├── A Tiny npm Loader With a Much Bigger Payload
A five-stage npm postinstall chain that builds a local Node runtime, disguises an obfuscated implant as a VS Code manifest, and targets credentials, wallets, SSH material, and files.
read write-up → ├── Phishing PDFs in the Wild - Patterns Across Three Campaigns
Three low-complexity PDF phishing samples with different lure styles but the same objective: drive urgent clicks into credential or payload delivery paths.
read write-up → ├── LinaStealer Unity NSIS Electron Loader: Multi-Stage Infostealer Campaign Analysis
Multi-stage loader analysis abusing Unity + NSIS + Electron to deliver a Brotli-compressed infostealer payload.
read write-up → ├── Windows Loader/Stager Crash Case
Dynamic analysis of a Windows executable that performed environment checks, re-executed under a new parent, and triggered a CRITICAL_PROCESS_DIED bugcheck without observed payload delivery.
read write-up → ├── Songtrust Impersonation via SMS, Fake Work Portal, Telegram Pivot
Unsolicited SMS promised easy remote pay, linked to a Songtrust-branded login page that simply funnels victims to Telegram.
read write-up → ├── Lumma Stealer HTA Loader Analysis
Static analysis of a Lumma Stealer HTA loader that self-reads, decodes embedded hex payload data, and executes it via eval.
read write-up → ├── Office 365 Termination Phish, Google Forms Credential Grab, Evidence Preserved
Sketchy email asking me to give them my email + password to verify that my email was in fact still being used.
read write-up → ├── LinkedIn 'Recruiter' Links, Dead Redirector, Evidence Preserved
A repeatable headers only workflow to sanity check suspicious short links from a LinkedIn DM, capture what you can, and preserve evidence even when the redirect chain is already dead.
read write-up → └── Casefile: 'System Shutdown' Phish — Safe Redirect Triage + IOC Extraction
A repeatable email-triage workflow: preserve evidence, review headers, extract/defang links, safely resolve redirects (headers-only), and document IOCs + defensive actions.
read write-up →