WhatsApp Usernames: A Privacy Win That Opens a New Impersonation Surface
WhatsApp usernames reduce phone-number exposure, but they also create a new global namespace where brands, public bodies, and lookalike handles can become fraud infrastructure.
Security Research & Analysis
Offensive thinking.
Offensive thinking.
Defensive expertise.
In-depth red team research, blue team strategy — and privacy-first security tools that run entirely in your browser. No accounts. No telemetry. No data leaves your machine.
Featured
Latest research
Archive
Recent posts
The VPN Was Never the Problem: How a Windows Telemetry ID Unmasked a Scattered Spider Suspect
A 19-year-old allegedly hid behind a VPN and ngrok during an $8M jewelry-retailer extortion case. Windows' Global Device Identifier (GDID) gave investigators a device-level pivot.
AI-Built Browser Ransomware Abuses Chrome File Access
Check Point analyzed a DeepSeek-attributed ransomware sample that should not work from a browser tab. Most of it was fiction — except for one detail that mapped to a real Chromium API. No malware install required.
Minimum Package Age: The Supply Chain Control That Buys Defenders Time
Fast takedowns do not protect systems that auto-install malicious packages or extensions in the first minutes after release. Minimum package age turns time into a practical supply chain defense.
The Watchdog Got Bitten: Pegasus Spyware Hit the EU Committee Investigating It
A member of the EU committee investigating Pegasus abuse was hacked with Pegasus himself. Here is how forensic researchers proved it — and how to run the same detection process yourself.
Your Headphones Have Firmware: FOTA Is the IoT Attack Surface Nobody Patches
Bluetooth earbuds, speakers, and IoT devices now ship with firmware update paths, microphones, pairing protocols, and cloud-adjacent features. That does not make every headset a network foothold, but it does make the accessory worth threat-modeling.
RFC 10008: The New HTTP QUERY Method and the Attack Surface Still Catching Up
IETF published RFC 10008 in June 2026, standardizing the HTTP QUERY method. Here is where WAFs, caches, CORS handling, and CSRF assumptions need review.