FileFix - A ClickFix Alternative mrd0x.com/filefix-clickfix-a…

Released TpDirectCallbackHijack, a process injection PoC where you overwrite one function pointer inside an existing thread pool object (TP_IO / TP_ALPC / TP_JOB), post a single completion packet, and the victim's own worker thread dispatches your shellcode. Restore stub puts the pointer back on the way through, so the thread pool keeps working. No remote thread, no Get/SetThreadContext. Pool Party adjacent. Based on @_0xDeku's research. github.com/Maldev-Academy/Tp…

I wrote an article about the technique that was disclosed some years ago by @mrd0x - Custom Extensions, including detection opportunities. TL;DR: Threat actors may create a custom extension or modify an existing file extension to masquerade a malicious file as a legitimate file or evade Windows SmartScreen. 🖊️ ipurple.team/2026/10/22/cust…

Every EDR should alert on any of the following commands: skrzsecurity.net/blue-team-1

Not sure how I managed to miss this repository! Offensive techniques using Windows Fibers: 1⃣ PoisonFiber (The first remote enumeration & Fiber injection capability POC tool) 2⃣ PhantomThread (An evolved callstack-masking implementation) github.com/JanielDary/Immora…

Publishing the "ApiHashing" repository based on the latest V2 update of the malware development course. The library replaces GetModuleHandleA/W, GetProcAddress, and GetModuleFileNameW and supports EAF bypass through ROP-style gadgets, forwarded functions, ordinal exports and API set DLLs versions 2 through 6. github.com/Maldev-Academy/Ap…

Biggest lie in history!

Malware Development database updated for the month of September with new snippets. End of summer sale is still active using SUMMER15 code. Database: search.maldevacademy.com/upd…

A quick video of how to use MSBuild.exe to target a .csproj file that has been tampered with multiple text template files and execute code embedded in .tt files.

Qwen3.8-27b is good. Like really good for local inference. It's completely changed the game as far as what's possible on consumer hardware. I put together some of my rambling and tinkering on my blog. steve-s.gitbook.io/0xtriboul…

Understanding EDR internals is just as valuable for attackers as it is for defenders. In our EDR Internals & Development course, students learn and implement ETW Threat Intelligence (ETW-TI), a powerful Windows telemetry source capable of exposing security-relevant activity such as cross-process memory writes, memory protection changes, APC operations, and thread manipulation. Understanding how an EDR observes an operation changes how you think about offensive tradecraft. Instead of looking at a technique only from the attacker's perspective, you can understand the telemetry it generates, which behaviors are visible to security products, and why certain techniques are easier to detect than others. EDR Internals & Development Course: maldevacademy.com/edr-course

If you want to avoid the noise and stay up to date with everything that is happening in our industry, filtered by different domains, feel free to join the purpleteamsec community teddit.net/r/purpleteamsec/

Our Malware Development course is being upgraded to version 2.0, with updates rolling out gradually in phases. The first phase will modernize the first 25 modules and is expected to launch by early next week. All currently enrolled students will receive the the updated course at no additional cost. Malware Development Course: maldevacademy.com/maldev-cou…

Since launching the EDR Internals & Development course last month, the feedback coming in has been incredible. Students are learning how EDRs work internally while building an agent from the ground up. The training is packed with technical depth and is not easy, making it very rewarding upon completion. EDR Internals & Development: maldevacademy.com/edr-course

I got permanently banned from @Hacker0x01. Account deleted. No explanation. Years of work gone overnight. Submission history, achievements, leaderboard ranks, every contribution I made to the security and crypto ecosystems through HackerOne. Wiped, like I was never there.

👀krebsonsecurity.com/2026/07/…

I'm currently working on reviving the OG social engineering technique for phishing attacks to be natively supported in Evilginx Pro. The Browser-in-the-Browser (BITB) technique (pioneered by @mrd0x) is making a well-deserved comeback soon. - Displays a fake OS pop-up window with the phishing page rendered within. 🖼️ - Customisable URL in the pop-up window's address bar to spoof the legitimate domain. 🔗 - Rendered pop-up window supports moving and resizing. ↔️ - Evades IFraming protections. 🔓 - Auto-detects Windows & macOS (light/dark modes) to make the pop-up window match the visitor's OS theme. 🎨 - Displays any web page in the background to support your social engineering pretext. 🖌️ I will soon release a full-length demo video to demonstrate how it works. For the time being, enjoy the sneak peek of BITB paired with the latest Google phishlet using Phishlets 2.0. Made exclusively for vetted cybersecurity professionals. Coming soon to Evilginx Pro. 🪝🐟

🚨 Since @TwoSevenOneT dropped the EDRChoker article, I’ve noticed some inaccurate detection guidance around the registry key monitoring. 🧠 Specifically, when a QoS policy is created in ActiveStore, nothing is written to the registry. More details ⤵️ 🖊️ ipurple.team/2026/06/17/qos-…

‼️🚨 He's back: Nightmare Eclipse just dropped RoguePlanet, a new Windows Defender local privilege escalation 0day PoC. The RCE paths broke after Microsoft's Defender patch. NE suspects the BitLocker bypass may still work but isn't certain. He has a new GitHub btw, let's see how long the account will last: github.com/MSNightmare/Rogue…

💡 If you missed my X post yesterday, I wrote an article about using WinGet for offensive operations (code execution, persistence) and a complete detection strategy. 🖊️ ipurple.team/2026/06/09/wing…