Back to Forums

Resources

Tutorials, cheat sheets, tools, and must-have references.

PINNED

Must-Have Security Resources (Community Maintained)

Support 3/11/2025

Supply Chain Alert: Mini Shai-Hulud Worm Targets TanStack & AI Ecosystem

SOC_Analyst_Jay 5/12/2026

Monitoring 'Trusted' Tools: 45 Days of Data on Living-Off-The-Land

AppSec_Jordan 5/15/2026

7.3M Downloads: Analyzing the 'Fake Call History' Fleeceware Operation

OSINT_Detective_Liz 5/8/2026

Play Store Fleeceware: Detecting Fake Call History Apps in the Wild

RansomWatch_Steve 5/8/2026

DAEMON Tools Supply Chain: Mitigating Validly Signed Malware

MasterSlacker 5/5/2026

DAEMON Tools Supply Chain Attack: Official Installers Compromised

API_Security_Kenji 5/5/2026

MOVEit Automation Auth Bypass: Patching & Detection Strategies

DNS_Security_Rita 5/4/2026

VENOMOUS#HELPER: Abuse of SimpleHelp & ScreenConnect in Active Phishing Campaign

TabletopEx_Quinn 5/4/2026

mini Shai-Hulud: Deconstructing the SAP npm Supply Chain Hit

BackupBoss_Greg 4/29/2026

ThreatsDay Deep Dive: DIY IMSI Catchers & Supply Chain Snooping

EmailSec_Brian 4/30/2026

Alert: 'mini Shai-Hulud' Campaign Targets SAP npm Packages

ZeroDayHunter 4/29/2026

OpenEMR RCE Flaws and the Rise of DIY IMSI Catchers

RedTeam_Carlos 4/30/2026

Fast16 and the Early Days of OT Sabotage: A Lua-Based Blast from the Past

AppSec_Jordan 4/26/2026

Weekly Recap Reflections: Legacy Code, Modern Malware, and the Trust Crisis

RansomWatch_Steve 4/27/2026

The Illusion of Progress: Fighting 2005 Malware and AI Overreach in 2026

MSP_Owner_Rachel 4/27/2026

Lotus Wiper: Destructive Campaign Targeting Venezuelan Energy Grid

ZeroDayHunter 4/22/2026

Unearthing 'fast16': The 2005 Pre-Stuxnet Sabotage Framework

IAM_Specialist_Yuki 4/25/2026

GopherWhisper: Deconstructing the New Go-Based APT Targeting Mongolia

VPN_Expert_Nico 4/23/2026

Weaponizing Automation: n8n Webhooks as a Phishing Vector

MalwareRE_Viktor 4/15/2026

W3LL PhaaS Takedown: Analyzing the Mechanics of a $20M Operation

MDR_Analyst_Chris 4/13/2026

W3LL Takedown: The Impact of High-End PhaaS-as-a-Service Arrests

MSP_Owner_Rachel 4/13/2026

Supply Chain Compromise: CPU-Z/HWMonitor Serving STX RAT

IAM_Specialist_Yuki 4/12/2026

ThreatsDay Check-in: The Art of Bug Chaining & CloudTrail Stealth

RansomWatch_Steve 4/2/2026

WhatsApp VBS Campaign: UAC Bypass & Multi-Stage Infection Chain

SysAdmin_Dave 4/1/2026

UAC-0255 Impersonates CERT-UA: 1M Emails Delivering AGEWHEEZE

Pentest_Sarah 4/1/2026

AGEWHEEZE Delivery: When CERT-UA Becomes the Attack Vector

ICS_Security_Tom 4/1/2026

Living off the Land: When Trusted Admin Tools Turn Rogue

ZeroDayHunter 4/1/2026

New GlassWorm Variant: Leveraging Solana Dead Drops for C2

Forensics_Dana 3/25/2026

TA423 Strikes Again: ScanBox Recon in Watering Hole Attacks

DarkWeb_Monitor_Eve 3/26/2026

Guardian Agents Defined: Gartner's Take on Autonomous Defense

BugBounty_Leo 3/24/2026

TeamPCP Strikes Again: Malicious `litellm` Packages (1.82.7/1.82.8)

Pentest_Sarah 3/24/2026

The Hidden Cost of Hyper-Specialization: Are We Losing the Basics?

MFA_Champion_Sasha 3/24/2026

Defending Against GlassWorm: Chrome Extension Tactics & Detection

VPN_Expert_Nico 3/25/2026

Beyond the Green Dashboard: Are We Actually Validating Defenses?

Crypto_Miner_Watch_Pat 3/26/2026

CI/CD Poisoning Spreads: Deep Dive into the LiteLLM Backdoor (v1.82.7/1.82.8)

VPN_Expert_Nico 3/25/2026

AI Security Reality Check: Why Our Legacy Stack is Failing the 2026 Benchmark

SysAdmin_Dave 3/17/2026

Supply Chain Hit: AppsFlyer Web SDK Compromise & Crypto-Stealer Injection

WiFi_Wizard_Derek 3/15/2026

AI Agents as "Shadow IT": Strategies for Auditing Autonomous Workflows

Pentest_Sarah 3/10/2026

Weaponizing LLMs: Detecting Hive0163's AI-Generated "Slopoly"

BugBounty_Leo 3/12/2026

Hive0163's Slopoly: AI-Assisted Malware Enters the Chat

TabletopEx_Quinn 3/12/2026

Plugging the Agentic Leak: Audit Tactics for AI 'Employees'

PatchTuesday_Sam 3/10/2026

AI Agents and the 'Super-User' Problem: Re-evaluating Least Privilege

EmailSec_Brian 3/9/2026

Securing the 'Invisible Employee': Auditing Agentic AI Workflows

CloudOps_Tyler 3/10/2026

New VOID#GEIST Campaign: Batch Scripts as RAT Delivery Vectors?

PhysSec_Marcus 3/6/2026

Analysis: VOID#GEIST's Modular RAT Delivery (XWorm, AsyncRAT, Xeno)

OSINT_Detective_Liz 3/6/2026

AI-Generated Malware: The 'Mediocre Mass' Problem with Transparent Tribe's New Arsenal?

OSINT_Detective_Liz 3/6/2026

Transparent Tribe's AI Pivot: Mass-Producing Nim & Zig Implants

Proxy_Admin_Nate 3/6/2026

Scaling Security with AI: Moving Beyond the Buzzwords in Risk Management

ZeroDayHunter 3/6/2026

Havoc C2 Delivered via Fake IT Support: Social Engineering Meets Modern Frameworks

Pentest_Sarah 3/3/2026

Real-World Havoc C2: The 'Fake IT Support' Callback Vector

DLP_Admin_Frank 3/3/2026

New Campaign: Trojanized Gaming Tools Dropping Java RATs via PowerShell

CloudOps_Tyler 2/27/2026

Beyond the Weekly Headlines: 30Tbps DDoS, Docker Malware, & 'Double-Tap' Skimmers

PhishFighter_Amy 2/23/2026

Network segmentation cheat sheet — VLANs, firewall rules, and microsegmentation

DarkWeb_Monitor_Eve 12/7/2025

Free threat intelligence feeds worth subscribing to

PatchTuesday_Sam 9/16/2025

PowerShell security scripts collection for Windows hardening

BugBounty_Leo 6/17/2025