Social Engineering
GhostPack Necromancy: Reforging C# Tools with WasmForge
In the previous post we walked through WasmForge, our Go-to-WebAssembly loader that takes existing signatured Go tools and ships them as opsec-safe binaries. This approach doesn’t just apply to Go, however, as ...
Conan O’Brien Deadpans Deepfakes
Organizations struggle to keep employees engaged in cybersecurity awareness training. Maybe they’ll tune in—and stay in—for Conan O’Brien ...
Malwarebytes Finds Ad Scams Hidden in 40+ World Cup Streaming Sites
Malwarebytes researchers uncovered more than 40 sites promising livestreams of World Cup games that instead trapped victims in endless loops or barraged them with popups, hidden ads, redirects, and malware. It was ...
Cardiac patients’ medical data stolen and held to ransom
Cardiac monitoring provider iRhythm has been hit by a data theft followed by an extortion attempt ...
When the Frontier Blinks: What the Mythos and Fable Controversy Reveals About AI Security
When Anthropic abruptly pulled Mythos 5 and Fable 5 from circulation, the move sent a jolt through the AI and cybersecurity communities. These were not minor point releases. They were widely regarded ...
Centurion: Bring Your Own Execution Environment
Writing my own virtualized loader is something I’ve been wanting to do since I first read Microsoft’s deep dive on FinFisher’s multi-layered VM obfuscation back in 2018. FinFisher didn’t just use one layer of ...
Threat Actors Abuse ChatGPT Chats to Host Fake Outage Page, Deliver Malware
Threat actors are using legitimate-looking ChatGPT service outage notices planted in the chatbot's content-sharing feature to convince users to click on a button to download the ChatGPT desktop app. Hitting the button ...
Adversarial Oracles: LLM-Guided EDR Signature Reduction
In previous blog posts we’ve talked about getting nerd sniped. Today we’re going to talk about a kind of nerd sniping that any offensive security tool creator is familiar with; when your ...
Jailbroken Gemini AI Model Supercharged Russian-Speaker’s Fraud Campaign
A solo Russian-speaking threat actor was able to scale his small five-year fraud operation aimed at MAGA and QAnon followers last year when he began using a jailbroken Google Gemini AI model ...
Your Login Page Is Lying: What AI Agents Find When They Read Your Frontend
TL;DR: Single-page applications ship their entire frontend codebase to every visitor, including unauthenticated ones. Even a login page with no visible functionality delivers JavaScript bundles containing route definitions, API endpoint URLs, authentication ...
