𓆏

𓀢𓀣𓀥𓀪𓀡

[Elastic Security Labs @elasticseclabs]

We reverse engineered malware built to kill our own EDR.

In August 2026, eSentire documented a ClickFix campaign selling a DLL sideloader as a service.

It drops a malicious mscoree.dll next to a signed Microsoft binary, vb7to8.exe. Windows loads the planted copy first. Attacker code then runs inside a trusted process.

The kit also ships a vulnerable driver (BYOVD) to disable EDR, including Elastic Endpoint.

So we rebuilt it. A NativeAOT .NET 7 library, exports faked, a module initializer that fires on load.

We dropped it beside vb7to8.exe and ran it.

Elastic Defend 9.5.0 flagged the load as DLL Hijack: Masquerading.

Detecting this before 9.5.0 took ~88 lines and a list of ~2,600 library names. Now it's one line.

MITRE ATT&CK: T1574.001 (Hijack Execution Flow: DLL), T1036 (Masquerading).

Reverse engineering walkthrough, the .NET rebuild, and the detection breakdownby @0xfluxsec and @django88_: https://t.co/l1xdUTa7tN

Original campaign research by @eSentire.

[Thomas Seigneuret @_zblurx]

New release of DPLoot 🔥

Now DPLoot can recover secrets over multiple protocols : SMB, WMI, WinRM, MSSQL, Local and Cobalt Strike REST API.

https://t.co/O7K4x355wi

[Duty @duty_1g]

🚀 x64dbg-MCP Server — fully automated, dynamic, agentic reverse engineering for x64dbg.

🧠 71 MCP tools
🤖 Fully automated & dynamic agentic RE
🔴 22 debugger event callbacks
⚡ Native Zig plugin — zero dependencies
🛠️ Breakpoints, memory, registers, tracing, xrefs, PE analysis & more
🌐 Streamable HTTP + SSE
📦 x32 + x64
Let your AI agent control, analyze, debug, and dynamically reverse engineer binaries directly through x64dbg.
🔗 https://t.co/5gmqJw6SVm
#x64dbg #MCP #AgenticAI #ReverseEngineering #CyberSecurity #RedTeam #MalwareAnalysis #Zig

[Tony/Humpty @humpty_tony]

If you operate a SIEM I'd recommend giving a look st https://t.co/XFRCqQryZ3. Absolute fantastic work!

[Tom Greenwald @tomgreenwald]

100% open source. Help us grow and star on GitHub here: https://t.co/qRu6tRjOk0

[blackorbird @blackorbird]

The exploitation pipeline for Windows kernel drivers, from attack surface to privilege escalation.
https://t.co/phwSCnGCIL

[Coontzy1 @Coontzy1]

So, if you don't need a signed payload... you can serve whatever you want with wsuks https://t.co/OrEAeg1FX4

Cool blog and fire memes! @bagelByt3s

https://t.co/71xJ207L02

[SpecterOps @SpecterOps]

Your browser is a C2 agent waiting to happen.

@KingOfTheNOPs shows how to silently sideload a Chromium extension, no prompts or GUI, and turn Chrome/Edge into a persistent implant with SOCKS, cookie theft, and OS access.

Read more 👇 https://t.co/kh0W1ObkeQ

[Borja Martínez @Qm9yamFN]

DEFCON 34: You can find our research here:

https://t.co/sEzW29Z1Ul

[Swissky @pentest_swissky]

WAF Bypasses via h2 framing - Diyan Apostolov (@thefosi)
https://t.co/3w6vr9qoFx

[Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 @elder_plinius]

video is up! come watch a simple QR code break Gemini and turn a Unitree robot into a rabid attack dog 🦾🤖

Black Hat USA Briefings: Kinetic Prompt Injection: Agent Compromise With a Physical Blast Radius

https://t.co/P0Lw99sgEb

[Angelboy @scwuaptx]

My #BHUSA 2026 slides are online!

It was an honor to share our AFD research and how a different perspective led to 30+ Windows kernel vulnerabilities.

Blog post coming soon — check out the slides here:
https://t.co/l8xIaRtL7V

[Dirk-jan @_dirkjan]

✈️ blog to kick off BH/DC week: Borrowing Windows Hello keys for authentication and persistence. https://t.co/zWiaJDh6oR

[SEKTOR7 Institute @SEKTOR7net]

And voila, an example implementation of active defense framework to lure and exploit the attacker's LLM.

It's basic and should work in simple scenarios. Great work @crackenagi

Link to the framework: https://t.co/xjuQivf8VZ

[Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 @elder_plinius]

probably nothing

[Sploitus @sploitus_com]

We're back!
With updated design and features

[Yuval Avrahami @yuvalavra]

We (+@liormama) gained full access to EVERY database on Azure's flagship DB service 🤯

And all we needed was a single key 🔑

This is the story of #CosmosEscape 🧵👇

[Lsec @lsecqt]

I wrote a short blogpost about a technique I found a while ago, executing DCSync attack entirely form the memory of a Windows host using C# assembly.

https://t.co/mIWclMTgtf

[James Kettle @albinowax]

In "Can AI Do Novel Security Research?" I'll share:
- A research-machine blueprint for AI enthusiasts
- Clearly defined AI fail-points for AI dodgers
- Extensive insight into what makes security research work
- Many many novel desync goodies

I'll also publish major updates to Turbo Intruder, Param Miner and HTTP Request Smuggler. Plus the full source of the HTTP Terminator itself. Choose your own adventure :)

[SpecterOps @SpecterOps]

Compromise one node in a Windows Server Failover Cluster and you've compromised all of them.

@unsigned_sh0rt dug into why: shared credentials, forged tickets, and a full attack chain to own the cluster.

Check it out! https://t.co/53K9xgF7rY