Research Archive

Sample Analysis

Browse entries by research type, time, topic, and threat domain. This page behaves more like an archive than a feed.

2026

Over a near-black teal-blue background, a captured git bundle unpacks within intercepted network traffic as plaintext credentials and cryptographic material spill out intact and ungoverned by any redaction filter; the foreground shows a clean developer-tool facade concealing a background upload conduit dispatching the entire repository ahead of the model's inference call; the midground features a parallel conduit bypassing a security filter with raw sensitive data flowing unchecked through the ungoverned channel — copper-orange accents punctuate the scene, symbolizing the Grok CLI whole-repo upload reverse analysis
Security Research

Grok CLI Whole-Repo Upload Reverse Analysis: How a Single Prompt Ships Your .env to the Cloud

Triple cross-verified with IDA Pro, Frida, and mitmproxy, this post reproduces Grok CLI v0.2.98 uploading the entire codebase (including .env, RSA private keys, and other common dev-time secrets) verbatim and unredacted to xAI cloud storage via git bundle at the start of each turn. Compared against v0.2.93, the upload mechanism is identical across both versions, respect_gitignore defaults to false, and one of the 8 independent switches allows remote override.

2026-07-15 10 min #Sample Analysis
A copper-orange Telegram paper plane badge being replicated onto a dark glass panel against a near-black teal-blue dossier background, symbolizing local session replication bypassing authentication
Security Research

Telegram Desktop Local Session Reuse: a Reproduction That Should Not Have Happened

A macOS stealer can copy Telegram Desktop's tdata directory and Telegram for macOS's local session files to another machine, restoring the logged-in state without triggering phone verification, SMS codes, or 2FA. An honest account of the discovery and the cognitive shift from 'this shouldn't happen' to 'but it does.'

2026-07-15 10 min #Malware

2025

Over a near-black teal-blue background, a GitHub repo crowned with inflated Stars and Forks, a hijacked npm dependency URL in package-lock.json rerouting to a rogue package, and copper-orange exfiltration arrows flowing toward a C2 server — symbolizing the Solana trading bot supply chain attack on GitHub
Security Research

A Popular Solana Bot on GitHub Was a Wallet Thief: Supply Chain Attack Analysis

A malicious GitHub project disguised as a Solana trading bot lured developers with inflated Star and Fork counts, then exfiltrated wallet private keys by hijacking an npm dependency's download URL in package-lock.json. Full attack chain from discovery to deobfuscation and C2 exfiltration, spanning 29 malicious repos and 2 rogue npm packages.

2025-07-03 6 min #Supply Chain Attack
Over a near-black teal-blue background, a malicious extension icon highlighted copper-orange in a browser extension store, terminal drag-and-drop execution and Base64-decoding code fragments scattered across the backdrop, AppleScript hidden execution paths and data-exfiltration channel arrows — symbolizing the Osiris malicious browser extension download-link hijacking attack
Security Research

Osiris Malicious Browser Extension Analysis: Download Link Hijacking Disguised as a Security Tool

In May 2025, a malicious browser extension named Osiris disguised itself as a Web3 security tool and hijacked users' download links via the declarativeNetRequest API, replacing legitimate programs with malicious ones. The attackers leveraged macOS AppleScript and base64 encoding to conceal their malicious behavior, stealing Chrome browser data and Keychain information.

2025-05-28 5 min #Web3 Security
Over a near-black teal-blue background, a LinkedIn recruitment message dialog beside a malicious npm package structure diagram, an arrow tracing the encrypted payload exfiltrated via a C2 channel to a dark server, a developer terminal showing installation complete while keys leak in the backdrop — symbolizing the LinkedIn recruitment phishing attack targeting blockchain engineers
Security Research

LinkedIn Recruitment Phishing Analysis: A Targeted Attack Against Blockchain Engineers

In March 2025, attackers posed as recruiters on LinkedIn targeting blockchain engineers, sending them Bitbucket repositories containing malicious code. The malicious payload was hidden on line 46 of server.js behind an extremely long horizontal scrollbar, encrypted through multiple layers of base64, and ultimately connected to a C2 server to download an info-stealing trojan and a persistence backdoor.

2025-03-15 6 min #Web3 Security

2022

Over a near-black teal-blue background, a mobile wallet app icon leaks mnemonic phrase data streams outward, the Sentry server receiving endpoint highlighted, multiple nodes in the blockchain network topology lit in copper-orange and red — symbolizing the Solana mass theft triggered by Slope Wallet Sentry leaking mnemonic phrases
Security Research

Solana Blockchain Mass Theft Analysis: Slope Wallet Sentry Leaks Mnemonic Phrases

On August 3, 2022, a large-scale theft occurred on the Solana blockchain. Slow Mist Security Team analysis found that Slope Wallet Android >= 2.2.0 sent user mnemonic phrases and private keys to the o7e.slope.finance server via Sentry services, causing the mnemonic phrases of approximately 30% of victim addresses to be leaked.

2022-08-04 4 min #Web3 Security