Publications
Security research and technical writing published across various platforms. Contributing to the broader security community.
Recent Publications
6 articlesDetecting Tycoon 2FA AiTM attacks across Entra ID and Google Workspace
Detection engineering for the Tycoon 2FA phishing-as-a-service platform, which uses adversary-in-the-middle techniques to steal MFA-protected sessions across Microsoft 365 and Google Workspace.
TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook
Analysis of a Brazilian banking trojan that spreads through trojanized Logitech installers and self-propagating worm modules, abusing WhatsApp and Outlook to target financial institutions.
Microsoft Entra ID OAuth Phishing and Detections
Exploring OAuth phishing and token-based abuse in Microsoft Entra ID through emulation and analysis of tokens, device behavior, and sign-in activity.
Bit ByBit - Emulation of the DPRK's Largest Cryptocurrency Heist
A high-fidelity emulation of the DPRK's largest cryptocurrency heist via a compromised macOS developer and AWS pivots.
AWS SNS Abuse: Data Exfiltration and Phishing
Developed detection capabilities by investigating publicly known SNS abuse attempts for data exfiltration and phishing operations.
Emulating AWS S3 SSE-C Ransom for Threat Detection
Explores how threat actors leverage Amazon S3's Server-Side Encryption with Customer-Provided Keys for ransom and extortion operations.
Full Archive
Browse the complete collection of 15 publications, including older research and external contributions.
View Archive