Blog Posts
Thoughts, tutorials, and insights about technology and development.
How I reverse-engineered the Spanish Royal Academy's Android app and found an API used by dozens of projects, with hardcoded credentials that have been public for years.
An in-depth teardown of a postal phishing campaign targeting Ledger hardware wallet users with fake 'Quantum Resistance' upgrades, QR redirection chains, Cloudflare geo-fencing, and seed phrase exfiltration.
Light Yagami runs a worldwide killing operation with a weapon that leaves no trace, and he still gets caught. His failures are the same ones most people make with their phone, their routine, their devices and the people they trust. Eight OPSEC mistakes, and the lessons for everyday life.
This analysis documents a sophisticated multi-stage phishing campaign targeting cryptocurrency wallet users. The attack chain spans from email delivery through credential exfiltration, incorporating TDS (Traffic Direction System) cloaking, BIP39 cryptographic validation, and social engineering across five sequential stages.
This blog post explores a fake tech interview scam that infects victims' machines through a malicious GitHub repository. The infection occurs via Visual Studio Code's `.vscode` folder and a legitimate-looking Express app, allowing attackers to execute arbitrary code and steal sensitive information.
Notes on an active crypto phishing campaign impersonating Ledger — a verified Google advertiser buying "ledger" ads pointing at a typosquat that walks you through a fake firmware update and harvests your recovery phrase.
I discovered a non documented anti-censorship feature in WhatsApp that allows users to bypass censorship in certain countries.
Full technical breakdown of an active Phishing-as-a-Service kit targeting Colombian banking customers. The kit impersonates logistics company TCC, runs a real-time card keylogger via an obfuscated runtime, routes victims by BIN prefix, and exfiltrates data through postMessage to a Chinese-built multi-tenant C2 platform at tcc-ayv.cc.
Your terminal is where you live as a dev. This guide turns that bland default setup into something you'll actually want to open — autocompletion, syntax highlighting, a clean prompt, and pro tools included.
A deep dive into a malware sample hiding inside a fake PDF — emoji-obfuscated batch scripts, C2 communication, and payloads embedded in JPEGs using steganography.