threat research @_CPResearch_ views are my own.
Vienna
Joined January 2022
- Tweets1.2K
- Following1K
- Followers7.3K
- Likes7.1K
Catch me at Virus Bulletin in Sevilla on Oct 14th for my talk "Spec-Driven Malware: Turning Markdown into Threats".
I will be talking about spec-driven malware development from a researcher/hunter perspective and also yap a bit about agentic reverse engineering. Come say hi :3
Heads up: This bot is sending DMs to infosec/AI people pretending to be from @Bloomberg . I followed through in hopes of some cool malware, but the lure is just a calendly link which redirects you to x[.]login-api[.]com to phish your credentials.
deepseek harness + halogen-flash-server running qwen3.8-flash-next + a strix halo pc was all I needed to get rid of my subscriptions for these awful companies. 40-60 t/s is more than enough for me. Feels good (γ
Β΄ Λ `)
I was wondering how services serving "unlimited tokens" for models like Opus or GPT (or even Fable) work exactly. Obv they do not really serve these models, so I investigated a bit on openlimits[.]app.
tldr; they just serve minimax-m3 w/ a bad prompt guard, as the models admit:
They also have some sort of prompt injection guard which replaces some tokens in the output with "I am MODEL by VENDOR", but that does not really do anything Β―\(γ)/Β―
I was thinking about how to hunt/detect prompt malware & once I started treating it like a compiler problem, the answer was clear.
NLIR is a PoC IR for natural language, which enables one to hunt over prompts with a yara like rule syntax. See my blog: eversinc33.com/hunting-prompβ¦
Any thoughts and feedback about the idea are appreciated.
Repository: github.com/eversinc33/NLIR
eversinc33 π€πͺ retweeted
A year ago I wanted a powerful home server so I could use all my Windows VMs on Mac. It however, needed to be portable. So here is the overview of my portable server that has it's own private WIFI network attached!
felixm.pw/blog/ultimate_portβ¦
A handy .NET reverse engineering trick:
Add a sample.exe.config file next to your sample and you can trace e.g. all network requests, including content and headers without hooking or bothering with proxies. Helpful to e.g. quickly inspect c2 traffic:
gist.github.com/eversinc33/cβ¦
Theres some genuinely cool tradecraft in this implant
π¨ We are following up with additional observations of the TA488βs use of βhalf-clickβ exploits.
The group has initiated a new wave of exploitation abusing a cross-site scripting (XSS) vulnerability, CVE-2026-42897, in Outlook Web Access (OWA).
New blog: proofpoint.com/us/blog/threaβ¦
Great post. If you are at Virus Bulletin, I will be giving a talk aboit this exact topic, how we see threat actors use disposable tooling and what it implies for malware analysts ;)
First blog post in a mini series where I look at "disposable tooling". This post shares what I have found to be useful when 1-shot'ing LLM generated Stage-0 agents for Mythic. specterops.io/blog/2026/06/2β¦
Really enjoying the FIRST Con @FIRSTdotOrg CTF - been a while since I reversed a gameboy binary! :3
