Crimson7 Blog
Research & Insights
Adversary analysis, detection engineering and threat hunting from the Crimson7 team.
secure development
Our Coding Agents Thought They Knew Security. Here's How We Fixed That
Teaching AI coding agents to stop answering from memory by making authoritative security guidance part of planning, implementation and review.
attack chains
Assume They're Already In
A leak of mostly metadata at a Belgian e-signature supplier, and municipalities now warn residents about phishing. Initial access can be made harder, never impossible. What decides the outcome is whether your SOC sees each step of the attack chain that follows.
offensive security
We Were the Queue: An AI Agent Team at BruCON
Around 50 AI agents, one shared channel and 942 messages. Our BruCON CTF team finished second. The harder lesson was learning how to keep the agents out of each other's way.
Latest articles19
threat intelligence
Forked and Weaponized: How Criminals Get Their Own Claude Code
A fraud operator took a legitimate open-source AI coding agent, stripped its safety, bolted on jailbreak prompts and a fraud toolkit, and started selling subscriptions. We traced the full pipeline.
detection engineering
Five Questions to Ask Your Security Team About Your Detections
The board report says the controls are in place. It rarely says when anyone last proved they fire. Five questions a CISO or CTO can ask at the next security review, and what a good answer sounds like.
threat intelligence
Your Browser Already Downloaded the Malware. You Just Haven't Run It Yet.
Browser Cache Smuggling combined with ClickFix turns the browser's disk cache into a payload stash: the browser delivers the malware silently, while the command that executes it downloads nothing.
events
Both Cybersec Netherlands Talks, Now on Video
We ran two sessions at Cybersec Netherlands in Utrecht on 9 and 10 September, one on the attack side and one on the defence side. Both recordings are now online, 27 and 24 minutes, with live product demos rather than slideware.
threat intelligence
The Revolut Breach: Infrastructure, Actors, and the Compliance Gap
Revolut handed passport scans, KYC selfies and full transaction histories to a fraudulent emergency data request sent from a real, compromised law enforcement mailbox. Two actors claim the breach, both leak domains are now on registry hold, and a darknet Revolut account shop refreshed its stock the same week. We trace the infrastructure, the actors, and the technique.
threat intelligence
Ph1shy v2.0.0: The Forum Post Said "Phishing Panel." The Source Code Said Otherwise.
How static analysis of a cloned Next.js frontend uncovered a full-spectrum criminal operations platform hiding behind a five-feature forum advertisement.
threat intelligence
EtherHiding: When Malware Hides Its C2 on the Blockchain
Threat actors are storing C2 domains inside Ethereum smart contracts. The contract address is stable, the retrieval is anonymous, and there is no registrar or hosting provider to send a takedown request to. We observed the technique live in the Shai-Hulud supply chain campaign, deployed our own proof of concept on Sepolia, and decoded the active C2 domain straight off mainnet.
threat intelligence
Shai-Hulud's Ethereum C2: Inside a Blockchain-Backed npm Supply-Chain Attack
How keyv@6.0.0 uses EtherHiding to resolve its C2 domains from an Ethereum smart contract at runtime, and what the major threat intel platforms are missing. We reproduced the malware's eth_call, recovered the active C2 domain and its full 72-day rotation history, traced the operator's wallet to a FixedFloat exchange, and decrypted 294 obfuscated strings offline. At publication the active C2 is live and absent from the public feeds we checked.
threat intelligence
Browsing Outlook As You: Inside an Unreported ARToken / EvilTokens Phishing Tenant
We captured and reverse-engineered the client build of ARToken, an operator panel for a Microsoft 365 / Entra ID token-theft operation. It phishes the device-code authentication flow, steals access, refresh, and Primary Refresh Tokens, and drives the victim tenant from a dashboard with 80+ API endpoints. Cisco Talos ties ARToken to the EvilTokens phishing-as-a-service ecosystem. The tenant we analysed is not in Talos's published IOCs, so it is a previously-unreported deployment, complete with a bundled anti-detect browser for offline session replay.
Showing 9 of 19 articles