GitHub Trends
Project Radar
- Blue team toolCriticalPathSecurity/Zeek-Intelligence-FeedsZeek · 406 stars
- Blue team tool0xDanielLopez/TweetFeedRepo · 694 stars
- Blue team toolPranith-Jain/dfir-threat-intel-platformTypeScript · 5 stars
Research DeskLatest Research: October 15, 2026News Feed Refresh: October 26, 2026Radar Refresh: October 26, 202664 research entries
Independent Research Desk
Phishing Tradecraft · Infrastructure · Detection Engineering
PhishPond researches how modern phishing operations are built, run, and detected — campaign evolution, adversary infrastructure, phishing kits, OAuth and device-code abuse, AiTM frameworks, and the detection and validation workflows that catch them.
Recurring Intel
Attack-Side Tradecraft
Campaign tradecraft, lure mechanics, adversary infrastructure, identity pressure, and operator workflows worth modeling.
12 attack-side readsDetection Engineering
Detection engineering, telemetry analysis, reporting workflows, and validation that security teams can operationalize.
34 detection readsAPT Tradecraft
Emerging procedures, tooling, initial-access patterns, and cross-team tradecraft from real-world actor reporting.
18 tradecraft readsGitHub Trends
New Today
Lead Research
Enrollment urgency is the oldest helpdesk pretext wearing a new word. The objective is still a session token, and the tell is still Graph.
Microsoft tracked Storm-3121 and Storm-3032 running passkey-themed helpdesk calls since May 2026. The passkey narrative is a pretext that routes victims into AiTM and device-code flows — and the detection lives in what happens after the token lands, not in the lure.
Read more:Microsoft Security BlogBleepingComputer
Live Collection
Read more:The Hacker News
Read more:The Hacker News
Read more:BleepingComputer
Read more:Microsoft Security Blog
Read more:Dark Reading
Zeek-Formatted Threat Intelligence Feeds Primary language: Zeek. 406 stars.
Open project:GitHub
#malware#phishing#threat-intelligence#threatintel
TweetFeed collects Indicators of Compromise (IOCs) shared by the infosec community at Twitter. Here you will find malicious URLs, domains, IPs, and SHA256/MD5 hashes. 694 stars.
Open project:GitHub
#blueteam#malware#malware-detection#malware-research
A 135+ tool DFIR toolkit, a live self-updating threat-intel platform, and a 332-tool MCP server — on one Cloudflare Workers deploy. MIT licensed. Portfolio: pranithjain.qzz.io Primary language: TypeScript. 5 stars.
Open project:GitHub
#blue-team#cloudflare-workers#cti#detection-engineering
Real-time phishing & scam domain blocklist - 205k+ curated threats, 1M+ community, free API, multiple formats Primary language: HTML. 2,091 stars.
Open project:GitHub
#anti-phishing#blacklist#blocklist#crypto-scam
x402 risk-check provider: signed pre-payment verdicts — OFAC, phishing feeds, transaction simulation, drainer-kit code, and our own EIP-7702 kit watch (poisoners, sweepers). $0.001 per check with prepaid credits; per call via x402 from $0.0035. Primary language: TypeScript. 12 stars.
Open project:GitHub
#ai-agents#attestation#base#cloudflare-workers
Coverage Map
Specific campaigns, actor activity, and the lures behind them.
How techniques work end-to-end — walkthroughs and operator workflows.
Adversary infrastructure: kits, AiTM, redirectors, and sending abuse.
Detection engineering, telemetry, validation, and response.
Longer research notes, measurement, and periodic briefs.
Search Tool
Search titles, authors, tags, and body text across the PhishPond research archive.
Showing 2 matching entries.Clear search
Field Analysis
Revised October 2026. Our April assessment held that passkey fallback and recovery workflows would become attacker targets. Six months of research confirmed it and added something we did not anticipate: attacks against synced passkey key material itself.
Field Analysis
Copy Fail, Dirty Frag, and ssh-keysign-pwn show why local Linux privilege escalation still belongs in phishing and infrastructure-defense planning.
Read more:CERT-EUDirty Frag