Research library
Technical case studies, recovered malware behavior and practical browser-security guidance. Evidence is separated from inference, public IOCs are defanged and victim details stay private.
Latest publication
1 published report
A sanitized reconstruction of the vacuumtubr ClickFix chain, from a trusted Help-page lure through PowerShell persistence, linker64.so shellcode recovery, HijackLoader and the recovered SilabRAT configuration.
Publishing standard
Articles may include attacker domains, URLs, public addresses, hashes, smart-contract addresses and local artifacts when they aid detection. They exclude victim identities, endpoint names, usernames, email addresses, internal identifiers, private addresses and organization-specific telemetry.