Threat reports
Investigations from the CORD toolchain: what a campaign does, the infrastructure behind it, indicators to block, detection rules, and how to recover if you were hit.
Hijacked gaming accounts push a Steam gift-card QR phish, fake Steam apps and a MrBeast crypto-casino scam
Hijacked Steam and Discord accounts are sending lure images to their contacts. Behind them sit a Russian-speaking phishing-as-a-service platform that runs fake Steam credential-relay apps, spread through fake game cheats, and a separate disposable crypto-casino farm. Full infrastructure, malware analysis, indicators, detection and recovery steps.
PHP2Shell and potassium: four RCE paths, the DDoS bot pushed through them, and the operator behind it
Three PHP session CVEs yield four demonstrated remote-code-execution paths. This is the full analysis: the attack chains, the detection matrix built against real crashing traffic, the encrypted Mirai-derived bot pushed through within hours, and the operator, down to decoy DNS, an Ethereum C2 fallback and a money trail to named exchanges.