory-certificate-services-exploitation/</guid>
<pubDate>Mon, 18 May 2026 05:56:48 +0000</pubDate>
<description><![CDATA[ [ Active Directory ] We provide a technical deep-dive into advanced AD CS exploitation, including certificate template misconfigurations and shadow credential misuse. Our findings present a comprehensive breakdown of the attacker's toolkit and their evolving operational behaviors. ]]></description>
<author><![CDATA[ Shachar Roitman, Stav Setty, Tom Fakterman ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] When configuration becomes a vulnerability: Exploitable misconfigurations in AI apps ]]></title>
<link>https://www.microsoft.com/en-us/security/blog/2026/05/14/configuration-becomes-vulnerability-exploitable-misconfigurations-ai-apps/</link>
<guid>https://www.microsoft.com/en-us/security/blog/2026/05/14/configuration-becomes-vulnerability-exploitable-misconfigurations-ai-apps/</guid>
<pubDate>Mon, 18 May 2026 05:54:36 +0000</pubDate>
<description><![CDATA[ [ DevOps - Machine Learning & AI - Pentests & Red Teams ] Exposed UIs, weak authentication, and risky defaults could turn cloud-native AI apps on Kubernetes into potential targets by threat actors. This article discusses how exploitable misconfigurations lead to RCE and data leaks. ]]></description>
<author><![CDATA[ Yossi Weizman ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] Phantom Stealer Analysis: Inside the Two-Layer Attack Chain Hidden Behind a Windows DLL ]]></title>
<link>https://darkatlas.io/blog/phantom-stealer-analysis-inside-the-two-layer-attack-chain-hidden-behind-a-windows-dll</link>
<guid>https://darkatlas.io/blog/phantom-stealer-analysis-inside-the-two-layer-attack-chain-hidden-behind-a-windows-dll</guid>
<pubDate>Mon, 18 May 2026 05:52:53 +0000</pubDate>
<description><![CDATA[ [ Malware Analysis ] Phantom Stealer is a two-layer Windows infostealer attack chain that uses a malicious pdh.dll loader, process hollowing into jsc.exe, aggressive anti-analysis checks, browser and wallet theft, and a cryptocurrency clipper to steal credentials, financial data, and crypto-related assets while maintaining stealth and persistence. ]]></description>
</item>
<item>
<title><![CDATA[ [ARTICLE] Revisiting Two-Shot Kernel Shellcode Execution From Control Flow Hijacking ]]></title>
<link>https://blog.zolutal.io/two-shot-kernel-shellcode/</link>
<guid>https://blog.zolutal.io/two-shot-kernel-shellcode/</guid>
<pubDate>Mon, 18 May 2026 05:50:02 +0000</pubDate>
<description><![CDATA[ [ Exploits & Payloads ] We revisit the classic two‑shot kernel shellcode exploit - first disabling SMEP/SMAP, then running user‑space payload - by showing how the newer "CR Pinning" mitigation can be bypassed using a KProbe placed in the tiny window between a mov cr4, ... and the pin‑fixup, together with existing kernel gadgets (e.g., devm_action_release) and the NPerm technique. ]]></description>
<author><![CDATA[ Jennifer Miller ]]></author>
</item>
<item>
<title><![CDATA[ [TOOL] PromptZero ]]></title>
<link>https://github.com/openbashok/promptzero</link>
<guid>https://github.com/openbashok/promptzero</guid>
<pubDate>Mon, 18 May 2026 05:46:23 +0000</pubDate>
<description><![CDATA[ [ Machine Learning & AI - Tunnels, Proxies & Reverseshell ] Transparent Claude API proxy that anonymizes PII and sensitive data before it leaves your environment. From pentesters, to pentesters. ]]></description>
<author><![CDATA[ openbashok ]]></author>
</item>
<item>
<title><![CDATA[ [TOOL] Capture Bypass ]]></title>
<link>https://github.com/Londopy/capture-bypass</link>
<guid>https://github.com/Londopy/capture-bypass</guid>
<pubDate>Mon, 18 May 2026 05:44:09 +0000</pubDate>
<description><![CDATA[ [ Injection ] DLL injection tool to bypass screen-capture protection on Windows 10/11 ]]></description>
<author><![CDATA[ Londo ]]></author>
</item>
<item>
<title><![CDATA[ [TOOL] Shells-X ]]></title>
<link>https://github.com/vektor-x-com/Shells-X</link>
<guid>https://github.com/vektor-x-com/Shells-X</guid>
<pubDate>Mon, 18 May 2026 05:42:42 +0000</pubDate>
<description><![CDATA[ [ Post-Exploitation & Lateral Movement - RAT & Reverse Shells ] Modular single-file web shell framework with pure-PHP recon, SOCKS5 pivoting, and per-build fingerprinting ]]></description>
</item>
<item>
<title><![CDATA[ [TOOL] Safeline ]]></title>
<link>https://github.com/api-evangelist/safeline</link>
<guid>https://github.com/api-evangelist/safeline</guid>
<pubDate>Mon, 18 May 2026 05:41:29 +0000</pubDate>
<description><![CDATA[ [ Application Security ] SafeLine is an open-source self-hosted Web Application Firewall (WAF) and reverse proxy developed by Chaitin Technology that protects web applications and APIs from attacks including SQL injection, XSS, code injection, OS command injection, SSRF, path traversal, and RCE. ]]></description>
</item>
<item>
<title><![CDATA[ [ARTICLE] Safeline ]]></title>
<link>https://github.com/api-evangelist/safeline</link>
<guid>https://github.com/api-evangelist/safeline</guid>
<pubDate>Mon, 18 May 2026 05:41:03 +0000</pubDate>
<description><![CDATA[ [ Application Security ] SafeLine is an open-source self-hosted Web Application Firewall (WAF) and reverse proxy developed by Chaitin Technology that protects web applications and APIs from attacks including SQL injection, XSS, code injection, OS command injection, SSRF, path traversal, and RCE. ]]></description>
</item>
<item>
<title><![CDATA[ [TOOL] MSTIC Jupyter and Python Security Tools ]]></title>
<link>https://github.com/microsoft/msticpy</link>
<guid>https://github.com/microsoft/msticpy</guid>
<pubDate>Mon, 18 May 2026 05:40:32 +0000</pubDate>
<description><![CDATA[ [ Incident Response & Forensics - Threat Hunting ] msticpy is a library for InfoSec investigation and hunting in Jupyter Notebooks. It includes functionality to query log data, enrich the data, extract Indicators of Activity (IoA), perform sophisticated analysis, and visualize data. It also includes some time-saving notebook tools such as widgets to set query time boundaries, select and display items from lists, and configure the notebook environment. ]]></description>
</item>
<item>
<title><![CDATA[ [ARTICLE] NTFS Transactions in Windows: Kernel Transaction Manager, CreateFileTransacted, and Process Doppelganging >> TrainSec ]]></title>
<link>https://trainsec.net/library/windows-internals/ntfs-transactions-in-windows-kernel-transaction-manager-createfiletransacted-and-process-doppelganging/</link>
<guid>https://trainsec.net/library/windows-internals/ntfs-transactions-in-windows-kernel-transaction-manager-createfiletransacted-and-process-doppelganging/</guid>
<pubDate>Mon, 18 May 2026 05:31:44 +0000</pubDate>
<description><![CDATA[ [ Injection ] We delve into NTFS and registry transactions internals in Windows, how they work using CreateTransaction, CreateFileTransacted, and the Kernel Transaction Manager, and how the Process Doppelganging technique exploits them. ]]></description>
<author><![CDATA[ Pavel Yosifovich ]]></author>
</item>
<item>
<title><![CDATA[ [TOOL] Relay Bypass Server ]]></title>
<link>https://github.com/vincentng295/relay_bypass_server</link>
<guid>https://github.com/vincentng295/relay_bypass_server</guid>
<pubDate>Mon, 18 May 2026 05:29:12 +0000</pubDate>
<description><![CDATA[ [ Obfuscation, Evasion & LoL - Relay ] A robust high-performance relay server designed to bypass network restrictions using Xray (VLESS Reality) and FRP Tunneling ]]></description>
<author><![CDATA[ vincentng295 ]]></author>
</item>
<item>
<title><![CDATA[ [TOOL] VectorSmuggle ]]></title>
<link>https://github.com/jaschadub/VectorSmuggle</link>
<guid>https://github.com/jaschadub/VectorSmuggle</guid>
<pubDate>Fri, 15 May 2026 07:32:35 +0000</pubDate>
<description><![CDATA[ [ Machine Learning & AI - Obfuscation, Evasion & LoL ] Research framework that quantifies how steganographic obfuscation of embeddings defeats off-the-shelf statistical detection in RAG pipelines, paired with the VectorPin cryptographic-provenance defense ]]></description>
<author><![CDATA[ Jascha ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] CVE-2022-33649: Chain of Forgotten Features ]]></title>
<link>https://jinmo.github.io/blog/2026/05/10/cve-2022-33649-entrypoint-to-push-to-install.html</link>
<guid>https://jinmo.github.io/blog/2026/05/10/cve-2022-33649-entrypoint-to-push-to-install.html</guid>
<pubDate>Fri, 15 May 2026 07:29:05 +0000</pubDate>
<description><![CDATA[ [ Browser Security - Exploits & Payloads ] I detail a chain of 5 vulnerabilities in Edge: an allowlist for bing.com, a Bing open redirect, a Microsoft Store URL handler that leaks the MS account token, a forgotten “Push to Install” backend, and a skuId path traversal that bypasses its ownership check. Chained together they allow the install of an attacker-controlled app on the victim's devices. ]]></description>
<author><![CDATA[ Yonghwi Jin ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] SMB alternative ports now supported in Windows Insider ]]></title>
<link>https://techcommunity.microsoft.com/blog/filecab/smb-alternative-ports-now-supported-in-windows-insider/3974509</link>
<guid>https://techcommunity.microsoft.com/blog/filecab/smb-alternative-ports-now-supported-in-windows-insider/3974509</guid>
<pubDate>Fri, 15 May 2026 07:22:34 +0000</pubDate>
<description><![CDATA[ [ Network & WiFi ] We provide details about the ability to configure client to connect to ports other than TCP/445 and QUIC/443. ]]></description>
<author><![CDATA[ Ned Pyle ]]></author>
</item>
<item>
<title><![CDATA[ [TOOL] AddUser SAMR ]]></title>
<link>https://github.com/ricardojoserf/AddUser-SAMR</link>
<guid>https://github.com/ricardojoserf/AddUser-SAMR</guid>
<pubDate>Fri, 15 May 2026 07:21:03 +0000</pubDate>
<description><![CDATA[ [ Post-Exploitation & Lateral Movement ] Create local administrators with the SAMR API (lowest-level technique). Implemented in C#, Crystal, Python and Rust ]]></description>
<author><![CDATA[ Ricardo J. Ruiz  ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] TAPOcalypse Now: Exploiting TP-Link Smart Devices From Anywhere ]]></title>
<link>https://labs.taszk.io/articles/post/tapocalypse/</link>
<guid>https://labs.taszk.io/articles/post/tapocalypse/</guid>
<pubDate>Fri, 15 May 2026 07:19:49 +0000</pubDate>
<description><![CDATA[ [ Exploits & Payloads - IoT & ICS ] In this post, we describe the major findings from our review of TP-Link new generation TAPO security cameras: a pre-auth RCE, multiple authentication bypass vulnerabilities leading to 10+ post-auth RCE, and a cryptographic design weakness that can enable a full cloud account compromise. ]]></description>
<author><![CDATA[ Botond Hartmann, Laszlo Radnai ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] Dissecting Impacket for Good and Bad ]]></title>
<link>https://www.abdulmhsblog.com/posts/impacket-iocs/</link>
<guid>https://www.abdulmhsblog.com/posts/impacket-iocs/</guid>
<pubDate>Fri, 15 May 2026 07:14:31 +0000</pubDate>
<description><![CDATA[ [ Incident Response & Forensics ] I walk through the process that led me to build a curated list of 70 + impackets protocol‑level indicators of compromise that expose both obvious implementation quirks (e.g., non‑GUID client IDs, hard‑coded nonces) and subtle deviations from Microsoft's specifications. ]]></description>
<author><![CDATA[ Abdul Mhanni ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] Inside a Tor Backed Supply Chain Worm ]]></title>
<link>https://www.cloudsek.com/blog/inside-a-tor-backed-supply-chain-worm</link>
<guid>https://www.cloudsek.com/blog/inside-a-tor-backed-supply-chain-worm</guid>
<pubDate>Fri, 15 May 2026 07:08:56 +0000</pubDate>
<description><![CDATA[ [ DevOps - Malware Analysis ] We uncovered a sophisticated npm supply chain attack using a typosquatted package, crypto-javascri, to mimic crypto-js. The malware steals npm and GitHub credentials, hijacks maintainer accounts, republishes trojanized packages, and uses Tor-based command-and-control. The campaign targets Linux developer systems and CI/CD environments, creating serious downstream supply chain risk. ]]></description>
</item>
<item>
<title><![CDATA[ [TOOL] vaultify ]]></title>
<link>https://github.com/securityjoes/vaultify</link>
<guid>https://github.com/securityjoes/vaultify</guid>
<pubDate>Fri, 15 May 2026 07:07:37 +0000</pubDate>
<description><![CDATA[ [ Credentials Dumps, Theft and Cracking - Hardening ] In a world where everyone can be Vibe Coders, everyone can expose credentials. Vaultify remediates the gap, allowing blazing fast scan for forgotten or misplaced credentials, assisting with rapid relocation to safety with vault integration. ]]></description>
</item>
<item>
<title><![CDATA[ [TOOL] Passkey Path ]]></title>
<link>https://techbrandon.github.io/passkey-path/</link>
<guid>https://techbrandon.github.io/passkey-path/</guid>
<pubDate>Fri, 15 May 2026 07:05:54 +0000</pubDate>
<description><![CDATA[ [ Credentials Dumps, Theft and Cracking - Labs & Simulation ] A choose-your-own-adventure guide to understanding, deploying, and supporting passkeys ]]></description>
<author><![CDATA[ Brandon Colley ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] Kazuar: Anatomy of a nation-state botnet ]]></title>
<link>https://www.microsoft.com/en-us/security/blog/2026/05/14/kazuar-anatomy-of-a-nation-state-botnet/</link>
<guid>https://www.microsoft.com/en-us/security/blog/2026/05/14/kazuar-anatomy-of-a-nation-state-botnet/</guid>
<pubDate>Fri, 15 May 2026 07:03:40 +0000</pubDate>
<description><![CDATA[ [ Malware Analysis ] Technical analysis of Kazuar, a sophisticated malware that expanded from a relatively traditional backdoor into a highly modular peer-to-peer (P2P) botnet ecosystem designed to enable persistent, covert access to target environments. ]]></description>
</item>
<item>
<title><![CDATA[ [ARTICLE] RCE in VSCode Copilot Chat ]]></title>
<link>https://www.hacktron.ai/blog/rce-in-vscode-copilot</link>
<guid>https://www.hacktron.ai/blog/rce-in-vscode-copilot</guid>
<pubDate>Wed, 13 May 2026 06:45:06 +0000</pubDate>
<description><![CDATA[ [ Exploits & Payloads ] Copilot agent mode is vulnerable to a prompt injection attack. If a repository maintainer clicks 'code with agent mode' on an issue, it will open a new codespace and copilot will automatically run the issue's description. ]]></description>
</item>
</channel>
</rss>