Cybersecurity Community
Joined April 2024
- Tweets64
- Following56
- Followers48
- Likes112
📚Learn about the in memory Lazarus PE RAT
blog.fox-it.com/2026/05/22/r…
SkullNet retweeted
‼️🚨 Microsoft has patched a critical Windows DNS Client remote code execution vulnerability that allows an unauthorized attacker to execute code over a network. All it takes is a malicious DNS response.
The vulnerability is tracked as CVE-2026-41096 with a CVSS score of 9.8. It is a heap-based buffer overflow in dnsapi.dll, the Windows component that processes DNS answers on every machine.
To trigger it, an attacker needs a position where they can influence DNS responses: a rogue DNS server, a poisoned resolver, a compromised router, hostile WiFi, or a man-in-the-middle placement.
That puts ordinary Windows DNS activity in the blast radius. Browsers, VPN clients, enterprise apps, update checks, and background services constantly ask DNS where to connect. The vulnerable processing sits in the Windows DNS Client path, not an edge-facing server product.
Microsoft assessed exploitation as "less likely," and Rapid7 lists the issue as not publicly disclosed and not known to be exploited at release.
On the contrary, a 9.8 unauthenticated network RCE in DNS client handling is exactly the kind of bug defenders should assume will be reverse-engineered quickly.
Defenders should:
- Deploy the May 2026 cumulative updates and confirm coverage across endpoints and servers
- Restrict DNS traffic to trusted resolvers where possible
- Monitor Dnscache and svchost.exe for abnormal child processes or unexpected outbound activity
- Treat public WiFi and untrusted resolver paths as higher-risk until patching is complete
SkullNet retweeted
Introducing SubQ - a major breakthrough in LLM intelligence.
It is the first model built on a fully sub-quadratic sparse-attention architecture (SSA),
And the first frontier model with a 12 million token context window which is:
- 52x faster than FlashAttention at 1MM tokens
- Less than 5% the cost of Opus
Transformer-based LLMs waste compute by processing every possible relationship between words (standard attention).
Only a small fraction actually matter.
@subquadratic finds and focuses only on the ones that do.
That's nearly 1,000x less compute and a new way for LLMs to scale.
SkullNet retweeted
Big news for Blue Team nerds
That nerd who released those Microsoft 0days has created two new repos on GitHub with spooky sounding names indicating they will be releasing two new Windows 0days.
Very cool
github.com/Nightmare-Eclipse
SkullNet retweeted
‼️🚨 Microsoft calls this "intended behaviour," so here we go.
How to dump the credentials of every user stored in Microsoft Edge:
1. Open Edge. Don't browse anywhere, just open it.
2. Flip to Task Manager, find Edge, expand the task.
3. Highlight the "browser" sub-task, right-click, and choose "Create Memory Dump."
4. Open the dump file and look for credentials.
The logged-in Windows user can dump every stored Edge credential with no additional rights. Which means any malware that user executes has those credentials for the asking.
Thanks to Rob VandenBrink at SANS: isc.sans.edu/diary/32954
SkullNet retweeted
Microsoft Edge loads all your saved passwords into memory in cleartext — even when you’re not using them.
SkullNet retweeted
Experience Report - AI-Assisted BOF Development in Red Teaming avantguard.io/en/blog/erfahr…
SkullNet retweeted
Microsoft has addressed a one-click NTLM leak vulnerability affecting Windows Snipping Tool (CVE-2026-33829), discovered by our researcher Marcos Díaz (@Calvaruga).
➡️ Read the write-up: github.com/blackarrowsec/red…
➡️ Microsoft bulletin: msrc.microsoft.com/update-gu…
SkullNet retweeted
Foreign enterprise apps can expose your Entra ID tenant. Today, we release part 1 of our 4-part weekly series on common Entra ID pitfalls and how to detect them with EntraFalcon. Learn how external apps can lead to data access or worse: blog.compass-security.com/20…
SkullNet retweeted
How many sign-in logging bypasses can Azure Entra ID contain?
At least 4.
Who knew a really long string could make an Entra ID login disappear from the logs entirely? In our #blog, @nyxgeek breaks down how overflowing #Azure's sign-in logging mechanism allowed access tokens to be issued without a single log entry. Read it now! hubs.la/Q047xTVc0
SkullNet retweeted
FancyBear Exposed: Major OPSEC Blunder Inside Russian Espionage Ops - Ctrl-Alt-Intel ctrlaltintel.com/threat%20re…
SkullNet retweeted
🚨 This Python tool just made vector databases optional for RAG.
It's called PageIndex. It reads documents the way you do.
No embeddings. No chunking. No vector database needed.
Here's the problem with normal RAG:
It takes your document, cuts it into tiny pieces, turns those pieces into numbers, and searches for the closest match. But closest match doesn't mean best answer.
PageIndex works completely different.
→ It reads your full document
→ Builds a tree structure like a table of contents
→ When you ask a question, the AI walks through that tree
→ It thinks step by step until it finds the exact right section
Same way you'd find an answer in a textbook. You don't read every page. You check the chapters, pick the right one, and go straight to the answer.
That's exactly what PageIndex teaches AI to do.
Here's the wildest part:
It scored 98.7% accuracy on FinanceBench. That's a test where AI answers real questions from SEC filings and earnings reports. Most traditional RAG systems can't touch that number.
Works with PDFs, markdown, and even raw page images without OCR.
100% Open Source. MIT License.
SkullNet retweeted
Building RAG systems usually means stitching together 10 different tools.
OpenRAG bundles everything into one stack.
• document ingestion
• semantic search
• agentic workflows
• chat over your data
Powered by Langflow, Docling, and OpenSearch.
SkullNet retweeted
M365Pwned: Red Team tooling for Microsoft 365 exploitation via Microsoft Graph API.
Two WinForms GUI tools for enumerating, searching, and exfiltrating data from M365 environments using application-level OAuth tokens — no user interaction required.
meterpreter.org/m365pwned-re…
SkullNet retweeted
Why yes, yes we can use ESTSAUTH captured from evilginx to automatically register a passkey
SkullNet retweeted
Descubre RAPTOR, el framework de IA que convierte a Claude en un agente de ciberseguridad ofensiva/defensiva para automatizar análisis, fuzzing y exploits. Una mirada al futuro de SecOps.
🕵️♂️🤖🛡️⚠️ #HackingEtico #Ciberseguridad #AI #SecOps #AI #RedTeam #Claude
SkullNet retweeted
''GitHub - Maldev-Academy/DumpChromeSecrets: Extract data from modern Chrome versions, including refresh tokens, cookies, saved credentials, autofill data, browsing history, and bookmarks''
#infosec #pentest #redteam #blueteam
github.com/Maldev-Academy/Du…
SkullNet retweeted
#SharePoint Online Enumeration Just Got Easier for Red Teamers
During assumed breach exercises, or after compromising a user token or credentials, SharePoint Online is often one of the richest data sources in a Microsoft 365 environment. It’s the central repository for an organization’s most sensitive documents, including credential guides, financial reports, HR records, and strategic project plans.
There is a new addition to the EvilMist toolkit: #SharePointEnum, a #PowerShell SharePoint Online search and file download tool built for red team operators and penetration testers.
---
What It Does
SharePointEnum leverages the SharePoint REST Search API to perform full-text keyword searches across all SharePoint document libraries accessible to a compromised identity. Think of it as "grep for SharePoint" during an engagement.
Key capabilities:
- Full-text search across all SharePoint document libraries.
- Faceted Query Language (FQL) for surgical targeting.
- Refinement filters by file type, author, date, or site.
- File download to disk or Base64-encoded output for C2 exfiltration.
- Auto-detection of the SharePoint domain from the Azure session.
- Stealth mode with configurable delays, jitter, and throttle handling.
- CSV/JSON export with search metadata.
---
#BlueTeam Takeaways
This tool also has defensive value:
- Understand what data is discoverable via the SharePoint Search API with a given identity.
- Test DLP policy effectiveness against REST API-based searches.
- Validate that token-based access controls and Conditional Access policies are working as expected.
- Assess exposure of sensitive documents to broad search queries.
If an attacker with a compromised user token can search and download your SharePoint content via REST API, your DLP and access controls need attention.
Full documentation and source code: github.com/Logisek/EvilMist
#Cybersecurity #CloudSecurity #PenTest #RedTeam #SharePoint #Microsoft365 #Azure #InfoSec #OffensiveSecurity #EvilMist #Logisek
