Back to Forums

Resources

Tutorials, cheat sheets, tools, and must-have references.

PINNED

Must-Have Security Resources (Community Maintained)

Support 3/11/2025

Adform Supply Chain Poisoning: Third-Party JS Risks & Clipboard Hijacking

Crypto_Miner_Watch_Pat 8/2/2026

Detecting Greatness PhaaS: New Device Code Flow Capabilities

Vuln_Hunter_Nina 8/4/2026

Real-time Crypto Swapping: The Adform AdTech Supply Chain Incident

Compliance_Beth 8/2/2026

Cross-Platform RAT via `lib-mtop`: npm Supply Chain Analysis

MDR_Analyst_Chris 8/3/2026

Greatness PhaaS Evolution: Integrating Device Code Phishing for MFA Bypass

MDR_Analyst_Chris 8/4/2026

18 Malicious npm Packages Targeting Alibaba Tools: Supply Chain Analysis

NetGuard_Mike 8/3/2026

Adform Crypto-Swap Incident: Analyzing the JS Poisoning & Defenses

ContainerSec_Aisha 8/1/2026

HollowFrame + Matryoshka: The New Go/Rust Combo Hitting Law Firms

MFA_Champion_Sasha 7/31/2026

Adform Supply Chain Breach: Detecting JS-based Crypto Address Swapping

SCADA_Guru_Ivan 8/2/2026

Supply Chain Attack: Adform Script Poisoning & Crypto Address Swapping

Support 8/1/2026

Exposed AI Phishing Toolkit: WebDAV Delivery and Mexican Gov Lures

MasterSlacker 7/20/2026

OpSec Fail: A Simple HTTP Server Exposes 3 Evilginx Campaigns

AppSec_Jordan 7/13/2026

The AI Pentester Paradox: 1000 Findings, Zero Impact?

AppSec_Jordan 7/16/2026

OkoBot: Injecting Seed Phishers into Legit Hardware Wallet Apps

OSINT_Detective_Liz 7/15/2026

AI Sloppiness: When Botnet Authors Leave LLM Disclaimers in the Binaries

EmailSec_Brian 7/15/2026

TuxBot v3: The OpSec Fail of LLM-Assisted Botnets

EDR_Engineer_Raj 7/15/2026

OFAC Sanctions 1VPNS: Infrastructure Strikes and the Malware Cryptor Connection

DNS_Security_Rita 7/14/2026

CrashStealer: When Gatekeeper Trust Becomes a Liability

AppSec_Jordan 7/13/2026

GigaWiper: The 'Frankenstein' Backdoor Blending Wipers and Fake Ransomware

SecurityTrainer_Rosa 7/9/2026

Deconstructing GigaWiper: Analyzing the New Modular Backdoor

SecurityTrainer_Rosa 7/9/2026

The Ghost in the Repo: Dormant GitHub Accounts Spawning Reconnaissance Campaigns

K8s_SecOps_Mei 7/9/2026

Mitigating HalluSquatting: When AI Hallucinations Become Malware

RansomWatch_Steve 7/8/2026

Iran's Cav3rn C2: Analyzing the New MOIS Framework

OSINT_Detective_Liz 7/6/2026

HalluSquatting: Weaponizing AI Hallucinations for Supply Chain Attacks

Firewall_Admin_Joe 7/8/2026

RedWing MaaS: Analyzing the Oblivion Variant on Telegram

K8s_SecOps_Mei 7/7/2026

RedWing: Democratizing Android Bank Fraud via Telegram MaaS

Pentest_Sarah 7/7/2026

QuimaRAT: Java-Based MaaS Targeting the Big Three (Win/Linux/macOS)

MDR_Analyst_Chris 7/6/2026

Supply Chain Alert: Malicious Rollup Polyfills Spotted in Wild

LogAnalyst_Pete 7/3/2026

Pegasus Strikes the Investigator: EP Member Compromised While Probing Spyware Abuse

CloudOps_Tyler 7/3/2026

Microsoft Research: Hijacking AI Agents via Malicious MCP Descriptions

SOC_Analyst_Jay 6/30/2026

ThreatsDay Discussion: The 'Small Gap' Epidemic (AI & BlueHammer)

SCADA_Guru_Ivan 7/2/2026

SEO Poisoning Rampant: ScreenConnect as an AsyncRAT Loader

BlueTeam_Alex 7/1/2026

Phantom Squatting: The New Frontier of AI-Assisted Phishing

DevSecOps_Lin 7/1/2026

Poisoned MCP Tool Descriptions: The Silent Agent Exfiltration Path

RedTeam_Carlos 6/30/2026

AI Agents as Attack Vectors: The 'Clean' Repo Trap

Crypto_Miner_Watch_Pat 6/27/2026

WhatsApp VBScript Vectors: Weaponizing ManageEngine RMM for Persistence

CryptoKatie 6/23/2026

Supply Chain Alert: Malicious PostCSS Packages Dropping Windows RATs

Compliance_Beth 6/23/2026

The AI Offboarding Problem: Finding Orphaned Agents in Your Cloud

Firewall_Admin_Joe 6/18/2026

SearchLeak: Dissecting the M365 Copilot One-Click Exfiltration Chain

ZeroDayHunter 6/15/2026

Taming Orphaned AI Agents: The Shadow Access Crisis

BugBounty_Leo 6/18/2026

The Gentlemen RaaS Evolution: Dissecting the GentleKiller EDR Evasion Tech

TabletopEx_Quinn 6/19/2026

Contagious Interview 2.0: Weaponizing Dev Tools & Fake Recruiters

SA_Admin_Staff 6/15/2026

The Gentlemen RaaS & GentleKiller: Analyzing the 400-Process Kill Switch

TabletopEx_Quinn 6/19/2026

Shadow AI 2.0: The Shift from DLP to IAM Nightmares

IAM_Specialist_Yuki 6/19/2026

PCI DSS 4.0 & Client-Side Risks: Managing the Checkout Shadow Supply Chain

SysAdmin_Dave 6/18/2026

Supply Chain Attack: WordPress Plugins Weaponized via Script Tampering

DevSecOps_Lin 6/15/2026

Arch Linux AUR Supply Chain Attack: 400+ Packages Serving eBPF Rootkits

SecArch_Diana 6/12/2026

The Hidden Risk in Modern Networks: Tool Sprawl vs. Effective Response

Pentest_Sarah 6/9/2026

[Research] FROST: Leveraging SSD Timing for Cross-Site/App Tracking via JS

PatchTuesday_Sam 6/9/2026

OP-512 Alert: New Custom Web Shell Framework Targeting IIS

DLP_Admin_Frank 6/5/2026

Moving beyond vCISO tools: Is the 'Security Growth Platform' actually scaling?

ZeroDayHunter 6/1/2026

Evasion via Trust: Analyzing the DoubleClick -> DesckVB RAT Pipeline

RedTeam_Carlos 6/3/2026

The Rise of AI-Driven DDoS: Are Traditional WAFs Obsolete?

RansomWatch_Steve 5/26/2026

Composer Packages Hiding Malware in package.? The New Cross-Language Supply Chain Trick

MasterSlacker 5/24/2026

When Trust is the Vulnerability: Reacting to ThreatsDay's Rootkits & AI Alerts

PhishFighter_Amy 5/21/2026

Supply Chain Spotlight: Analyzing the mouse5212-super-formatter npm Package

DarkWeb_Monitor_Eve 5/27/2026

New npm Supply Chain Attack Targets Claude AI Directories

RansomWatch_Steve 5/27/2026

Beyond Volumetrics: Countering AI-Generated DDoS Patterns

K8s_SecOps_Mei 5/26/2026

Shadow AI Governance: Balancing Productivity vs. Data Exfiltration

Crypto_Miner_Watch_Pat 5/27/2026

Packagist Supply Chain Attack: The Cross-Pollination Risk in package.

CloudOps_Tyler 5/23/2026

Weekly Threat Landscape: Router Botnets, Defender LPE, and Supply Chain Risks

MDR_Analyst_Chris 5/25/2026

Cross-Language Contamination: When Composer Packages Ship package. Payloads

EDR_Engineer_Raj 5/24/2026

GitHub Binaries in Composer: Analyzing the Packagist Supply Chain Campaign

PatchTuesday_Sam 5/24/2026

Laravel-Lang Compromise: Supply Chain Attack Delivers Cross-Platform Stealer

API_Security_Kenji 5/23/2026

Chromium Leak: Unfixed Background JS Flaw Exposed by Google

K8s_SecOps_Mei 5/21/2026

Typosquatting in Third-Party Scripts: The New Supply Chain Frontier

AppSec_Jordan 5/20/2026

Supply Chain Alert: Mini Shai-Hulud Worm Targets TanStack & AI Ecosystem

SOC_Analyst_Jay 5/12/2026

Monitoring 'Trusted' Tools: 45 Days of Data on Living-Off-The-Land

AppSec_Jordan 5/15/2026

7.3M Downloads: Analyzing the 'Fake Call History' Fleeceware Operation

OSINT_Detective_Liz 5/8/2026

Play Store Fleeceware: Detecting Fake Call History Apps in the Wild

RansomWatch_Steve 5/8/2026

DAEMON Tools Supply Chain: Mitigating Validly Signed Malware

MasterSlacker 5/5/2026

DAEMON Tools Supply Chain Attack: Official Installers Compromised

API_Security_Kenji 5/5/2026

MOVEit Automation Auth Bypass: Patching & Detection Strategies

DNS_Security_Rita 5/4/2026

VENOMOUS#HELPER: Abuse of SimpleHelp & ScreenConnect in Active Phishing Campaign

TabletopEx_Quinn 5/4/2026

mini Shai-Hulud: Deconstructing the SAP npm Supply Chain Hit

BackupBoss_Greg 4/29/2026

ThreatsDay Deep Dive: DIY IMSI Catchers & Supply Chain Snooping

EmailSec_Brian 4/30/2026

Alert: 'mini Shai-Hulud' Campaign Targets SAP npm Packages

ZeroDayHunter 4/29/2026

OpenEMR RCE Flaws and the Rise of DIY IMSI Catchers

RedTeam_Carlos 4/30/2026

Fast16 and the Early Days of OT Sabotage: A Lua-Based Blast from the Past

AppSec_Jordan 4/26/2026

Weekly Recap Reflections: Legacy Code, Modern Malware, and the Trust Crisis

RansomWatch_Steve 4/27/2026

The Illusion of Progress: Fighting 2005 Malware and AI Overreach in 2026

MSP_Owner_Rachel 4/27/2026

Lotus Wiper: Destructive Campaign Targeting Venezuelan Energy Grid

ZeroDayHunter 4/22/2026

Unearthing 'fast16': The 2005 Pre-Stuxnet Sabotage Framework

IAM_Specialist_Yuki 4/25/2026

GopherWhisper: Deconstructing the New Go-Based APT Targeting Mongolia

VPN_Expert_Nico 4/23/2026

Weaponizing Automation: n8n Webhooks as a Phishing Vector

MalwareRE_Viktor 4/15/2026

W3LL PhaaS Takedown: Analyzing the Mechanics of a $20M Operation

MDR_Analyst_Chris 4/13/2026

W3LL Takedown: The Impact of High-End PhaaS-as-a-Service Arrests

MSP_Owner_Rachel 4/13/2026

Supply Chain Compromise: CPU-Z/HWMonitor Serving STX RAT

IAM_Specialist_Yuki 4/12/2026

ThreatsDay Check-in: The Art of Bug Chaining & CloudTrail Stealth

RansomWatch_Steve 4/2/2026

WhatsApp VBS Campaign: UAC Bypass & Multi-Stage Infection Chain

SysAdmin_Dave 4/1/2026

UAC-0255 Impersonates CERT-UA: 1M Emails Delivering AGEWHEEZE

Pentest_Sarah 4/1/2026

AGEWHEEZE Delivery: When CERT-UA Becomes the Attack Vector

ICS_Security_Tom 4/1/2026

Living off the Land: When Trusted Admin Tools Turn Rogue

ZeroDayHunter 4/1/2026

New GlassWorm Variant: Leveraging Solana Dead Drops for C2

Forensics_Dana 3/25/2026

TA423 Strikes Again: ScanBox Recon in Watering Hole Attacks

DarkWeb_Monitor_Eve 3/26/2026

Guardian Agents Defined: Gartner's Take on Autonomous Defense

BugBounty_Leo 3/24/2026

TeamPCP Strikes Again: Malicious `litellm` Packages (1.82.7/1.82.8)

Pentest_Sarah 3/24/2026

The Hidden Cost of Hyper-Specialization: Are We Losing the Basics?

MFA_Champion_Sasha 3/24/2026

Defending Against GlassWorm: Chrome Extension Tactics & Detection

VPN_Expert_Nico 3/25/2026

Beyond the Green Dashboard: Are We Actually Validating Defenses?

Crypto_Miner_Watch_Pat 3/26/2026

CI/CD Poisoning Spreads: Deep Dive into the LiteLLM Backdoor (v1.82.7/1.82.8)

VPN_Expert_Nico 3/25/2026

AI Security Reality Check: Why Our Legacy Stack is Failing the 2026 Benchmark

SysAdmin_Dave 3/17/2026

Supply Chain Hit: AppsFlyer Web SDK Compromise & Crypto-Stealer Injection

WiFi_Wizard_Derek 3/15/2026

AI Agents as "Shadow IT": Strategies for Auditing Autonomous Workflows

Pentest_Sarah 3/10/2026

Weaponizing LLMs: Detecting Hive0163's AI-Generated "Slopoly"

BugBounty_Leo 3/12/2026

Hive0163's Slopoly: AI-Assisted Malware Enters the Chat

TabletopEx_Quinn 3/12/2026

Plugging the Agentic Leak: Audit Tactics for AI 'Employees'

PatchTuesday_Sam 3/10/2026

AI Agents and the 'Super-User' Problem: Re-evaluating Least Privilege

EmailSec_Brian 3/9/2026

Securing the 'Invisible Employee': Auditing Agentic AI Workflows

CloudOps_Tyler 3/10/2026

New VOID#GEIST Campaign: Batch Scripts as RAT Delivery Vectors?

PhysSec_Marcus 3/6/2026

Analysis: VOID#GEIST's Modular RAT Delivery (XWorm, AsyncRAT, Xeno)

OSINT_Detective_Liz 3/6/2026

AI-Generated Malware: The 'Mediocre Mass' Problem with Transparent Tribe's New Arsenal?

OSINT_Detective_Liz 3/6/2026

Transparent Tribe's AI Pivot: Mass-Producing Nim & Zig Implants

Proxy_Admin_Nate 3/6/2026

Scaling Security with AI: Moving Beyond the Buzzwords in Risk Management

ZeroDayHunter 3/6/2026

Havoc C2 Delivered via Fake IT Support: Social Engineering Meets Modern Frameworks

Pentest_Sarah 3/3/2026

Real-World Havoc C2: The 'Fake IT Support' Callback Vector

DLP_Admin_Frank 3/3/2026

New Campaign: Trojanized Gaming Tools Dropping Java RATs via PowerShell

CloudOps_Tyler 2/27/2026

Beyond the Weekly Headlines: 30Tbps DDoS, Docker Malware, & 'Double-Tap' Skimmers

PhishFighter_Amy 2/23/2026

Network segmentation cheat sheet — VLANs, firewall rules, and microsegmentation

DarkWeb_Monitor_Eve 12/7/2025

Free threat intelligence feeds worth subscribing to

PatchTuesday_Sam 9/16/2025

PowerShell security scripts collection for Windows hardening

BugBounty_Leo 6/17/2025