ShieldBreak: When Defender Becomes the Privilege Boundary
ShieldBreak (CVE-2026-69414) abuses file-path resolution around Microsoft Defender. Trace the privilege chain, detection telemetry, and interim controls.
-
-
Pass-ta-Key: When Synced Passkeys Trust a Compromised Host
Unit 42’s Pass-ta-key research exposes device-trust and recovery attacks around Google-synced passkeys. Trace the mechanics, detection, and defensive choices.
-
Gunra Before Encryption: Detect the Ransomware Handoff
Gunra’s locker is the last stage. Detect the earlier handoff from VPN compromise to remote access, exfiltration, backup deletion, and offline encryption.
-
The Page Was Blank: Inside macOS ClickFix Cloaking
A macOS ClickFix campaign hid its lure behind browser fingerprinting. This analysis reproduces the gate safely and builds detection across web, endpoint and identity telemetry.
-
The Same PHP Web Shell Appeared Across 47 Domains—Here’s How to Hunt It
A real PHP web shell appeared across 47 domains on one shared host. Hunt its signatures, triage WordPress, preserve evidence, and recover safely.
-
Ransomware Recovery: Where to Find Public Decryptors Before You Pay
A practical guide for security teams on when public ransomware decryptors work, where to find them, and how to avoid making recovery worse.
