COFFSec·4d agoCase Study of the Binance Cyber Incident on 29 October 2026: A Signing-Path Compromise and an…How one laptop became a signing request, and how 50 pre-signed EIP-7702 authorizations turned a Binance hot wallet into a sweeper. A…
COFFSec·Nov 2Top 10 Malware File Extensions Every Blue Teamer Must KnowDetection engineering is extension-aware: ten file-extension families account for over 95% of email-and-web-driven malware delivery in…
COFFSec·Oct 23PHP2Shell (CVE-2026–109618 and CVE-2026–109619): A Deep Technical WalkthroughA source-backed, step-by-step explanation of PHP2Shell: follow HTTP input into Zend, understand unfinished entries and expired references…
COFFSec·Oct 19A technical analysis of AnyPwn: Pre-Authentication Root RCE in AnyDesk LinuxA technical analysis of AnyPwn(CVE-2026–109390): how an unvalidated packet length in AnyDesk became a pre-authentication, zero-click RCE.
COFFSec·Oct 310 Windows Event Logs Every Defender Must MonitorThis post covers the ten most critical Windows Event ID categories what they capture, how to enable them, what malicious patterns look…
COFFSec·Sep 2910 Most Common C2 Protocols Every Red Teamer Must KnowA deep technical walkthrough of the ten command and control protocols red teamers use most.
COFFSec·Sep 20Blinding an EDR With Windows Filtering Platform (WFP)Register one persistent kernel callout at the WFP connect layer, that BLOCKs outbound traffic from EDR processes. The agent remains alive…
COFFSec·Sep 11Physical Pentest Access Cards: A Deep Technical Walkthrough of RFID and NFC Credential CloningA step by step technical walkthrough of access card cloning for physical penetration testing, from LF 125 kHz HID Prox and EM410x, to…
COFFSec·Sep 7How Threat Actors Use MP3 Audio Steganography for Data ExfiltrationA deep technical research walkthrough on how attackers use MP3 audio files to secretly steal data from compromised systems.
COFFSec·Sep 1ArrayRef Supply Chain Attack: How a Compromised Rust Crate Delivered Malware at Build TimeA technical walkthrough of the August 20 2026 Rust supply chain attack on the arrayref crate (244 million all time downloads).
