One spoofed "Ledger" email led to a 320-site phishing cluster, a deobfuscated seed-phrase harvester on Azure, a fake Ledger Identity API leaking its origin via CNAME, and a lesson in why vision models need a human in the loop.
read post →1. Executive Summary On 2026-08-27 at 14:30 UTC, a UK recipient received a phishing email spoofing an Intuit QuickBooks payment notification. The email
A note on the indicators below: all hostnames and URLs in this post are defanged (hxxps[:]//, [.]) so nothing in the page is clickable. Re-fang them
So I have been playing around with GLM 5.2 alot more lately for the offensive side of things. As mentioned all over this site, I
Z.ai has announced GLM 5.3. It uses the same base model as GLM 5.2. No new pre-training run. No larger foundation model.
Hugging Face says hosted frontier models blocked its forensic prompts during an AI-driven intrusion. A locally hosted GLM 5.2 helped analyse more than 17,000 events without the evidence or credentials leaving its environment.
TL;DR: We integrated urlquery.net as a second web scanning engine alongside urlscan.io in our MCP-powered phishing infrastructure pipeline. The re-run of
1. Executive summary CVE-2026-6471 ("PostGREShell") is a missing-authorization flaw (CVSS 7.2 HIGH, CWE-862, not in CISA KEV,
1. Executive summary The "Phantom Deal" campaign is a social-engineering operation in which threat actors conduct deep reconnaissance on target companies
1. Executive summary Cisco has disclosed three critical (CVSS 9.8) vulnerabilities following a comprehensive internal security review of IOS XR Software and a
1. Executive summary CISA has published ICS advisory ICSA-26-246-06 covering CVE-2026-77393 in Inductive Automation Ignition 8.1.53 and
1. Executive summary On 3 September 2026, the researcher known as Nightmare Eclipse (aliases Chaotic Eclipse, Infinite Nightmare, MSNightmare) published a working proof-of-