Detecting Malicious Traffic That Was Allowed Through The Firewall
22 July 2026by Detection Engineering Team
Learn how to detect malicious traffic allowed through your firewall despite being flagged, using Fortinet logs and Sentinel KQL.
Wizard Cyber Blogs
Technique Profile: Cross-tenant Helpdesk Impersonation Leading To Data Exfiltration
21 July 2026by Threat Hunting Team
Learn how attackers abuse Microsoft Teams helpdesk impersonation to gain access, move laterally, and steal sensitive data.
CopyFail, Dirty Frag, And Fragnesia: Linux Page Cache Corruption Vulnerabilities Enabling LPE
15 July 2026by Cyber Shield Intelligence (CSI) Team
CopyFail, Dirty Frag, and Fragnesia are Linux kernel flaws enabling local root escalation via page cache corruption. Patch now.
How We Tracked The Dohdoor Backdoor’s Encrypted C2 Channel Using DNS-over-HTTPS Behavioral Analysis
1 July 2026by Threat Hunting Team
Learn how Wizard Cyber detected the Dohdoor backdoor by identifying DNS-over-HTTPS C2 traffic and KQL threat hunting.
Why Claude AI Is Being Abused In Modern Attack Campaigns
19 May 2026by Cyber Shield Intelligence (CSI) Team
Learn how attackers abuse Claude AI through fake installers, ads, and ClickFix lures to steal credentials and deploy malware.
Detecting Boot-Level Persistence In Windows: BCD Abuse And Startup Manipulation
19 May 2026by Detection Engineering Team
Learn how to detect boot-level persistence in Windows by identifying BCD abuse, bcdedit misuse, and early startup manipulation.
Cybercrime Actors Exploit VPN Trust Through SEO Poisoning To Steal Enterprise Credentials
13 May 2026by Cyber Shield Intelligence (CSI) Team
Threat actors exploit SEO poisoning to distribute fake VPN installers, steal credentials, and gain silent access to enterprises.
Learn how ClickFix and HijackLoader deliver DeerStealer via user execution, MSI abuse, and DLL sideloading on Windows.
When One Command Line Tells The Whole Attack: Detecting Amos Malware On MacOS
6 May 2026by Detection Engineering Team
Learn how Amos macOS malware can be detected through high-signal command-line behavior and native tool abuse.
Phishing Campaign Uses Fake Software Updates To Install Remote Access Tools
5 May 2026by Cyber Shield Intelligence (CSI) Team
Phishing campaigns use fake software updates and signed installers to deploy RMM tools, enabling persistent remote access.
From Fake Errors To DNS Payloads: The Rapid Rise Of ClickFix-Style Attacks
27 April 2026by Cyber Shield Intelligence (CSI) Team
Explore the rise of ClickFix-style attacks, from fake error prompts to DNS-staged payloads and token theft techniques.
Learn how the Crystal PDF malicious installer campaign used ads and SEO poisoning to steal browser credentials and sessions.
Copyright by Wizard Cyber. All rights reserved.
Copyright by Wizard Cyber. All rights reserved.WIZARD CYBERHeadquarters
Providing enterprises with bespoke & powerful managed solutions to protect against all forms of cybercrimeOUR LOCATIONSWhere to find us?
WIZARD CYBERHeadquarters
Providing enterprises with bespoke & powerful managed solutions to protect against all forms of cybercrimeOUR LOCATIONSWhere to find us?
GET IN TOUCHLatest Updates
Stay up to date with the latest news from Wizard Cyber and the cybersecurity industry
