Tricta

⚙️ Low Level | 🏴‍☠️ New Pirate

[Paulos Yibelo @PaulosYibelo]

Escaping Chrome's GPU sandbox through an undocumented macOS API.

Discovered a sandboxed Chrome GPU process could inject keyboard events so sent ⌘+Space, typed "Calculator" & hit Return 😂. CVE-2026-106378 is fixed in Chrome 155. Update chrome dependancies. Happy Octoberfest.

[Speedyfriend67 @speedyfriend433]

Contacts Stack Overflow Bug on iOS 27

[Hakai Security @HakaiOffsec]

About a year ago, Hakai Security introduced the Beerus Framework, an initiative created to centralize security tools and streamline the penetration testing process directly on Android devices.

Now, Beerus expands its capabilities to iOS. Following the same approach as the Android version, the framework aims to gather essential tools into a single environment and simplify device preparation for security testing, reducing complex configurations and operational friction during assessments.

Authors:

Daniel França Lima
Daniel, known as Daniboy, is 19 years old, Brazilian, and works as a Pentester and Researcher at Hakai Security. Passionate about understanding how things work, building tools, and manipulating systems. In his free time, he enjoys gaming, especially titles like Hollow Knight, and he also loves foxes.

Gabriel Rodrigues @Gabriel52489026
Gabriel Rodrigues, researcher and Pentester at Hakai Security. He has one year of experience in offensive security and holds the CPTS certification. As he says himself: “My friends call me Texugo (Badger) because one of them once said that I look like one."

Check out the article on our newly redesigned blog: https://t.co/3Mk3tOFcJT

Github: https://t.co/xqmZbgltlC

[Hakai Security @HakaiOffsec]

Hakai Security research recognized by Apple!

Our analyst Gabriel Rodrigues, from Yokai Research team, was acknowledged by Apple in the security content for macOS Golden Gate 27, following security research related to iCloud that was reported to the company.

The technical details of the vulnerability cannot be disclosed yet, so for now, the finding itself will have to remain under wraps.

But as soon as we are able to disclose, we'll bring you some technical breakdown for sure! 👀

Congratulations, @Gabriel52489026, on the research and the recognition! 🔥

Apple Security Content:
https://t.co/uZ4qWOiVCY 

#HakaiSecurity #SecurityResearch #AppleSecurity #CyberSecurity

[Hakai Security @HakaiOffsec]

Hakai Security dominated Las Vegas!

Our team had a massive presence on stage at BSides Las Vegas and DEF CON 34. We delivered 7 high-level technical talks, bringing cutting-edge research on exploit development, reverse engineering, detection evasion, mobile hacking, and APT tradecraft to the global cybersecurity community.

Seeing our team in the spotlight at some of the world's premier security conferences reinforces what we believe in: continuous research, innovation, and technical excellence in offensive security.

Congratulations to all the speakers for representing Hakai Security and Brazil at such a high level!

[Senumy @senumy_ipa]

🚀 Dopamine Jailbreak v3.0.5 is OUT!

• iOS 15.0–17.3.1 — all devices
• A12/A13 — iOS 16.6–18.7.1 & 26.0–26.0.1

🆕 Added iOS 26.1 Beta 1–3 support
Fixed crashes & improved jailbreak detection

📥 IPA + guide: https://t.co/D7dvvDIAoX

[Tricta @_tricta]

d(^o^)b

[Hakai Security @HakaiOffsec]

How much memory should be required to change the tag of an NPM package? Just a few bytes, right?
During research conducted by Yokai, Hakai Offensive Security's research team, analysis of Gitea's Package Registry revealed that a seemingly harmless endpoint could be abused to cause a Denial of Service condition against the entire Gitea instance.

Gitea loaded the entire HTTP request body into memory before validating it, allowing an authenticated user to indirectly control how much memory the process allocated.

A single request with an excessively large body could terminate the Gitea process, while concurrent requests could keep the instance in a continuous cycle of crashes and restarts.

No administrative privileges, victim interaction, or access to other users' packages were required.

The vulnerability affected Gitea 1.26.2 and development versions prior to 1.27.0, and was fixed in Gitea 1.27.0.
CVE-2026-42931

Full technical analysis on the blog.
Check it out https://t.co/9ZTia0yvnH
Author @_tricta

[Hakai Security @HakaiOffsec]

About a year ago, Hakai Security introduced the Beerus Framework, a proposal to unify mobile tools in order to streamline the penetration testing process directly on Android devices. The idea was simple: centralize tooling and optimize the testing environment setup, removing the need for complex configurations and reducing operational friction during assessments.

Today, after a year of evolution, the framework is no longer just a concept. It has become a robust platform for offensive mobile analysis, gaining international recognition within the community. In this talk, we revisit Beerus in its current form, exploring its evolution, the capabilities that have been consolidated over time, and the lessons learned from real-world scenarios.

We also discuss the future vision of the project, covering new features, technical challenges faced during its development, and how the framework can continue evolving to keep up with modern mobile security assessment demands.

João Pedro Tricta @_tricta and Daniel França Lima @dd4n1b0y

Mobile Hacking Community, Saturday 15:00-16:00 (8 of august) - Brazil 19h

DEFCON 2026 https://t.co/d8nUeAfPbh / @wearedefcon ?@defcon

[Hakai Security @HakaiOffsec]

Rust is rapidly becoming the language of choice for red team tooling, implants, and security-critical software. Yet the offensive security ecosystem has almost no obfuscation tooling for it. Nearly every production obfuscator targets C/C++ binaries or operates on final PE/ELF images; Rust's unique compile pipeline, name mangling, and LLVM IR patterns require a fundamentally different approach.

This talk presents Lyra, an open-source, cargo-native LLVM IR obfuscator for Rust. Lyra intercepts each crate during a normal "cargo build" via RUSTC_WRAPPER, transforms the LLVM IR with a configurable pass pipeline - string encryption, basic-block shuffling, indirect-branch obfuscation - recompiles the result with llc + clang, and substitutes the object before the real MSVC linker runs. Zero changes to the Rust compiler, zero changes to the target project's source code, one flag on the command line.

We walk through the architecture, the engineering challenges unique to Windows/MSVC (UTF-16 response files, allocator-shim object preservation, inkwell's undocumented panic guards), and live before-and-after demonstrations in IDA Pro, Ghidra, and Binary Ninja. We also show a YARA rule that confidently matches a plain demo build returning zero results on the obfuscated binary, and two consecutive unseeded builds producing different hex patterns, defeating a rule written on the first build. Lyra is released open-source at the time of the talk. All demos are reproducible from the release. Attendees leave with a working tool they can run against their own Rust projects the same day.

Rafael Felix @biscoitomesmo and João Pedro Tricta @_tricta

Malware Village, Friday 10:55-11:35 (7 of august)
Brazil 14:55h
DEFCON 2026 https://t.co/d8nUeAgn0P / @wearedefcon / @defcon

[Tricta @_tricta]

It's tomorrow!! 😁

[Hakai Security @HakaiOffsec]

Rust is rapidly becoming the language of choice for red team tooling, implants, and security-critical software. Yet the offensive security ecosystem has almost no obfuscation tooling for it. Nearly every production obfuscator targets C/C++ binaries or operates on final PE/ELF images; Rust’s unique compile pipeline, name mangling, and LLVM IR patterns require a fundamentally different approach.

This talk presents Lyra, an open-source, cargo-native LLVM IR obfuscator for Rust. Lyra intercepts each crate during a normal “cargo build” via RUSTC_WRAPPER, transforms the LLVM IR with a configurable pass pipeline - string encryption, basic-block shuffling, indirect-branch obfuscation - recompiles the result with llc + clang, and substitutes the object before the real MSVC linker runs. Zero changes to the Rust compiler, zero changes to the target project’s source code, one flag on the command line.

We walk through the architecture, the engineering challenges unique to Windows/MSVC (UTF-16 response files, allocator-shim object preservation, inkwell’s undocumented panic guards), and live before-and-after demonstrations in IDA Pro, Ghidra, and Binary Ninja. We also show a YARA rule that confidently matches a plain demo build returning zero results on the obfuscated binary, and two consecutive unseeded builds producing different hex patterns, defeating a rule written on the first build. Lyra is released open-source at the time of the talk. All demos are reproducible from the release. Attendees leave with a working tool they can run against their own Rust projects the same day.

Rafael Felix @biscoitomesmo and João Pedro Tricta @_tricta
Breaking Ground, Tuesday 18:00-19:00 (4 of august)
BSides La Vegas https://t.co/0uWJhukvbQ / @BSidesLV

[Hakai Security @HakaiOffsec]

In this talk, we will cover reverse engineering Windows kernel-mode drivers, identifying vulnerabilities, and performing BYOVD (Bring Your Own Vulnerable Driver) attacks.

We will learn techniques to exploit driver vulnerabilities in order to bypass EDRs or gain kernel-level permissions. Additionally, we will review BYOVD attacks carried out by real APTs and how they disable EDRs and antivirus software using kernel-mode techniques.

Diego Tellaroli @diegotellaroli
Breaking Ground, Tuesday 14:30-15:00, Florentine A (4 of august)
BSides La Vegas https://t.co/0uWJhukvbQ

[Tricta @_tricta]

Aww, that’s so cute!! 🥺

[GameHacking.GG @GameHackingGG]

In addition to our village badges, we are selling plushies of our Legally Distinct Pocket Creatures (aka Blooplings for short)

Come by and get yours as soon as the village opens on Friday!

[Hakai Security @HakaiOffsec]

Teams. Outlook.
Half your enterprise software. They're all quietly shipping a Chromium browser inside them called WebView2.
Murilo Caixeta shows how to turn that trusted, signed process into a genuine red team asset.

Red Team Village @theredteamvillage
SUNDAY, AUGUST 9, 2026 - 11:00 AM

DEFCON 2026 https://t.co/d8nUeAfPbh

[みさか @misakazip]

I was able to root without Bootloader unlock👀

Device: Xiaomi 15T Pro

[Rick de Jager @rdjgr]

Here’s the Age of Empires RCE from yesterday’s Patch Tuesday: CVE-2026-50663.

Join an attacker’s lobby, (auto-)accept UCG, and you get remote code execution.

[Hakai Security @HakaiOffsec]

A few months after the initial release of the Beerus Framework, we are publishing version v1.1, a minor update that brings support for new root environments, a relevant architectural change in data transport, integrated auto-update, and a set of accumulated fixes since the first release.

In this post, we detail each change included in this version, the technical context behind each decision, and what it means in practice for those who use Beerus in their day-to-day Android testing.

Authors @_tricta and @d3vchac

Check it out https://t.co/AhgFvnRbnK

[Mobile Hacker @androidmalware2]

Android 17 root

Full chain browser-to-kernel exploit with two 0-day vulnerabilities affecting Firefox before v151.0.2 (CVE-2026-10702)

Click on the link -> root Android

Discovered by @nebusecurity
PoC not available.
Info: https://t.co/1dmlWIsuyR

[ultra @0x_ultra]

you guys don't understand how exciting this is

the jailbreaking scene has been semi dead with the last real bootROM exploit being checkm8 on iPhone X

that was 2019, 7 YEARS AGO

usbliter8 might lead to another full bootROM exploit based jailbreak for A12/A13 chips, which means up to iOS 27+!

in the claude era this will bring a real resurgence of creativity to ios

tweaks are coming back. sileo is coming back. the whole space is coming back

and ill be honest this one is personal. i got into coding as a kid building tweaks. this space shaped me and seeing it come back feels like coming home

[chompie @chompie1337]

i love this exploit! universal SELinux bypass still works to this day. I released it for Qualcomm based processors and just realized I never released the Exynos version so here it is unprivated: https://t.co/rW1Kr8CLva