Stishy

Red Team. Definitely don't waste too much money on computer hardware.

[cr3ghost @cr3ghost]

SmartScreen bypassed. Mark of the Web removed. No Run Dialog. No PowerShell popup. Just a browser file upload.

FileFix is a new ClickFix alternative. Browser file upload opens File Explorer. File Explorer address bar executes OS commands. cmd.exe spawns as a child of Chrome. The user thinks they are pasting a file path.

Executables launched through File Explorer's address bar lose their MOTW attribute entirely. SmartScreen never triggers.

https://t.co/17VpLAxeoM

Author: @mrd0x

#Malware #Phishing #InfoSec

[Alex Neff @al3x_n3ff]

Onelogon: Taking over Active Directory Accounts via Netlogon🔑

We analyzed Netlogon, bypassed the Zerologon patch, resulting in a full auth bypass. An attacker can leverage this to compromise computer accounts, or even the entire AD. Non-standard config must be present tho 🧵

[nedwill @NedWilliamson]

Been a fan of chompie since her early Linux work, great interview! This is what real AI vuln research looks like. Full self bug hunting™ by end of year.

[Nicolas Krassas @Dinosn]

chainreactors/aiscan: pi-like agentic security scanner — single binary for AI-driven pentesting, from red team ops to bug bounty https://t.co/dzvZkSyA7n

[Dirk-jan @_dirkjan]

I just wrote a new blog on bypassing CA policies in Entra ID that have a resource exclusion, and why you probably want to enable baseline enforcement if you have such policies. Enjoy!

https://t.co/a1rGl3wss8

[Mehmet Ergene @Cyb3rMonk]

New TTP in the arsenal. Looks quite dangerous.

https://t.co/Y5CGZyte84

[Dave Kennedy @HackingDave]

Using a coding hardness? Hook NightBeacon up to it. Drop files, logs, whatever - have it automatically RE it, give full timeline of artifacts. Have it automatically spin up containers and detonate malware, snag all the IOCs, submit it to TI sources automatically. Runs through Suricata, Zeek, Hayabusa, CAPE, and many others including 10K+ yara rules.

Use velociraptor? Dump it in, automatically analyzes, reaches out via connectors to pull additional data if necessary, gives you full timelines.

Want to kick off a threat hunt ? Cool, ask NightBeacon to generate a hypothesis based threat hunt on the past week of activity, pushes through your connectors, brings results back and analysis.

Want to take action? "Contain these hosts". Done.

Just want to see how your org is doing? "How am I looking today?"

#BinaryDefense

[V12 @v12sec]

AnyPwn: AnyDesk preauth 0click RCE (heap buffer overflow)

we will release PoC post disclosure and patch

[冬天 @seventhoce56019]

分享一个比较危险的项目

逆向工程以前是安全大佬的专属技能，现在有人把它做成了技能包，直接喂给 AI。

项目叫 reverse-skill，核心思路很简单：只要塞一个routing.md进去，告诉 AI 遇到不同的安全任务该走哪条路。AI 拿到之后自动分诊，自己决定用什么工具、什么方法。
覆盖 20 多个子技能方向：APK 逆向分析、IDA 静态分析、JS 前端逆向、固件安全、EDR 绕过、漏洞利用……基本上安全攻防常见场景都能覆盖。

20多个子技能，安全攻防的门槛被AI又踩平了一截。是好是坏，各位自己掂量着看。

项目地址：https://t.co/tqd95pObVT

[Panos Gkatziroulis 🦄 @ipurple]

UnCanny - Another new coercion primitive with LPE 0day - machine-account NTLM coercion from a non-admin user via Windows Store InstallService plugin resolution experiments https://t.co/Vw2LEhoZXZ

[Prepakis Georgios @kernelstub]

Defensive patch Tuesday semantic diff cli for Windows build snapshots for drivers, dlls, and more.

Microsoft, don't kill me. Thank you.

https://t.co/GEKZbTNyHO

[Prepakis Georgios @kernelstub]

I made this Windows security research toolkit for LPE, persistence, COM hijacking, and attack surface enumeration.

Leave a star and follow on GitHub so I can feed my 10 kids <3

https://t.co/esI60KXU2X

[Panos Gkatziroulis 🦄 @ipurple]

Beacon Object File for LDAP Queries Through ADWS https://t.co/xHEurcxLJw

[guyru @guyru_]

We're mostly an IDA shop at @CellebriteLabs, but I decided to play around with Ghidra. My main motivation was to experiment with agentic reverse engineering techniques. The result is an agent skill for Ghidra, which we are releasing publicly:
https://t.co/mPrNFR8mOq >>

[ATTL4S @DaniLJ94]

Very cool research done by my mate Marcos 🙌

https://t.co/10pE6Lj6ki

[drop @dropn0w]

If I have one recommendation to give, transform into deterministic workflows EVERYTHING you can to offload your agent.

This will:
- Save tones of tokens at runtime
- Make your workflow more deterministic and less reliant on the LLM to accomplish key steps

Tokens are cheap now and you should enjoy the party, but that will change. The more you build for the long term in a deterministic way, the more tokens you’ll save in the future, so you will spend less compare to your competitors, think about that.

So invest time in building your system, and thank me later.

[R136a1 @TheEnergyStory]

Have you noticed that those deep-dive stories about complex Windows malware have pretty much vanished, especially in recent years? It feels like the era of "blockbuster" Windows malware has just gone silent, and this blog post tries to give some answers why.

https://t.co/sFsf3uPm5o

[Norbert Tihanyi, PhD @TihanyiNorbert]

Powershell Scripts With 100% AV Bypass (PSSW100AVB) repository
https://t.co/fiLzzTgPjn

New undetectable PowerShell reverse shell added (May 4, 2026). 🔥 Essential for red teamers—use it in the next 2-3 weeks before it gets flagged!
#Powershell #RedTeam #ReverseShell

[DirectoryRanger @DirectoryRanger]

BitlockMove. Lateral Movement via Bitlocker DCOM & COM Hijacking, by @ShitSecure
https://t.co/e8hoFAqNQw

[bfho @0xbfho]

boh starred 0xMohammedHassan/morphkatz on Github https://t.co/hCyV7No9Yd