HAIJA INTEL REPORT

The creator of Cobalt Strike left the industry in 2021, came back, and is now publishing everything he knows about evasion tradecraft openly and for free. Tradecraft Garden separates evasion tradecraft from capability. Crystal Palace is the linker that makes it work:

Today we updated our @arcanuminfosec Prompt Injection Taxonomy to 1.6!!! - Several new inputs and intents - MANY new techniques and evasions, a combined 70 node growth! - New tagging taxonomy - Legend for direct and indirect methods - Tagging for local-only attacks - “Aka”

CVSS 9.9 vulnerability. Treated as a two-request afterthought by the attacker. The 9.3 scored sibling? Four sustained attack waves and thousands of exploitations in the wild. CVSS score is not an exploitation rank. Sysdig TRT has the firsthand data. Full research:

New GhostWorks blog! @_xpn_ continues his series, exploring how LLMs are impacting how we approach endpoint security, from EDR analysis to evasion research. Read more

I'm currently working on reviving the OG social engineering technique for phishing attacks to be natively supported in Evilginx Pro. The Browser-in-the-Browser (BITB) technique (pioneered by @mrd0x ) is making a well-deserved comeback soon. - Displays a fake OS pop-up window

"From network traffic recorded during the second round of exploitation, we saw the ActiveMQ Server process downloading the malicious XML file containing the commands to be run in the command-line interface: " Report: https:// thedfirreport.com/2026/02/23/apa che-activemq-exploit-

What happens when network exposure data meets attack path analysis? @hdmoore joins #KnowYourAdversary to discuss RunZeroHound, BloodHound OpenGraph, and how defenders can uncover attack paths that traditional vulnerability management misses. https:// ghst.ly/4g9XtkB

When vulnerability discovery and exploit development can happen in under 10 hours, annual testing starts to look a little… dusty @davegerryjr and @thedavidbrumley discuss why security teams need to move toward continuous validation, red teaming, and active adversary

ATO with Open Redirect OAuth apps trust a registered redirect_uri to receive the authorization code after login. The problem: most servers only check that the value starts with the right domain, not that it matches exactly. That loose check is the whole bug. No injection, no