@RedByte1337

Offensive Security Lead @ Spotit. Creator of GraphSpy

 Belgium
linkedin.com/in/keanunys/
Joined August 2014
  • Tweets125
  • Following84
  • Followers1.3K
26Media
🚀I'm finally releasing GraphSpy to the public!🕵️ A powerful offensive security tool focused on making initial access and post-compromise enumeration in Microsoft Entra and M365 much more convenient during penetration tests and red team assessments! github.com/RedByte1337/Graph…

GitHub - RedByte1337/GraphSpy: Initial Access and Post-Exploitation Tool for Entra ID and M365 with...

Initial Access and Post-Exploitation Tool for Entra ID and M365 with a browser-based GUI - RedByte1337/GraphSpy

github.com
4
135
3
380
35,333
Have you ever seen a phishing email in which a working password prompt is in the actual email body + a dynamic MFA prompt? 😜 Come check out this (and several other) new phishing techniques in action during my talk tomorrow morning 11 am CEST on stage at @brucon, or its stream!
2
3
21
1,224
Full schedule: brucon.org/conference Link to the livestream: streaming.brucon.org/

Conference | BruCON

BruCON 0X10 BruCON is an annual security and hacker conference providing two days of an interesting atmosphere for open discussions of critical infosec issues, privacy, information technology and its...

brucon.org
1
241
Excited to be back as a @defcon mainstage speaker in Vegas for the 2nd year in a row! 🎉 This year I'll reveal new techniques to get Microsoft to deliver any phishing email from official Microsoft addresses. Plus... interactive phishing pages rendered inside email clients!? 😜
6
5
22
1,422
hackertracker.app/defcon34/c…
2
227
Just open-sourced CredSpy Couldn't find any tools that allowed unauthenticated enumeration of auth methods for @Microsoft accounts, so I created it. Shows whether target accounts use Passkeys, certificate auth, passwordless push, etc... Find it here: github.com/RedByte1337/CredS…
1
88
2
296
19,363
This is exactly why I did not share my research with MSRC before my talk last @defcon, to make a statement against their classic "does not meet the bar for servicing (unless you publish it)" response. Next DEF CON will be interesting...
vx-underground
@vxundergroundMay 28
Chat, I don't want to be that guy, but I think Microsoft has really pissed off security researchers and we're approaching the tipping point. This Eclipse guy has really rocked the boat for Microsoft.
3
3
1
39
3,237
I even dedicated the first three minutes of my talk to calling them out for these practices. They came to me afterward and told me I would have gotten at least a $10k bounty if I had reported it. Sure... youtu.be/z6GJqrkL0S0

DEFCON33 - Turning Microsoft's Login Page into our Phishing Infrastructure - Keanu Nys

This video contains the recording of my mainstage talk at DEF CON 3...

youtube.com
1
1
10
851
Just shipped GraphSpy v1.7.0 ✨ Mostly under-the-hood work this time with major refactoring to speed up future development ⚙️ Huge shoutout to n3rada for leading the effort! More exciting features coming soon 🚀 github.com/RedByte1337/Graph…

GitHub - RedByte1337/GraphSpy: Initial Access and Post-Exploitation Tool for Entra ID and M365 with...

Initial Access and Post-Exploitation Tool for Entra ID and M365 with a browser-based GUI - RedByte1337/GraphSpy

github.com
1
12
38
2,967
Early Bird Offer for Q2 Bootcamps 2026 is ending soon. Save 15% on our upcoming Red Team live bootcamps across Azure and Active Directory. Use code EARLYBIRD15. Offer valid till April 10, 2026. June 5 - CARTP® Bootcamp June 6 - CRTP® Bootcamp June 27 - CARTE® Bootcamp Secure your seat: alteredsecurity.com/bootcamp… #CyberSecurity #RedTeaming #CloudSecurity #InfoSec
2
1
12
1,932
Keanu Nys retweeted
Nikhil Mittal
@nikhil_mittApr 7
Join @RedByte1337 and me for the June 2026 bootcamps as we take you through the on-prem and Azure Red team. Very practical and hands-on labs with fantastic learning aids. Bonus - dad jokes and insight (read rant) on state of identity security.
Altered Security
@AlteredSecurityApr 7
Early Bird Offer for Q2 Bootcamps 2026 is ending soon. Save 15% on our upcoming Red Team live bootcamps across Azure and Active Directory. Use code EARLYBIRD15. Offer valid till April 10, 2026. June 5 - CARTP® Bootcamp June 6 - CRTP® Bootcamp June 27 - CARTE® Bootcamp Secure your seat: alteredsecurity.com/bootcamp… #CyberSecurity #RedTeaming #CloudSecurity #InfoSec
1
9
1,133
Keanu Nys retweeted
Kuba Gretzky
@mrgretzkyMar 27
It was an honour to share what I've been working on on the stream! It was a blast! 🪝🐟 The demo gods were thankfully kind to me. 🙏 P.S. To anyone copying the session cookies character-by-character from the video feed - all the sessions have been invalidated. 🥲
Stephen Sims
@Steph3nSimsMar 27
Big thanks to @mrgretzky for a great stream on the latest in MFA bypass attacks with Evilginx and Phishlets 2.0! Each time web developers come up with new ways to secure things, Kuba is right there to find a workaround! You can watch the recording here: youtube.com/live/eeauoOYUwoM…

Evilginx MFA Phishing Evolution With Phishlets 2.0 with Kuba Gretzky

In this webcast, Kuba Gretzky demonstrates how modern adversary-in-...

youtube.com
3
9
46
4,334
I recently sat down with @_JohnHammond to record a video about GraphSpy! 😁 We went over the most powerful features GraphSpy has to offer, and even showcased some of the new features that were added lately. This video is now live on his YouTube channel, so go check it out! 😉
John Hammond
@_JohnHammondMar 11
GraphSpy: A Hacker's Tooling Deep Dive, video demos with the creator @RedByte1337! 🤩 Keanu shows me the wild things you can do for post-exploitation in Entra ID -- even adding a physical security key for persistence and a ton of other tricks 🤯 Video: youtu.be/qEtoKC32UoE
2
9
43
9,349
Maximum 16-character password "for security reasons". 🤔 And what I find more surprising is the fact that the "<" character is not permitted either... Is this some poor attempt at preventing XSS? That would mean the password is displayed in cleartext somewhere on a web page...🤨
1
6
427
I will be teaching the advanced version of the Attacking & Defending Azure Cloud bootcamp once again in February with @AlteredSecurity! Live, hands-on Azure red team training with realistic labs to sharpen both your Offensive and Defensive skills! 🔥 🔗 alteredsecurity.com/carte-bo…

Attacking and Defending Azure Cloud: Advanced Edition (CARTE)

This 2-week advanced bootcamp is designed to help security professionals in taking their Azure Red Team skills to the next level.

alteredsecurity.com
2
9
653
GraphSpy just hit 1000 ⭐ on GitHub! What started as a personal side project is now used by pentesters around the world. Never imagined this as my first project, especially not in under 2 years. 🤯 I silently pushed v1.6 right before the holidays with powerful new features 😉
4
5
31
2,833
Check out the new features under the Release Notes section: 🔗github.com/RedByte1337/Graph…

GitHub - RedByte1337/GraphSpy: Initial Access and Post-Exploitation Tool for Entra ID and M365 with...

Initial Access and Post-Exploitation Tool for Entra ID and M365 with a browser-based GUI - RedByte1337/GraphSpy

github.com
6
14
1,136
Wow, this almost passed by without me noticing👀 This is not how I envisioned GraphSpy to be covered in a @_JohnHammond video, but then again, it was only a matter of time before malicious actors used it. You just hope it is used for more good than bad when creating these tools.
John Hammond
@_JohnHammond22 Nov 2025
Uncovered screen recordings from threat actors! 👀 Real footage of cybercriminals using anti-detect browsers and infostealer malware logs for session hijacking, and another using GraphSpy to read their Entra ID victim's emails in Outlook! 💀 Video: youtu.be/vX7JcpRqbEk
1
9
1,730
Thanks to everyone who joined my DEFCON33 talk!🎉 For those of you who missed it and are interested in seeing how we can extract cleartext credentials and bypass MFA directly from the official Microsoft login page, I just uploaded the recording to YouTube: youtu.be/z6GJqrkL0S0
15
144
5
529
53,507
I will be sharing more in-depth details and the tools/scripts I created to set up some of these attacks in a blog post very soon!
23
2,338
Keanu Nys retweeted
Wietze@Wietze12 Aug 2025
A special shoutout to the many 🇪🇺European cyber researchers presenting their work at #DEFCON, you were awesome. 🇳🇱@_dirkjan @John_Fokker 🇮🇹@Van1sh_BSidesIT 🇫🇷@christophetd @fr0gger_ @kalimer0x00 🇧🇪@RedByte1337 🇨🇿@marektoth 🇬🇧@_mattmuir @johnnyspandex @buffaloverflow +many others
3
5
33
7,657
Load more