GitHub Trends
Project Radar
- Blue team toolsublime-security/sublime-rulesYAML · 368 stars
- Dual-use project0xDanielLopez/TweetFeedRepo · 671 stars
- Dual-use projectphishdestroy/destroylistHTML · 1,662 stars
Research DeskLatest update July 19, 202659 research entries
Independent Research Desk
Phishing Tradecraft · Infrastructure · Detection Engineering
PhishPond researches how modern phishing operations are built, run, and detected — campaign evolution, adversary infrastructure, phishing kits, OAuth and device-code abuse, AiTM frameworks, and the detection and validation workflows that catch them.
Recurring Intel
Attack-Side Tradecraft
Campaign tradecraft, lure mechanics, adversary infrastructure, identity pressure, and operator workflows worth modeling.
12 attack-side readsDetection Engineering
Detection engineering, telemetry analysis, reporting workflows, and validation that security teams can operationalize.
32 detection readsAPT Tradecraft
Emerging procedures, tooling, initial-access patterns, and cross-team tradecraft from real-world actor reporting.
15 tradecraft readsGitHub Trends
New Today
Lead Research
The authentication failures look fragmented by app, but the campaign becomes visible when defenders pivot on missing app names, error semantics, source behavior, and tenant-wide volume.
Two large Entra ID campaigns used hundreds of thousands to millions of fictional OAuth client IDs to spread account enumeration across apparent applications.
Live Collection
Fake verification steps train users into running attacker-provided instructions.
Read more:The Hacker News
A successful click delivers persistent remote access, not just credentials.
Read more:The Hacker News
Trusted suppliers and developer channels can carry phishing risk past normal filters.
Read more:BleepingComputer
Fake verification steps train users into running attacker-provided instructions.
Read more:BleepingComputer
Fake verification steps train users into running attacker-provided instructions.
Read more:The Hacker News
Sublime rules for email attack detection, prevention, and threat hunting. Primary language: YAML. 368 stars.
Open project:GitHub
#email-security#phishing#threat-hunting
TweetFeed collects Indicators of Compromise (IOCs) shared by the infosec community at Twitter. Here you will find malicious URLs, domains, IPs, and SHA256/MD5 hashes. 671 stars.
Open project:GitHub
#blueteam#malware#malware-detection#malware-research
Real-time phishing & scam domain blocklist — 200k+ curated threats, 888K+ community, free API, multiple formats Primary language: HTML. 1,662 stars.
Open project:GitHub
#anti-phishing#blacklist#blocklist#crypto-scam
🐟 PhishTank Blocklist for Pi-hole Primary language: Shell. 12 stars.
Open project:GitHub
#blocklist#hosts#phishing#pihole
Aggregation of lists of malicious domains (phishing) that can be integrated into FortiGate firewalls and other products. Primary language: DIGITAL Command Language. 110 stars.
Open project:GitHub
#blocklist#blocklists#domains-blacklist#domains-list
Coverage Map
Specific campaigns, actor activity, and the lures behind them.
How techniques work end-to-end — walkthroughs and operator workflows.
Adversary infrastructure: kits, AiTM, redirectors, and sending abuse.
Detection engineering, telemetry, validation, and response.
Longer research notes, measurement, and periodic briefs.
Search Tool
Search titles, authors, tags, and body text across the PhishPond research archive.
Field Analysis
Reverse-proxy phishing kits commoditized session-token theft over the last two years. The kit market now resembles SaaS, and that has implications for how defenders track operators.
Read more:Microsoft Threat IntelligenceSekoia
Field Analysis
A June 2026 wave of AWS console phishing sites relayed sign-in and MFA to the real AWS in real time, capturing session material from a curated list of engineers. AiTM has moved past Microsoft identity, and the detection has to move with it.
Read more:Datadog Security LabsNVISO Labs
Field Analysis
Phishing kits get the headlines, but the hosting underneath them is the durable asset. A May 2026 seizure of 800+ servers, resilient scanning networks, and the routine hop behind a CDN show why takedowns rarely stick and where the defensible signal actually lives.
Read more:CISA (with NSA, DC3, FBI, and international partners)ELLIO
Field Analysis
Analysis of roughly 3,000 live ClickFix payloads shows the clipboard command is now served by a backend that hands every visitor a freshly scrambled variant. The delivery moved server-side, and so did the detection problem.
Read more:The Hacker NewsSplunk Security Content
Field Analysis
A late-June 2026 intrusion pivoted from an email lure to an external Teams call posing as 'System Administrator,' drove the victim's desktop through Teams screen-control, and staged a Node.js-based EtherRAT that resolves its C2 from an Ethereum smart contract. The trusted channel is the tradecraft.
Read more:Unit 42 (Palo Alto Networks)GBHackers
Field Analysis
Proofpoint's UNK_MassTraction investigation shows how a low-volume email can execute in vulnerable Roundcube, steal the live session, and pivot into server compromise.
Read more:Proofpoint Threat ResearchNIST National Vulnerability Database
Field Analysis
Google's 2026 public-sector M-Trends brief says vishing reached 11 percent of global infections, sharpening the case for stronger help-desk recovery and device-enrollment controls.
Read more:Google CloudMicrosoft Security Blog
Field Analysis
A fake recruiter asking a candidate to review an MVP repo shows why unsolicited source code is not a document. It is an executable threat surface with access to developer secrets.
Field Analysis
Scammers abusing a real Microsoft account-alert sender are part of a wider pattern: attackers are turning legitimate SaaS notification workflows into authenticated phishing infrastructure.
Read more:TechCrunchAbnormal AI