All posts by John Doe

🎚 The Mosad Playbook: How One Alias Built a Cross-Platform Leak Network. https://stealthmole-intelligence-hub.blogspot.com/2026/07/the-mosad-playbook-how-one-alias-built.html

■■■■■ EvilTokens phishing can look clean during URL checks. The real page stays encrypted until it opens in the victim’s browser, then uses Microsoft device-code phishing to push toward Microsoft 365 account takeover. The blind spot is browser visibility, not just email scanning. https://thehackernews.com/2026/07/new-ghost-phishing-wave-is-breaking.html

■■■□□ 🇮🇷 Cavern Manticore: Exposing Iran-Linked Modular C2 Framework CP reveals: 🎯 Israeli Gov & IT sector targeted 🧩 Novel modular “Cavern” C2 framework, 3 .NET formats 🕵️ Iran-nexus; MOIS ties to MuddyWater & Lyceum 👻 Most samples: zero VT hits https://research.checkpoint.com/2026/cavern-manticore-exposing-iran-linked-modular-c2-framework/

■■■■□ ⚪️⚪️⚪️🔺🔺⚪️ ⚪️⚪️🔺⚪️🔺⚪️🔺 Exploit for Exynos devices to gain ACE in BootROM context. A length parameter left unchecked in the USB Control Request code allows iRAM to be dumped, modified and resent to the device, allowing for code execution. https://github.com/halal-beef/houston-pub

■■□□□ Why DMARC’s new “NP” tag can fail with DNSSEC. https://dmarcwise.io/blog/dmarc-np-incompatibility-with-dnssec

■■■■■ ☁️ ☁️ Floci – A Fast, Free & Open-Source AWS Local Emulator Floci is an open-source AWS emulator that lets developers run AWS services locally without an AWS account, authentication tokens, or feature restrictions. Designed as a lightweight alternative to LocalStack Community, it supports 68+ AWS services with real Docker-backed execution for higher fidelity.…

■■■■□ Exploring cross-domain & cross-forest RBCD: part 2 https://www.synacktiv.com/en/publications/exploring-cross-domain-cross-forest-rbcd-part-2

FROST side channel correlation attack.

■■■□□ Disinformation: Subtle but effective. https://www.linkedin.com/posts/tim-de-zitter_small-lie-but-still-useful-as-a-case-study-share-7476891210545192960-kCdo/

■■■■■ A new Linux kernel exploit (CVE-2026-46331) gets root without modifying a single file on disk. It poisons the cached copy of /bin/su in memory. The binary on disk stays untouched. File-integrity checks come back clean. The root shell is already open. https://thehackernews.com/2026/06/new-linux-pedit-cow-exploit-enables.html