Mocking G33K

Lone hacker on a classified mission.

[Mocking G33K @g33xter]

Information is power. But like all power, there are those who want to keep it for themselves. -- #AaronSwartz

[IT Guy @T3chFalcon]

Did you know there's a type of phishing attack that defeats MFA completely.

It's called a reverse proxy phishing kit and it's one of the fastest-growing attack techniques in cybersecurity.

Traditional phishing works by using fake login page. you type your password. attacker gets it. if you have MFA enabled, the stolen password alone is useless. attacker gets stopped at the second gate.

reverse proxy is different.

instead of a fake page, the attacker sets up a live proxy server between you and the real website. when you click the phishing link, you connect to the attacker's server. the server connects to the real Microsoft, Google, or Okta on your behalf. it fetches the real login page and serves it directly to you, pixel for pixel in real time.

you're looking at the actual login page. you type your real password. the proxy relays it to Microsoft. Microsoft sends back an MFA prompt. the proxy relays that to you. you approve it. Microsoft sends back a session cookie.

the proxy intercepts the cookie before it reaches your browser.

You're logged in, so is the attacker using the same session.

Tools used: Evilginx, Modlishka, Muraena. all open source. all free. all with pre-built templates for Microsoft 365, Google Workspace, Okta, and PayPal.

commercial versions: EvilProxy, Tycoon 2FA, Mamba 2FA, Starkiller. Sold as subscription services on Telegram.

Reverse proxy phishing surged 139% between September 2025 and March 2026, nearly 1 in 4 phishing links now carries a reverse proxy payload.

18 US universities hit last year. Microsoft 365 campaigns targeting thousands of organizations globally.

The only authentication method that stops this completely: FIDO2 passkeys and hardware security keys. They bind credentials to the real domain. The proxy can't replay them because the credential was never issued for the proxy's domain.

Everything else, SMS codes, authenticator apps, push notifications can all be relayed.

[𝒢𝒾𝓁𝒷ℯ𝓇𝓉 @AbakpaJob]

It's amazing how much you can accomplish around the house under the threat of someone coming over.

[cr3ghost @cr3ghost]

The creator of Cobalt Strike left the industry in 2021, came back, and is now publishing everything he knows about evasion tradecraft openly and for free.

Tradecraft Garden separates evasion tradecraft from capability. Crystal Palace is the linker that makes it work: position-independent code, binary transformation, code and register randomization, link-time hooking, YARA rule generation from invariant instructions, and a PICO convention for reusable tradecraft modules.

The community built an entire ecosystem on top of it. Crystal Kit for Cobalt Strike, Sliver, Mythic, and Adaptix. Reflective loaders, call stack spoofing, sleep masking, module overloading. Offense and defense both benefit because every technique is published as a testable ground truth.

If you work in red teaming, detection engineering, or EDR evaluation, this is required reading.

TTPs: https://t.co/A4O6Tuh58M
Blog: https://t.co/4jb7cRpcA9

His original Red Team Ops with Cobalt Strike series is also still on YouTube. 9 parts covering the full red team operations workflow. Free. From the person who built the tool. Red Team Ops with Cobalt Strike - Operations (1 of 9): https://t.co/Jd28yWuaYs

Author: Raphael Mudge

#BlueTeam #InfoSec #RedTeam

[SpecterOps @SpecterOps]

What happens when a new Mythic agent can be generated, tested, and deployed in ~2 hours?

@_xpn_ explores "disposable tooling" and the implications for offensive operations and defenders alike.

Check out the latest from GhostWorks ⬇️ https://t.co/MHsx7W4mhp

[Dave Kennedy @HackingDave]

Sign up for this one! Insanely brilliant folks from both TrustedSec and binary defense on this one ! Gonna be amazing

[Martin @cantcomputer]

MFers worried about Mythos and we havent even solved “compromised legacy credential"

[Ayaan 🐧 @twtayaan]

Apple just made Docker Desktop optional on Mac.

And it is completely free.

This is apple/container. 26.5k stars no Github.

You can now run Linux containers natively on your Mac without installing Docker Desktop, without a background daemon hogging your RAM, and without paying $21 a month per developer for a commercial license.

Here is what it does:

→ Runs Linux containers as lightweight VMs directly on Apple Silicon using macOS 26 virtualization
→ Fully OCI compatible. Pull any image from Docker Hub, GitHub Container Registry or anywhere else
→ Written in Swift and optimised specifically for Apple Silicon. Faster and lighter than anything Docker Desktop does on Mac
→ Standard container CLI syntax. If you know Docker commands you already know how to use this
→ Push images you build to any standard container registry and run them anywhere

Docker Desktop charges $21 per developer per month for commercial use. Apple's version costs nothing and ships as open source under Apache-2.0.

Microsoft made Docker Desktop optional on Windows with WSL Containers last month.

Apple just did the same on Mac.

Docker is not going anywhere. But the era of paying for a GUI wrapper around containers on your own machine is quietly ending.

Repo here: https://t.co/uFJ867sul6

[0xor0ne @0xor0ne]

Building autonomous vulnerability hunting lab with Claude Code + MCP

https://t.co/MT4LbPOVGU

#infosec #llm

[RedTeam Recipes | RTR @RedTeamRecipes]

We dropped our complete OSED notes index on the blog. It’s a raw technical reference covering x86 assembly, PE structure analysis, format string primitives, and OS mitigation bypasses.

https://t.co/BDr6aJZO5J

#offsec

[cr3ghost @cr3ghost]

Your EDR is running. Detecting everything. Alerting on nothing.

EDRSilencer blocks all EDR outbound traffic using Windows Filtering Platform. The agent keeps running. Detections keep firing. Nothing reaches the cloud. No alerts. No telemetry. Blind.

Works against Defender, SentinelOne, CrowdStrike, Cortex XDR, Carbon Black, Elastic, Trellix, FortiEDR, ESET, TrendMicro, and more.

Additional techniques covered: WFP filters, hosts file manipulation, NRPT rules, null sinkholing, firewall rules.

If your SOC relies on cloud-based alerting and you are not monitoring for WFP filter creation, you have a problem.

https://t.co/9y586rIknx
https://t.co/egLu98X3bC

Authors: @ipurple

#DefenseEvasion #ThreatIntel #InfoSec

[Two Seven One Three @TwoSevenOneT]

New #redteam tool for blocking EDRs: EDRChoker
Instead of fully blocking the EDR agents' connections to their server, we can throttle their bandwidth so they consistently time out when sending data, which is effectively the same as blocking but avoids triggering "block" or "drop" packet events
#pentest #cybersecurity
Github: TwoSevenOneT/EDRChoker

[Mocking G33K @g33xter]

@mizukiiverse Death note

[Mocking G33K @g33xter]

@animeposts

[DirectoryRanger @DirectoryRanger]

ADCS Attack Techniques Cheatsheet
https://t.co/myZpR3PobY

[Alex Matrosov @matrosov]

Follow every Mythos discovery through our coordinated vulnerability disclosure dashboard.

https://t.co/xri3fTpf77

[Mocking G33K @g33xter]

@Justtdavid_ For me, it’s Hunter x Hunter.

[Mocking G33K @g33xter]

@HackingDave @Oddvarmoe Congratulations Dave.

[LiveOverflow 🔴 @LiveOverflow]

I am a bit late to the "Mythos" clickbait. But here we go:

Why Mythos doesn't matter (for us)

https://t.co/2ATIC7Etal

[Swissky @pentest_swissky]

How I Found Open-Source 0-days with an LLM Multi-Agent Workflow - Hyunseo Shin
https://t.co/WASkY7Q47C

[Mocking G33K @g33xter]

@Pulaxki What’s the app name that’s showing event on lock screen?