Passkey Lures, Stolen Sessions, and the Microsoft 365 Data Trail
Microsoft describes intrusions that start with fake passkey support calls and continue through new MFA methods, Graph reconnaissance, and cloud data access.
Threat Intelligence & Analysis
Offensive thinking.
Offensive thinking.
Defensive expertise.
In-depth red team tactics, blue team strategy — and privacy-first security tools that run entirely in your browser. No accounts. No telemetry. No data leaves your machine.
Featured
Latest analysis
Archive
Recent posts
VeloCloud CVE-2026-93952: An Exploited Flaw in the SD-WAN Control Plane
An actively exploited VeloCloud Orchestrator flaw needs no admin login. Check certificate-based exposure, fixed releases, and evidence of compromise.
BragJack: When a Browser Extension Reaches the AI Agent
Researchers demonstrated five ways a malicious extension could cross into browser AI features. The impact varies by product, but extension governance is the shared control.
The Digital Parasite: How Attacker Tradecraft Evolved in 2026
Picus Labs found evasion, persistence and command-and-control techniques in eight of its 2026 top ten malware behaviors. What defenders can take from the data.
The Cache That Bites Back: GitHub Actions Cache Poisoning Attacks
How attackers turn GitHub Actions' shared build cache into a supply chain weapon — real cases, attack mechanics, detection logic, and mitigations.
GitHub's VS Code Extension Breach: What We Know, What We Don't, and How to Defend
GitHub says an employee device was compromised through a poisoned third-party VS Code extension and internal repositories were exfiltrated. Here is the fact-checked breakdown for defenders.
Roundcube CVE-2026-48842: Check the Plugin, Patch the SQL Injection
A pre-authentication SQL injection in Roundcube's virtuser_query plugin has been reported in active use. Check whether your installation is exposed, update it, and investigate suspicious activity.