Browser vulnerability research, threat hunting and long-form writing by Oleg Zaytsev.https://olegzay.com/en-ushttps://www.island.io/blog/behind-the-connect-button-the-fake-ai-ads-campaignhttps://www.island.io/blog/behind-the-connect-button-the-fake-ai-ads-campaignOleg Zaytsev and Ofek Ronen uncovered a human-operated phishing platform disguised as a suite of AI advertising management products (Muse Ads, ChatGPT, Gemini, Claude). The platform weaponized Browser-in-the-Browser (BitB) interfaces and live human operator MFA manipulation to hijack advertising and SaaS accounts.Tue, 06 Oct 2026 00:00:00 GMTPhishingAI-AdsBrowserInTheBrowserMFA-BypassSessionHijackingOleg Zaytsev, Ofek Ronenhttps://www.island.io/blog/agentbaiting-how-800-fake-ai-skills-and-mcp-servers-delivered-malwarehttps://www.island.io/blog/agentbaiting-how-800-fake-ai-skills-and-mcp-servers-delivered-malwareOleg Zaytsev exposed 'AgentBaiting' and the FakeGit operation: 7,600+ malicious GitHub repos, including 800+ masquerading as AI Skills and MCP servers, designed to trick autonomous AI agents (Claude Code, Gemini, ChatGPT) into autonomously discovering and recommending malware.Wed, 15 Jul 2026 00:00:00 GMTAI-SecurityAgentBaitingMCPAI-SkillsSmartLoaderStealCThreatHuntingOleg Zaytsevhttps://www.island.io/blog/badblocker-11-million-users-one-server-call-away-from-compromisehttps://www.island.io/blog/badblocker-11-million-users-one-server-call-away-from-compromiseIsland researchers Oleg Zaytsev and Shachar Gritzman analyzed 'Adblock for YouTube' (11M+ installs) and revealed that its architecture contained a latent capability to execute arbitrary remote JavaScript across all websites visited by the user via a single daily server check.Thu, 25 Jun 2026 00:00:00 GMTBrowserExtensionsChromeWebStoreSupplyChainAdblockVulnerabilityResearchOleg Zaytsev, Shachar Gritzmanhttps://www.island.io/blog/the-chromium-security-paradoxhttps://www.island.io/blog/the-chromium-security-paradoxAn in-depth architectural analysis of the Chromium security paradox: why Chromium's state-of-the-art sandboxing and site isolation leave enterprise data completely exposed to local access attacks and info-stealing malware.Mon, 28 Apr 2025 00:00:00 GMTChromiumBrowserSecurityThreatModelInfostealersEnterpriseSecurityOleg Zaytsevhttps://olegzay.com/360xss/https://olegzay.com/360xss/Hackers are exploiting a reflected XSS vulnerability in the "Krpano" VR library across hundreds of websites, injecting malicious scripts to hijack Google’s search index and distribute spam ads at scale.Wed, 26 Feb 2025 00:00:00 GMTCyberSecurityThreatHuntingWebSecurityXSSSEO-PoisoningOleg Zaytsevhttps://olegzay.com/subdomailing/https://olegzay.com/subdomailing/How Nati Tal and I exposed an industrial-scale operation that hijacked thousands of abandoned subdomains of major brands to send millions of spam emails — and how the name I coined for it, Subdomailing, stuck.Wed, 01 Jan 2025 00:00:00 GMTCyberSecurityDNSSubdomain-TakeoverSPFThreatHuntingOleg Zaytsevhttps://guard.io/labs/echospoofing-a-massive-phishing-campaign-exploiting-proofpoints-email-protection-to-dispatchhttps://guard.io/labs/echospoofing-a-massive-phishing-campaign-exploiting-proofpoints-email-protection-to-dispatchGuardio Labs uncovered a critical in-the-wild exploit of Proofpoint's email protection service dubbed 'EchoSpoofing'. Threat actors exploited an overly permissive Microsoft Office 365 relay misconfiguration to dispatch up to 14 million perfectly spoofed emails daily carrying authentic SPF and DKIM signatures from Fortune 100 brands including Disney, IBM, Nike, Best Buy, and Coca-Cola.Mon, 29 Jul 2024 00:00:00 GMTEmail-SecurityPhishingProofpointSPFDKIMEchoSpoofingOffice365ThreatHuntingNati Tal, Oleg Zaytsevhttps://guard.io/labs/cve-2024-21388-microsoft-edges-marketing-api-exploited-for-covert-extension-installationhttps://guard.io/labs/cve-2024-21388-microsoft-edges-marketing-api-exploited-for-covert-extension-installationOleg Zaytsev discovered CVE-2024-21388, an Elevation of Privilege vulnerability in Microsoft Edge that allowed silent installation of extensions with arbitrary permissions without user prompt or consent by abusing an undocumented marketing API.Wed, 27 Mar 2024 00:00:00 GMTMicrosoftEdgeZeroDayCVE-2024-21388BrowserSecurityElevationOfPrivilegeOleg Zaytsevhttps://guard.io/labs/subdomailing-thousands-of-hijacked-major-brand-subdomains-found-bombarding-users-with-millionshttps://guard.io/labs/subdomailing-thousands-of-hijacked-major-brand-subdomains-found-bombarding-users-with-millionsFlagship research exposing the ResurrecAds operation: an automated empire hijacking 8,000+ domains and 13,000+ subdomains of major global brands (MSN, VMware, McAfee, Cornell, CBS, NYC.gov, eBay) to dispatch millions of spam and phishing emails passing SPF/DKIM/DMARC.Mon, 26 Feb 2024 00:00:00 GMTDNSSubdomainTakeoverSubdomailingPhishingSPFResurrecAdsNati Tal, Oleg Zaytsevhttps://guard.io/labs/scammers-paradise-exploring-telegrams-dark-markets-breeding-ground-for-modern-phishinghttps://guard.io/labs/scammers-paradise-exploring-telegrams-dark-markets-breeding-ground-for-modern-phishingDeep-dive investigation into how Telegram evolved into an underground turn-key cybercrime marketplace, offering automated phishing kits, stolen Facebook corporate accounts, and 2FA reverse-proxy bypass tools for under $230.Mon, 29 Jan 2024 00:00:00 GMTTelegramPhishingDarkWebCybercrimeThreatHuntingOleg Zaytsev, Nati Talhttps://guard.io/labs/myflaw-cross-platform-0-day-rce-vulnerability-discovered-in-operas-browsershttps://guard.io/labs/myflaw-cross-platform-0-day-rce-vulnerability-discovered-in-operas-browsersOleg Zaytsev uncovered a cross-platform zero-day remote code execution vulnerability in the Opera browser family. The flaw abused Opera's 'My Flow' cross-device sync feature and internal extensions to escape the browser sandbox and run arbitrary code on Windows and macOS.Mon, 15 Jan 2024 00:00:00 GMTBrowserSecurityZeroDayOperaRCEVulnerabilityResearchSandboxEscapeOleg Zaytsevhttps://guard.io/labs/etherhiding-hiding-web2-malicious-code-in-web3-smart-contractshttps://guard.io/labs/etherhiding-hiding-web2-malicious-code-in-web3-smart-contractsGroundbreaking research coining 'EtherHiding': a revolutionary technique where threat actors host second-stage malicious payloads inside smart contracts on Binance Smart Chain and Ethereum, creating takedown-proof bulletproof hosting.Fri, 13 Oct 2023 00:00:00 GMTWeb3SmartContractsBlockchainEtherHidingMalwareThreatHuntingNati Tal, Oleg Zaytsevhttps://guard.io/labs/mrtonyscam-botnet-of-facebook-users-launch-high-intent-messenger-phishing-attack-on-businesshttps://guard.io/labs/mrtonyscam-botnet-of-facebook-users-launch-high-intent-messenger-phishing-attack-on-businessAnalysis of a massive Facebook Messenger botnet targeting 100,000+ business accounts weekly with Python-based information stealers disguised as PDF portfolios to hijack business managers and monetize them on Telegram.Sun, 10 Sep 2023 00:00:00 GMTPhishingBotnetFacebookInfostealerTelegramThreatHuntingOleg Zaytsev, Nati Talhttps://guard.io/labs/phishforce-vulnerability-uncovered-in-salesforces-email-services-exploited-for-phishinghttps://guard.io/labs/phishforce-vulnerability-uncovered-in-salesforces-email-services-exploited-for-phishingGuardio Labs discovered a zero-day vulnerability in Salesforce's Email-to-Case service exploited in the wild to send authenticated phishing emails from @salesforce.com, bypassing SPF/DKIM/DMARC filters to target high-value Facebook accounts.Wed, 02 Aug 2023 00:00:00 GMTPhishingSalesforceZero-DayFacebookEmail-SecurityThreatHuntingOleg Zaytsev, Nati Tal