Now Boarding: Clickfix
ibiza-airport.org is hosting clickfix. As it turns out the EtherHiding C2 reveals are campaign affecting over 2100 sites globally.
8 min
author
vs
posts
I sure am glad I'm not a software developer at a Russian bank.
How a dependency confusion campaign hid its C2 behind a one-byte XOR, why hashes will not detect it, and what to hunt for instead. 1,046 samples analysed.
76 min
Breaking down North Korea's continuation of the BeaverTail campaign
Breaking down North Korea's continuation of the BeaverTail campaign
10 min
Dear developers, please stop obfuscating your code.
I do a lot of open-source dependency threat hunting, and recently I've been seeing something that is both incredibly annoying and
3 min
moika.tech. It's just telemetry. I promise.
300 packages on NPMJS, credential theft, token exfil and a reverse-SSH RAT calling moika.tech. Full malware and analysis of this ongoing campaign.
15 min
There's a fish in my git
Sometimes, when I've had enough of package manager supply-chain attacks, I like to browse twitter.com. And sometimes, I see something
11 min
intercom–client@7.0.4 - Malware Analysis
A comprehensive analysis of npm package intercom-client@7.0.4 malware, as part of the Shai Hulud 3 campaign
19 min
I'm Forever Curling Buckets
A look inside how your mates' football apps actually work.
21 min
Could security scanners have caught the Trivy hack any faster?
Trivy supply chain attack, GitHub Actions, CI/CD security, software supply chain, teamPCP, CanisterWorm, npm worm, security scanners. What was detectable, what wasn't, and why the first stage defeated every automated tool in the game.
7 min
What the hell is an internet computer? And why is it in my pipeline.
Amongst the IOCs and remediation advice from the Trivy supply chain attack is something cool. A blockchain canister being used as C2 infrastructure. Here's what it is, how it works, and why it matters.
5 min
A fake competition, phishing site and bullet-proof host. exchallenges.net scam
From a fake steam friend, an invitation to a counter-strike tournament, to a phishing page. Taking a dive into a sophisticated phishing attack, involving social engineering and a UK based bullet-proof hosting provider
5 min
Threat hunting with HNTR. apache-httpclient10
Another day, another malware package on NPMJS. Investigating NPM malware apache-httpclient10 with HNTR.
5 min
Nodelogex NPM malware analysis with Ossprey.com
Detecting & Analysing the Nodelogex NPM malware backdoor with Ossprey Security's detection engine. You're telling me this logger has a logger in it ?
8 min
Detecting interceptor jets with machine learning.
Detecting interceptor jets using OSINT and machine-learning.
5 min
Optimising token usage in static AI-powered code security analysis
Take this block of code. A self contained JS script that exfiltrates system and project info. I can read it, you can read it,
5 min
Threat Hunting the Node Package Manager - Bsides Cheltenham 2025 Resources
Below are links and downloads for data set related to the talk Threat Hunting the Node Package Manager. Scraper: https://github.com/veryserious-systems/
1 min
The risks package managers pose to enterprise software deployment workflows.
In some of my previous posts I've written about threat hunting the NodeJS Package manager, these posts go into methodology and some
7 min
Threat hunting the NPM package manager
This is part 1 of a multi part series, where we will be gathering, enriching, processing and analysing hopefully millions of open source packages
16 min
Using certificate transparency to search for malicious domains.
Today, we'll be looking at public certificate transparency logs, to determine if we can identify malicious websites at the point of certificate
6 min