Device Code Lab - Infrastructure Expansion & New Capability Analysis 2026-06-10 80 Paul Newton True GraphSpy in the Wild: Exposed Device Code Phishing Operation 2026-06-05 70 Paul Newton True Device Code Lab (DCL) — Deep Dive into a Device Code Phishing Toolkit 2026-05-28 80 Paul Newton True Novel Evilginx Frontend - Lowering the barrier for token theft reuse 2026-05-15 80 Paul Newton True Hunting New C2 Frameworks - Part 2 - Nexus C2, Shipped with Creds 2026-05-10 72 Paul Newton True Hunting New C2 Frameworks 2026-05-05 75 Paul Newton True Device Code Phishing Campaign — Infrastructure Update 2026-03-18 72 Paul Newton True Uncovering a New Device Code Phishing Campaign 2026-03-10 70 Paul Newton True Hunting Malicious NPM Packages with AI 2026-03-06 85 Paul Newton True ConsentFix: A New way to Phish for Tokens 2025-12-17 65 Paul Newton True Microsoft Entra Token Theft - Part One: Offline Access and Conditional Access 2025-12-12 70 Paul Newton True Detecting Abuse of VSCode Remote Tunnels 2025-01-16 70 Paul Newton True Microsoft Dev Tunnels: Tunnelling C2 and More 2024-11-13 70 Paul Newton True SVCHost.exe and Internet Sharing Triage 2023-10-25 45 Paul Newton True Virtual Machine Aware Phishing Sites 2021-08-03 50 Paul Newton True A Guide to Threat Hunting in a SOC 2021-06-28 45 Paul Newton True Cobalt Strike - Bypassing C2 Network Detections 2021-03-03 65 Paul Newton True Malware Analysis: Memory Forensics with Volatility 3 2020-11-10 70 Paul Newton True Analysing Fileless Malware: Cobalt Strike Beacon 2020-07-22 70 Paul Newton True 
