Disclaimer: All research and opinions expressed here are my own and are independent of any employer or organisation.

post-exploitation

2 posts tagged with "post-exploitation"

GraphSpy in the Wild: Exposed Device Code Phishing Operation

Jun 5, 2026

Analysis of a device code phishing operation built on the open-source GraphSpy tool, extended with a custom phish page generator and Cloudflare tunnel infrastructure, found via an exposed open directory and unauthenticated operator panel.

Threat Intelligence Threat Hunting device-code phishing graphspy

Device Code Lab (DCL) — Deep Dive into a Device Code Phishing Toolkit

May 28, 2026

A deep dive into Device Code Lab, a professional grade, device code phishing platform, with numerous defense evasion and post-exploitation features.

Threat Intelligence Threat Hunting device-code phishing token-theft