Oleg Zaytsev

Security researcher · Israel

Builder with the mindset of a breaker.

I break the software everyone relies on, hunt the campaigns hiding inside trusted infrastructure — and build products people use.

Now
Lead Security Researcher, Island
Before
Threat Hunter, Guardio Labs
Trained
IDF Unit 8200
Scroll

01The coverage

Hundreds of headlines.
Worldwide.

The Hacker NewsBleepingComputerForbesDark ReadingSecurityWeekTechRadarPCMagGeektime

Cited by Microsoft MSRC · Google Mandiant · CERT-EU · US HHS · Spamhaus · NJCCIC

All research & press

Things I built.

02 Things I built.

dorin.app

FounderBuilt alone2025 —

An AI apartment hunter for Israel, serving more than 20,000 users. Designed, engineered, launched and grown — alone.

20K+ users · zero co-founders

Visit dorin.app

Things I broke.

03 Things I broke. 1/3

CVE‑2024‑21388

Microsoft Edge2024

A hidden marketing API in Microsoft Edge that let a web page silently install any extension, with any permission. No prompt, no click.

MSRC credited CVE · patched in Edge 121

Covered by Microsoft MSRC · The Hacker News · TechRadar

Read the case

03 Things I broke. 2/3

MyFlaw

Opera2024

A web page that could run any file on your computer. A sandbox escape and remote code execution in Opera, on Windows and macOS.

300M+ Opera users exposed

Covered by The Hacker News · SecurityWeek · Cyber Security News

Read the case

03 Things I broke. 3/3

PhishForce

Salesforce2023

A flaw in Salesforce’s email gateway that let anyone send mail as @salesforce.com — signed, trusted, and straight past every filter.

@salesforce.com spoofable by anyone · patched globally

Covered by BleepingComputer · The Hacker News · SecurityWeek

Read the case

Threats I hunted.

04 Threats I hunted. 1/3

AgentBaiting

Island2026

The largest documented list of malicious AI skills and MCP servers — planted where coding agents look, so the assistants themselves would hand malware to developers.

~1,000 malicious skills & MCP servers · the largest documented list

Covered by The Hacker News · BleepingComputer · Help Net Security

Read the case

04 Threats I hunted. 2/3

SubdoMailing & EchoSpoofing

Guardio Labs2024

Two campaigns that sent millions of perfectly authenticated emails a day — from hijacked MSN and eBay subdomains, and through Proofpoint’s own relays as Disney, Nike and IBM. I named both, and both names became industry terms.

2 terms now used by Microsoft, Broadcom, Spamhaus and Red Sift

Covered by BleepingComputer · The Hacker News · Forbes

Read the case

04 Threats I hunted. 3/3

360XSS

Independent2025

The largest documented campaign to exploit a one-day XSS for SEO and spam — turning Yale, CNN and Utah.gov into billboards ranked on Google’s first page.

350+ high-authority sites hijacked

Covered by The Hacker News · SC World · Wiz Research

Read the full story

Research, talks, or a product idea

Let's talk.

hey@olegzay.com
Writing About LinkedIn ↗ X ↗