Malek Badawi

Threat Research

Your Laptop, Someone Else's Exit Node: Hunting Trojanised Inno Setup Installers And Proxyware In Defender

Fake downloads install proxyware and compute agents with SYSTEM scheduled tasks. How the chain works, and Defender hunts for every stage.

8 min read Threat Research

A Shortcut That Runs ftp.exe: Hunting BITTER's PapRAT Chains (LNK, VHDX And WebDAV) In Defender

BITTER delivers PapRAT through ftp.exe shortcuts, VHDX disk images and WebDAV links. How each chain works, and Defender hunts for every step.

8 min read Threat Research

A Fake AI Coding Extension Planted An SSH Key: Hunting The svc-telemetry Backdoor On Windows, macOS And Linux

A trojanised AI coding extension added an attacker's SSH key, a reverse tunnel and a fake SysMon task. Removing it isn't enough. What to hunt and remove.

8 min read Threat Research

The Installer Is Genuine, The AI App Isn't: Hunting The Yoba Sideloading Chain On Windows

Fake AI desktop apps on GitHub pair a genuine signed installer with a malicious DLL. How the Yoba chain works, and Defender hunts for each step.

8 min read Threat Research

A Hidden Edge Window And An SSH Tunnel: Hunting APT28's Hookedge Backdoor In Defender

APT28 ran a backdoor through an off-screen Edge window, stole NTLM hashes and tunnelled out over Windows' own SSH client. How to hunt each step in Defender.

8 min read Threat Research

Your Firewall Config Knows Your AD Password: Hunting The k0t Edge-To-Domain-Admin Chain

k0t decrypted stolen firewall configs to get AD bind credentials, then went for Domain Admin. How the chain works and how to hunt it in Defender.

9 min read Threat Research

Starting Python Was Enough: Hunting The Poisoned AI Gateway Package And Its Startup Hooks

A hijacked AI gateway release ran a credential stealer every time Python started. How it worked, and how to hunt and contain it with Defender KQL.

9 min read Threat Research

No Affiliates, Just Your VPN: Hunting SafePay Ransomware (AA26-293A) In Microsoft Defender

A joint US, German and UK advisory says SafePay has hit 600+ organisations. Map its path from VPN to encryption, with Defender hunts for each step.

8 min read Threat Research

A Genuine Signed Installer, A Hostile Folder: Hunting The ROMULUS ClickFix Panel And CVE-2026-110936

A ClickFix delivery panel is planting malicious DLLs beside genuine signed software. How the chain works and how to hunt it with Defender KQL.

8 min read Fundamentals

What Is DLL Sideloading? How Attackers Hide Inside Signed Software

DLL sideloading gets a trusted, signed program to load an attacker's code. How it works, how it differs from DLL hijacking, and how to detect and stop it.

9 min read Threat Research

Ten Minutes On The Update Server: Hunting A Hijacked Software Updater On Windows Endpoints

An attacker hijacked a Windows tool's updates for minutes at a time, then cleaned up. How to hunt the backdoor it left on endpoints with Defender KQL.

8 min read Threat Research

Infostealers Have Found Your Developers' AI Tools: Hunting Aoki On Windows Endpoints

A new Aoki build steals AI coding tool tokens alongside cookies and cloud keys. What it takes, how to hunt it in Defender and what to rotate.

8 min read Threat Research

The New Starter Who Isn't: Spotting North Korean IT Workers On Your Endpoints And In Entra

The FBI says North Korean IT workers are widening their facilitator networks. The signals a SOC can see on endpoints and in Entra, with hunting queries.

8 min read Threat Research

Hunting For CVE-2025-59287 Exploitation In Windows Server Update Services (WSUS)

CVE-2025-59287 is a critical deserialisation flaw in WSUS. How exploitation looks in practice, and how to hunt for it with behavioural indicators rather than static signatures.

8 min read