Writing
Research, written down.
Long-form stories here on the blog, and every investigation I've published at Island and Guardio Labs.
On this blog
360XSS: Mass Website Exploitation via Virtual Tour Framework for SEO Poisoning
Hackers are exploiting a reflected XSS vulnerability in the "Krpano" VR library across hundreds of websites, injecting malicious scripts to hijack Google’s search index and distribute spam ads at scale.
Subdomailing: The Campaign That Abused Thousands of Hijacked Subdomains
How Nati Tal and I exposed an industrial-scale operation that hijacked thousands of abandoned subdomains of major brands to send millions of spam emails — and how the name I coined for it, Subdomailing, stuck.
Published research
2026
- Behind the Connect Button: The Fake AI Ads Campaign Covered by The Hacker News · Cyber Insider
- AgentBaiting: How 800+ Fake AI Skills and MCP Servers Delivered Malware Covered by The Hacker News · Help Net Security · BleepingComputer · Cloud Security Alliance +1
- BadBlocker: 11 Million Users, One Server Call Away from Compromise Covered by ICT Security Magazine · The Hacker News · Risky Business
2024
- EchoSpoofing: A Massive Phishing Campaign Exploiting Proofpoint’s Email Protection to Dispatch Millions of Perfectly Spoofed Emails Covered by BleepingComputer · The Hacker News · SecurityWeek · Infosecurity Magazine +9
- CVE-2024-21388: Microsoft Edge’s Marketing API Exploited for Covert Extension Installation Covered by Microsoft MSRC · The Hacker News · TechRadar · HKCERT
- SubdoMailing: Thousands of Hijacked Major-Brand Subdomains Found Bombarding Users With Millions of Malicious Emails Covered by BleepingComputer · The Hacker News · Dark Reading · Forbes +2
- Scammers Paradise: Exploring Telegram’s Dark Markets, Breeding Ground for Modern Phishing Operations Covered by PCMag · Forbes · The Hacker News · Dark Reading
- MyFlaw: Cross-Platform 0-Day RCE Vulnerability Discovered in Opera’s Browser Covered by The Hacker News · SecurityWeek · DarkRelay Security · Cyber Security News
2023
- EtherHiding: Hiding Web2 Malicious Code in Web3 Smart Contracts Covered by BleepingComputer · The Hacker News · Google Mandiant · Dark Reading +1
- MrTonyScam: Botnet of Facebook Users Launch High-Intent Messenger Phishing Attack on Business Accounts Covered by BleepingComputer · Dark Reading · Tom's Guide
- PhishForce: Vulnerability Uncovered in Salesforce’s Email Services Exploited for Phishing Facebook Accounts In-The-Wild Covered by BleepingComputer · The Hacker News · SecurityWeek · Dark Reading