Phishing has always been about deceiving people. But in this campaign, I discovered something new. The attackers weren’t only targeting users, they also attempted to manipulate AI-based defences. T…

HackerOne API를 활용하여 버그 바운티 프로그램 정보, 공개된 보고서, 범위 등 다양한 데이터를 조회하고 분석하는 파이썬 기반 도구입니다.

What is s1ngularity-repository? Nx is compromised and the malware steals wallets and API keys using Claude CLI or Gemini.

Starting Point It all began with a tweet:
sdcyberresearch on X
This tweet hinted at a Magecart-style campaign involving malicious JavaScript injection to skim payment data.
Initial Sample The script was hosted at:
https://www.cc-analytics[.]com/app.js
The…

IPv4/IPv6 Packet Fragmentation: Detection & Reassembly Introduction A packet can be broken into smaller pieces, or fragments, at the network layer (by the IPv4 and IPv6 protocols) to fit within a specific Maximum Transmission Unit (MTU). For IPv4, a packet’s…

TL;DR I found a RCE in the AION client starting from 3.0 (not confirmed the latest version vulnerable) using the built-in housing system. Private servers are still vulnerable. Important Note In the initial version of this post I wrote that the housing system…

On July 18, 2025, users of CrushFTP woke up to an announcement:

As we’ve all experienced in 2025, 2025 has been the year of vendors burying their heads in the sand with regard to in-the-wild exploitation, even in the face of impressively indisputable evidence…

Why code analysis can be hard when it comes to malicious code.

Referral rewards programs are nearly ubiquitous today, from consumer tech to SaaS companies, but are rarely given much security oversight.

Malware delivery through Microsoft Teams is an emerging threat. Discover how attackers exploit external chats, which regions they target, and key IOCs defenders must track.

LDAP authentication is everywhere in networks, but intercepting encrypted LDAP traffic can be challenging. LDAP authentication in the web…

Because we can!

A misconfigured upload path exposed a Linux web server to attack. Varonis Threat Labs reveals how it happened and how to prevent future breaches.

AmberWolf Security Research Blog

IPv6 often remains active in corporate networks. In this article, I will discuss attacks on IPv6 and detection methods.

ZERO-DAY ALERT: Automated Discovery of Critical CWMP Stack Overflow in TP-Link Routers Update CVE assigned: CVE-2025–9961 NVD Awaiting Analysis This CVE record has been marked for NVD enrichment …

I just finished up a phone call with a "stealth startup" that was pitching an idea that agents could generate code securely via an MCP server. Needless to say, the phone call did not go well. What follows is a recap of the conversation where I just shot down…

Some memory corruption bugs are much harder to exploit than others. They can involve race conditions, crash the system, and impose limitations that make a researcher's life difficult. Working with such fragile vulnerabilities demands significant time and…