On the Hunt

Deep dive into malware analysis, threat hunting, blue team defense strategies, and red team techniques

Recent Posts

DPRK's Contagious Interview Meets ErrTraffic

Oct 29, 2026

DPRK's Contagious Interview campaign appears to have started buying ClickFix traffic from ErrTraffic, a kit sold as a service, alongside its fake recruiter and fake interview lures. Every route delivers a portable Node.js loader that resolves its C2 from Polygon smart contracts labelled team1 to team10, plus a second npm.zip RAT kit with a hardcoded C2.

Threat Intelligence Malware Analysis

From Win+X to EdgeUpdate - Unpacking a jsDelivr Hosted ClickFix Loader

Oct 19, 2026

Analysis of a ClickFix campaign across compromised WordPress sites that pulls its first stage from GitHub via jsDelivr, decodes a 6 MB XOR'd PowerShell loader, and Early Bird injects shellcode into MicrosoftEdgeUpdate.exe to reflectively load an undetected PE masquerading as Realtek HD Audio Manager.

Threat Intelligence Malware Analysis

Device Code Lab - Infrastructure Expansion & New Capability Analysis

Jun 10, 2026

Continued tracking of Device Code Lab (DCL) PhaaS infrastructure reveals expansion. Unauthenticated access to multiple exposed tool modules reveals an inbox listener, email extractor, SMTP lure sender, and an SVG attachment generator with MDE bypass capability.

Threat Intelligence Threat Hunting

GraphSpy in the Wild: Exposed Device Code Phishing Operation

Jun 5, 2026

Analysis of a device code phishing operation built on the open-source GraphSpy tool, extended with a custom phish page generator and Cloudflare tunnel infrastructure, found via an exposed open directory and unauthenticated operator panel.

Threat Intelligence Threat Hunting

Device Code Lab (DCL) - Deep Dive into a Device Code Phishing Toolkit

May 28, 2026

A deep dive into Device Code Lab, a professional grade, device code phishing platform, with numerous defense evasion and post-exploitation features.

Threat Intelligence Threat Hunting