Threat Intelligence

4 posts tagged with "Threat Intelligence"

Device Code Lab - Infrastructure Expansion & New Capability Analysis

Jun 10, 2026

Continued tracking of Device Code Lab (DCL) PhaaS infrastructure reveals expansion. Unauthenticated access to multiple exposed tool modules reveals an inbox listener, email extractor, SMTP lure sender, and an SVG attachment generator with MDE bypass capability.

Threat Intelligence Threat Hunting device-code phishing token-theft

GraphSpy in the Wild: Exposed Device Code Phishing Operation

Jun 5, 2026

Analysis of a device code phishing operation built on the open-source GraphSpy tool, extended with a custom phish page generator and Cloudflare tunnel infrastructure, found via an exposed open directory and unauthenticated operator panel.

Threat Intelligence Threat Hunting device-code phishing graphspy

Device Code Lab (DCL) - Deep Dive into a Device Code Phishing Toolkit

May 28, 2026

A deep dive into Device Code Lab, a professional grade, device code phishing platform, with numerous defense evasion and post-exploitation features.

Threat Intelligence Threat Hunting device-code phishing token-theft

Novel Evilginx Frontend - Lowering the barrier for token theft reuse

May 15, 2026

Uncovering an undocumented Microsoft 365 account takeover panel using Evilginx API integration for easy token reuse and account compromise.

Threat Intelligence Threat Hunting threat-intelligence microsoft-365 evilginx