Labs

Medium

Campaign, CyberCrime, LOLBin

Defense Evasion

EDR, Sysmon, Windows

Deno as a LOLRuntime: ClickFix Campaign Evades Controls and Steals Credentials

A widespread ClickFix campaign compromises WordPress sites to display fake Cloudflare prompts, tricking victims into running PowerShell that installs Deno […]

Learn more

Medium

Bypass

Privilege Escalation

EDR, Sysmon, Windows

ShieldCrash - ShieldBreak/CVE-2026-69414 bypass

ShieldCrash (CVE-2026-XXXXX) is a critical improper-permission-validation vulnerability that allows any authenticated low-privileged user to escalate to SYSTEM/root privileges on affected […]

Learn more

Medium

Bypass

Credential Access

Windows

The Diagnostic Loophole: Extract Secure Credentials from Windows Kernel Live Dumps

Elevated PowerShell diagnostic commands trigger kernel live dumps, writing LSASS process memory to disk. Attackers steal these cached credentials offline, […]

Learn more

Medium

Campaign, CyberCrime, Malware

Discovery, Execution

EDR, Sysmon, Windows

Deep Dive into Snow Flurry campaign: Edgecution Persistence and the "Headless Process Clean Up"

The Snow Flurry campaign leverages Edgecution persistence through scheduled tasks. It features an automated "Headless Process Clean Up" mechanism to […]

Learn more

Medium

CVE

Privilege Escalation

Windows

Certighost to Domain Takeover: AD CS chase referrals weaponized for Domain Controller impersonation.

Certighost (CVE-2026-54121) is a critical improper-authorization vulnerability in Microsoft Active Directory Certificate Services (AD CS) that allows any low-privileged authenticated […]

Learn more

Medium

Bypass

Execution, Privilege Escalation

EDR, Sysmon, Windows

LegacyHive: Windows ProfSvc enabling cross-user registry Hive Loading

LegacyHive is a Windows local privilege-escalation zero-day that abuses the User Profile Service’s registry hive-loading logic to redirect or expose […]

Learn more

Medium

Campaign, Malware

Defense Evasion

EDR, Sysmon, Windows

ClickFix to StealC: ResiLoader weaponizes pcdhost.sys BYOVD driver to achieve ring-0 code execution

ResiLoader drops the vulnerable pcdhost.sys driver in a BYOVD attack, using its kernel privileges to kill AV/EDR processes before hollowing […]

Learn more

Medium

Campaign

Defense Evasion

EDR, Sysmon, Windows

GentleKiller: Inside The Gentlemen RaaS EDR‑Killer Framework and Its BYOVD Driver Arsenal

The emerging Gentlemen RaaS equips its affiliates with the GentleKiller EDR‑killer framework and third‑party BYOVD tools to systematically disable more […]

Learn more

Medium

Campaign

Command and Control

EDR, Sysmon, Windows

ClickFix’s Second Door: SocGholish-Inspired Proxy-Based Intrusion Chains

ClickFix has evolved into a platform similar to SocGholish, integrating PySoxy to create durable and redundant access chains through automated […]

Learn more

Medium

Campaign

Credential Access

EDR, Sysmon, Windows

PowerShell P/Invoke of CredEnumerate for Credential Manager Extraction

In today’s threat landscape, SEO poisoning campaigns continue to evolve by leveraging technology trends and user trust in widely adopted […]

Learn more