GitHub Trends
Project Radar
- Blue team tool0xDanielLopez/TweetFeedRepo · 694 stars
- Blue team toolphishdestroy/destroylistHTML · 2,092 stars
- Blue team toolsjhgvr/oisdRepo · 272 stars
Research DeskLatest Research: October 15, 2026News Feed Refresh: October 26, 2026Radar Refresh: October 26, 202664 research entries
Independent Research Desk
Phishing Tradecraft · Infrastructure · Detection Engineering
PhishPond researches how modern phishing operations are built, run, and detected — campaign evolution, adversary infrastructure, phishing kits, OAuth and device-code abuse, AiTM frameworks, and the detection and validation workflows that catch them.
Recurring Intel
Attack-Side Tradecraft
Campaign tradecraft, lure mechanics, adversary infrastructure, identity pressure, and operator workflows worth modeling.
12 attack-side readsDetection Engineering
Detection engineering, telemetry analysis, reporting workflows, and validation that security teams can operationalize.
34 detection readsAPT Tradecraft
Emerging procedures, tooling, initial-access patterns, and cross-team tradecraft from real-world actor reporting.
18 tradecraft readsGitHub Trends
Lead Research
Enrollment urgency is the oldest helpdesk pretext wearing a new word. The objective is still a session token, and the tell is still Graph.
Microsoft tracked Storm-3121 and Storm-3032 running passkey-themed helpdesk calls since May 2026. The passkey narrative is a pretext that routes victims into AiTM and device-code flows — and the detection lives in what happens after the token lands, not in the lure.
Read more:Microsoft Security BlogBleepingComputer
Live Collection
Read more:BleepingComputer
Read more:Microsoft Security Blog
Read more:Dark Reading
Read more:Malwarebytes Labs
Read more:BleepingComputer
TweetFeed collects Indicators of Compromise (IOCs) shared by the infosec community at Twitter. Here you will find malicious URLs, domains, IPs, and SHA256/MD5 hashes. 694 stars.
Open project:GitHub
#blueteam#malware#malware-detection#malware-research
Real-time phishing & scam domain blocklist - 205k+ curated threats, 1M+ community, free API, multiple formats Primary language: HTML. 2,092 stars.
Open project:GitHub
#anti-phishing#blacklist#blocklist#crypto-scam
oisd blocklist 272 stars.
Open project:GitHub
#adblocking#adblocking-dns#adblocking-list#adblocklist
🐟 PhishTank Blocklist for Pi-hole Primary language: Shell. 13 stars.
Open project:GitHub
#blocklist#hosts#phishing#pihole
Zeek-Formatted Threat Intelligence Feeds Primary language: Zeek. 405 stars.
Open project:GitHub
#malware#phishing#threat-intelligence#threatintel
Coverage Map
Specific campaigns, actor activity, and the lures behind them.
How techniques work end-to-end — walkthroughs and operator workflows.
Adversary infrastructure: kits, AiTM, redirectors, and sending abuse.
Detection engineering, telemetry, validation, and response.
Longer research notes, measurement, and periodic briefs.
Search Tool
Search titles, authors, tags, and body text across the PhishPond research archive.
Showing 51 matching entries.Clear search
Showing defense-pattern and dual-use coverage. Clear team filter
Field Analysis
AvisLoader shows why taking down a lure does not establish that a compromised endpoint has lost its control channel. Examine Tox-based communications, ToxNetV2 as a separate Radar companion, and assessment objectives for detection, privacy, and containment.
Read more:Varonis Threat LabsTox
Field Analysis
The Windows Run box truncates at roughly 260 characters, and that limit has shaped ClickFix tradecraft since it appeared. Three developments this quarter — browser cache smuggling, Google Sheets C2, and blockchain-hosted payloads — are all solutions to the same constraint.
Read more:Cisco Talos IntelligenceThe Hacker News
Field Analysis
Microsoft documented a July 2026 campaign dropping MSP360 RMM v2.5.0.67 as the initial agent and ConnectWise ScreenConnect as a second channel. ANY.RUN tracked the wider operation across 46 countries, with 94% of its kit URLs alive for a single day.
Read more:Microsoft Security BlogThe Hacker News
Field Analysis
Microsoft's DCU disrupted EvilTokens on September 22, 2026 — a $1,500 device-code phishing platform tied to 12,000 compromised inboxes across 10,000 organisations. The operator is gone. The flow it abused is unchanged, and the serverless infrastructure pattern is the part that outlives the brand.
Read more:Microsoft Security BlogThe Hacker News
Field Analysis
Revised October 2026. Our April assessment held that passkey fallback and recovery workflows would become attacker targets. Six months of research confirmed it and added something we did not anticipate: attacks against synced passkey key material itself.
Field Analysis
A June 2026 wave of AWS console phishing sites relayed sign-in and MFA to the real AWS in real time, capturing session material from a curated list of engineers. AiTM has moved past Microsoft identity, and the detection has to move with it.
Read more:Datadog Security LabsNVISO Labs
Field Analysis
Phishing kits get the headlines, but the hosting underneath them is the durable asset. A May 2026 seizure of 800+ servers, resilient scanning networks, and the routine hop behind a CDN show why takedowns rarely stick and where the defensible signal actually lives.
Read more:CISA (with NSA, DC3, FBI, and international partners)ELLIO
Field Analysis
Analysis of roughly 3,000 live ClickFix payloads shows the clipboard command is now served by a backend that hands every visitor a freshly scrambled variant. The delivery moved server-side, and so did the detection problem.
Read more:The Hacker NewsSplunk Security Content
Field Analysis
A late-June 2026 intrusion pivoted from an email lure to an external Teams call posing as 'System Administrator,' drove the victim's desktop through Teams screen-control, and staged a Node.js-based EtherRAT that resolves its C2 from an Ethereum smart contract. The trusted channel is the tradecraft.
Read more:Unit 42 (Palo Alto Networks)GBHackers