Drew
@bugfire.io
malware detection and analysis, hunting and gathering, threat research Views are my own.
Highly recommend this podcast!
James Wilson@jameswilson.io · 7d agoNew solo pod from me delving into the real cost of having to switch from an open-weight LLM to a close-weight API. It's not an easy switch, especially for cybersecurity work. The trust boundary, privacy, capabilities, availability, and most of all model behaviour matters. 🎧 risky.biz/RBFEATURES33/
So remember last week when we said we hadn’t see TA488/Laundry Bear/Void since Feb? Well... We kinda lied Day before the release, we found em throwing a half click against Outlook to install one of the coolest implants we’ve ever examined: OWAReaper www.proofpoint.com/us/blog/thre...
Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit | Proofpoint US
Threat Research would like to thank the Proofpoint Cloudmark Authority team for their collaboration. Key Findings On 22 July 2026, one day prior to Proofpoint’s recent joint release
proofpoint.com
Our Proofpoint AI threat researchers continue to observe activity on underground criminal forums, suggesting that Indirect Prompt Injection (IDPI) could soon be leveraged as an intrusion vector. Explore the methods that are being actively developed and sold: www.proofpoint.com/us/blog/thre....
New Binary Cartography episode: Pinpointing Interesting Code in Binaries We cover heuristics for protocols, crypto routines, library functions, RC4, decryption loops -- and how these signals guide agents youtu.be/HQA3U5MnD5U Slides & samples: github.com/mrphrazer/bi...
Pinpointing Interesting Code in Binaries: Heuristics, Statistics, and Agents
YouTube video by Tim Blazytko
youtu.be
New research from Censys Senior Security Researcher Aidan Holland maps the AsyncRAT family across ~40 variants. The detection signal is its inherited TLS certificate metadata that persists across forks. Read more: https://bit.ly/4eQP03m
Premiering at this year's @hexacon.bsky.social: my reworked Software Deobfuscation Techniques training. It now combines deep technical know-how with agentic workflows to automate large-scale deobfuscation. www.hexacon.fr/trainer/soft...
New trainings sample on samplepedia Backdoor, obfuscated Python bytecode. 0/60 on Virustotal, which means it's still fresh. www.virustotal.com/gui/file/4ad... samplepedia.cc/sample/4ada6...
#SocGholish, the “FakeUpdates” web injects framework linked to major ransomware events, has been disrupted by #OperationEndgame. ❌ 100 servers and domains worldwide dismantled ❌ 14,971 websites remediated Learn more: www.proofpoint.com/us/blog/thre.... 🧵⤵️
🦔 📹 Poison X kernel mode rootkit analysis ➡️ kernel mode driver theory ➡️ Ghidra markup ➡️ basic string deobfuscation #MalwareAnalysisForHedgehogs www.youtube.com/watch?v=yx6A...
Malware Analysis - PoisonX rootkit, Kernel driver rootkit markup in Ghidra
YouTube video by MalwareAnalysisForHedgehogs
youtube.com
Much of our security work is communicating with colleagues throughout the org. 10 habits that sharpen how the technical work gets heard. https://zeltser.com/strong-communication-skills
10 Communication Tips for Security and IT Professionals
Explaining security and IT work is often harder than the work itself. Ten habits will sharpen how you explain it to specialists, executives, and everyone in between.
zeltser.com
Device-code phishing is surging. One cybercriminal tool can target virtually every Microsoft user. Okta Threat Intelligence digs deep into the OAuth CLI device flow and how to minimize your attack surface. www.okta.com/blog/threat-...
Device code phishing: it’s phishing with dynamite
Okta Threat Intelligence studies recent abuse of the device code authorization flow in service provider ecosystems, and provides links to detection and remediation strategies for protecting clients cr...
okta.com
I highly recommend this comprehensive blog on EDR internals 0xdbgman.github.io/posts/edr-in...
EDR Tradecraft: Internals, Detection, Evasion & Advanced Researchg
Technical reference on modern EDR architecture, detection mechanisms, evasion techniques, and reverse-engineering methodology. Covers kernel callback APIs, file-system mini-filters, ETW providers, the...
0xdbgman.github.io
We report certificates for revocation when they sign malware. What about before they sign malware? I've started adding certificates to Cert Graveyard that are being used to "warm" the certificate and improve it's score before being sign malware. 1/4
Launching oauthsentry.github.io Look up any OAuth app ID and find out what it actually is across thousands of legitimate, risky, and malicious apps (Entra, Google, GitHub). Multiple feeds, API, detection ideas and remediation guidance. Still improving the detections a bit 🦾
OAuthSentry - OAuth application intelligence for defenders
Search OAuth Application IDs across Microsoft Entra, Google Workspace and more. Three classification feeds for defenders: compliance, risky, and malicious. Includes investigation playbooks, forensic t...
oauthsentry.github.io
Great listen!
Ryan Naraine@ryanaraine.bsky.social · 3mo agoNEW! We're joined by WIRED writer Andy Greenberg to dig into SentinelLabs' bombshell FAST16 research, a newly deciphered piece of sabotage malware that predates Stuxnet by five years and quietly tampered with physics modeling software likely tied to Iran's nuclear program. youtu.be/jIr6QdgUodU
Out-of-the-box Claude Code is solid for general work. What makes it indispensable is the personalization, hardening, and connectors you layer on top. I mapped my setup into a seven-layer Personal AI Stack, so you can optimize yours.
The Personal AI Stack: A Power User's Guide
An AI tool like Claude Code gives you solid general-purpose capabilities out of the box. To make it truly indispensable, add the layers that teach it who you are, how you work, and what you do.
zeltser.com
2026-04-23 (Thursday): #SmartApeSG campaign using #ClickFix instructions to push some sort of #RAT. Not sure what this #malware is yet, but it looks like a RAT. Details at www.malware-traffic-analysis.net/2026/04/23/i...
Joined by Katrina Manson to hear all about her latest book release: Project Maven & the Dawn of AI Warfare 👀 We talk AI usage at the Pentagon, drone intel, AI enabled targeting, and the ethical tipping point of autonomous weapons. Super fascinating ideas. Video: youtu.be/OVgruylpVXc
New Video: Build your own LLM dynamic analysis lab 🦔🎥 ➡️ AI debugs and unpacks with x64dbg ➡️ AI can access powershell terminal www.youtube.com/watch?v=QrWz...
Build your own AI based Dynamic Reversing Lab, x64dbg automate
YouTube video by MalwareAnalysisForHedgehogs
youtube.com
Wild story on a big AI-powered social engineering campaign, leveraging Device Code phishing to steal Entra ID/Microsoft accounts -- all with entirely unique and personalized per-victim lures from vibecode-crafted infrastructure 🤯 Video: youtu.be/9b3kirR8s2U
I wrote an article about SugarSMP Minecraft scams, Spark stealer, extortion and hacked accounts. After a brief contact to the threat actor, we talked to two victims and followed the trail. Analysis in collaboration with @rifteyy #GDATATechblog #GDATA blog.gdatasoftware.com/2026/03/3839...
Minecraft: SugarSMP's Dark Tale of Scams, Malware & Extortion
Some Minecraft players were looking for safe haven away from griefers, but found an elaborate web of malware, deception and extortion.
blog.gdatasoftware.com
🤓 A month ago I published a blog post on how to monitor Claude Code sessions using hooks and NOVA Protector! At the time, no one was really talking about this. Coding agents were being handed full access to your machine and people were just trusting the output blindly. The post covers how I […]
Original post on infosec.exchange
infosec.exchange
New post out! "The Red Queen’s Race: Arms Race Dynamics in Threat Detection" medium.com/@koifsec/the...
The Red Queen’s Race: Arms Race Dynamics in Threat Detection
“Now, here, you see, it takes all the running you can do, to keep in the same place.” — The Red Queen, Through the Looking-Glass
medium.com
On this episode of Discarded, our team explores how #artificialintelligence is shaping modern #malware analysis and detection workflows. Listen now on your favorite #podcast platform, and you'll get a balanced view of AI's growing impact on cybersecurity. 🎙️: www.proofpoint.com/us/podcasts/...
🤓 Happy to see that my DEFCON talk on crypto money laundering and tracking techniques was featured in the DEFCON 33 Almanac! Read it here: https://harris.uchicago.edu/sites/default/files/the_def_con_33_hackers_almanack.pdf
I started making comics, in part, as a respite from the grind that is cybersecurity. Only hackers/scammers are everywhere. I’m no @johnhammond.bsky.social but here is my video on how scammers try to take advantage of creators on Kickstarter.
Green Archer Comics - Where Legends Live!@greenarcher.io · 6mo agoAlso, coincidentally, I just released my video on Kickstarter scam targeting creators. It’s not just you, there are more scammers and they are more brazen AND they love to hit creators!
Episode 2 of Breach Log is now available! Special thanks to Max Margolis for joining me and telling his story. If you have a story you'd like to share, get in contact and we can have some fun! breachlogpodcast [@] gmail[.]com open.spotify.com/episode/4SDz...
Spotify – Web Player
open.spotify.com
🤓 Let me introduce you to MoltThreats: The first AI Threat Intel Feed for Ai Agents! In one week, OpenClaw became a widely used general AI agent. People started to run their own agents all over the world and connect them directly to the internet. But this […] [Original post on infosec.exchange]
