Research library
We dig into real phishing pages, malware, scripts, and the infrastructure running underneath them, then turn what we find into something a reader can actually use. New case studies go up as investigations wrap and we've stripped out anything sensitive.
Latest publication
6 published reports
An exposed phishing panel shows how device-code lures send victims to Microsoft's real login page to capture OAuth tokens. Timeline, IOCs and defenses.
Static reversing of a modular Win64 backdoor with deterministic DuckDNS discovery, separate control and module channels, Registry-backed modules and custom PE mapping.
A fake verification page, a persistent AppleScript backdoor and two NITRO2 stealer modules. A reconstruction with explicit evidence boundaries and defanged indicators.
A cross-platform reconstruction of GETWELL: WebDAV and Amatera on Windows, AppleScript and an AMOS-derived stealer on macOS, joined by shared operational design.
A compromised ThaiCham WordPress site served a TermFix lure that led through PowerShell, a Polygon resolver and a signed loader to Vidar Stealer v2.
A reconstruction of the vacuumtubr ClickFix chain, from a trusted Help-page lure through PowerShell persistence, linker64.so shellcode recovery, HijackLoader and a recovered SilabRAT payload.
Publishing standard
Articles publish attacker domains, URLs, public addresses, hashes, smart-contract addresses and local artifacts that support detection and reversing.
For the human-facing decisions behind these campaigns, begin with modern phishing awareness. Our editorial methodology explains analysis, sanitization and corrections.