HAIJA INTEL REPORT

Is your office printer secretly putting your network at risk? Amy and Martin Lee chat through 2025 phishing and APT trends to expose how threat actors are blending high-tech exploits with everyday business workflows to …

A compromised AI tool became an attack path into enterprise identity. @jaredcatkinson breaks down the lesson from the recent Vercel breach: AI tools are non-human identities w/ delegated access. If compromised, attackers inherit it. Read more

Me trying to figure out Agent Identities in Entra ID. I really wonder who decided apps and service principals weren't already difficult enough to understand and went with a design that is even wayyy more complicated .

#SEOPoisoning seen delivering #LummaStealer via fake YubiKey pages. The attack chain utilizes DLL sideloading and PowerShell-based defense evasion to deploy a heavily obfuscated AutoIt loader, which ultimately injects Lumma Stealer directly into memory: https:// bit.ly/4u5e8tp

Ok fck it. You want really easy windows LPEs, right? I will show you how to do it. It is super simple. Windows is a broken piece of sh*t bc msft leadership is incompetent and toxic. I begin a new blog series starting tomorrow. I will show some novel techniques never seen before.

A forum I visited had a CSRF bug and someone made a viral CSRF exploit that would post itself from victims account Devs fixed it, but posts with exploit still kept popping up. WTF? Turned out users decided it will be fun to just repost the exploit manually to mess with the devs I

AI has gotten way better at finding and exploiting vulnerabilities. Claude Mythos Preview shows the gap between discovery and exploitation is shrinking fast. So what's that mean for your organization?

Centralizing vulnerability triage is difficult at current volumes. The NIST CVE framework update confirms that priority should come from how a threat functions in practice, not just database notes. Bugcrowd’s @treyford notes that future programs will rely on continuous